diff --git a/docs/requirements.md b/docs/requirements.md
index 560759f7..8183ef07 100644
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -446,6 +446,9 @@ Internal architecture, components, and application logic.
 | DR-250 | Stopping means nothing is playing, from any renderer — not "whatever we believe owns playback has been asked to stop". A background-audio handoff swaps which renderer that is, and the swap is bookkeeping that can be mid-flight: `exit_background_audio` marks the webview element the player again the moment it is called, while the element has not reloaded. The teardown's stop was gated on flags describing what the component started, so after a handoff it described a player that was no longer making sound and the stop was skipped — the audio stream kept running and the mini player adopted it, which is why a movie reappeared as an audio track. The stop is now unconditional (it is idempotent) and clears the handoff base and flag, so a later position read cannot be interpreted against a handoff that no longer exists | Player | UR-040, UR-005 | Done |
 | DR-251 | A duration of zero is treated as "the engine does not know yet", and falls back to the runtime the item already carries. ExoPlayer reports `C.TIME_UNSET` until it resolves one and `JellyTauPlayer.getDuration()` maps that to `0.0`, so the engine answered `Some(0.0)` rather than `None` — which satisfied every "unknown duration" fallback and left the seek bar with no scale. It presented as scrubbing being broken rather than as a duration that never arrived, and the catalog had the runtime the whole time | Player | UR-005, UR-040 | Done |
 | DR-252 | Seconds reported by an engine are converted to a `Duration` only when finite and positive. `Duration::from_secs_f64` panics on a negative or non-finite value and no engine promises otherwise: ExoPlayer reports `C.TIME_UNSET` (`Long::MIN_VALUE`, about -9.2e15) for a stream whose length it does not know, which is every background-audio handoff — `/Audio/{id}/universal` is a chunked, length-less transcode. Held as a float that junk was harmless; converted to a `Duration` by the `MediaPlayer` adapter it became a panic that killed the backend mid-handoff and left a black screen with no controls. One guard on the contract, used by every engine crossing into it | Player | UR-005 | Done |
+| DR-253 | A deferred seek is discarded when the file it was issued against stops being the one loading. `seek` holds a position while MPV has nothing loaded and the `FileLoaded` handler applies it (DR-241), but neither `load` nor `stop` cleared it — so scrubbing near the end of a transcoded item, which re-opens the stream, and then skipping to the next item before the reload completed applied the old position to the new item. It started wherever the previous one had been scrubbed to, silently | Player | UR-040, UR-005 | Done |
+| DR-254 | Advancing to the next episode drops a per-playback quality override. The override is process-wide and describes one playback: a viewer who drops to 720p for a struggling episode has said nothing about the next. Every advance the frontend drives clears it via `player_play_item`; the background audio-only advance loads the next episode in Rust and skipped all three clearing sites, so every later episode stayed capped with nothing in the UI saying why | Repository | UR-074 | Done |
+| DR-255 | One helper answers "what URL should an engine open". `playback_url` was gated to Android because only ExoPlayer needed it, and that gate is why a byte-identical copy was later added for the cross-platform open path — the original is invisible in a Linux build, so nothing warned. Two matches over `MediaSource` meant a new variant could be handled in one and forgotten in the other | Player | UR-081 | Done |
 | DR-198 | The webview runs under a real Content-Security-Policy, and the asset protocol is scoped to the one directory it still serves. `csp` was `null`, which disables CSP entirely: any script that reached the web layer — through a future `{@html}`, a dependency, or a devtools paste — would have inherited the whole IPC surface, and with it the user's session. `script-src 'self'` (Tauri injects a nonce for SvelteKit's inline bootstrap script at build time, so no `'unsafe-inline'` is needed) plus `object-src`/`frame-src 'none'` and `base-uri 'self'` is the part that is genuinely restrictive. `img-src`/`media-src`/`connect-src` cannot be: the Jellyfin origin is typed in by the user at run time and is commonly plain `http` on a LAN, so they allow `http:`/`https:` — a wide grant for *data*, but one that still bars `file:`, `filesystem:` and scripting schemes, and leaves `script-src` untouched. `style-src` keeps `'unsafe-inline'` because Svelte compiles `style="…"` attributes (including `app.html`'s `display: contents` wrapper) into markup; this is safe only while no `<style>` element survives into `index.html`, since a nonce there would make Tauri's injection outrank — and therefore void — `'unsafe-inline'`. `worker-src blob:` and `media-src blob:` are hls.js: it demuxes in a worker built from a blob and attaches MSE through `URL.createObjectURL`. `asset:` and `http://asset.localhost` are the same protocol under the two naming schemes `convertFileSrc` emits (custom scheme on Linux/macOS, `http` host on Windows/Android); `ipc:`/`http://ipc.localhost` is the invoke transport, which would otherwise be blocked by `connect-src`. A run-time CSP naming the server origin exactly was rejected: Tauri computes the header from immutable config when it serves the HTML, so it would mean rebuilding config and reloading the webview on every server change, for a policy the user can already point anywhere. The asset-protocol scope narrows from `$APPDATA/**` to `$APPDATA/thumbnails/**` — since DR-137 moved downloaded media to the loopback server, `imageCache` is the only `convertFileSrc` caller left, so the database and the encrypted-token fallback file no longer sit inside the grant | Security | UR-012, UR-071 | Done |
 
 ---
@@ -762,6 +765,8 @@ Internal architecture, components, and application logic.
 | UT-222 | The values that killed the backend are rejected rather than converted: `C.TIME_UNSET` as seconds, negatives, zero, NaN and both infinities all yield no duration, while a real runtime survives | DR-252 | Done |
 | UT-223 | The adapter survives an engine that answers badly. A `HostileBackend` reports `C.TIME_UNSET` as seconds, NaN, both infinities, a negative and a zero; reading a snapshot yields no duration and a zero position rather than panicking, and a well-behaved engine still round-trips. The conformance suite could not have caught this — it only ever drives engines that report sane numbers, which is why it stayed green while a real one took the backend down | DR-252 | Done |
 | UT-224 | Stopping clears an active background-audio handoff, both the flag and the base offset, so a later position read cannot be interpreted against a handoff that no longer exists. Previously verified only by listening to a device | DR-250 | Done |
+| UT-225 | Both `load` and `stop` discard a deferred seek, so a position held for a file that is no longer loading cannot be applied to whatever loads next | DR-253 | Done |
+| UT-226 | The background episode advance clears the per-playback quality override, so a ceiling chosen for one episode does not cap every episode after it | DR-254 | Done |
 
 ### Integration Tests
 
diff --git a/src-tauri/src/player/media.rs b/src-tauri/src/player/media.rs
index b4b0d583..49f412b1 100644
--- a/src-tauri/src/player/media.rs
+++ b/src-tauri/src/player/media.rs
@@ -171,19 +171,6 @@ pub enum MediaSource {
     DirectUrl { url: String },
 }
 
-impl MediaItem {
-    /// The URL or path an engine should open.
-    ///
-    /// TRACES: UR-081 | DR-245
-    pub fn playable_url(&self) -> String {
-        match &self.source {
-            MediaSource::Remote { stream_url, .. } => stream_url.clone(),
-            MediaSource::Local { file_path, .. } => file_path.to_string_lossy().into_owned(),
-            MediaSource::DirectUrl { url } => url.clone(),
-        }
-    }
-}
-
 impl MediaItem {
     /// Get the Jellyfin item ID if available
     pub fn jellyfin_id(&self) -> Option<&str> {
@@ -198,10 +185,16 @@ impl MediaItem {
         }
     }
 
-    /// Get the playback URL or file path
+    /// The URL or path an engine should open.
     ///
-    /// Only available on Android where ExoPlayer needs direct URL access
-    #[cfg(target_os = "android")]
+    /// Not gated to Android any more. It was, back when only ExoPlayer needed
+    /// direct URL access — and that gate is why a byte-identical copy was later
+    /// added for the cross-platform `MediaPlayer::open` path without anyone
+    /// noticing this existed: it is invisible in a Linux build, so nothing
+    /// warned. Two matches over `MediaSource` meant a new variant could be
+    /// handled in one and forgotten in the other, silently.
+    ///
+    /// TRACES: UR-081 | DR-245, DR-255
     pub fn playback_url(&self) -> String {
         match &self.source {
             MediaSource::Remote { stream_url, .. } => stream_url.clone(),
diff --git a/src-tauri/src/player/mod.rs b/src-tauri/src/player/mod.rs
index d9a7ff60..414c6445 100644
--- a/src-tauri/src/player/mod.rs
+++ b/src-tauri/src/player/mod.rs
@@ -582,7 +582,7 @@ impl PlayerController {
         backend.open(OpenRequest::new(
             item.clone(),
             StreamSelection::for_queued_item(
-                item.playable_url(),
+                item.playback_url(),
                 item.transport,
                 item.needs_transcoding,
             ),
@@ -1995,6 +1995,15 @@ impl PlayerController {
         &self,
         next_episode_id: &str,
     ) -> Result<(), String> {
+        // A new episode is a new playback, so a ceiling chosen for the previous
+        // one does not carry into it. Every advance the frontend drives goes
+        // through `player_play_item` and is cleared there; this one loads the
+        // next episode in Rust and would otherwise keep the old cap forever,
+        // with nothing in the UI saying why. Cleared before the URL is built,
+        // since that is what reads it.
+        // TRACES: UR-074 | DR-254
+        crate::repository::online::clear_playback_quality_override();
+
         let repo = self
             .repository
             .lock_safe()
@@ -2313,6 +2322,39 @@ impl Default for PlayerController {
 #[cfg(test)]
 mod tests {
 
+    /// Advancing to the next episode drops a per-playback quality override.
+    ///
+    /// The override is process-wide and describes *one* playback: a viewer who
+    /// drops to 720p for a struggling episode has said nothing about the next
+    /// one. `player_play_item`, `player_play_queue` and `player_play_tracks`
+    /// all clear it, so every advance the frontend drives is covered — but the
+    /// background audio-only advance loads the next episode in Rust and skips
+    /// all three, so every later episode stayed capped at the old quality with
+    /// nothing in the UI saying so.
+    ///
+    /// A wiring assertion, like UT-218 and UT-225: the call site is what
+    /// matters, and reaching it at runtime needs a repository, a server and a
+    /// live player.
+    ///
+    /// TRACES: UR-074 | DR-254 | UT-226
+    #[test]
+    fn test_background_episode_advance_clears_the_quality_override() {
+        let src = include_str!("mod.rs");
+        let start = src
+            .find("fn advance_to_next_episode_audio_only")
+            .expect("advance_to_next_episode_audio_only not found");
+        let rest = &src[start..];
+        let end = rest.find("\n    pub ").unwrap_or(rest.len());
+        let body = &rest[..end];
+
+        assert!(
+            body.contains("clear_playback_quality_override"),
+            "the background episode advance does not clear the per-playback \
+             quality override, so a ceiling chosen for one episode silently \
+             caps every episode after it"
+        );
+    }
+
     /// Stopping clears a background-audio handoff.
     ///
     /// This was verified by listening to a tablet, which is not a test. The
diff --git a/src-tauri/src/player/mpv_backend.rs b/src-tauri/src/player/mpv_backend.rs
index d05bc590..43e26348 100644
--- a/src-tauri/src/player/mpv_backend.rs
+++ b/src-tauri/src/player/mpv_backend.rs
@@ -592,6 +592,14 @@ impl PlayerBackend for MpvBackend {
         // one's "last observed" position.
         self.observed.lock_safe().reset();
 
+        // Nor its deferred seek. A seek held for a file that is no longer the
+        // one loading would be applied to this one by the `FileLoaded` handler
+        // — so scrubbing near the end of a transcoded item, which re-opens the
+        // stream, and then skipping to the next item before the reload finished
+        // started the new item wherever the old one had been scrubbed to.
+        // TRACES: UR-040, UR-005 | DR-253
+        *self.pending_seek.lock_safe() = None;
+
         // Load the media file
         self.mpv
             .command("loadfile", &[&stream_url])
@@ -634,6 +642,10 @@ impl PlayerBackend for MpvBackend {
             message: format!("Failed to stop: {:?}", e),
         })?;
 
+        // Stopping ends the seek's subject along with the playback.
+        // TRACES: UR-040, UR-005 | DR-253
+        *self.pending_seek.lock_safe() = None;
+
         let mut state = self.state.lock_safe();
         state.current_media = None;
 
diff --git a/src-tauri/src/player/mpv_backend_test.rs b/src-tauri/src/player/mpv_backend_test.rs
index cbdd0812..3f85fb6c 100644
--- a/src-tauri/src/player/mpv_backend_test.rs
+++ b/src-tauri/src/player/mpv_backend_test.rs
@@ -59,6 +59,43 @@ mod tests {
         }
     }
 
+    /// A deferred seek belongs to the file it was issued against.
+    ///
+    /// `seek` holds a position when MPV has nothing loaded yet, and the
+    /// `FileLoaded` handler applies it (DR-241). Nothing discarded it when a
+    /// *different* file was loaded or playback stopped — so scrubbing near the
+    /// end of a transcoded item (which re-opens the stream) and then skipping to
+    /// the next item before the reload completed applied the old position to the
+    /// new item. It silently started wherever you had scrubbed to in the
+    /// previous one.
+    ///
+    /// Asserted against the source: the state lives behind a live MPV handle,
+    /// and constructing one needs libmpv and an audio device that CI cannot be
+    /// assumed to have. Crude, but it pins the one thing that matters — that
+    /// both lifecycle points discard it.
+    ///
+    /// TRACES: UR-040, UR-005 | DR-253 | UT-225
+    #[test]
+    fn test_load_and_stop_discard_a_deferred_seek() {
+        let src = include_str!("mpv_backend.rs");
+
+        for func in ["fn load(", "fn stop("] {
+            let start = src
+                .find(func)
+                .unwrap_or_else(|| panic!("{func} not found - has the backend been restructured?"));
+            // The body runs to the next top-level `    fn ` at the same depth.
+            let rest = &src[start + func.len()..];
+            let end = rest.find("\n    fn ").unwrap_or(rest.len());
+            let body = &rest[..end];
+
+            assert!(
+                body.contains("pending_seek"),
+                "{func} does not discard `pending_seek`. A seek held for a file \
+                 that is no longer loading will be applied to whatever loads next."
+            );
+        }
+    }
+
     /// Test that simulates the position update thread spawning async tasks
     /// without a Tokio runtime (the bug we just fixed)
     #[test]