test

            return authid;

        }

        // Tries every configured mediadb source (Args->config->getMediaSource)

        // in priority order, keeping the first that actually answers.

        // Without a token there's no authed endpoint to probe with, so this

        // just builds a lazy client against the primary source (same as the

        // old single-URL behavior) -- callers that only know their token

        // later (e.g. the _mdbGetImagePool factory, run once per pool miss

        // before the caller's session token is known) get real failover at

        // the point they actually use the connection instead (see the

        // get_media retry in the getimage route, and _ensureMdbReady below).

        std::unique_ptr<mediadb::Client> _connectMediaDB(const std::string &token = ""){

            size_t n = Args->config->getMediaSourceCount();

            if(n == 0)

                throw std::runtime_error("no mediadb source configured");

            if(token.empty()){

                const auto &src = Args->config->getMediaSource(0);

                return std::make_unique<mediadb::Client>(src.url, src.tlsVerify, false);

            }

            std::string lastErr = "unreachable";

            for(size_t i = 0; i < n; ++i){

                const auto &src = Args->config->getMediaSource(i);

                try {

                    auto client = std::make_unique<mediadb::Client>(src.url, src.tlsVerify, false);

                    client->set_token(token);

                    client->list_stores(); // cheap reachability + auth check

                    return client;

                } catch(std::exception &e) {

                    lastErr = e.what();

                } catch(...) {

                    lastErr = "unknown error";

                }

            }

            throw std::runtime_error("all mediadb sources unreachable: " + lastErr);

        }

        void _ensureMdbReady(int tid, const std::string &token = ""){

            if(!_mdb[tid]){

                try {

                    _mdb[tid] = std::make_unique<mediadb::Client>(_mdbUrl, _mdbTlsVerify, false);

                    _mdb[tid] = _connectMediaDB(token);

                } catch(std::exception &e) {

                    std::cerr << "media: _ensureMdbReady: new Client failed: " << e.what() << std::endl;

                    throw;

                }

                return; // token, if any, was already applied by _connectMediaDB

            }

            if(!token.empty()){

                try {

                    // Connection broken — recreate client and retry

                    std::cerr << "media: _ensureMdbReady: set_token failed, reconnecting: " << e.what() << std::endl;

                    try {

                        _mdb[tid] = std::make_unique<mediadb::Client>(_mdbUrl, _mdbTlsVerify, false);

                        _mdb[tid]->set_token(token);

                        _mdb[tid] = _connectMediaDB(token);

                    } catch(std::exception &e2) {

                        std::cerr << "media: _ensureMdbReady: reconnect failed: " << e2.what() << std::endl;

                        _mdb[tid].reset();

                } catch(...) {

                    std::cerr << "media: _ensureMdbReady: set_token unknown error, reconnecting" << std::endl;

                    try {

                        _mdb[tid] = std::make_unique<mediadb::Client>(_mdbUrl, _mdbTlsVerify, false);

                        _mdb[tid]->set_token(token);

                        _mdb[tid] = _connectMediaDB(token);

                    } catch(...) {

                        _mdb[tid].reset();

                        throw;