diff --git a/.ci/before_build_wheel.sh b/.ci/before_build_wheel.sh
index 56108dcd60..44ca97f31b 100644
--- a/.ci/before_build_wheel.sh
+++ b/.ci/before_build_wheel.sh
@@ -7,4 +7,4 @@ if command -v yum &> /dev/null; then
 fi
 
 # Install a Rust toolchain
-curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.82.0 -y --profile minimal
+curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain stable -y --profile minimal
diff --git a/.ci/complement_package.gotpl b/.ci/complement_package.gotpl
index 2dd5e5e0e6..e71ed9f616 100644
--- a/.ci/complement_package.gotpl
+++ b/.ci/complement_package.gotpl
@@ -29,7 +29,7 @@ which is under the Unlicense licence.
     {{- with .TestCases -}}
         {{- /* Passing tests are first */ -}}
         {{- range . -}}
-            {{- if eq .Result "PASS" -}}
+            {{- if and (eq .Result "PASS") (not $settings.HideSuccessfulTests) -}}
                 ::group::{{ "\033" }}[0;32m✅{{ " " }}{{- .Name -}}
                 {{- "\033" -}}[0;37m ({{if $settings.ShowTestStatus}}{{.Result}}; {{end}}{{ .Duration -}}
                 {{- with .Coverage -}}
@@ -49,7 +49,8 @@ which is under the Unlicense licence.
 
         {{- /* Then skipped tests are second */ -}}
         {{- range . -}}
-            {{- if eq .Result "SKIP" -}}
+            {{- /* Skipped tests are also purposefully hidden if "HideSuccessfulTests" is enabled */ -}}
+            {{- if and (eq .Result "SKIP") (not $settings.HideSuccessfulTests) -}}
                 ::group::{{ "\033" }}[0;33m🚧{{ " " }}{{- .Name -}}
                 {{- "\033" -}}[0;37m ({{if $settings.ShowTestStatus}}{{.Result}}; {{end}}{{ .Duration -}}
                 {{- with .Coverage -}}
diff --git a/.ci/scripts/auditwheel_wrapper.py b/.ci/scripts/auditwheel_wrapper.py
deleted file mode 100755
index 9599b79e50..0000000000
--- a/.ci/scripts/auditwheel_wrapper.py
+++ /dev/null
@@ -1,147 +0,0 @@
-#!/usr/bin/env python
-#
-# This file is licensed under the Affero General Public License (AGPL) version 3.
-#
-# Copyright (C) 2023 New Vector, Ltd
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# See the GNU Affero General Public License for more details:
-# <https://www.gnu.org/licenses/agpl-3.0.html>.
-#
-# Originally licensed under the Apache License, Version 2.0:
-# <http://www.apache.org/licenses/LICENSE-2.0>.
-#
-# [This file includes modifications made by New Vector Limited]
-#
-#
-
-# Wraps `auditwheel repair` to first check if we're repairing a potentially abi3
-# compatible wheel, if so rename the wheel before repairing it.
-
-import argparse
-import os
-import subprocess
-from typing import Optional
-from zipfile import ZipFile
-
-from packaging.tags import Tag
-from packaging.utils import parse_wheel_filename
-from packaging.version import Version
-
-
-def check_is_abi3_compatible(wheel_file: str) -> None:
-    """Check the contents of the built wheel for any `.so` files that are *not*
-    abi3 compatible.
-    """
-
-    with ZipFile(wheel_file, "r") as wheel:
-        for file in wheel.namelist():
-            if not file.endswith(".so"):
-                continue
-
-            if not file.endswith(".abi3.so"):
-                raise Exception(f"Found non-abi3 lib: {file}")
-
-
-def cpython(wheel_file: str, name: str, version: Version, tag: Tag) -> str:
-    """Replaces the cpython wheel file with a ABI3 compatible wheel"""
-
-    if tag.abi == "abi3":
-        # Nothing to do.
-        return wheel_file
-
-    check_is_abi3_compatible(wheel_file)
-
-    # HACK: it seems that some older versions of pip will consider a wheel marked
-    # as macosx_11_0 as incompatible with Big Sur. I haven't done the full archaeology
-    # here; there are some clues in
-    #     https://github.com/pantsbuild/pants/pull/12857
-    #     https://github.com/pypa/pip/issues/9138
-    #     https://github.com/pypa/packaging/pull/319
-    # Empirically this seems to work, note that macOS 11 and 10.16 are the same,
-    # both versions are valid for backwards compatibility.
-    platform = tag.platform.replace("macosx_11_0", "macosx_10_16")
-    abi3_tag = Tag(tag.interpreter, "abi3", platform)
-
-    dirname = os.path.dirname(wheel_file)
-    new_wheel_file = os.path.join(
-        dirname,
-        f"{name}-{version}-{abi3_tag}.whl",
-    )
-
-    os.rename(wheel_file, new_wheel_file)
-
-    print("Renamed wheel to", new_wheel_file)
-
-    return new_wheel_file
-
-
-def main(wheel_file: str, dest_dir: str, archs: Optional[str]) -> None:
-    """Entry point"""
-
-    # Parse the wheel file name into its parts. Note that `parse_wheel_filename`
-    # normalizes the package name (i.e. it converts matrix_synapse ->
-    # matrix-synapse), which is not what we want.
-    _, version, build, tags = parse_wheel_filename(os.path.basename(wheel_file))
-    name = os.path.basename(wheel_file).split("-")[0]
-
-    if len(tags) != 1:
-        # We expect only a wheel file with only a single tag
-        raise Exception(f"Unexpectedly found multiple tags: {tags}")
-
-    tag = next(iter(tags))
-
-    if build:
-        # We don't use build tags in Synapse
-        raise Exception(f"Unexpected build tag: {build}")
-
-    # If the wheel is for cpython then convert it into an abi3 wheel.
-    if tag.interpreter.startswith("cp"):
-        wheel_file = cpython(wheel_file, name, version, tag)
-
-    # Finally, repair the wheel.
-    if archs is not None:
-        # If we are given archs then we are on macos and need to use
-        # `delocate-listdeps`.
-        subprocess.run(["delocate-listdeps", wheel_file], check=True)
-        subprocess.run(
-            ["delocate-wheel", "--require-archs", archs, "-w", dest_dir, wheel_file],
-            check=True,
-        )
-    else:
-        subprocess.run(["auditwheel", "repair", "-w", dest_dir, wheel_file], check=True)
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Tag wheel as abi3 and repair it.")
-
-    parser.add_argument(
-        "--wheel-dir",
-        "-w",
-        metavar="WHEEL_DIR",
-        help="Directory to store delocated wheels",
-        required=True,
-    )
-
-    parser.add_argument(
-        "--require-archs",
-        metavar="archs",
-        default=None,
-    )
-
-    parser.add_argument(
-        "wheel_file",
-        metavar="WHEEL_FILE",
-    )
-
-    args = parser.parse_args()
-
-    wheel_file = args.wheel_file
-    wheel_dir = args.wheel_dir
-    archs = args.require_archs
-
-    main(wheel_file, wheel_dir, archs)
diff --git a/.ci/scripts/calculate_jobs.py b/.ci/scripts/calculate_jobs.py
index 5249acdc5d..1ddea715b0 100755
--- a/.ci/scripts/calculate_jobs.py
+++ b/.ci/scripts/calculate_jobs.py
@@ -35,49 +35,58 @@ IS_PR = os.environ["GITHUB_REF"].startswith("refs/pull/")
 
 # First calculate the various trial jobs.
 #
-# For PRs, we only run each type of test with the oldest Python version supported (which
-# is Python 3.9 right now)
+# For PRs, we only run each type of test with the oldest and newest Python
+# version that's supported. The oldest version ensures we don't accidentally
+# introduce syntax or code that's too new, and the newest ensures we don't use
+# code that's been dropped in the latest supported Python version.
 
 trial_sqlite_tests = [
     {
-        "python-version": "3.9",
+        "python-version": "3.10",
         "database": "sqlite",
         "extras": "all",
-    }
+    },
+    {
+        "python-version": "3.14",
+        "database": "sqlite",
+        "extras": "all",
+    },
 ]
 
 if not IS_PR:
+    # Otherwise, check all supported Python versions.
+    #
+    # Avoiding running all of these versions on every PR saves on CI time.
     trial_sqlite_tests.extend(
         {
             "python-version": version,
             "database": "sqlite",
             "extras": "all",
         }
-        for version in ("3.10", "3.11", "3.12", "3.13")
+        for version in ("3.11", "3.12", "3.13")
     )
 
+# Only test postgres against the earliest and latest Python versions that we
+# support in order to save on CI time.
 trial_postgres_tests = [
     {
-        "python-version": "3.9",
+        "python-version": "3.10",
         "database": "postgres",
-        "postgres-version": "13",
+        "postgres-version": "14",
         "extras": "all",
-    }
+    },
+    {
+        "python-version": "3.14",
+        "database": "postgres",
+        "postgres-version": "17",
+        "extras": "all",
+    },
 ]
 
-if not IS_PR:
-    trial_postgres_tests.append(
-        {
-            "python-version": "3.13",
-            "database": "postgres",
-            "postgres-version": "17",
-            "extras": "all",
-        }
-    )
-
+# Ensure that Synapse passes unit tests even with no extra dependencies installed.
 trial_no_extra_tests = [
     {
-        "python-version": "3.9",
+        "python-version": "3.10",
         "database": "sqlite",
         "extras": "",
     }
@@ -99,24 +108,24 @@ set_output("trial_test_matrix", test_matrix)
 
 # First calculate the various sytest jobs.
 #
-# For each type of test we only run on bullseye on PRs
+# For each type of test we only run on bookworm on PRs
 
 
 sytest_tests = [
     {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "bookworm",
     },
     {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "bookworm",
         "postgres": "postgres",
     },
     {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "bookworm",
         "postgres": "multi-postgres",
         "workers": "workers",
     },
     {
-        "sytest-tag": "bullseye",
+        "sytest-tag": "bookworm",
         "postgres": "multi-postgres",
         "workers": "workers",
         "reactor": "asyncio",
@@ -127,11 +136,11 @@ if not IS_PR:
     sytest_tests.extend(
         [
             {
-                "sytest-tag": "bullseye",
+                "sytest-tag": "bookworm",
                 "reactor": "asyncio",
             },
             {
-                "sytest-tag": "bullseye",
+                "sytest-tag": "bookworm",
                 "postgres": "postgres",
                 "reactor": "asyncio",
             },
diff --git a/.ci/scripts/gotestfmt b/.ci/scripts/gotestfmt
deleted file mode 100755
index 83e0ec6361..0000000000
--- a/.ci/scripts/gotestfmt
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash
-#
-# wraps `gotestfmt`, hiding output from successful packages unless
-# all tests passed.
-
-set -o pipefail
-set -e
-
-# tee the test results to a log, whilst also piping them into gotestfmt,
-# telling it to hide successful results, so that we can clearly see
-# unsuccessful results.
-tee complement.log | gotestfmt -hide successful-packages
-
-# gotestfmt will exit non-zero if there were any failures, so if we got to this
-# point, we must have had a successful result.
-echo "All tests successful; showing all test results"
-
-# Pipe the test results back through gotestfmt, showing all results.
-# The log file consists of JSON lines giving the test results, interspersed
-# with regular stdout lines (including reports of downloaded packages).
-grep '^{"Time":' complement.log | gotestfmt
diff --git a/.ci/scripts/prepare_old_deps.sh b/.ci/scripts/prepare_old_deps.sh
deleted file mode 100755
index 3589be26f8..0000000000
--- a/.ci/scripts/prepare_old_deps.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-# this script is run by GitHub Actions in a plain `jammy` container; it
-# - installs the minimal system requirements, and poetry;
-# - patches the project definition file to refer to old versions only;
-# - creates a venv with these old versions using poetry; and finally
-# - invokes `trial` to run the tests with old deps.
-
-set -ex
-
-# Prevent virtualenv from auto-updating pip to an incompatible version
-export VIRTUALENV_NO_DOWNLOAD=1
-
-# TODO: in the future, we could use an implementation of
-#   https://github.com/python-poetry/poetry/issues/3527
-#   https://github.com/pypa/pip/issues/8085
-# to select the lowest possible versions, rather than resorting to this sed script.
-
-# Patch the project definitions in-place:
-# - Replace all lower and tilde bounds with exact bounds
-# - Replace all caret bounds---but not the one that defines the supported Python version!
-# - Delete all lines referring to psycopg2 --- so no testing of postgres support.
-# - Use pyopenssl 17.0, which is the oldest version that works with
-#   a `cryptography` compiled against OpenSSL 1.1.
-# - Omit systemd: we're not logging to journal here.
-
-sed -i \
-   -e "s/[~>]=/==/g" \
-   -e '/^python = "^/!s/\^/==/g' \
-   -e "/psycopg2/d" \
-   -e 's/pyOpenSSL = "==16.0.0"/pyOpenSSL = "==17.0.0"/' \
-   -e '/systemd/d' \
-   pyproject.toml
-
-echo "::group::Patched pyproject.toml"
-cat pyproject.toml
-echo "::endgroup::"
diff --git a/.ci/scripts/setup_complement_prerequisites.sh b/.ci/scripts/setup_complement_prerequisites.sh
index 47a3ff8e69..1fdaf5e631 100755
--- a/.ci/scripts/setup_complement_prerequisites.sh
+++ b/.ci/scripts/setup_complement_prerequisites.sh
@@ -10,7 +10,6 @@ alias block='{ set +x; } 2>/dev/null; func() { echo "::group::$*"; set -x; }; fu
 alias endblock='{ set +x; } 2>/dev/null; func() { echo "::endgroup::"; set -x; }; func'
 
 block Install Complement Dependencies
-  sudo apt-get -qq update && sudo apt-get install -qqy libolm3 libolm-dev
   go install -v github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest
 endblock
 
diff --git a/.ci/scripts/triage_labelled_issue.sh b/.ci/scripts/triage_labelled_issue.sh
new file mode 100755
index 0000000000..0458bccbd4
--- /dev/null
+++ b/.ci/scripts/triage_labelled_issue.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# 1) Resolve project ID.
+PROJECT_ID=$(gh project view "$PROJECT_NUMBER" --owner "$PROJECT_OWNER" --format json | jq -r '.id')
+
+# 2) Find existing item (project card) for this issue.
+ITEM_ID=$(
+  gh project item-list "$PROJECT_NUMBER" --owner "$PROJECT_OWNER" --format json \
+  | jq -r --arg url "$ISSUE_URL" '.items[] | select(.content.url==$url) | .id' | head -n1
+)
+
+# 3) If one doesn't exist, add this issue to the project.
+if [ -z "${ITEM_ID:-}" ]; then
+  ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner "$PROJECT_OWNER" --url "$ISSUE_URL" --format json | jq -r '.id')
+fi
+
+# 4) Get Status field id + the option id for TARGET_STATUS.
+FIELDS_JSON=$(gh project field-list "$PROJECT_NUMBER" --owner "$PROJECT_OWNER" --format json)
+STATUS_FIELD=$(echo "$FIELDS_JSON" | jq -r '.fields[] | select(.name=="Status")')
+STATUS_FIELD_ID=$(echo "$STATUS_FIELD" | jq -r '.id')
+OPTION_ID=$(echo "$STATUS_FIELD" | jq -r --arg name "$TARGET_STATUS" '.options[] | select(.name==$name) | .id')
+
+if [ -z "${OPTION_ID:-}" ]; then
+  echo "No Status option named \"$TARGET_STATUS\" found"; exit 1
+fi
+
+# 5) Set Status (moves item to the matching column in the board view).
+gh project item-edit --id "$ITEM_ID" --project-id "$PROJECT_ID" --field-id "$STATUS_FIELD_ID" --single-select-option-id "$OPTION_ID"
\ No newline at end of file
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 4c7b0335e6..729b638c79 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -26,3 +26,8 @@ c4268e3da64f1abb5b31deaeb5769adb6510c0a7
 # Update black to 23.1.0 (https://github.com/matrix-org/synapse/pull/15103)
 9bb2eac71962970d02842bca441f4bcdbbf93a11
 
+# Use type hinting generics in standard collections (https://github.com/element-hq/synapse/pull/19046)
+fc244bb592aa481faf28214a2e2ce3bb4e95d990
+
+# Write union types as X | Y where possible (https://github.com/element-hq/synapse/pull/19111)
+fcac7e0282b074d4bd3414d1c9c181e9701875d9
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7ce353ed64..38920ead7a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,23 +1,92 @@
 version: 2
+# As dependabot is currently only run on a weekly basis, we raise the
+# open-pull-requests-limit to 10 (from the default of 5) to better ensure we
+# don't continuously grow a backlog of updates.
 updates:
   - # "pip" is the correct setting for poetry, per https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
     package-ecosystem: "pip"
     directory: "/"
+    open-pull-requests-limit: 10
     schedule:
       interval: "weekly"
+    # Group patch updates to packages together into a single PR, as they rarely
+    # if ever contain breaking changes that need to be reviewed separately.
+    # 
+    # Less PRs means a streamlined review process.
+    #
+    # Python packages follow semantic versioning, and tend to only introduce
+    # breaking changes in major version bumps. Thus, we'll group minor and patch
+    # versions together.
+    groups:
+      minor-and-patches:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    # Prevent pulling packages that were recently updated to help mitigate
+    # supply chain attacks. 14 days was taken from the recommendation at
+    # https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
+    # where the author noted that 9/10 attacks would have been mitigated by a
+    # two week cooldown.
+    #
+    # The cooldown only applies to general updates; security updates will still
+    # be pulled in as soon as possible.
+    cooldown:
+      default-days: 14
 
   - package-ecosystem: "docker"
     directory: "/docker"
+    open-pull-requests-limit: 10
     schedule:
       interval: "weekly"
+    # For container versions, breaking changes are also typically only introduced in major
+    # package bumps.
+    groups:
+      minor-and-patches:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    cooldown:
+      default-days: 14
 
   - package-ecosystem: "github-actions"
     directory: "/"
+    open-pull-requests-limit: 10
     schedule:
       interval: "weekly"
+    # Similarly for GitHub Actions, breaking changes are typically only introduced in major
+    # package bumps.
+    groups:
+      minor-and-patches:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    cooldown:
+      default-days: 14
 
   - package-ecosystem: "cargo"
     directory: "/"
+    open-pull-requests-limit: 10
     versioning-strategy: "lockfile-only"
     schedule:
       interval: "weekly"
+    # The Rust ecosystem is special in that breaking changes are often introduced
+    # in minor version bumps, as packages typically stay pre-1.0 for a long time.
+    # Thus we specifically keep minor version bumps separate in their own PRs.
+    groups:
+      patches:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+    cooldown:
+      default-days: 14
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0deb5052d5..051c66ebba 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -28,10 +28,10 @@ jobs:
     steps:
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Extract version from pyproject.toml
         # Note: explicitly requesting bash will mean bash is invoked with `-eo pipefail`, see
@@ -41,21 +41,53 @@ jobs:
           echo "SYNAPSE_VERSION=$(grep "^version" pyproject.toml | sed -E 's/version\s*=\s*["]([^"]*)["]/\1/')" >> $GITHUB_ENV
 
       - name: Log in to DockerHub
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Log in to GHCR
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Tailscale
+        uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4.1.2
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          audience: ${{ secrets.TS_AUDIENCE }}
+          tags: tag:github-actions
+
+      - name: Compute vault jwt role name
+        id: vault-jwt-role
+        run: |
+           echo "role_name=github_service_management_$( echo "${{ github.repository }}" | sed -r 's|[/-]|_|g')" | tee -a "$GITHUB_OUTPUT"
+
+      - name: Get team registry token
+        id: import-secrets
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+        with:
+          url: https://vault.infra.ci.i.element.dev
+          role: ${{ steps.vault-jwt-role.outputs.role_name }}
+          path: service-management/github-actions
+          jwtGithubAudience: https://vault.infra.ci.i.element.dev
+          method: jwt
+          secrets: |
+             services/backend-repositories/secret/data/oci.element.io username | OCI_USERNAME ;
+             services/backend-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;
+
+      - name: Login to Element OCI Registry
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        with:
+          registry: oci-push.vpn.infra.element.io
+          username: ${{ steps.import-secrets.outputs.OCI_USERNAME }}
+          password: ${{ steps.import-secrets.outputs.OCI_PASSWORD }}
+
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           push: true
           labels: |
@@ -64,6 +96,7 @@ jobs:
           tags: |
             docker.io/matrixdotorg/synapse
             ghcr.io/element-hq/synapse
+            oci-push.vpn.infra.element.io/synapse
           file: "docker/Dockerfile"
           platforms: ${{ matrix.platform }}
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
@@ -75,7 +108,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: digests-${{ matrix.suffix }}
           path: ${{ runner.temp }}/digests/*
@@ -90,40 +123,73 @@ jobs:
         repository:
           - docker.io/matrixdotorg/synapse
           - ghcr.io/element-hq/synapse
+          - oci-push.vpn.infra.element.io/synapse
 
     needs:
       - build
     steps:
       - name: Download digests
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*
           merge-multiple: true
 
       - name: Log in to DockerHub
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         if: ${{ startsWith(matrix.repository, 'docker.io') }}
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Log in to GHCR
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         if: ${{ startsWith(matrix.repository, 'ghcr.io') }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Tailscale
+        uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4.1.2
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          audience: ${{ secrets.TS_AUDIENCE }}
+          tags: tag:github-actions
+
+      - name: Compute vault jwt role name
+        id: vault-jwt-role
+        run: |
+           echo "role_name=github_service_management_$( echo "${{ github.repository }}" | sed -r 's|[/-]|_|g')" | tee -a "$GITHUB_OUTPUT"
+
+      - name: Get team registry token
+        id: import-secrets
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+        with:
+          url: https://vault.infra.ci.i.element.dev
+          role: ${{ steps.vault-jwt-role.outputs.role_name }}
+          path: service-management/github-actions
+          jwtGithubAudience: https://vault.infra.ci.i.element.dev
+          method: jwt
+          secrets: |
+             services/backend-repositories/secret/data/oci.element.io username | OCI_USERNAME ;
+             services/backend-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;
+
+      - name: Login to Element OCI Registry
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        with:
+          registry: oci-push.vpn.infra.element.io
+          username: ${{ steps.import-secrets.outputs.OCI_USERNAME }}
+          password: ${{ steps.import-secrets.outputs.OCI_PASSWORD }}
+
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Calculate docker image tag
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ matrix.repository }}
           flavor: |
diff --git a/.github/workflows/docs-pr-netlify.yaml b/.github/workflows/docs-pr-netlify.yaml
deleted file mode 100644
index 53a2d6b597..0000000000
--- a/.github/workflows/docs-pr-netlify.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: Deploy documentation PR preview
-
-on:
-  workflow_run:
-    workflows: [ "Prepare documentation PR preview" ]
-    types:
-      - completed
-
-jobs:
-  netlify:
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      # There's a 'download artifact' action, but it hasn't been updated for the workflow_run action
-      # (https://github.com/actions/download-artifact/issues/60) so instead we get this mess:
-      - name: 📥 Download artifact
-        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
-        with:
-          workflow: docs-pr.yaml
-          run_id: ${{ github.event.workflow_run.id }}
-          name: book
-          path: book
-
-      - name: 📤 Deploy to Netlify
-        uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
-        with:
-          path: book
-          owner: ${{ github.event.workflow_run.head_repository.owner.login }}
-          branch: ${{ github.event.workflow_run.head_branch }}
-          revision: ${{ github.event.workflow_run.head_sha }}
-          token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          site_id: ${{ secrets.NETLIFY_SITE_ID }}
-          desc: Documentation preview
-          deployment_env: PR Documentation Preview
diff --git a/.github/workflows/docs-pr.yaml b/.github/workflows/docs-pr.yaml
index e4b8a4c9f2..cba1293743 100644
--- a/.github/workflows/docs-pr.yaml
+++ b/.github/workflows/docs-pr.yaml
@@ -13,7 +13,7 @@ jobs:
     name: GitHub Pages
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Fetch all history so that the schema_versions script works.
           fetch-depth: 0
@@ -21,10 +21,10 @@ jobs:
       - name: Setup mdbook
         uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
-          mdbook-version: '0.4.17'
+          mdbook-version: '0.5.2'
 
       - name: Setup python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
 
@@ -39,7 +39,7 @@ jobs:
           cp book/welcome_and_overview.html book/index.html
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: book
           path: book
@@ -50,12 +50,12 @@ jobs:
     name: Check links in documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup mdbook
         uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
-          mdbook-version: '0.4.17'
+          mdbook-version: '0.5.2'
 
       - name: Setup htmltest
         run: |
@@ -64,8 +64,17 @@ jobs:
           tar zxf htmltest_0.17.0_linux_amd64.tar.gz
 
       - name: Test links with htmltest
-        # Build the book with `./` as the site URL (to make checks on 404.html possible)
-        # Then run htmltest (without checking external links since that involves the network and is slow).
         run: |
+          # Build the book with `./` as the site URL (to make checks on 404.html possible)
           MDBOOK_OUTPUT__HTML__SITE_URL="./" mdbook build
-          ./htmltest book --skip-external
+
+          # Delete the contents of the print.html file, as it can raise false
+          # positives during link checking.
+          #
+          # We empty out the file, instead of deleting it, as doing so would
+          # just cause htmltest to complain that links to it were invalid.
+          # Ideally `htmltest` would have an option to ignore specific files
+          # instead.
+          echo '<!DOCTYPE HTML>' > book/print.html
+
+          ./htmltest book --conf docs/.htmltest.yml
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 0ca45a39cf..31f3b05b8e 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -50,7 +50,7 @@ jobs:
     needs:
       - pre
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Fetch all history so that the schema_versions script works.
           fetch-depth: 0
@@ -58,13 +58,13 @@ jobs:
       - name: Setup mdbook
         uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
-          mdbook-version: '0.4.17'
+          mdbook-version: '0.5.2'
 
       - name: Set version of docs
         run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js
 
       - name: Setup python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
 
diff --git a/.github/workflows/fix_lint.yaml b/.github/workflows/fix_lint.yaml
index d73df1e2e7..aea55fe0ce 100644
--- a/.github/workflows/fix_lint.yaml
+++ b/.github/workflows/fix_lint.yaml
@@ -18,20 +18,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Setup Poetry
         uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           install-project: "false"
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
 
       - name: Run ruff check
         continue-on-error: true
@@ -47,6 +47,6 @@ jobs:
       - run: cargo fmt
         continue-on-error: true
 
-      - uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
+      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
         with:
           commit_message: "Attempt to fix linting"
diff --git a/.github/workflows/latest_deps.yml b/.github/workflows/latest_deps.yml
index e97109d5fa..746223ef4a 100644
--- a/.github/workflows/latest_deps.yml
+++ b/.github/workflows/latest_deps.yml
@@ -42,19 +42,19 @@ jobs:
     if: needs.check_repo.outputs.should_run_workflow == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       # The dev dependencies aren't exposed in the wheel metadata (at least with current
       # poetry-core versions), so we install with poetry.
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           python-version: "3.x"
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
           extras: "all"
       # Dump installed versions for debugging.
       - run: poetry run pip list > before.txt
@@ -77,13 +77,13 @@ jobs:
             postgres-version: "14"
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - run: sudo apt-get -qq install xmlsec1
       - name: Set up PostgreSQL ${{ matrix.postgres-version }}
@@ -93,7 +93,7 @@ jobs:
             -e POSTGRES_PASSWORD=postgres \
             -e POSTGRES_INITDB_ARGS="--lc-collate C --lc-ctype C --encoding UTF8" \
             postgres:${{ matrix.postgres-version }}
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - run: pip install .[all,test]
@@ -126,7 +126,6 @@ jobs:
           -exec echo "::endgroup::" \;
           || true
 
-
   sytest:
     needs: check_repo
     if: needs.check_repo.outputs.should_run_workflow == 'true'
@@ -139,9 +138,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - sytest-tag: bullseye
+          - sytest-tag: bookworm
 
-          - sytest-tag: bullseye
+          - sytest-tag: bookworm
             postgres: postgres
             workers: workers
             redis: redis
@@ -152,13 +151,13 @@ jobs:
       BLACKLIST: ${{ matrix.workers && 'synapse-blacklist-with-workers' }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Ensure sytest runs `pip install`
         # Delete the lockfile so sytest will `pip install` rather than `poetry install`
@@ -173,7 +172,7 @@ jobs:
         if: ${{ always() }}
         run: /sytest/scripts/tap_to_gha.pl /logs/results.tap
       - name: Upload SyTest logs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: ${{ always() }}
         with:
           name: Sytest Logs - ${{ job.status }} - (${{ join(matrix.*, ', ') }})
@@ -181,7 +180,6 @@ jobs:
             /logs/results.tap
             /logs/**/*.log*
 
-
   complement:
     needs: check_repo
     if: "!failure() && !cancelled() && needs.check_repo.outputs.should_run_workflow == 'true'"
@@ -202,23 +200,65 @@ jobs:
 
     steps:
       - name: Check out synapse codebase
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: synapse
 
       - name: Prepare Complement's Prerequisites
         run: synapse/.ci/scripts/setup_complement_prerequisites.sh
 
-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           cache-dependency-path: complement/go.sum
           go-version-file: complement/go.mod
 
-      - run: |
+      - name: Run Complement Tests
+        id: run_complement_tests
+        # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
+        #     are underpowered and don't like running tons of Synapse instances at once.
+        # -json: Output JSON format so that gotestfmt can parse it.
+        #
+        # tee /tmp/gotest-complement.log: We tee the output to a file so that we can re-process it
+        # later on for better formatting with gotestfmt. But we still want the command
+        # to output to the terminal as it runs so we can see what's happening in
+        # real-time.
+        run: |
           set -o pipefail
-          TEST_ONLY_IGNORE_POETRY_LOCKFILE=1 POSTGRES=${{ (matrix.database == 'Postgres') && 1 || '' }} WORKERS=${{ (matrix.arrangement == 'workers') && 1 || '' }} COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh -json 2>&1 | synapse/.ci/scripts/gotestfmt
+          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh -p 1 -json 2>&1 | tee /tmp/gotest-complement.log
         shell: bash
-        name: Run Complement Tests
+        env:
+          POSTGRES: ${{ (matrix.database == 'Postgres') && 1 || '' }}
+          WORKERS: ${{ (matrix.arrangement == 'workers') && 1 || '' }}
+          TEST_ONLY_IGNORE_POETRY_LOCKFILE: 1
+
+      - name: Formatted Complement test logs
+        # Always run this step if we attempted to run the Complement tests.
+        if: always() && steps.run_complement_tests.outcome != 'skipped'
+        run: cat /tmp/gotest-complement.log | gotestfmt -hide "successful-downloads,empty-packages"
+
+      - name: Run in-repo Complement Tests
+        id: run_in_repo_complement_tests
+        # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
+        #     are underpowered and don't like running tons of Synapse instances at once.
+        # -json: Output JSON format so that gotestfmt can parse it.
+        #
+        # tee /tmp/gotest-in-repo-complement.log: We tee the output to a file so that we can re-process it
+        # later on for better formatting with gotestfmt. But we still want the command
+        # to output to the terminal as it runs so we can see what's happening in
+        # real-time.
+        run: |
+          set -o pipefail
+          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh --in-repo -p 1 -json 2>&1 | tee /tmp/gotest-in-repo-complement.log
+        shell: bash
+        env:
+          POSTGRES: ${{ (matrix.database == 'Postgres') && 1 || '' }}
+          WORKERS: ${{ (matrix.arrangement == 'workers') && 1 || '' }}
+          TEST_ONLY_IGNORE_POETRY_LOCKFILE: 1
+
+      - name: Formatted in-repo Complement test logs
+        # Always run this step if we attempted to run the Complement tests.
+        if: always() && steps.run_in_repo_complement_tests.outcome != 'skipped'
+        run: cat /tmp/gotest-in-repo-complement.log | gotestfmt -hide "successful-downloads,empty-packages"
 
   # Open an issue if the build fails, so we know about it.
   # Only do this if we're not experimenting with this action in a PR.
@@ -234,7 +274,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/poetry_lockfile.yaml b/.github/workflows/poetry_lockfile.yaml
index 5c8a0d7117..5042a564f2 100644
--- a/.github/workflows/poetry_lockfile.yaml
+++ b/.github/workflows/poetry_lockfile.yaml
@@ -16,8 +16,8 @@ jobs:
     name: "Check locked dependencies have sdists"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.x'
       - run: pip install tomli
diff --git a/.github/workflows/push_complement_image.yml b/.github/workflows/push_complement_image.yml
index bfafe5642a..3931dbebb3 100644
--- a/.github/workflows/push_complement_image.yml
+++ b/.github/workflows/push_complement_image.yml
@@ -33,29 +33,33 @@ jobs:
       packages: write
     steps:
       - name: Checkout specific branch (debug build)
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: github.event_name == 'workflow_dispatch'
         with:
           ref: ${{ inputs.branch }}
       - name: Checkout clean copy of develop (scheduled build)
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: github.event_name == 'schedule'
         with:
           ref: develop
       - name: Checkout clean copy of master (on-push)
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: github.event_name == 'push'
         with:
           ref: master
+      # We use `poetry` in `complement.sh`
+      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        with:
+          poetry-version: "2.2.1"
       - name: Login to registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Work out labels for complement image
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ghcr.io/${{ github.repository }}/complement-synapse
           tags: |
@@ -69,6 +73,7 @@ jobs:
         run: |
           for TAG in ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}; do 
             echo "tag and push $TAG"
-            docker tag complement-synapse $TAG
+            # `localhost/complement-synapse` should match the image created by `scripts-dev/complement.sh`
+            docker tag localhost/complement-synapse $TAG
             docker push $TAG
           done
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 8a43f696dc..c313a64250 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -5,7 +5,7 @@ name: Build release artifacts
 on:
   # we build on PRs and develop to (hopefully) get early warning
   # of things breaking (but only build one set of debs). PRs skip
-  # building wheels on macOS & ARM.
+  # building wheels on ARM.
   pull_request:
   push:
     branches: ["develop", "release-*"]
@@ -27,8 +27,8 @@ jobs:
     name: "Calculate list of debian distros"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - id: set-distros
@@ -55,18 +55,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-        with:
-          install: true
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Set up docker layer caching
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -74,7 +72,7 @@ jobs:
             ${{ runner.os }}-buildx-
 
       - name: Set up python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
 
@@ -101,7 +99,7 @@ jobs:
           echo "ARTIFACT_NAME=${DISTRO#*:}" >> "$GITHUB_OUTPUT"
 
       - name: Upload debs as artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: debs-${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
           path: debs/*
@@ -114,47 +112,45 @@ jobs:
         os:
           - ubuntu-24.04
           - ubuntu-24.04-arm
-          - macos-13 # This uses x86-64
-          - macos-14 # This uses arm64
         # is_pr is a flag used to exclude certain jobs from the matrix on PRs.
         # It is not read by the rest of the workflow.
         is_pr:
           - ${{ startsWith(github.ref, 'refs/pull/') }}
 
         exclude:
-          # Don't build macos wheels on PR CI.
-          - is_pr: true
-            os: "macos-13"
-          - is_pr: true
-            os: "macos-14"
           # Don't build aarch64 wheels on PR CI.
           - is_pr: true
             os: "ubuntu-24.04-arm"
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           # setup-python@v4 doesn't impose a default python version. Need to use 3.x
           # here, because `python` on osx points to Python 2.7.
           python-version: "3.x"
 
       - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==3.0.0
+        run: python -m pip install cibuildwheel==3.2.1
 
       - name: Only build a single wheel on PR
         if: startsWith(github.ref, 'refs/pull/')
-        run: echo "CIBW_BUILD="cp39-manylinux_*"" >> $GITHUB_ENV
+        run: echo "CIBW_BUILD="cp310-manylinux_*"" >> $GITHUB_ENV
 
       - name: Build wheels
         run: python -m cibuildwheel --output-dir wheelhouse
         env:
-          # Skip testing for platforms which various libraries don't have wheels
-          # for, and so need extra build deps.
-          CIBW_TEST_SKIP: pp3*-* *i686* *musl*
+          # The platforms that we build for are determined by the
+          # `tool.cibuildwheel.skip` option in `pyproject.toml`.
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+          # We skip testing wheels for the following platforms in CI:
+          #
+          # pp3*-* (PyPy wheels) broke in CI (TODO: investigate).
+          # musl: (TODO: investigate).
+          CIBW_TEST_SKIP: pp3*-* *musl*
+
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Wheel-${{ matrix.os }}
           path: ./wheelhouse/*.whl
@@ -165,8 +161,8 @@ jobs:
     if: ${{ !startsWith(github.ref, 'refs/pull/') }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
 
@@ -175,7 +171,7 @@ jobs:
       - name: Build sdist
         run: python -m build --sdist
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Sdist
           path: dist/*.tar.gz
@@ -191,7 +187,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all workflow run artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Build a tarball for the debs
         # We need to merge all the debs uploads into one folder, then compress
         # that.
@@ -200,16 +196,11 @@ jobs:
           mv debs*/* debs/
           tar -cvJf debs.tar.xz debs
       - name: Attach to release
-        # Pinned to work around https://github.com/softprops/action-gh-release/issues/445
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v0.1.15
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          files: |
-            Sdist/*
-            Wheel*/*
-            debs.tar.xz
-          # if it's not already published, keep the release as a draft.
-          draft: true
-          # mark it as a prerelease if the tag contains 'rc'.
-          prerelease: ${{ contains(github.ref, 'rc') }}
+        run: |
+          gh release upload "${{ github.ref_name }}" \
+            Sdist/* \
+            Wheel*/* \
+            debs.tar.xz \
+            --repo ${{ github.repository }}
diff --git a/.github/workflows/schema.yaml b/.github/workflows/schema.yaml
index 53d6bace2c..430ff8861a 100644
--- a/.github/workflows/schema.yaml
+++ b/.github/workflows/schema.yaml
@@ -14,8 +14,8 @@ jobs:
     name: Ensure Synapse config schema is valid
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - name: Install check-jsonschema
@@ -40,8 +40,8 @@ jobs:
     name: Ensure generated documentation is up-to-date
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - name: Install PyYAML
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ae75369809..488208291f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -26,59 +26,59 @@ jobs:
       linting: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.linting }}
       linting_readme: ${{ !startsWith(github.ref, 'refs/pull/') || steps.filter.outputs.linting_readme }}
     steps:
-    - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
-      id: filter
-      # We only check on PRs
-      if: startsWith(github.ref, 'refs/pull/')
-      with:
-        filters: |
-          rust:
-            - 'rust/**'
-            - 'Cargo.toml'
-            - 'Cargo.lock'
-            - '.rustfmt.toml'
-            - '.github/workflows/tests.yml'
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: filter
+        # We only check on PRs
+        if: startsWith(github.ref, 'refs/pull/')
+        with:
+          filters: |
+            rust:
+              - 'rust/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - '.rustfmt.toml'
+              - '.github/workflows/tests.yml'
 
-          trial:
-            - 'synapse/**'
-            - 'tests/**'
-            - 'rust/**'
-            - '.ci/scripts/calculate_jobs.py'
-            - 'Cargo.toml'
-            - 'Cargo.lock'
-            - 'pyproject.toml'
-            - 'poetry.lock'
-            - '.github/workflows/tests.yml'
+            trial:
+              - 'synapse/**'
+              - 'tests/**'
+              - 'rust/**'
+              - '.ci/scripts/calculate_jobs.py'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'pyproject.toml'
+              - 'poetry.lock'
+              - '.github/workflows/tests.yml'
 
-          integration:
-            - 'synapse/**'
-            - 'rust/**'
-            - 'docker/**'
-            - 'Cargo.toml'
-            - 'Cargo.lock'
-            - 'pyproject.toml'
-            - 'poetry.lock'
-            - 'docker/**'
-            - '.ci/**'
-            - 'scripts-dev/complement.sh'
-            - '.github/workflows/tests.yml'
+            integration:
+              - 'synapse/**'
+              - 'rust/**'
+              - 'docker/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'pyproject.toml'
+              - 'poetry.lock'
+              - 'docker/**'
+              - '.ci/**'
+              - 'scripts-dev/complement.sh'
+              - '.github/workflows/tests.yml'
 
-          linting:
-            - 'synapse/**'
-            - 'docker/**'
-            - 'tests/**'
-            - 'scripts-dev/**'
-            - 'contrib/**'
-            - 'synmark/**'
-            - 'stubs/**'
-            - '.ci/**'
-            - 'mypy.ini'
-            - 'pyproject.toml'
-            - 'poetry.lock'
-            - '.github/workflows/tests.yml'
+            linting:
+              - 'synapse/**'
+              - 'docker/**'
+              - 'tests/**'
+              - 'scripts-dev/**'
+              - 'contrib/**'
+              - 'synmark/**'
+              - 'stubs/**'
+              - '.ci/**'
+              - 'mypy.ini'
+              - 'pyproject.toml'
+              - 'poetry.lock'
+              - '.github/workflows/tests.yml'
 
-          linting_readme:
-            - 'README.rst'
+            linting_readme:
+              - 'README.rst'
 
   check-sampleconfig:
     runs-on: ubuntu-latest
@@ -86,16 +86,16 @@ jobs:
     if: ${{ needs.changes.outputs.linting == 'true' }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           python-version: "3.x"
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
           extras: "all"
       - run: poetry run scripts-dev/generate_sample_config.sh --check
       - run: poetry run scripts-dev/config-lint.sh
@@ -106,18 +106,18 @@ jobs:
     if: ${{ needs.changes.outputs.linting == 'true' }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
-      - run: "pip install 'click==8.1.1' 'GitPython>=3.1.20'"
+      - run: "pip install 'click==8.1.1' 'GitPython>=3.1.20' 'sqlglot>=28.0.0'"
       - run: scripts-dev/check_schema_delta.py --force-colors
 
   check-lockfile:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - run: .ci/scripts/check_lockfile.py
@@ -129,12 +129,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Poetry
         uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
           install-project: "false"
 
       - name: Run ruff check
@@ -151,13 +151,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Setup Poetry
         uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
@@ -169,12 +169,12 @@ jobs:
           # https://github.com/matrix-org/synapse/pull/15376#issuecomment-1498983775
           # To make CI green, err towards caution and install the project.
           install-project: "true"
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
 
       # Cribbed from
       # https://github.com/AustinScola/mypy-cache-github-action/blob/85ea4f2972abed39b33bd02c36e341b28ca59213/src/restore.ts#L10-L17
       - name: Restore/persist mypy's cache
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             .mypy_cache
@@ -187,19 +187,20 @@ jobs:
   lint-crlf:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Check line endings
         run: scripts-dev/check_line_terminators.sh
 
   lint-newsfile:
-    if: ${{ (github.base_ref == 'develop'  || contains(github.base_ref, 'release-')) && github.actor != 'dependabot[bot]' }}
+    # Only run on pull_request events, targeting develop/release branches, and skip when the PR author is dependabot[bot].
+    if: ${{ github.event_name == 'pull_request' && (github.base_ref == 'develop' || contains(github.base_ref, 'release-')) && github.event.pull_request.user.login != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - run: "pip install 'towncrier>=18.6.0rc1'"
@@ -207,40 +208,20 @@ jobs:
         env:
           PULL_REQUEST_NUMBER: ${{ github.event.number }}
 
-  lint-pydantic:
-    runs-on: ubuntu-latest
-    needs: changes
-    if: ${{ needs.changes.outputs.linting == 'true' }}
-
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
-        with:
-          toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
-      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
-        with:
-          poetry-version: "2.1.1"
-          extras: "all"
-      - run: poetry run scripts-dev/check_pydantic_models.py
-
   lint-clippy:
     runs-on: ubuntu-latest
     needs: changes
     if: ${{ needs.changes.outputs.rust == 'true' }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
-            components: clippy
-            toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+          components: clippy
+          toolchain: ${{ env.RUST_VERSION }}
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - run: cargo clippy -- -D warnings
 
@@ -252,14 +233,14 @@ jobs:
     if: ${{ needs.changes.outputs.rust == 'true' }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
-            toolchain: nightly-2025-04-23
-            components: clippy
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+          toolchain: nightly-2026-02-01
+          components: clippy
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - run: cargo clippy --all-features -- -D warnings
 
@@ -270,13 +251,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Setup Poetry
         uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
@@ -284,7 +265,7 @@ jobs:
           # Install like a normal project from source with all optional dependencies
           extras: all
           install-project: "true"
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
 
       - name: Ensure `Cargo.lock` is up to date (no stray changes after install)
         # The `::error::` syntax is using GitHub Actions' error annotations, see
@@ -306,7 +287,7 @@ jobs:
     if: ${{ needs.changes.outputs.rust == 'true' }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
@@ -315,7 +296,7 @@ jobs:
           # `.rustfmt.toml`.
           toolchain: nightly-2025-04-23
           components: rustfmt
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - run: cargo fmt --check
 
@@ -326,8 +307,8 @@ jobs:
     needs: changes
     if: ${{ needs.changes.outputs.linting_readme == 'true' }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - run: "pip install rstcheck"
@@ -341,7 +322,6 @@ jobs:
       - lint-mypy
       - lint-crlf
       - lint-newsfile
-      - lint-pydantic
       - check-sampleconfig
       - check-schema-delta
       - check-lockfile
@@ -363,21 +343,19 @@ jobs:
             lint
             lint-mypy
             lint-newsfile
-            lint-pydantic
             lint-clippy
             lint-clippy-nightly
             lint-rust
             lint-rustfmt
             lint-readme
 
-
   calculate-test-jobs:
     if: ${{ !cancelled() && !failure() }} # Allow previous steps to be skipped, but not fail
     needs: linting-done
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - id: get-matrix
@@ -394,10 +372,10 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        job:  ${{ fromJson(needs.calculate-test-jobs.outputs.trial_test_matrix) }}
+        job: ${{ fromJson(needs.calculate-test-jobs.outputs.trial_test_matrix) }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - run: sudo apt-get -qq install xmlsec1
       - name: Set up PostgreSQL ${{ matrix.job.postgres-version }}
         if: ${{ matrix.job.postgres-version }}
@@ -415,12 +393,12 @@ jobs:
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           python-version: ${{ matrix.job.python-version }}
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
           extras: ${{ matrix.job.extras }}
       - name: Await PostgreSQL
         if: ${{ matrix.job.postgres-version }}
@@ -453,13 +431,13 @@ jobs:
       - changes
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       # There aren't wheels for some of the older deps, so we need to install
       # their build dependencies
@@ -468,19 +446,17 @@ jobs:
           sudo apt-get -qq install build-essential libffi-dev python3-dev \
             libxml2-dev libxslt-dev xmlsec1 zlib1g-dev libjpeg-dev libwebp-dev
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.9'
+          python-version: "3.10"
 
       - name: Prepare old deps
-        if: steps.cache-poetry-old-deps.outputs.cache-hit != 'true'
-        run: .ci/scripts/prepare_old_deps.sh
-
-      # Note: we install using `pip` here, not poetry. `poetry install` ignores the
-      # build-system section (https://github.com/python-poetry/poetry/issues/6154), but
-      # we explicitly want to test that you can `pip install` using the oldest version
-      # of poetry-core and setuptools-rust.
-      - run: pip install .[all,test]
+        # Note: we install using `uv` here, not poetry or pip to allow us to test with the
+        # minimum version of all dependencies, both those explicitly specified and those
+        # implicitly brought in by the explicit dependencies.
+        run: |
+          pip install uv
+          uv pip install --system --resolution=lowest .[all,test]
 
       # We nuke the local copy, as we've installed synapse into the virtualenv
       # (rather than use an editable install, which we no longer support). If we
@@ -514,17 +490,17 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["pypy-3.9"]
+        python-version: ["pypy-3.10"]
         extras: ["all"]
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       # Install libs necessary for PyPy to build binary wheels for dependencies
       - run: sudo apt-get -qq install xmlsec1 libxml2-dev libxslt-dev
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           python-version: ${{ matrix.python-version }}
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
           extras: ${{ matrix.extras }}
       - run: poetry run trial --jobs=2 tests
       - name: Dump logs
@@ -568,7 +544,7 @@ jobs:
         job: ${{ fromJson(needs.calculate-test-jobs.outputs.sytest_test_matrix) }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Prepare test blacklist
         run: cat sytest-blacklist .ci/worker-blacklist > synapse-blacklist-with-workers
 
@@ -576,7 +552,7 @@ jobs:
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Run SyTest
         run: /bootstrap.sh synapse
@@ -585,7 +561,7 @@ jobs:
         if: ${{ always() }}
         run: /sytest/scripts/tap_to_gha.pl /logs/results.tap
       - name: Upload SyTest logs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: ${{ always() }}
         with:
           name: Sytest Logs - ${{ job.status }} - (${{ join(matrix.job.*, ', ') }})
@@ -615,11 +591,11 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - run: sudo apt-get -qq install xmlsec1 postgresql-client
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
           extras: "postgres"
       - run: .ci/scripts/test_export_data_command.sh
         env:
@@ -628,7 +604,6 @@ jobs:
           PGPASSWORD: postgres
           PGDATABASE: postgres
 
-
   portdb:
     if: ${{ !failure() && !cancelled() && needs.changes.outputs.integration == 'true'}} # Allow previous steps to be skipped, but not fail
     needs:
@@ -638,10 +613,10 @@ jobs:
     strategy:
       matrix:
         include:
-          - python-version: "3.9"
-            postgres-version: "13"
+          - python-version: "3.10"
+            postgres-version: "14"
 
-          - python-version: "3.13"
+          - python-version: "3.14"
             postgres-version: "17"
 
     services:
@@ -659,7 +634,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Add PostgreSQL apt repository
         # We need a version of pg_dump that can handle the version of
         # PostgreSQL being tested against. The Ubuntu package repository lags
@@ -673,7 +648,7 @@ jobs:
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           python-version: ${{ matrix.python-version }}
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
           extras: "postgres"
       - run: .ci/scripts/test_synapse_port_db.sh
         id: run_tester_script
@@ -683,7 +658,7 @@ jobs:
           PGPASSWORD: postgres
           PGDATABASE: postgres
       - name: "Upload schema differences"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: ${{ failure() && !cancelled() && steps.run_tester_script.outcome == 'failure' }}
         with:
           name: Schema dumps
@@ -714,33 +689,124 @@ jobs:
 
     steps:
       - name: Checkout synapse codebase
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: synapse
 
+      # Log Docker system info for debugging (compare with your local environment) and
+      # tracking GitHub runner changes over time (can easily compare a run from last
+      # week with the current one in question).
+      - run: docker system info
+        shell: bash
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+
+      # We use `poetry` in `complement.sh`
+      - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
+        with:
+          poetry-version: "2.2.1"
+          # Matches the `path` where we checkout Synapse above
+          working-directory: "synapse"
 
       - name: Prepare Complement's Prerequisites
         run: synapse/.ci/scripts/setup_complement_prerequisites.sh
 
-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           cache-dependency-path: complement/go.sum
           go-version-file: complement/go.mod
 
-        # use p=1 concurrency as GHA boxes are underpowered and don't like running tons of synapses at once.
-      - run: |
+      # Run the image sanity check test first as this is the first thing we want to know
+      # about (are we actually testing what we expect?) and we don't want to debug
+      # downstream failures (wild goose chase).
+      - name: Sanity check Complement image
+        id: run_sanity_check_complement_image_test
+        # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
+        #     are underpowered and don't like running tons of Synapse instances at once.
+        # -json: Output JSON format so that gotestfmt can parse it.
+        #
+        # tee /tmp/gotest-complement.log: We tee the output to a file so that we can re-process it
+        # later on for better formatting with gotestfmt. But we still want the command
+        # to output to the terminal as it runs so we can see what's happening in
+        # real-time.
+        run: |
           set -o pipefail
-          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh -p 1 -json 2>&1 | synapse/.ci/scripts/gotestfmt
+          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh --in-repo -p 1 -json -run 'TestSynapseVersion/Synapse_version_matches_current_git_checkout' 2>&1 | tee /tmp/gotest-sanity-check-complement.log
         shell: bash
         env:
           POSTGRES: ${{ (matrix.database == 'Postgres') && 1 || '' }}
           WORKERS: ${{ (matrix.arrangement == 'workers') && 1 || '' }}
-        name: Run Complement Tests
+
+      - name: Formatted sanity check Complement test logs
+        # Always run this step if we attempted to run the Complement tests.
+        if: always() && steps.run_sanity_check_complement_image_test.outcome != 'skipped'
+        # We do not hide successful tests in `gotestfmt` here as the list of sanity
+        # check tests is so short. Feel free to change this when we get more tests.
+        #
+        # Note that the `-hide` argument is interpreted by `gotestfmt`. From it,
+        # it derives several values under `$settings` and passes them to our
+        # custom `.ci/complement_package.gotpl` template to render the output.
+        run: cat /tmp/gotest-sanity-check-complement.log | gotestfmt -hide "successful-downloads,empty-packages"
+
+      - name: Run Complement Tests
+        id: run_complement_tests
+        # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
+        #     are underpowered and don't like running tons of Synapse instances at once.
+        # -json: Output JSON format so that gotestfmt can parse it.
+        #
+        # tee /tmp/gotest-complement.log: We tee the output to a file so that we can re-process it
+        # later on for better formatting with gotestfmt. But we still want the command
+        # to output to the terminal as it runs so we can see what's happening in
+        # real-time.
+        run: |
+          set -o pipefail
+          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh -p 1 -json 2>&1 | tee /tmp/gotest-complement.log
+        shell: bash
+        env:
+          POSTGRES: ${{ (matrix.database == 'Postgres') && 1 || '' }}
+          WORKERS: ${{ (matrix.arrangement == 'workers') && 1 || '' }}
+
+      - name: Formatted Complement test logs (only failing are shown)
+        # Always run this step if we attempted to run the Complement tests.
+        if: always() && steps.run_complement_tests.outcome != 'skipped'
+        # Hide successful tests in order to reduce the verbosity of the otherwise very large output.
+        #
+        # Note that the `-hide` argument is interpreted by `gotestfmt`. From it,
+        # it derives several values under `$settings` and passes them to our
+        # custom `.ci/complement_package.gotpl` template to render the output.
+        run: cat /tmp/gotest-complement.log | gotestfmt -hide "successful-downloads,successful-tests,empty-packages"
+
+      - name: Run in-repo Complement Tests
+        id: run_in_repo_complement_tests
+        # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
+        #     are underpowered and don't like running tons of Synapse instances at once.
+        # -json: Output JSON format so that gotestfmt can parse it.
+        #
+        # tee /tmp/gotest-in-repo-complement.log: We tee the output to a file so that we can re-process it
+        # later on for better formatting with gotestfmt. But we still want the command
+        # to output to the terminal as it runs so we can see what's happening in
+        # real-time.
+        run: |
+          set -o pipefail
+          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh --in-repo -p 1 -json 2>&1 | tee /tmp/gotest-in-repo-complement.log
+        shell: bash
+        env:
+          POSTGRES: ${{ (matrix.database == 'Postgres') && 1 || '' }}
+          WORKERS: ${{ (matrix.arrangement == 'workers') && 1 || '' }}
+
+      - name: Formatted in-repo Complement test logs (only failing are shown)
+        # Always run this step if we attempted to run the Complement tests.
+        if: always() && steps.run_in_repo_complement_tests.outcome != 'skipped'
+        # Hide successful tests in order to reduce the verbosity of the otherwise very large output.
+        #
+        # Note that the `-hide` argument is interpreted by `gotestfmt`. From it,
+        # it derives several values under `$settings` and passes them to our
+        # custom `.ci/complement_package.gotpl` template to render the output.
+        run: cat /tmp/gotest-in-repo-complement.log | gotestfmt -hide "successful-downloads,successful-tests,empty-packages"
 
   cargo-test:
     if: ${{ needs.changes.outputs.rust == 'true' }}
@@ -750,13 +816,13 @@ jobs:
       - changes
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - run: cargo test
 
@@ -770,13 +836,13 @@ jobs:
       - changes
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
-            toolchain: nightly-2022-12-01
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+          toolchain: nightly-2022-12-01
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - run: cargo bench --no-run
 
diff --git a/.github/workflows/triage_labelled.yml b/.github/workflows/triage_labelled.yml
index 41f535a15d..31dddab012 100644
--- a/.github/workflows/triage_labelled.yml
+++ b/.github/workflows/triage_labelled.yml
@@ -6,43 +6,26 @@ on:
 
 jobs:
   move_needs_info:
-    name: Move X-Needs-Info on the triage board
     runs-on: ubuntu-latest
     if: >
       contains(github.event.issue.labels.*.name, 'X-Needs-Info')
+    permissions:
+      contents: read
+    env:
+      # This token must have the following scopes: ["repo:public_repo", "admin:org->read:org", "user->read:user", "project"]
+      GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+      PROJECT_OWNER: matrix-org
+      # Backend issue triage board.
+      # https://github.com/orgs/matrix-org/projects/67/views/1
+      PROJECT_NUMBER: 67
+      ISSUE_URL: ${{ github.event.issue.html_url }}
+      # This field is case-sensitive.
+      TARGET_STATUS: Needs info
     steps:
-      - uses: actions/add-to-project@4515659e2b458b27365e167605ac44f219494b66 # v1.0.2
-        id: add_project
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          project-url: "https://github.com/orgs/matrix-org/projects/67"
-          github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-        # This action will error if the issue already exists on the project. Which is
-        # common as `X-Needs-Info` will often be added to issues that are already in
-        # the triage queue. Prevent the whole job from failing in this case.
-        continue-on-error: true
-      - name: Set status
-        env:
-          GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
-        run: |
-          gh api graphql -f query='
-          mutation(
-              $project: ID!
-              $item: ID!
-              $fieldid: ID!
-              $columnid: String!
-            )  {
-            updateProjectV2ItemFieldValue(
-              input: {
-               projectId: $project
-                itemId: $item
-                fieldId: $fieldid
-                value: { 
-                  singleSelectOptionId: $columnid
-                  }
-              }
-            ) {
-              projectV2Item {
-                id
-              }
-            }
-          }' -f project="PVT_kwDOAIB0Bs4AFDdZ" -f item=${{ steps.add_project.outputs.itemId }} -f fieldid="PVTSSF_lADOAIB0Bs4AFDdZzgC6ZA4" -f columnid=ba22e43c --silent
+          # Only clone the script file we care about, instead of the whole repo.
+          sparse-checkout: .ci/scripts/triage_labelled_issue.sh
+
+      - name: Ensure issue exists on the board, then set Status
+        run: .ci/scripts/triage_labelled_issue.sh
diff --git a/.github/workflows/twisted_trunk.yml b/.github/workflows/twisted_trunk.yml
index fbe1270767..be73e5283b 100644
--- a/.github/workflows/twisted_trunk.yml
+++ b/.github/workflows/twisted_trunk.yml
@@ -12,10 +12,9 @@ on:
       twisted_ref:
         description: Commit, branch or tag to checkout from upstream Twisted.
         required: false
-        default: 'trunk'
+        default: "trunk"
         type: string
 
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -43,19 +42,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           python-version: "3.x"
           extras: "all"
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
       - run: |
           poetry remove twisted
           poetry add --extras tls git+https://github.com/twisted/twisted.git#${{ inputs.twisted_ref || 'trunk' }}
@@ -70,26 +69,25 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - run: sudo apt-get -qq install xmlsec1
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
         with:
           python-version: "3.x"
           extras: "all test"
-          poetry-version: "2.1.1"
+          poetry-version: "2.2.1"
       - run: |
           poetry remove twisted
           poetry add --extras tls git+https://github.com/twisted/twisted.git#trunk
           poetry install --no-interaction --extras "all test"
       - run: poetry run trial --jobs 2 tests
-
       - name: Dump logs
         # Logs are most useful when the command fails, always include them.
         if: ${{ always() }}
@@ -108,22 +106,22 @@ jobs:
     if: needs.check_repo.outputs.should_run_workflow == 'true'
     runs-on: ubuntu-latest
     container:
-      # We're using debian:bullseye because it uses Python 3.9 which is our minimum supported Python version.
+      # We're using bookworm because that's what Debian oldstable is at the time of writing.
       # This job is a canary to warn us about unreleased twisted changes that would cause problems for us if
       # they were to be released immediately. For simplicity's sake (and to save CI runners) we use the oldest
       # version, assuming that any incompatibilities on newer versions would also be present on the oldest.
-      image: matrixdotorg/sytest-synapse:bullseye
+      image: matrixdotorg/sytest-synapse:bookworm
       volumes:
         - ${{ github.workspace }}:/src
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Patch dependencies
         # Note: The poetry commands want to create a virtualenv in /src/.venv/,
@@ -147,7 +145,7 @@ jobs:
         if: ${{ always() }}
         run: /sytest/scripts/tap_to_gha.pl /logs/results.tap
       - name: Upload SyTest logs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: ${{ always() }}
         with:
           name: Sytest Logs - ${{ job.status }} - (${{ join(matrix.*, ', ') }})
@@ -175,14 +173,14 @@ jobs:
 
     steps:
       - name: Run actions/checkout@v4 for synapse
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: synapse
 
       - name: Prepare Complement's Prerequisites
         run: synapse/.ci/scripts/setup_complement_prerequisites.sh
 
-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           cache-dependency-path: complement/go.sum
           go-version-file: complement/go.mod
@@ -199,11 +197,53 @@ jobs:
           poetry lock
         working-directory: synapse
 
-      - run: |
+      - name: Run Complement Tests
+        id: run_complement_tests
+        # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
+        #     are underpowered and don't like running tons of Synapse instances at once.
+        # -json: Output JSON format so that gotestfmt can parse it.
+        #
+        # tee /tmp/gotest-complement.log: We tee the output to a file so that we can re-process it
+        # later on for better formatting with gotestfmt. But we still want the command
+        # to output to the terminal as it runs so we can see what's happening in
+        # real-time.
+        run: |
           set -o pipefail
-          TEST_ONLY_SKIP_DEP_HASH_VERIFICATION=1 POSTGRES=${{ (matrix.database == 'Postgres') && 1 || '' }} WORKERS=${{ (matrix.arrangement == 'workers') && 1 || '' }} COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh -json 2>&1 | synapse/.ci/scripts/gotestfmt
+          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh -p 1 -json 2>&1 | tee /tmp/gotest-complement.log
         shell: bash
-        name: Run Complement Tests
+        env:
+          POSTGRES: ${{ (matrix.database == 'Postgres') && 1 || '' }}
+          WORKERS: ${{ (matrix.arrangement == 'workers') && 1 || '' }}
+          TEST_ONLY_SKIP_DEP_HASH_VERIFICATION: 1
+
+      - name: Formatted Complement test logs
+        # Always run this step if we attempted to run the Complement tests.
+        if: always() && steps.run_complement_tests.outcome != 'skipped'
+        run: cat /tmp/gotest-complement.log | gotestfmt -hide "successful-downloads,empty-packages"
+
+      - name: Run in-repo Complement Tests
+        id: run_in_repo_complement_tests
+        # -p=1: We're using `-p 1` to force the test packages to run serially as GHA boxes
+        #     are underpowered and don't like running tons of Synapse instances at once.
+        # -json: Output JSON format so that gotestfmt can parse it.
+        #
+        # tee /tmp/gotest-in-repo-complement.log: We tee the output to a file so that we can re-process it
+        # later on for better formatting with gotestfmt. But we still want the command
+        # to output to the terminal as it runs so we can see what's happening in
+        # real-time.
+        run: |
+          set -o pipefail
+          COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh --in-repo -p 1 -json 2>&1 | tee /tmp/gotest-in-repo-complement.log
+        shell: bash
+        env:
+          POSTGRES: ${{ (matrix.database == 'Postgres') && 1 || '' }}
+          WORKERS: ${{ (matrix.arrangement == 'workers') && 1 || '' }}
+          TEST_ONLY_SKIP_DEP_HASH_VERIFICATION: 1
+
+      - name: Formatted in-repo Complement test logs
+        # Always run this step if we attempted to run the Complement tests.
+        if: always() && steps.run_in_repo_complement_tests.outcome != 'skipped'
+        run: cat /tmp/gotest-in-repo-complement.log | gotestfmt -hide "successful-downloads,empty-packages"
 
   # open an issue if the build fails, so we know about it.
   open-issue:
@@ -217,7 +257,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/CHANGES.md b/CHANGES.md
index 76f4645905..c6e06aad49 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,3 +1,985 @@
+# Synapse 1.151.0 (2026-04-07)
+
+## Bugfixes
+
+- Fix `KNOWN_ROOM_VERSIONS.__contains__` raising `TypeError` for non-string keys, which could cause `/sync` to fail for rooms with a `NULL` room version in the database. Bug introduced in [#19589](https://github.com/element-hq/synapse/pull/19589) as part of v1.151.0rc1. ([\#19649](https://github.com/element-hq/synapse/issues/19649))
+
+
+
+
+# Synapse 1.151.0rc1 (2026-03-31)
+
+## Features
+
+- Add stable support for [MSC4284](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) Policy Servers. ([\#19503](https://github.com/element-hq/synapse/issues/19503))
+- Update and stabilize support for [MSC2666](https://github.com/matrix-org/matrix-spec-proposals/pull/2666): Get rooms in common with another user. Contributed by @tulir @ Beeper. ([\#19511](https://github.com/element-hq/synapse/issues/19511))
+- Updated experimental support for [MSC4388: Secure out-of-band channel for sign in with QR](https://github.com/matrix-org/matrix-spec-proposals/pull/4388). ([\#19573](https://github.com/element-hq/synapse/issues/19573))
+- Stabilize `room_version` and `encryption` fields in the space/room `/hierarchy` API (part of [MSC3266](https://github.com/matrix-org/matrix-spec-proposals/pull/3266)). ([\#19576](https://github.com/element-hq/synapse/issues/19576))
+- Introduce a [configuration option](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#matrix_authentication_service) to allow using HTTP/2 over plaintext when Synapse connects to Matrix Authentication Service. ([\#19586](https://github.com/element-hq/synapse/issues/19586))
+
+## Bugfixes
+
+- Fix [MSC4284](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) Policy Servers implementation to skip signing `org.matrix.msc4284.policy` and `m.room.policy` state events. ([\#19503](https://github.com/element-hq/synapse/issues/19503))
+- Correctly apply [MSC4284](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) Policy Server signatures to events when the sender and policy server have the same server name. ([\#19503](https://github.com/element-hq/synapse/issues/19503))
+- Allow Synapse to start up even when discovery fails for an OpenID Connect provider. ([\#19509](https://github.com/element-hq/synapse/issues/19509))
+- Fix quarantine media admin APIs sometimes returning inaccurate counts for remote media. ([\#19559](https://github.com/element-hq/synapse/issues/19559))
+- Fix `Build and push complement image` CI job not having `poetry` available for the Complement runner script. ([\#19578](https://github.com/element-hq/synapse/issues/19578))
+- Increase timeout for policy server requests to avoid repeated requests for checking media. ([\#19629](https://github.com/element-hq/synapse/issues/19629))
+
+## Deprecations and Removals
+
+- Remove support for [MSC3852: Expose user agent information on Device](https://github.com/matrix-org/matrix-spec-proposals/pull/3852) as the MSC was closed. ([\#19430](https://github.com/element-hq/synapse/issues/19430))
+
+## Internal Changes
+
+- Fix small comment typo in config output from the `demo/start.sh` script. ([\#19538](https://github.com/element-hq/synapse/issues/19538))
+- Add MSC3820 comment context to `RoomVersion` attributes. ([\#19577](https://github.com/element-hq/synapse/issues/19577))
+- Remove `redacted_because` from internal unsigned. ([\#19581](https://github.com/element-hq/synapse/issues/19581))
+- Prevent sending registration emails if registration is disabled. ([\#19585](https://github.com/element-hq/synapse/issues/19585))
+- Port `RoomVersion` to Rust. ([\#19589](https://github.com/element-hq/synapse/issues/19589))
+- Only show failing Complement tests in the formatted output in CI. ([\#19590](https://github.com/element-hq/synapse/issues/19590))
+- Ensure old Complement test files are removed when downloading a Complement checkout via `./scripts-dev/complement.sh`. ([\#19592](https://github.com/element-hq/synapse/issues/19592))
+- Update `HomeserverTestCase.pump()` docstring to demystify behavior (Twisted reactor/clock). ([\#19602](https://github.com/element-hq/synapse/issues/19602))
+- Deprecate `HomeserverTestCase.pump()` in favor of more direct `HomeserverTestCase.reactor.advance(...)` usage. ([\#19602](https://github.com/element-hq/synapse/issues/19602))
+- Lower the Postgres database `statement_timeout` to 10m (previously 1h). ([\#19604](https://github.com/element-hq/synapse/issues/19604))
+
+
+
+
+# Synapse 1.150.0 (2026-03-24)
+
+No significant changes since 1.150.0rc1.
+
+
+
+
+# Synapse 1.150.0rc1 (2026-03-17)
+
+## Features
+
+- Add experimental support for the [MSC4370](https://github.com/matrix-org/matrix-spec-proposals/pull/4370) Federation API `GET /extremities` endpoint. ([\#19314](https://github.com/element-hq/synapse/issues/19314))
+- [MSC4140: Cancellable delayed events](https://github.com/matrix-org/matrix-spec-proposals/pull/4140): When persisting a delayed event to the timeline, include its `delay_id` in the event's `unsigned` section in `/sync` responses to the event sender. ([\#19479](https://github.com/element-hq/synapse/issues/19479))
+- Expose [MSC4354 Sticky Events](https://github.com/matrix-org/matrix-spec-proposals/pull/4354) over the legacy (v3) /sync API. ([\#19487](https://github.com/element-hq/synapse/issues/19487))
+- When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. ([\#19554](https://github.com/element-hq/synapse/issues/19554))
+
+## Bugfixes
+
+- Fix `Build and push complement image` CI job pointing to non-existent image. ([\#19523](https://github.com/element-hq/synapse/issues/19523))
+- Fix a bug introduced in v1.26.0 that caused deactivated, erased users to not be removed from the user directory. ([\#19542](https://github.com/element-hq/synapse/issues/19542))
+
+## Improved Documentation
+
+- In the Admin API documentation, always express path parameters as `/<param>` instead of as `/$param`. ([\#19307](https://github.com/element-hq/synapse/issues/19307))
+- Update docs to clarify `outbound_federation_restricted_to` can also be used with the [Secure Border Gateway (SBG)](https://element.io/en/server-suite/secure-border-gateways). ([\#19517](https://github.com/element-hq/synapse/issues/19517))
+- Unify Complement developer docs. ([\#19518](https://github.com/element-hq/synapse/issues/19518))
+
+## Internal Changes
+
+- Put membership updates in a background resumable task when changing the avatar or the display name. ([\#19311](https://github.com/element-hq/synapse/issues/19311))
+- Add in-repo Complement test to sanity check Synapse version matches git checkout (testing what we think we are). ([\#19476](https://github.com/element-hq/synapse/issues/19476))
+- Migrate `dev` dependencies to [PEP 735](https://peps.python.org/pep-0735/) dependency groups. ([\#19490](https://github.com/element-hq/synapse/issues/19490))
+- Remove the optional `systemd-python` dependency and the `systemd` extra on the `synapse` package. ([\#19491](https://github.com/element-hq/synapse/issues/19491))
+- Avoid re-computing the event ID when cloning events. ([\#19527](https://github.com/element-hq/synapse/issues/19527))
+- Allow caching of the `/versions` and `/auth_metadata` public endpoints. ([\#19530](https://github.com/element-hq/synapse/issues/19530))
+- Add a few labels to the number groupings in the `Processed request` logs. ([\#19548](https://github.com/element-hq/synapse/issues/19548))
+
+
+
+
+# Synapse 1.149.1 (2026-03-11)
+
+## Internal Changes
+
+- Bump `matrix-synapse-ldap3` to `0.4.0` to support `setuptools>=82.0.0`. Fixes [\#19541](https://github.com/element-hq/synapse/issues/19541). ([\#19543](https://github.com/element-hq/synapse/issues/19543))
+
+
+
+
+# Synapse 1.149.0 (2026-03-10)
+
+No significant changes since 1.149.0rc1.
+
+
+
+
+# Synapse 1.149.0rc1 (2026-03-03)
+
+## Features
+
+- Add experimental support for [MSC4388: Secure out-of-band channel for sign in with QR](https://github.com/matrix-org/matrix-spec-proposals/pull/4388). ([\#19127](https://github.com/element-hq/synapse/issues/19127))
+- Add stable support for [MSC4380](https://github.com/matrix-org/matrix-spec-proposals/pull/4380) invite blocking. ([\#19431](https://github.com/element-hq/synapse/issues/19431))
+
+## Bugfixes
+
+- Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. ([\#18518](https://github.com/element-hq/synapse/issues/18518))
+- Fix `/sync` missing membership event in `state_after` (experimental [MSC4222](https://github.com/matrix-org/matrix-spec-proposals/pull/4222) implementation) in some scenarios. ([\#19460](https://github.com/element-hq/synapse/issues/19460))
+
+## Internal Changes
+
+- Add log to explain when and why we freeze objects in the garbage collector. ([\#19440](https://github.com/element-hq/synapse/issues/19440))
+- Better instrument `JoinRoomAliasServlet` with tracing. ([\#19461](https://github.com/element-hq/synapse/issues/19461))
+- Fix Complement CI not running against the code from our PRs. ([\#19475](https://github.com/element-hq/synapse/issues/19475))
+- Log `docker system info` in CI so we have a plain record of how GitHub runners evolve over time. ([\#19480](https://github.com/element-hq/synapse/issues/19480))
+- Rename the `test_disconnect` test helper so that pytest doesn't see it as a test. ([\#19486](https://github.com/element-hq/synapse/issues/19486))
+- Add a log line when we delete devices. Contributed by @bradtgmurray @ Beeper. ([\#19496](https://github.com/element-hq/synapse/issues/19496))
+- Pre-allocate the buffer based on the expected `Content-Length` with the Rust HTTP client. ([\#19498](https://github.com/element-hq/synapse/issues/19498))
+- Cancel long-running sync requests if the client has gone away. ([\#19499](https://github.com/element-hq/synapse/issues/19499))
+- Try and reduce reactor tick times when under heavy load. ([\#19507](https://github.com/element-hq/synapse/issues/19507))
+- Simplify Rust HTTP client response streaming and limiting. ([\#19510](https://github.com/element-hq/synapse/issues/19510))
+- Replace deprecated collection import locations with current locations. ([\#19515](https://github.com/element-hq/synapse/issues/19515))
+- Bump most locked Python dependencies to their latest versions. ([\#19519](https://github.com/element-hq/synapse/issues/19519))
+
+
+
+
+# Synapse 1.148.0 (2026-02-24)
+
+No significant changes since 1.148.0rc1.
+
+
+
+
+# Synapse 1.148.0rc1 (2026-02-17)
+
+## Features
+
+- Support sending and receiving [MSC4354 Sticky Event](https://github.com/matrix-org/matrix-spec-proposals/pull/4354) metadata. ([\#19365](https://github.com/element-hq/synapse/issues/19365))
+
+## Improved Documentation
+
+- Fix reference to the `experimental_features` section of the configuration manual documentation. ([\#19435](https://github.com/element-hq/synapse/issues/19435))
+
+## Deprecations and Removals
+
+- Remove support for [MSC3244: Room version capabilities](https://github.com/matrix-org/matrix-spec-proposals/pull/3244) as the MSC was rejected. ([\#19429](https://github.com/element-hq/synapse/issues/19429))
+
+## Internal Changes
+
+- Add in-repo Complement tests so we can test Synapse specific behavior at an end-to-end level. ([\#19406](https://github.com/element-hq/synapse/issues/19406))
+- Push Synapse docker images to Element OCI Registry. ([\#19420](https://github.com/element-hq/synapse/issues/19420))
+- Allow configuring the Rust HTTP client to use HTTP/2 only. ([\#19457](https://github.com/element-hq/synapse/issues/19457))
+- Correctly refuse to start if the Rust workspace config has changed and the Rust library has not been rebuilt. ([\#19470](https://github.com/element-hq/synapse/issues/19470))
+
+
+
+
+# Synapse 1.147.1 (2026-02-12)
+
+## Internal Changes
+
+- Block federation requests and events authenticated using a known insecure signing key. See [CVE-2026-24044](https://www.cve.org/CVERecord?id=CVE-2026-24044) / [ELEMENTSEC-2025-1670](https://github.com/element-hq/ess-helm/security/advisories/GHSA-qwcj-h6m8-vp6q). ([\#19459](https://github.com/element-hq/synapse/issues/19459))
+
+
+
+
+# Synapse 1.147.0 (2026-02-10)
+
+No significant changes since 1.147.0rc1.
+
+# Synapse 1.147.0rc1 (2026-02-03)
+
+## Bugfixes
+
+- Fix memory leak caused by not cleaning up stopped looping calls. Introduced in v1.140.0. ([\#19416](https://github.com/element-hq/synapse/issues/19416))
+- Fix a typo that incorrectly made `setuptools_rust` a runtime dependency. ([\#19417](https://github.com/element-hq/synapse/issues/19417))
+
+## Internal Changes
+
+- Prune stale entries from `sliding_sync_connection_required_state` table. ([\#19306](https://github.com/element-hq/synapse/issues/19306))
+- Update "Event Send Time Quantiles" graph to only use dots for the event persistence rate (Grafana dashboard). ([\#19399](https://github.com/element-hq/synapse/issues/19399))
+- Update and align Grafana dashboard to use regex matching for `job` selectors (`job=~"$job"`) so the "all" value works correctly across all panels. ([\#19400](https://github.com/element-hq/synapse/issues/19400))
+- Don't retry joining partial state rooms all at once on startup. ([\#19402](https://github.com/element-hq/synapse/issues/19402))
+- Disallow requests to the health endpoint from containing trailing path characters. ([\#19405](https://github.com/element-hq/synapse/issues/19405))
+- Add notes that new experimental features should have associated tracking issues. ([\#19410](https://github.com/element-hq/synapse/issues/19410))
+- Bump `pyo3` from 0.26.0 to 0.27.2 and `pythonize` from 0.26.0 to 0.27.0. Contributed by @razvp @ ERCOM. ([\#19412](https://github.com/element-hq/synapse/issues/19412))
+
+
+
+
+# Synapse 1.146.0 (2026-01-27)
+
+No significant changes since 1.146.0rc1.
+
+## Deprecations and Removals
+
+- [MSC2697](https://github.com/matrix-org/matrix-spec-proposals/pull/2697) (Dehydrated devices) has been removed, as the MSC is closed. Developers should migrate to [MSC3814](https://github.com/matrix-org/matrix-spec-proposals/pull/3814). ([\#19346](https://github.com/element-hq/synapse/issues/19346))
+- Support for Ubuntu 25.04 (Plucky Puffin) has been dropped. Synapse no longer builds debian packages for Ubuntu 25.04.
+
+
+
+# Synapse 1.146.0rc1 (2026-01-20)
+
+## Features
+
+- Add a new config option [`enable_local_media_storage`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_local_media_storage) which controls whether media is additionally stored locally when using configured `media_storage_providers`. Setting this to `false` allows off-site media storage without a local cache. Contributed by Patrice Brend'amour @dr.allgood. ([\#19204](https://github.com/element-hq/synapse/issues/19204))
+- Stabilise support for [MSC4312](https://github.com/matrix-org/matrix-spec-proposals/pull/4312)'s `m.oauth` User-Interactive Auth stage for resetting cross-signing identity with the OAuth 2.0 API. The old, unstable name (`org.matrix.cross_signing_reset`) is now deprecated and will be removed in a future release. ([\#19273](https://github.com/element-hq/synapse/issues/19273))
+- Refactor Grafana dashboard to use `server_name` label (instead of `instance`). ([\#19337](https://github.com/element-hq/synapse/issues/19337))
+
+## Bugfixes
+
+- Fix joining a restricted v12 room locally when no local room creator is present but local users with sufficient power levels are. Contributed by @nexy7574. ([\#19321](https://github.com/element-hq/synapse/issues/19321))
+- Fixed parallel calls to `/_matrix/media/v1/create` being ratelimited for appservices even if `rate_limited: false` was set in the registration. Contributed by @tulir @ Beeper. ([\#19335](https://github.com/element-hq/synapse/issues/19335))
+- Fix a bug introduced in 1.61.0 where a user's membership in a room was accidentally ignored when considering access to historical state events in rooms with the "shared" history visibility. Contributed by Lukas Tautz. ([\#19353](https://github.com/element-hq/synapse/issues/19353))
+- [MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140): Store the JSON content of scheduled delayed events as text instead of a byte array. This fixes the inability to schedule a delayed event with non-ASCII characters in its content. ([\#19360](https://github.com/element-hq/synapse/issues/19360))
+- Always rollback database transactions when retrying (avoid orphaned connections). ([\#19372](https://github.com/element-hq/synapse/issues/19372))
+- Fix `InFlightGauge` typing to allow upgrading to `prometheus_client` 0.24. ([\#19379](https://github.com/element-hq/synapse/issues/19379))
+
+## Updates to the Docker image
+
+- Add [Prometheus HTTP service discovery](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config) endpoint for easy discovery of all workers when using the `docker/Dockerfile-workers` image (see the [*Metrics* section of our Docker testing docs](docker/README-testing.md#metrics)). ([\#19336](https://github.com/element-hq/synapse/issues/19336))
+
+## Improved Documentation
+
+- Remove docs on legacy metric names (no longer in the codebase since 2022-12-06). ([\#19341](https://github.com/element-hq/synapse/issues/19341))
+- Clarify how the estimated value of room complexity is calculated internally. ([\#19384](https://github.com/element-hq/synapse/issues/19384))
+
+## Internal Changes
+
+- Add an internal `cancel_task` API to the task scheduler. ([\#19310](https://github.com/element-hq/synapse/issues/19310))
+- Tweak docstrings and signatures of `auth_types_for_event` and `get_catchup_room_event_ids`. ([\#19320](https://github.com/element-hq/synapse/issues/19320))
+- Replace usage of deprecated `assertEquals` with `assertEqual` in unit test code. ([\#19345](https://github.com/element-hq/synapse/issues/19345))
+- Drop support for Ubuntu 25.04 'Plucky Puffin', add support for Ubuntu 25.10 'Questing Quokka'. ([\#19348](https://github.com/element-hq/synapse/issues/19348))
+- Revert "Add an Admin API endpoint for listing quarantined media (#19268)". ([\#19351](https://github.com/element-hq/synapse/issues/19351))
+- Bump `mdbook` from 0.4.17 to 0.5.2 and remove our custom table-of-contents plugin in favour of the new default functionality. ([\#19356](https://github.com/element-hq/synapse/issues/19356))
+- Replace deprecated usage of PyGitHub's `GitRelease.title` with `.name` in release script. ([\#19358](https://github.com/element-hq/synapse/issues/19358))
+- Update the Element logo in Synapse's README to be an absolute URL, allowing it to render on other sites (such as PyPI). ([\#19368](https://github.com/element-hq/synapse/issues/19368))
+- Apply minor tweaks to v1.145.0 changelog. ([\#19376](https://github.com/element-hq/synapse/issues/19376))
+- Update Grafana dashboard syntax to use the latest from importing/exporting with Grafana 12.3.1. ([\#19381](https://github.com/element-hq/synapse/issues/19381))
+- Warn about skipping reactor metrics when using unknown reactor type. ([\#19383](https://github.com/element-hq/synapse/issues/19383))
+- Add support for reactor metrics with the `ProxiedReactor` used in worker Complement tests. ([\#19385](https://github.com/element-hq/synapse/issues/19385))
+
+
+
+
+# Synapse 1.145.0 (2026-01-13)
+
+No significant changes since 1.145.0rc4.
+
+## End of Life of Ubuntu 25.04 Plucky Puffin
+
+Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17, 2026. Synapse will stop building packages for Ubuntu 25.04 shortly thereafter.
+
+## Updates to Locked Dependencies No Longer Included in Changelog
+
+The "Updates to locked dependencies" section has been removed from the changelog due to lack of use and the maintenance burden. ([\#19254](https://github.com/element-hq/synapse/issues/19254))
+
+
+
+
+# Synapse 1.145.0rc4 (2026-01-08)
+
+No significant changes since 1.145.0rc3.
+
+This RC contains a fix specifically for openSUSE packaging and no other changes. 
+
+
+
+# Synapse 1.145.0rc3 (2026-01-07)
+
+No significant changes since 1.145.0rc2.
+
+This RC strips out unnecessary files from the wheels that were added when fixing the source distribution packaging in the previous RC.
+
+
+
+# Synapse 1.145.0rc2 (2026-01-07)
+
+No significant changes since 1.145.0rc1.
+
+This RC fixes the source distribution packaging for uploading to PyPI.
+
+
+
+# Synapse 1.145.0rc1 (2026-01-06)
+
+## Features
+
+- Add `memberships` endpoint to the admin API. This is useful for forensics and T&S purposes. ([\#19260](https://github.com/element-hq/synapse/issues/19260))
+- Server admins can bypass the quarantine media check when downloading media by setting the `admin_unsafely_bypass_quarantine` query parameter to `true` on Client-Server API media download requests. ([\#19275](https://github.com/element-hq/synapse/issues/19275))
+- Implemented pagination for the [MSC2666](https://github.com/matrix-org/matrix-spec-proposals/pull/2666) mutual rooms endpoint. Contributed by @tulir @ Beeper. ([\#19279](https://github.com/element-hq/synapse/issues/19279))
+- Admin API: add worker support to `GET /_synapse/admin/v2/users/<user_id>`. ([\#19281](https://github.com/element-hq/synapse/issues/19281))
+- Improve proxy support for the `federation_client.py` dev script. Contributed by Denis Kasak (@dkasak). ([\#19300](https://github.com/element-hq/synapse/issues/19300))
+
+## Bugfixes
+
+- Fix sliding sync performance slow down for long lived connections. ([\#19206](https://github.com/element-hq/synapse/issues/19206))
+- Fix a bug where Mastodon posts (and possibly other embeds) have the wrong description for URL previews. ([\#19231](https://github.com/element-hq/synapse/issues/19231))
+- Fix bug where `Duration` was logged incorrectly. ([\#19267](https://github.com/element-hq/synapse/issues/19267))
+- Fix bug introduced in 1.143.0 that broke support for versions of `zope-interface` older than 6.2. ([\#19274](https://github.com/element-hq/synapse/issues/19274))
+- Transform events with client metadata before serialising in /event response. ([\#19340](https://github.com/element-hq/synapse/issues/19340))
+
+## Updates to the Docker image
+
+- Add a way to expose metrics from the Docker image (`SYNAPSE_ENABLE_METRICS`). ([\#19324](https://github.com/element-hq/synapse/issues/19324))
+
+## Improved Documentation
+
+- Document the importance of `public_baseurl` when configuring OpenID Connect authentication. ([\#19270](https://github.com/element-hq/synapse/issues/19270))
+
+## Deprecations and Removals
+
+- Ubuntu 25.04 (Plucky Puffin) will be end of life on Jan 17, 2026. Synapse will stop building packages for Ubuntu 25.04 shortly thereafter.
+- Remove the "Updates to locked dependencies" section from the changelog due to lack of use and the maintenance burden. ([\#19254](https://github.com/element-hq/synapse/issues/19254))
+
+## Internal Changes
+
+- Group together dependabot update PRs to reduce the review load. ([\#18402](https://github.com/element-hq/synapse/issues/18402))
+- Fix `HomeServer.shutdown()` failing if the homeserver hasn't been setup yet. ([\#19187](https://github.com/element-hq/synapse/issues/19187))
+- Respond with useful error codes with `Content-Length` header/s are invalid. ([\#19212](https://github.com/element-hq/synapse/issues/19212))
+- Fix `HomeServer.shutdown()` failing if the homeserver failed to `start`. ([\#19232](https://github.com/element-hq/synapse/issues/19232))
+- Switch the build backend from `poetry-core` to `maturin`. ([\#19234](https://github.com/element-hq/synapse/issues/19234))
+- Raise the limit for concurrently-open non-security @dependabot PRs from 5 to 10. ([\#19253](https://github.com/element-hq/synapse/issues/19253))
+- Require 14 days to pass before pulling in general dependency updates to help mitigate upstream supply chain attacks. ([\#19258](https://github.com/element-hq/synapse/issues/19258))
+- Drop the broken netlify documentation workflow until a new one is implemented. ([\#19262](https://github.com/element-hq/synapse/issues/19262))
+- Don't include debug logs in `Clock` unless explicitly enabled. ([\#19278](https://github.com/element-hq/synapse/issues/19278))
+- Use `uv` to test olddeps to ensure all transitive dependencies use minimum versions. ([\#19289](https://github.com/element-hq/synapse/issues/19289))
+- Add a config to be able to rate limit search in the user directory. ([\#19291](https://github.com/element-hq/synapse/issues/19291))
+- Log the original bind exception when encountering `Failed to listen on 0.0.0.0, continuing because listening on [::]`. ([\#19297](https://github.com/element-hq/synapse/issues/19297))
+- Unpin the version of Rust we use to build Synapse wheels (was 1.82.0) now that MacOS support has been dropped. ([\#19302](https://github.com/element-hq/synapse/issues/19302))
+- Make it more clear how `shared_extra_conf` is combined in our Docker configuration scripts. ([\#19323](https://github.com/element-hq/synapse/issues/19323))
+- Update CI to stream Complement progress and format logs in a separate step after all tests are done. ([\#19326](https://github.com/element-hq/synapse/issues/19326))
+- Format `.github/workflows/tests.yml`. ([\#19327](https://github.com/element-hq/synapse/issues/19327))
+
+
+
+
+# Synapse 1.144.0 (2025-12-09)
+
+## Deprecation of MacOS Python wheels
+
+The team has decided to deprecate and stop publishing python wheels for MacOS.
+Synapse docker images will continue to work on MacOS, as will building Synapse
+from source (though note this requires a Rust compiler).
+
+## Unstable mutual rooms endpoint is now behind an experimental feature flag
+
+Admins using the unstable [MSC2666](https://github.com/matrix-org/matrix-spec-proposals/pull/2666) endpoint (`/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms`),
+please check [the relevant section in the upgrade notes](https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11440) as this release contains changes
+that disable that endpoint by default.
+
+
+
+No significant changes since 1.144.0rc1.
+
+
+
+
+# Synapse 1.144.0rc1 (2025-12-02)
+
+Admins using the unstable [MSC2666](https://github.com/matrix-org/matrix-spec-proposals/pull/2666) endpoint (`/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms`), please check [the relevant section in the upgrade notes](https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11440) as this release contains changes that disable that endpoint by default.
+
+## Features
+
+- Add experimentatal implememntation of [MSC4380](https://github.com/matrix-org/matrix-spec-proposals/pull/4380) (invite blocking). ([\#19203](https://github.com/element-hq/synapse/issues/19203))
+- Allow restarting delayed event timeouts on workers. ([\#19207](https://github.com/element-hq/synapse/issues/19207))
+
+## Bugfixes
+
+- Fix a bug in the database function for fetching state deltas that could result in unnecessarily long query times. ([\#18960](https://github.com/element-hq/synapse/issues/18960))
+- Fix v12 rooms when running with `use_frozen_dicts: True`. ([\#19235](https://github.com/element-hq/synapse/issues/19235))
+- Fix bug where invalid `canonical_alias` content would return 500 instead of 400. ([\#19240](https://github.com/element-hq/synapse/issues/19240))
+- Fix bug where `Duration` was logged incorrectly. ([\#19267](https://github.com/element-hq/synapse/issues/19267))
+
+## Improved Documentation
+
+- Document in the `--config-path` help how multiple files are merged - by merging them shallowly. ([\#19243](https://github.com/element-hq/synapse/issues/19243))
+
+## Deprecations and Removals
+
+- Stop building release wheels for MacOS. ([\#19225](https://github.com/element-hq/synapse/issues/19225))
+
+## Internal Changes
+
+- Improve event filtering for Simplified Sliding Sync. ([\#17782](https://github.com/element-hq/synapse/issues/17782))
+- Export `SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES` environment variable from `scripts-dev/complement.sh`. ([\#19208](https://github.com/element-hq/synapse/issues/19208))
+- Refactor `scripts-dev/complement.sh` logic to avoid `exit` to facilitate being able to source it from other scripts (composable). ([\#19209](https://github.com/element-hq/synapse/issues/19209))
+- Expire sliding sync connections that are too old or have too much pending data. ([\#19211](https://github.com/element-hq/synapse/issues/19211))
+- Require an experimental feature flag to be enabled in order for the unstable [MSC2666](https://github.com/matrix-org/matrix-spec-proposals/pull/2666) endpoint (`/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms`) to be available. ([\#19219](https://github.com/element-hq/synapse/issues/19219))
+- Prevent changelog check CI running on @dependabot's PRs even when a human has modified the branch. ([\#19220](https://github.com/element-hq/synapse/issues/19220))
+- Auto-fix trailing spaces in multi-line strings and comments when running the lint script. ([\#19221](https://github.com/element-hq/synapse/issues/19221))
+- Move towards using a dedicated `Duration` type. ([\#19223](https://github.com/element-hq/synapse/issues/19223), [\#19229](https://github.com/element-hq/synapse/issues/19229))
+- Improve robustness of the SQL schema linting in CI. ([\#19224](https://github.com/element-hq/synapse/issues/19224))
+- Add log to determine whether clients are using `/messages` as expected. ([\#19226](https://github.com/element-hq/synapse/issues/19226))
+- Simplify README and add ESS Getting started section. ([\#19228](https://github.com/element-hq/synapse/issues/19228), [\#19259](https://github.com/element-hq/synapse/issues/19259))
+- Add a unit test for ensuring associated refresh tokens are erased when a device is deleted. ([\#19230](https://github.com/element-hq/synapse/issues/19230))
+- Prompt user to consider adding future deprecations to the changelog in release script. ([\#19239](https://github.com/element-hq/synapse/issues/19239))
+- Fix check of the Rust compiled code being outdated when using source checkout and `.egg-info`. ([\#19251](https://github.com/element-hq/synapse/issues/19251))
+- Stop building macos wheels in CI pipeline. ([\#19263](https://github.com/element-hq/synapse/issues/19263))
+
+
+
+### Updates to locked dependencies
+
+* Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. ([\#19244](https://github.com/element-hq/synapse/issues/19244))
+* Bump actions/checkout from 5.0.0 to 6.0.0. ([\#19213](https://github.com/element-hq/synapse/issues/19213))
+* Bump actions/setup-go from 6.0.0 to 6.1.0. ([\#19214](https://github.com/element-hq/synapse/issues/19214))
+* Bump actions/setup-python from 6.0.0 to 6.1.0. ([\#19245](https://github.com/element-hq/synapse/issues/19245))
+* Bump attrs from 25.3.0 to 25.4.0. ([\#19215](https://github.com/element-hq/synapse/issues/19215))
+* Bump docker/metadata-action from 5.9.0 to 5.10.0. ([\#19246](https://github.com/element-hq/synapse/issues/19246))
+* Bump http from 1.3.1 to 1.4.0. ([\#19249](https://github.com/element-hq/synapse/issues/19249))
+* Bump pydantic from 2.12.4 to 2.12.5. ([\#19250](https://github.com/element-hq/synapse/issues/19250))
+* Bump pyopenssl from 25.1.0 to 25.3.0. ([\#19248](https://github.com/element-hq/synapse/issues/19248))
+* Bump rpds-py from 0.28.0 to 0.29.0. ([\#19216](https://github.com/element-hq/synapse/issues/19216))
+* Bump rpds-py from 0.29.0 to 0.30.0. ([\#19247](https://github.com/element-hq/synapse/issues/19247))
+* Bump sentry-sdk from 2.44.0 to 2.46.0. ([\#19218](https://github.com/element-hq/synapse/issues/19218))
+* Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115. ([\#19217](https://github.com/element-hq/synapse/issues/19217))
+* Bump types-jsonschema from 4.25.1.20250822 to 4.25.1.20251009. ([\#19252](https://github.com/element-hq/synapse/issues/19252))
+
+# Synapse 1.143.0 (2025-11-25)
+
+## Dropping support for PostgreSQL 13
+
+In line with our [deprecation policy](https://github.com/element-hq/synapse/blob/develop/docs/deprecation_policy.md), we've dropped
+support for PostgreSQL 13, as it is no longer supported upstream.
+This release of Synapse requires PostgreSQL 14+.
+
+No significant changes since 1.143.0rc2.
+
+
+
+
+# Synapse 1.143.0rc2 (2025-11-18)
+
+## Dropping support for PostgreSQL 13
+
+In line with our [deprecation policy](https://github.com/element-hq/synapse/blob/develop/docs/deprecation_policy.md), we've dropped
+support for PostgreSQL 13, as it is no longer supported upstream.
+This release of Synapse requires PostgreSQL 14+.
+
+
+## Internal Changes
+
+- Fixes docker image creation in the release workflow.
+
+
+
+# Synapse 1.143.0rc1 (2025-11-18)
+
+## Features
+
+- Support multiple config files in `register_new_matrix_user`. ([\#18784](https://github.com/element-hq/synapse/issues/18784))
+- Remove authentication from `POST /_matrix/client/v1/delayed_events`, and allow calling this endpoint with the update action to take (`send`/`cancel`/`restart`) in the request path instead of the body. ([\#19152](https://github.com/element-hq/synapse/issues/19152))
+
+## Bugfixes
+
+- Fixed a longstanding bug where background updates were only run on the `main` database. ([\#19181](https://github.com/element-hq/synapse/issues/19181))
+- Fixed a bug introduced in v1.142.0 preventing subpaths in MAS endpoints from working. ([\#19186](https://github.com/element-hq/synapse/issues/19186))
+- Fix the SQLite-to-PostgreSQL migration script to correctly migrate a boolean column in the `delayed_events` table. ([\#19155](https://github.com/element-hq/synapse/issues/19155))
+
+## Improved Documentation
+
+- Improve documentation around streams, particularly ID generators and adding new streams. ([\#18943](https://github.com/element-hq/synapse/issues/18943))
+
+## Deprecations and Removals
+
+- Remove support for PostgreSQL 13. ([\#19170](https://github.com/element-hq/synapse/issues/19170))
+
+## Internal Changes
+
+- Provide additional servers with federation room directory results. ([\#18970](https://github.com/element-hq/synapse/issues/18970))
+- Add a shortcut return when there are no events to purge. ([\#19093](https://github.com/element-hq/synapse/issues/19093))
+- Write union types as `X | Y` where possible, as per PEP 604, added in Python 3.10. ([\#19111](https://github.com/element-hq/synapse/issues/19111))
+- Reduce cardinality of `synapse_storage_events_persisted_events_sep_total` metric by removing `origin_entity` label. This also separates out events sent by local application services by changing the `origin_type` for such events to `application_service`. The `type` field also only tracks common event types, and anything else is bucketed under `*other*`. ([\#19133](https://github.com/element-hq/synapse/issues/19133), [\#19168](https://github.com/element-hq/synapse/issues/19168))
+- Run trial tests on Python 3.14 for PRs. ([\#19135](https://github.com/element-hq/synapse/issues/19135))
+- Update `pyproject.toml` project metadata to be compatible with standard Python packaging tooling. ([\#19137](https://github.com/element-hq/synapse/issues/19137))
+- Minor speed up of processing of inbound replication. ([\#19138](https://github.com/element-hq/synapse/issues/19138), [\#19145](https://github.com/element-hq/synapse/issues/19145), [\#19146](https://github.com/element-hq/synapse/issues/19146))
+- Ignore recent Python language refactors from git blame (`.git-blame-ignore-revs`). ([\#19150](https://github.com/element-hq/synapse/issues/19150))
+- Bump lower bounds of dependencies `parameterized` to `0.9.0` and `idna` to `3.3` as those are the first to advertise support for Python 3.10. ([\#19167](https://github.com/element-hq/synapse/issues/19167))
+- Point out which event caused the exception when checking [MSC4293](https://github.com/matrix-org/matrix-spec-proposals/pull/4293) redactions. ([\#19169](https://github.com/element-hq/synapse/issues/19169))
+- Restore printing `sentinel` for the log record `request` when no logcontext is active. ([\#19172](https://github.com/element-hq/synapse/issues/19172))
+- Add debug logs to track `Clock` utilities. ([\#19173](https://github.com/element-hq/synapse/issues/19173))
+- Remove explicit python version skips in `cibuildwheel` config as it's no longer required after [#19137](https://github.com/element-hq/synapse/pull/19137). ([\#19177](https://github.com/element-hq/synapse/issues/19177))
+- Fix potential lost logcontext when `PerDestinationQueue.shutdown(...)` is called. ([\#19178](https://github.com/element-hq/synapse/issues/19178))
+- Fix bad deferred logcontext handling across the codebase. ([\#19180](https://github.com/element-hq/synapse/issues/19180))
+
+
+
+### Updates to locked dependencies
+
+* Bump bytes from 1.10.1 to 1.11.0. ([\#19193](https://github.com/element-hq/synapse/issues/19193))
+* Bump click from 8.1.8 to 8.3.1. ([\#19195](https://github.com/element-hq/synapse/issues/19195))
+* Bump cryptography from 43.0.3 to 45.0.7. ([\#19159](https://github.com/element-hq/synapse/issues/19159))
+* Bump docker/metadata-action from 5.8.0 to 5.9.0. ([\#19161](https://github.com/element-hq/synapse/issues/19161))
+* Bump pydantic from 2.12.3 to 2.12.4. ([\#19158](https://github.com/element-hq/synapse/issues/19158))
+* Bump pyo3-log from 0.13.1 to 0.13.2. ([\#19156](https://github.com/element-hq/synapse/issues/19156))
+* Bump ruff from 0.14.3 to 0.14.5. ([\#19196](https://github.com/element-hq/synapse/issues/19196))
+* Bump sentry-sdk from 2.34.1 to 2.43.0. ([\#19157](https://github.com/element-hq/synapse/issues/19157))
+* Bump sentry-sdk from 2.43.0 to 2.44.0. ([\#19197](https://github.com/element-hq/synapse/issues/19197))
+* Bump tomli from 2.2.1 to 2.3.0. ([\#19194](https://github.com/element-hq/synapse/issues/19194))
+* Bump types-netaddr from 1.3.0.20240530 to 1.3.0.20251108. ([\#19160](https://github.com/element-hq/synapse/issues/19160))
+
+
+
+# Synapse 1.142.1 (2025-11-18)
+
+## Bugfixes
+
+- Fixed a bug introduced in v1.142.0 preventing subpaths in MAS endpoints from working. ([\#19186](https://github.com/element-hq/synapse/issues/19186))
+
+
+
+
+# Synapse 1.142.0 (2025-11-11)
+
+## Dropped support for Python 3.9
+
+This release drops support for Python 3.9, in line with our [dependency
+deprecation
+policy](https://element-hq.github.io/synapse/latest/deprecation_policy.html#platform-dependencies),
+as it is now [end of life](https://endoflife.date/python).
+
+## SQLite 3.40.0+ is now required
+
+The minimum supported SQLite version has been increased from 3.27.0 to 3.40.0.
+
+If you use current versions of the
+[matrixorg/synapse](setup/installation.html#docker-images-and-ansible-playbooks)
+Docker images, no action is required.
+
+
+## Deprecation of MacOS Python wheels
+
+The team has decided to deprecate and eventually stop publishing python wheels
+for MacOS. This is a burden on the team, and we're not aware of any parties
+that use them. Synapse docker images will continue to work on MacOS, as will
+building Synapse from source (though note this requires a Rust compiler).
+
+At present, publishing MacOS Python wheels will continue for the next release
+(1.143.0), but will not be available after that (1.144.0+). If you do make use
+of these wheels downstream, please reach out to us in
+[#synapse-dev:matrix.org](https://matrix.to/#/#synapse-dev:matrix.org). We'd
+love to hear from you!
+
+## Internal Changes
+
+- Properly stop building wheels for Python 3.9 and free-threaded CPython. ([\#19154](https://github.com/element-hq/synapse/issues/19154))
+
+
+
+
+# Synapse 1.142.0rc4 (2025-11-07)
+
+## Bugfixes
+
+- Fix a bug introduced in 1.142.0rc1 where any attempt to configure `matrix_authentication_service.secret_path` would prevent the homeserver from starting up. ([\#19144](https://github.com/element-hq/synapse/issues/19144))
+
+
+
+
+# Synapse 1.142.0rc3 (2025-11-04)
+
+## Internal Changes
+
+- Update release scripts to prevent building wheels for free-threaded Python, as Synapse does not currently support it. ([\#19140](https://github.com/element-hq/synapse/issues/19140))
+
+
+# Synapse 1.142.0rc2 (2025-11-04)
+
+
+## Internal Changes
+
+- Manually skip building Python 3.9 wheels, to prevent errors in the release workflow. ([\#19119](https://github.com/element-hq/synapse/issues/19119))
+
+
+
+
+# Synapse 1.142.0rc1 (2025-11-04)
+
+## Features
+
+- Add support for Python 3.14. ([\#19055](https://github.com/element-hq/synapse/issues/19055), [\#19134](https://github.com/element-hq/synapse/issues/19134))
+- Add an [Admin API](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html)
+  to allow an admin to fetch the space/room hierarchy for a given space. ([\#19021](https://github.com/element-hq/synapse/issues/19021))
+
+## Bugfixes
+
+- Fix a bug introduced in 1.111.0 where failed attempts to download authenticated remote media would not be handled correctly. ([\#19062](https://github.com/element-hq/synapse/issues/19062))
+- Update the `oidc_session_no_samesite` cookie to have the `Secure` attribute, so the only difference between it and the paired `oidc_session` cookie, is the configuration of the `SameSite` attribute as described in the comments / cookie names. Contributed by @kieranlane. ([\#19079](https://github.com/element-hq/synapse/issues/19079))
+- Fix a bug introduced in 1.140.0 where lost logcontext warnings would be emitted from timeouts in sync and requests made by Synapse itself. ([\#19090](https://github.com/element-hq/synapse/issues/19090))
+- Fix a bug introdued in 1.140.0 where lost logcontext warning were emitted when using `HomeServer.shutdown()`. ([\#19108](https://github.com/element-hq/synapse/issues/19108))
+
+## Improved Documentation
+
+- Update the link to the Debian oldstable package for SQLite. ([\#19047](https://github.com/element-hq/synapse/issues/19047))
+- Point out additional Redis configuration options available in the worker docs. Contributed by @servisbryce. ([\#19073](https://github.com/element-hq/synapse/issues/19073))
+- Update the list of Debian releases that the downstream Debian package is maintained for. ([\#19100](https://github.com/element-hq/synapse/issues/19100))
+- Add [a page](https://element-hq.github.io/synapse/latest/development/internal_documentation/release_notes_review_checklist.html) to the documentation describing the steps the Synapse team takes to review the release notes before publishing them. ([\#19109](https://github.com/element-hq/synapse/issues/19109))
+
+## Deprecations and Removals
+
+- Drop support for Python 3.9. ([\#19099](https://github.com/element-hq/synapse/issues/19099))
+- Remove support for SQLite < 3.37.2. ([\#19047](https://github.com/element-hq/synapse/issues/19047))
+
+## Internal Changes
+
+- Fix CI linter for schema delta files to correctly handle all types of `CREATE TABLE` syntax. ([\#19020](https://github.com/element-hq/synapse/issues/19020))
+- Use type hinting generics in standard collections, as per [PEP 585](https://peps.python.org/pep-0585/), added in Python 3.9. ([\#19046](https://github.com/element-hq/synapse/issues/19046))
+- Always treat `RETURNING` as supported by SQL engines, now that the minimum-supported versions of both SQLite and PostgreSQL support it. ([\#19047](https://github.com/element-hq/synapse/issues/19047))
+- Move `oidc.load_metadata()` startup into `_base.start()`. ([\#19056](https://github.com/element-hq/synapse/issues/19056))
+- Remove logcontext problems caused by awaiting raw `deferLater(...)`. ([\#19058](https://github.com/element-hq/synapse/issues/19058))
+- Prevent duplicate logging setup when running multiple Synapse instances. ([\#19067](https://github.com/element-hq/synapse/issues/19067))
+- Be mindful of other logging context filters in 3rd-party code and avoid overwriting log record fields unless we know the log record is relevant to Synapse. ([\#19068](https://github.com/element-hq/synapse/issues/19068))
+- Update pydantic to v2. ([\#19071](https://github.com/element-hq/synapse/issues/19071))
+- Update deprecated code in the release script to prevent a warning message from being printed. ([\#19080](https://github.com/element-hq/synapse/issues/19080))
+- Update the deprecated poetry development dependencies group name in `pyproject.toml`. ([\#19081](https://github.com/element-hq/synapse/issues/19081))
+- Remove `pp38*` skip selector from cibuildwheel to silence warning. ([\#19085](https://github.com/element-hq/synapse/issues/19085))
+- Don't immediately exit the release script if the checkout is dirty. Instead, allow the user to clear the dirty changes and retry. ([\#19088](https://github.com/element-hq/synapse/issues/19088))
+- Update the release script's generated announcement text to include a title and extra text for RC's. ([\#19089](https://github.com/element-hq/synapse/issues/19089))
+- Fix lints on main branch. ([\#19092](https://github.com/element-hq/synapse/issues/19092))
+- Use cheaper random string function in logcontext utilities. ([\#19094](https://github.com/element-hq/synapse/issues/19094))
+- Avoid clobbering other `SIGHUP` handlers in 3rd-party code. ([\#19095](https://github.com/element-hq/synapse/issues/19095))
+- Prevent duplicate GitHub draft releases being created during the Synapse release process. ([\#19096](https://github.com/element-hq/synapse/issues/19096))
+- Use Pillow's `Image.getexif` method instead of the experimental `Image._getexif`. ([\#19098](https://github.com/element-hq/synapse/issues/19098))
+- Prevent uv `/usr/local/.lock` file from appearing in built Synapse docker images. ([\#19107](https://github.com/element-hq/synapse/issues/19107))
+- Allow Synapse's runtime dependency checking code to take packaging markers (i.e. `python <= 3.14`) into account when checking dependencies. ([\#19110](https://github.com/element-hq/synapse/issues/19110))
+- Move exception handling up the stack (avoid `exit(1)` in our composable functions). ([\#19116](https://github.com/element-hq/synapse/issues/19116))
+- Fix a lint error related to lifetimes in Rust 1.90. ([\#19118](https://github.com/element-hq/synapse/issues/19118))
+- Refactor and align app entrypoints (avoid `exit(1)` in our composable functions). ([\#19121](https://github.com/element-hq/synapse/issues/19121), [\#19131](https://github.com/element-hq/synapse/issues/19131))
+- Speed up pruning of ratelimiters. ([\#19129](https://github.com/element-hq/synapse/issues/19129))
+
+
+
+### Updates to locked dependencies
+
+* Bump actions/download-artifact from 5.0.0 to 6.0.0. ([\#19102](https://github.com/element-hq/synapse/issues/19102))
+* Bump actions/upload-artifact from 4 to 5. ([\#19106](https://github.com/element-hq/synapse/issues/19106))
+* Bump hiredis from 3.2.1 to 3.3.0. ([\#19103](https://github.com/element-hq/synapse/issues/19103))
+* Bump icu_segmenter from 2.0.0 to 2.0.1. ([\#19126](https://github.com/element-hq/synapse/issues/19126))
+* Bump idna from 3.10 to 3.11. ([\#19053](https://github.com/element-hq/synapse/issues/19053))
+* Bump ijson from 3.4.0 to 3.4.0.post0. ([\#19051](https://github.com/element-hq/synapse/issues/19051))
+* Bump markdown-it-py from 3.0.0 to 4.0.0. ([\#19123](https://github.com/element-hq/synapse/issues/19123))
+* Bump msgpack from 1.1.1 to 1.1.2. ([\#19050](https://github.com/element-hq/synapse/issues/19050))
+* Bump psycopg2 from 2.9.10 to 2.9.11. ([\#19125](https://github.com/element-hq/synapse/issues/19125))
+* Bump pyyaml from 6.0.2 to 6.0.3. ([\#19105](https://github.com/element-hq/synapse/issues/19105))
+* Bump regex from 1.11.3 to 1.12.2. ([\#19074](https://github.com/element-hq/synapse/issues/19074))
+* Bump reqwest from 0.12.23 to 0.12.24. ([\#19077](https://github.com/element-hq/synapse/issues/19077))
+* Bump ruff from 0.12.10 to 0.14.3. ([\#19124](https://github.com/element-hq/synapse/issues/19124))
+* Bump sigstore/cosign-installer from 3.10.0 to 4.0.0. ([\#19075](https://github.com/element-hq/synapse/issues/19075))
+* Bump stefanzweifel/git-auto-commit-action from 6.0.1 to 7.0.0. ([\#19052](https://github.com/element-hq/synapse/issues/19052))
+* Bump tokio from 1.47.1 to 1.48.0. ([\#19076](https://github.com/element-hq/synapse/issues/19076))
+* Bump types-psycopg2 from 2.9.21.20250915 to 2.9.21.20251012. ([\#19054](https://github.com/element-hq/synapse/issues/19054))
+
+# Synapse 1.141.0 (2025-10-29)
+
+## Deprecation of MacOS Python wheels
+
+The team has decided to deprecate and eventually stop publishing python wheels
+for MacOS. This is a burden on the team, and we're not aware of any parties
+that use them. Synapse docker images will continue to work on MacOS, as will
+building Synapse from source (though note this requires a Rust compiler).
+
+Publishing MacOS Python wheels will continue for the next few releases. If you
+do make use of these wheels downstream, please reach out to us in
+[#synapse-dev:matrix.org](https://matrix.to/#/#synapse-dev:matrix.org). We'd
+love to hear from you!
+
+
+## Docker images now based on Debian `trixie` with Python 3.13
+
+The Docker images are now based on Debian `trixie` and use Python 3.13. If you
+are using the Docker images as a base image you may need to e.g. adjust the
+paths you mount any additional Python packages at.
+
+No significant changes since 1.141.0rc2.
+
+
+
+
+# Synapse 1.141.0rc2 (2025-10-28)
+
+## Bugfixes
+
+- Fix users being unable to log in if their password, or the server's configured pepper, was too long. ([\#19101](https://github.com/element-hq/synapse/issues/19101))
+
+
+
+
+# Synapse 1.141.0rc1 (2025-10-21)
+
+## Features
+
+- Allow using [MSC4190](https://github.com/matrix-org/matrix-spec-proposals/pull/4190) behavior without the opt-in registration flag. Contributed by @tulir @ Beeper. ([\#19031](https://github.com/element-hq/synapse/issues/19031))
+- Stabilized support for [MSC4326](https://github.com/matrix-org/matrix-spec-proposals/pull/4326): Device masquerading for appservices. Contributed by @tulir @ Beeper. ([\#19033](https://github.com/element-hq/synapse/issues/19033))
+
+## Bugfixes
+
+- Fix a bug introduced in 1.136.0 that would prevent Synapse from being able to be `reload`-ed more than once when running under systemd. ([\#19060](https://github.com/element-hq/synapse/issues/19060))
+- Fix a bug introduced in 1.140.0 where an internal server error could be raised when hashing user passwords that are too long. ([\#19078](https://github.com/element-hq/synapse/issues/19078))
+
+## Updates to the Docker image
+
+- Update docker image to use Debian trixie as the base and thus Python 3.13. ([\#19064](https://github.com/element-hq/synapse/issues/19064))
+
+## Internal Changes
+
+- Move unique snowflake homeserver background tasks to `start_background_tasks` (the standard pattern for this kind of thing). ([\#19037](https://github.com/element-hq/synapse/issues/19037))
+- Drop a deprecated field of the `PyGitHub` dependency in the release script and raise the dependency's minimum version to `1.59.0`. ([\#19039](https://github.com/element-hq/synapse/issues/19039))
+- Update TODO list of conflicting areas where we encounter metrics being clobbered (`ApplicationService`). ([\#19040](https://github.com/element-hq/synapse/issues/19040))
+
+
+
+
+# Synapse 1.140.0 (2025-10-14)
+
+## Compatibility notice for users of `synapse-s3-storage-provider`
+
+Deployments that make use of the
+[synapse-s3-storage-provider](https://github.com/matrix-org/synapse-s3-storage-provider)
+module must upgrade to
+[v1.6.0](https://github.com/matrix-org/synapse-s3-storage-provider/releases/tag/v1.6.0).
+Using older versions of the module with this release of Synapse will prevent
+users from being able to upload or download media.
+
+
+No significant changes since 1.140.0rc1.
+
+
+
+
+# Synapse 1.140.0rc1 (2025-10-10)
+
+## Features
+
+- Add [a new Media Query by ID Admin API](https://element-hq.github.io/synapse/v1.140/admin_api/media_admin_api.html#query-a-piece-of-media-by-id) that allows server admins to query and investigate the metadata of local or cached remote media via
+  the `origin/media_id` identifier found in a [Matrix Content URI](https://spec.matrix.org/v1.14/client-server-api/#matrix-content-mxc-uris). ([\#18911](https://github.com/element-hq/synapse/issues/18911))
+- Add [a new Fetch Event Admin API](https://element-hq.github.io/synapse/v1.140/admin_api/fetch_event.html) to fetch an event by ID. ([\#18963](https://github.com/element-hq/synapse/issues/18963))
+- Update [MSC4284: Policy Servers](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) implementation to support signatures when available. ([\#18934](https://github.com/element-hq/synapse/issues/18934))
+- Add experimental implementation of the `GET /_matrix/client/v1/rtc/transports` endpoint for the latest draft of [MSC4143: MatrixRTC](https://github.com/matrix-org/matrix-spec-proposals/pull/4143). ([\#18967](https://github.com/element-hq/synapse/issues/18967))
+- Expose a `defer_to_threadpool` function in the Synapse Module API that allows modules to run a function on a separate thread in a custom threadpool. ([\#19032](https://github.com/element-hq/synapse/issues/19032))
+
+## Bugfixes
+
+- Fix room upgrade `room_config` argument and documentation for `user_may_create_room` spam-checker callback. ([\#18721](https://github.com/element-hq/synapse/issues/18721))
+- Compute a user's last seen timestamp from their devices' last seen timestamps instead of IPs, because the latter are automatically cleared according to `user_ips_max_age`. ([\#18948](https://github.com/element-hq/synapse/issues/18948))
+- Fix bug where ephemeral events were not filtered by room ID. Contributed by @frastefanini. ([\#19002](https://github.com/element-hq/synapse/issues/19002))
+- Update Synapse main process version string to include git info. ([\#19011](https://github.com/element-hq/synapse/issues/19011))
+
+## Improved Documentation
+
+- Explain how `Deferred` callbacks interact with logcontexts. ([\#18914](https://github.com/element-hq/synapse/issues/18914))
+- Fix documentation for `rc_room_creation` and `rc_reports` to clarify that a `per_user` rate limit is not supported. ([\#18998](https://github.com/element-hq/synapse/issues/18998))
+
+## Deprecations and Removals
+
+- Remove deprecated `LoggingContext.set_current_context`/`LoggingContext.current_context` methods which already have equivalent bare methods in `synapse.logging.context`. ([\#18989](https://github.com/element-hq/synapse/issues/18989))
+- Drop support for unstable field names from the long-accepted [MSC2732](https://github.com/matrix-org/matrix-spec-proposals/pull/2732) (Olm fallback keys) proposal. ([\#18996](https://github.com/element-hq/synapse/issues/18996))
+
+## Internal Changes
+
+- Cleanly shutdown `SynapseHomeServer` object, allowing artifacts of embedded small hosts to be properly garbage collected. ([\#18828](https://github.com/element-hq/synapse/issues/18828))
+- Update OEmbed providers to use 'X' instead of 'Twitter' in URL previews, following a rebrand. Contributed by @HammyHavoc. ([\#18767](https://github.com/element-hq/synapse/issues/18767))
+- Fix `server_name` in logging context for multiple Synapse instances in one process. ([\#18868](https://github.com/element-hq/synapse/issues/18868))
+- Wrap the Rust HTTP client with `make_deferred_yieldable` so it follows Synapse logcontext rules. ([\#18903](https://github.com/element-hq/synapse/issues/18903))
+- Fix the GitHub Actions workflow that moves issues labeled "X-Needs-Info" to the "Needs info" column on the team's internal triage board. ([\#18913](https://github.com/element-hq/synapse/issues/18913))
+- Disconnect background process work from request trace. ([\#18932](https://github.com/element-hq/synapse/issues/18932))
+- Reduce overall number of calls to `_get_e2e_cross_signing_signatures_for_devices` by increasing the batch size of devices the query is called with, reducing DB load. ([\#18939](https://github.com/element-hq/synapse/issues/18939))
+- Update error code used when an appservice tries to masquerade as an unknown device using [MSC4326](https://github.com/matrix-org/matrix-spec-proposals/pull/4326). Contributed by @tulir @ Beeper. ([\#18947](https://github.com/element-hq/synapse/issues/18947))
+- Fix `no active span when trying to log` tracing error on startup (when OpenTracing is enabled). ([\#18959](https://github.com/element-hq/synapse/issues/18959))
+- Fix `run_coroutine_in_background(...)` incorrectly handling logcontext. ([\#18964](https://github.com/element-hq/synapse/issues/18964))
+- Add debug logs wherever we change current logcontext. ([\#18966](https://github.com/element-hq/synapse/issues/18966))
+- Update dockerfile metadata to fix broken link; point to documentation website. ([\#18971](https://github.com/element-hq/synapse/issues/18971))
+- Note that the code is additionally licensed under the [Element Commercial license](https://github.com/element-hq/synapse/blob/develop/LICENSE-COMMERCIAL) in SPDX expression field configs. ([\#18973](https://github.com/element-hq/synapse/issues/18973))
+- Fix logcontext handling in `timeout_deferred` tests. ([\#18974](https://github.com/element-hq/synapse/issues/18974))
+- Remove internal `ReplicationUploadKeysForUserRestServlet` as a follow-up to the work in https://github.com/element-hq/synapse/pull/18581 that moved device changes off the main process. ([\#18988](https://github.com/element-hq/synapse/issues/18988))
+- Switch task scheduler from raw logcontext manipulation to using the dedicated logcontext utils. ([\#18990](https://github.com/element-hq/synapse/issues/18990))
+- Remove `MockClock()` in tests. ([\#18992](https://github.com/element-hq/synapse/issues/18992))
+- Switch back to our own custom `LogContextScopeManager` instead of OpenTracing's `ContextVarsScopeManager` which was causing problems when using the experimental `SYNAPSE_ASYNC_IO_REACTOR` option with tracing enabled. ([\#19007](https://github.com/element-hq/synapse/issues/19007))
+- Remove `version_string` argument from `HomeServer` since it's always the same. ([\#19012](https://github.com/element-hq/synapse/issues/19012))
+- Remove duplicate call to `hs.start_background_tasks()` introduced from a bad merge. ([\#19013](https://github.com/element-hq/synapse/issues/19013))
+- Split homeserver creation (`create_homeserver`) and setup (`setup`). ([\#19015](https://github.com/element-hq/synapse/issues/19015))
+- Swap near-end-of-life `macos-13` GitHub Actions runner for the `macos-15-intel` variant. ([\#19025](https://github.com/element-hq/synapse/issues/19025))
+- Introduce `RootConfig.validate_config()` which can be subclassed in `HomeServerConfig` to do cross-config class validation. ([\#19027](https://github.com/element-hq/synapse/issues/19027))
+- Allow any command of the `release.py` script to accept a `--gh-token` argument. ([\#19035](https://github.com/element-hq/synapse/issues/19035))
+
+
+
+### Updates to locked dependencies
+
+* Bump Swatinem/rust-cache from 2.8.0 to 2.8.1. ([\#18949](https://github.com/element-hq/synapse/issues/18949))
+* Bump actions/cache from 4.2.4 to 4.3.0. ([\#18983](https://github.com/element-hq/synapse/issues/18983))
+* Bump anyhow from 1.0.99 to 1.0.100. ([\#18950](https://github.com/element-hq/synapse/issues/18950))
+* Bump authlib from 1.6.3 to 1.6.4. ([\#18957](https://github.com/element-hq/synapse/issues/18957))
+* Bump authlib from 1.6.4 to 1.6.5. ([\#19019](https://github.com/element-hq/synapse/issues/19019))
+* Bump bcrypt from 4.3.0 to 5.0.0. ([\#18984](https://github.com/element-hq/synapse/issues/18984))
+* Bump docker/login-action from 3.5.0 to 3.6.0. ([\#18978](https://github.com/element-hq/synapse/issues/18978))
+* Bump lxml from 6.0.0 to 6.0.2. ([\#18979](https://github.com/element-hq/synapse/issues/18979))
+* Bump phonenumbers from 9.0.13 to 9.0.14. ([\#18954](https://github.com/element-hq/synapse/issues/18954))
+* Bump phonenumbers from 9.0.14 to 9.0.15. ([\#18991](https://github.com/element-hq/synapse/issues/18991))
+* Bump prometheus-client from 0.22.1 to 0.23.1. ([\#19016](https://github.com/element-hq/synapse/issues/19016))
+* Bump pydantic from 2.11.9 to 2.11.10. ([\#19017](https://github.com/element-hq/synapse/issues/19017))
+* Bump pygithub from 2.7.0 to 2.8.1. ([\#18952](https://github.com/element-hq/synapse/issues/18952))
+* Bump regex from 1.11.2 to 1.11.3. ([\#18981](https://github.com/element-hq/synapse/issues/18981))
+* Bump serde from 1.0.224 to 1.0.226. ([\#18953](https://github.com/element-hq/synapse/issues/18953))
+* Bump serde from 1.0.226 to 1.0.228. ([\#18982](https://github.com/element-hq/synapse/issues/18982))
+* Bump setuptools-rust from 1.11.1 to 1.12.0. ([\#18980](https://github.com/element-hq/synapse/issues/18980))
+* Bump twine from 6.1.0 to 6.2.0. ([\#18985](https://github.com/element-hq/synapse/issues/18985))
+* Bump types-pyyaml from 6.0.12.20250809 to 6.0.12.20250915. ([\#19018](https://github.com/element-hq/synapse/issues/19018))
+* Bump types-requests from 2.32.4.20250809 to 2.32.4.20250913. ([\#18951](https://github.com/element-hq/synapse/issues/18951))
+* Bump typing-extensions from 4.14.1 to 4.15.0. ([\#18956](https://github.com/element-hq/synapse/issues/18956))
+
+# Synapse 1.139.2 (2025-10-07)
+
+## Bugfixes
+
+- Fix a bug introduced in 1.139.1 where a client could receive an Internal Server Error if they set `device_keys: null` in the request to [`POST /_matrix/client/v3/keys/upload`](https://spec.matrix.org/v1.16/client-server-api/#post_matrixclientv3keysupload). ([\#19023](https://github.com/element-hq/synapse/issues/19023))
+
+
+
+
+# Synapse 1.139.1 (2025-10-07)
+
+## Security Fixes
+
+- Fix [CVE-2025-61672](https://www.cve.org/CVERecord?id=CVE-2025-61672) / [GHSA-fh66-fcv5-jjfr](https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr). Lack of validation for device keys in Synapse before 1.139.1 allows an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. ([\#17097](https://github.com/element-hq/synapse/issues/17097))
+
+## Deprecations and Removals
+
+- Drop support for unstable field names from the long-accepted [MSC2732](https://github.com/matrix-org/matrix-spec-proposals/pull/2732) (Olm fallback keys) proposal. This change allows unit tests to pass following the security patch above. ([\#18996](https://github.com/element-hq/synapse/issues/18996))
+
+
+
+# Synapse 1.138.4 (2025-10-07)
+
+## Bugfixes
+
+- Fix a bug introduced in 1.138.3 where a client could receive an Internal Server Error if they set `device_keys: null` in the request to [`POST /_matrix/client/v3/keys/upload`](https://spec.matrix.org/v1.16/client-server-api/#post_matrixclientv3keysupload). ([\#19023](https://github.com/element-hq/synapse/issues/19023))
+
+
+
+
+# Synapse 1.138.3 (2025-10-07)
+
+## Security Fixes
+
+- Fix [CVE-2025-61672](https://www.cve.org/CVERecord?id=CVE-2025-61672) / [GHSA-fh66-fcv5-jjfr](https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr). Lack of validation for device keys in Synapse before 1.139.1 allows an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. ([\#17097](https://github.com/element-hq/synapse/issues/17097))
+
+## Deprecations and Removals
+
+- Drop support for unstable field names from the long-accepted [MSC2732](https://github.com/matrix-org/matrix-spec-proposals/pull/2732) (Olm fallback keys) proposal. This change allows unit tests to pass following the security patch above. ([\#18996](https://github.com/element-hq/synapse/issues/18996))
+
+# Synapse 1.139.0 (2025-09-30)
+
+### `/register` requests from old application service implementations may break when using MAS
+
+If you are using Matrix Authentication Service (MAS), as of this release any
+Application Services that do not set `inhibit_login=true` when calling `POST
+/_matrix/client/v3/register` will receive the error
+`IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED` in response. Please see [the
+upgrade
+notes](https://element-hq.github.io/synapse/develop/upgrade.html#register-requests-from-old-application-service-implementations-may-break-when-using-mas)
+for more information.
+
+No significant changes since 1.139.0rc3.
+
+
+# Synapse 1.139.0rc3 (2025-09-25)
+
+## Bugfixes
+
+- Fix a bug introduced in 1.139.0rc1 where `run_coroutine_in_background(...)` incorrectly handled logcontexts, resulting in partially broken logging. ([\#18964](https://github.com/element-hq/synapse/issues/18964))
+
+
+
+
+# Synapse 1.139.0rc2 (2025-09-23)
+
+## Internal Changes
+
+- Drop support for Ubuntu 24.10 Oracular Oriole, and add support for Ubuntu 25.04 Plucky Puffin. This change was applied on top of 1.139.0rc1. ([\#18962](https://github.com/element-hq/synapse/issues/18962))
+
+
+
+# Synapse 1.139.0rc1 (2025-09-23)
+
+## Features
+
+- Add experimental support for [MSC4308: Thread Subscriptions extension to Sliding Sync](https://github.com/matrix-org/matrix-spec-proposals/pull/4308) when [MSC4306: Thread Subscriptions](https://github.com/matrix-org/matrix-spec-proposals/pull/4306) and [MSC4186: Simplified Sliding Sync](https://github.com/matrix-org/matrix-spec-proposals/pull/4186) are enabled. ([\#18695](https://github.com/element-hq/synapse/issues/18695))
+- Update push rules for experimental [MSC4306: Thread Subscriptions](https://github.com/matrix-org/matrix-doc/issues/4306) to follow a newer draft. ([\#18846](https://github.com/element-hq/synapse/issues/18846))
+- Add `get_media_upload_limits_for_user` and `on_media_upload_limit_exceeded` module API callbacks to the media repository. ([\#18848](https://github.com/element-hq/synapse/issues/18848))
+- Support [MSC4169](https://github.com/matrix-org/matrix-spec-proposals/pull/4169) for backwards-compatible redaction sending using the `/send` endpoint. Contributed by @SpiritCroc @ Beeper. ([\#18898](https://github.com/element-hq/synapse/issues/18898))
+- Add an in-memory cache to `_get_e2e_cross_signing_signatures_for_devices` to reduce DB load. ([\#18899](https://github.com/element-hq/synapse/issues/18899))
+- Update [MSC4190](https://github.com/matrix-org/matrix-spec-proposals/pull/4190) support to return correct errors and allow appservices to reset cross-signing keys without user-interactive authentication. Contributed by @tulir @ Beeper. ([\#18946](https://github.com/element-hq/synapse/issues/18946))
+
+## Bugfixes
+
+- Ensure all PDUs sent via `/send` pass canonical JSON checks. ([\#18641](https://github.com/element-hq/synapse/issues/18641))
+- Fix bug where we did not send invite revocations over federation. ([\#18823](https://github.com/element-hq/synapse/issues/18823))
+- Fix prefixed support for [MSC4133](https://github.com/matrix-org/matrix-spec-proposals/pull/4133). ([\#18875](https://github.com/element-hq/synapse/issues/18875))
+- Fix open redirect in legacy SSO flow with the `idp` query parameter. ([\#18909](https://github.com/element-hq/synapse/issues/18909))
+- Fix a performance regression related to the experimental Delayed Events ([MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140)) feature. ([\#18926](https://github.com/element-hq/synapse/issues/18926))
+
+## Updates to the Docker image
+
+- Suppress "Applying schema" log noise bulk when `SYNAPSE_LOG_TESTING` is set. ([\#18878](https://github.com/element-hq/synapse/issues/18878))
+
+## Improved Documentation
+
+- Clarify Python dependency constraints in our deprecation policy. ([\#18856](https://github.com/element-hq/synapse/issues/18856))
+- Clarify necessary `jwt_config` parameter in OIDC documentation for authentik. Contributed by @maxkratz. ([\#18931](https://github.com/element-hq/synapse/issues/18931))
+
+## Deprecations and Removals
+
+- Remove obsolete and experimental `/sync/e2ee` endpoint. ([\#18583](https://github.com/element-hq/synapse/issues/18583))
+
+## Internal Changes
+
+- Fix `LaterGauge` metrics to collect from all servers. ([\#18791](https://github.com/element-hq/synapse/issues/18791))
+- Configure Synapse to run [MSC4306: Thread Subscriptions](https://github.com/matrix-org/matrix-spec-proposals/pull/4306) Complement tests. ([\#18819](https://github.com/element-hq/synapse/issues/18819))
+- Remove `sentinel` logcontext usage where we log in `setup`, `start` and `exit`. ([\#18870](https://github.com/element-hq/synapse/issues/18870))
+- Use the `Enum`'s value for the dictionary key when responding to an admin request for experimental features. ([\#18874](https://github.com/element-hq/synapse/issues/18874))
+- Start background tasks after we fork the process (daemonize). ([\#18886](https://github.com/element-hq/synapse/issues/18886))
+- Better explain how we manage the logcontext in `run_in_background(...)` and `run_as_background_process(...)`. ([\#18900](https://github.com/element-hq/synapse/issues/18900), [\#18906](https://github.com/element-hq/synapse/issues/18906))
+- Remove `sentinel` logcontext usage in `Clock` utilities like `looping_call` and `call_later`. ([\#18907](https://github.com/element-hq/synapse/issues/18907))
+- Replace usages of the deprecated `pkg_resources` interface in preparation of setuptools dropping it soon. ([\#18910](https://github.com/element-hq/synapse/issues/18910))
+- Split loading config from homeserver `setup`. ([\#18933](https://github.com/element-hq/synapse/issues/18933))
+- Fix `run_in_background` not being awaited properly in some tests causing `LoggingContext` problems. ([\#18937](https://github.com/element-hq/synapse/issues/18937))
+- Fix `run_as_background_process` not being awaited properly causing `LoggingContext` problems in experimental [MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140): Delayed events implementation. ([\#18938](https://github.com/element-hq/synapse/issues/18938))
+- Introduce `Clock.call_when_running(...)` to wrap startup code in a logcontext, ensuring we can identify which server generated the logs. ([\#18944](https://github.com/element-hq/synapse/issues/18944))
+- Introduce `Clock.add_system_event_trigger(...)` to wrap system event callback code in a logcontext, ensuring we can identify which server generated the logs. ([\#18945](https://github.com/element-hq/synapse/issues/18945))
+
+
+
+### Updates to locked dependencies
+
+* Bump actions/setup-go from 5.5.0 to 6.0.0. ([\#18891](https://github.com/element-hq/synapse/issues/18891))
+* Bump actions/setup-python from 5.6.0 to 6.0.0. ([\#18890](https://github.com/element-hq/synapse/issues/18890))
+* Bump authlib from 1.6.1 to 1.6.3. ([\#18921](https://github.com/element-hq/synapse/issues/18921))
+* Bump jsonschema from 4.25.0 to 4.25.1. ([\#18897](https://github.com/element-hq/synapse/issues/18897))
+* Bump log from 0.4.27 to 0.4.28. ([\#18892](https://github.com/element-hq/synapse/issues/18892))
+* Bump phonenumbers from 9.0.12 to 9.0.13. ([\#18893](https://github.com/element-hq/synapse/issues/18893))
+* Bump pydantic from 2.11.7 to 2.11.9. ([\#18922](https://github.com/element-hq/synapse/issues/18922))
+* Bump serde from 1.0.219 to 1.0.223. ([\#18920](https://github.com/element-hq/synapse/issues/18920))
+* Bump serde_json from 1.0.143 to 1.0.145. ([\#18919](https://github.com/element-hq/synapse/issues/18919))
+* Bump sigstore/cosign-installer from 3.9.2 to 3.10.0. ([\#18917](https://github.com/element-hq/synapse/issues/18917))
+* Bump towncrier from 24.8.0 to 25.8.0. ([\#18894](https://github.com/element-hq/synapse/issues/18894))
+* Bump types-psycopg2 from 2.9.21.20250809 to 2.9.21.20250915. ([\#18918](https://github.com/element-hq/synapse/issues/18918))
+* Bump types-requests from 2.32.4.20250611 to 2.32.4.20250809. ([\#18895](https://github.com/element-hq/synapse/issues/18895))
+* Bump types-setuptools from 80.9.0.20250809 to 80.9.0.20250822. ([\#18924](https://github.com/element-hq/synapse/issues/18924))
+
+# Synapse 1.138.2 (2025-09-24)
+
+## Internal Changes
+
+- Drop support for Ubuntu 24.10 Oracular Oriole, and add support for Ubuntu 25.04 Plucky Puffin. This change was applied on top of 1.138.1. ([\#18962](https://github.com/element-hq/synapse/issues/18962))
+
+
+
+# Synapse 1.138.1 (2025-09-24)
+
+## Bugfixes
+
+- Fix a performance regression related to the experimental Delayed Events ([MSC4140](https://github.com/matrix-org/matrix-spec-proposals/pull/4140)) feature. ([\#18926](https://github.com/element-hq/synapse/issues/18926))
+
+
+
+
+# Synapse 1.138.0 (2025-09-09)
+
+No significant changes since 1.138.0rc1.
+
+
+
+
 # Synapse 1.138.0rc1 (2025-09-02)
 
 ### Features
diff --git a/Cargo.lock b/Cargo.lock
index 095fb38ce1..e1747182e3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,21 +2,6 @@
 # It is not intended for manual editing.
 version = 3
 
-[[package]]
-name = "addr2line"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -28,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.99"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "arc-swap"
@@ -50,21 +35,6 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
-[[package]]
-name = "backtrace"
-version = "0.3.75"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets",
-]
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -103,9 +73,9 @@ checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
@@ -217,9 +187,9 @@ dependencies = [
 
 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -232,9 +202,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -242,15 +212,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -259,15 +229,15 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -276,21 +246,21 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -300,7 +270,6 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -341,12 +310,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "gimli"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-
 [[package]]
 name = "h2"
 version = "0.4.11"
@@ -410,12 +373,11 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
 dependencies = [
  "bytes",
- "fnv",
  "itoa",
 ]
 
@@ -625,9 +587,9 @@ dependencies = [
 
 [[package]]
 name = "icu_segmenter"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e185fc13b6401c138cf40db12b863b35f5edf31b88192a545857b41aeaf7d3d3"
+checksum = "38e30e593cf9c3ca2f51aa312eb347cd1ba95715e91a842ec3fc9058eab2af4b"
 dependencies = [
  "core_maths",
  "displaydoc",
@@ -684,17 +646,6 @@ version = "2.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"
 
-[[package]]
-name = "io-uring"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d93587f37623a1a17d94ef2bc9ada592f5465fe7732084ab7beefabe5c77c0c4"
-dependencies = [
- "bitflags",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "ipnet"
 version = "2.11.0"
@@ -753,9 +704,9 @@ checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
 
 [[package]]
 name = "log"
-version = "0.4.27"
+version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
 [[package]]
 name = "lru-slab"
@@ -784,15 +735,6 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
-]
-
 [[package]]
 name = "mio"
 version = "1.0.4"
@@ -804,20 +746,11 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "object"
-version = "0.36.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "openssl-probe"
@@ -837,12 +770,6 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
 [[package]]
 name = "portable-atomic"
 version = "1.11.1"
@@ -879,11 +806,12 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.25.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8970a78afe0628a3e3430376fc5fd76b6b45c4d43360ffd6cdd40bdde72b682a"
+checksum = "ab53c047fcd1a1d2a8820fe84f05d6be69e9526be40cb03b73f86b6b03e6d87d"
 dependencies = [
  "anyhow",
+ "bytes",
  "indoc",
  "libc",
  "memoffset",
@@ -897,19 +825,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.25.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "458eb0c55e7ece017adeba38f2248ff3ac615e53660d7c71a238d7d2a01c7598"
+checksum = "b455933107de8642b4487ed26d912c2d899dec6114884214a0b3bb3be9261ea6"
 dependencies = [
- "once_cell",
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.25.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7114fe5457c61b276ab77c5055f206295b812608083644a5c5b2640c3102565c"
+checksum = "1c85c9cbfaddf651b1221594209aed57e9e5cff63c4d11d1feead529b872a089"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -917,9 +844,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-log"
-version = "0.12.4"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45192e5e4a4d2505587e27806c7b710c231c40c56f3bfc19535d0bb25df52264"
+checksum = "26c2ec80932c5c3b2d4fbc578c9b56b2d4502098587edb8bef5b6bfcad43682e"
 dependencies = [
  "arc-swap",
  "log",
@@ -928,9 +855,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.25.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8725c0a622b374d6cb051d11a0983786448f7785336139c3c94f5aa6bef7e50"
+checksum = "0a5b10c9bf9888125d917fb4d2ca2d25c8df94c7ab5a52e13313a07e050a3b02"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -940,9 +867,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.25.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4109984c22491085343c05b0dbc54ddc405c3cf7b4374fc533f5c3313a572ccc"
+checksum = "03b51720d314836e53327f5871d4c0cfb4fb37cc2c4a11cc71907a86342c40f9"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -953,9 +880,9 @@ dependencies = [
 
 [[package]]
 name = "pythonize"
-version = "0.25.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597907139a488b22573158793aa7539df36ae863eba300c75f3a0d65fc475e27"
+checksum = "a3a8f29db331e28c332c63496cfcbb822aca3d7320bc08b655d7fd0c29c50ede"
 dependencies = [
  "pyo3",
  "serde",
@@ -983,9 +910,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.12"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes",
  "getrandom 0.3.3",
@@ -1062,9 +989,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.11.2"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1074,9 +1001,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1091,9 +1018,9 @@ checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "reqwest"
-version = "0.12.23"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64",
  "bytes",
@@ -1145,18 +1072,21 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
 
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.31"
@@ -1195,9 +1125,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.4"
+version = "0.103.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1249,19 +1179,35 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde"
-version = "1.0.219"
+name = "semver"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1270,14 +1216,15 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.143"
+version = "1.0.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d401abef1d108fbd9cbaebc3e46611f4b1021f714a0597a71f41ee463f5f4a5a"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
+ "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -1398,6 +1345,7 @@ dependencies = [
  "pythonize",
  "regex",
  "reqwest",
+ "rustc_version",
  "serde",
  "serde_json",
  "sha2",
@@ -1478,19 +1426,16 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.47.1"
+version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
 dependencies = [
- "backtrace",
  "bytes",
- "io-uring",
  "libc",
  "mio",
  "pin-project-lite",
- "slab",
  "socket2 0.6.0",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1533,9 +1478,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
  "bitflags",
  "bytes",
@@ -1771,6 +1716,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -1789,6 +1740,15 @@ dependencies = [
  "windows-targets",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -1971,3 +1931,9 @@ dependencies = [
  "quote",
  "syn",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ff05f8caa9038894637571ae6b9e29466c1f4f829d26c9b28f869a29cbe3445"
diff --git a/README.rst b/README.rst
index 92854f631c..4db5d461a8 100644
--- a/README.rst
+++ b/README.rst
@@ -1,4 +1,4 @@
-.. image:: ./docs/element_logo_white_bg.svg
+.. image:: https://github.com/element-hq/synapse/raw/develop/docs/element_logo_white_bg.svg
    :height: 60px
 
 **Element Synapse - Matrix homeserver implementation**
@@ -7,170 +7,48 @@
 
 Synapse is an open source `Matrix <https://matrix.org>`__ homeserver
 implementation, written and maintained by `Element <https://element.io>`_.
-`Matrix <https://github.com/matrix-org>`__ is the open standard for
-secure and interoperable real-time communications. You can directly run
-and manage the source code in this repository, available under an AGPL
-license (or alternatively under a commercial license from Element).
-There is no support provided by Element unless you have a
-subscription from Element.
+`Matrix <https://github.com/matrix-org>`__ is the open standard for secure and
+interoperable real-time communications. You can directly run and manage the
+source code in this repository, available under an AGPL license (or
+alternatively under a commercial license from Element).
 
-Subscription
-============
+There is no support provided by Element unless you have a subscription from
+Element.
 
-For those that need an enterprise-ready solution, Element
-Server Suite (ESS) is `available via subscription <https://element.io/pricing>`_.
-ESS builds on Synapse to offer a complete Matrix-based backend including the full
-`Admin Console product <https://element.io/enterprise-functionality/admin-console>`_,
-giving admins the power to easily manage an organization-wide
-deployment. It includes advanced identity management, auditing,
-moderation and data retention options as well as Long-Term Support and
-SLAs. ESS supports any Matrix-compatible client.
+🚀 Getting started
+==================
 
-.. contents::
+This component is developed and maintained by `Element <https://element.io>`_.
+It gets shipped as part of the **Element Server Suite (ESS)** which provides the
+official means of deployment.
 
-🛠️ Installation and configuration
-==================================
+ESS is a Matrix distribution from Element with focus on quality and ease of use.
+It ships a full Matrix stack tailored to the respective use case.
 
-The Synapse documentation describes `how to install Synapse <https://element-hq.github.io/synapse/latest/setup/installation.html>`_. We recommend using
-`Docker images <https://element-hq.github.io/synapse/latest/setup/installation.html#docker-images-and-ansible-playbooks>`_ or `Debian packages from Matrix.org
-<https://element-hq.github.io/synapse/latest/setup/installation.html#matrixorg-packages>`_.
+There are three editions of ESS:
 
-.. _federation:
-
-Synapse has a variety of `config options
-<https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html>`_
-which can be used to customise its behaviour after installation.
-There are additional details on how to `configure Synapse for federation here
-<https://element-hq.github.io/synapse/latest/federate.html>`_.
-
-.. _reverse-proxy:
-
-Using a reverse proxy with Synapse
-----------------------------------
-
-It is recommended to put a reverse proxy such as
-`nginx <https://nginx.org/en/docs/http/ngx_http_proxy_module.html>`_,
-`Apache <https://httpd.apache.org/docs/current/mod/mod_proxy_http.html>`_,
-`Caddy <https://caddyserver.com/docs/quick-starts/reverse-proxy>`_,
-`HAProxy <https://www.haproxy.org/>`_ or
-`relayd <https://man.openbsd.org/relayd.8>`_ in front of Synapse. One advantage of
-doing so is that it means that you can expose the default https port (443) to
-Matrix clients without needing to run Synapse with root privileges.
-For information on configuring one, see `the reverse proxy docs
-<https://element-hq.github.io/synapse/latest/reverse_proxy.html>`_.
-
-Upgrading an existing Synapse
------------------------------
-
-The instructions for upgrading Synapse are in `the upgrade notes`_.
-Please check these instructions as upgrading may require extra steps for some
-versions of Synapse.
-
-.. _the upgrade notes: https://element-hq.github.io/synapse/develop/upgrade.html
+- `ESS Community <https://github.com/element-hq/ess-helm>`_ - the free Matrix
+  distribution from Element tailored to small-/mid-scale, non-commercial
+  community use cases
+- `ESS Pro <https://element.io/server-suite>`_ - the commercial Matrix
+  distribution from Element for professional use
+- `ESS TI-M <https://element.io/server-suite/ti-messenger>`_ - a special version
+  of ESS Pro focused on the requirements of TI-Messenger Pro and ePA as
+  specified by the German National Digital Health Agency Gematik
 
 
-Platform dependencies
----------------------
+🛠️ Standalone installation and configuration
+============================================
 
-Synapse uses a number of platform dependencies such as Python and PostgreSQL,
-and aims to follow supported upstream versions. See the
-`deprecation policy <https://element-hq.github.io/synapse/latest/deprecation_policy.html>`_
-for more details.
+The Synapse documentation describes `options for installing Synapse standalone
+<https://element-hq.github.io/synapse/latest/setup/installation.html>`_. See
+below for more useful documentation links.
 
+- `Synapse configuration options <https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html>`_
+- `Synapse configuration for federation <https://element-hq.github.io/synapse/latest/federate.html>`_
+- `Using a reverse proxy with Synapse <https://element-hq.github.io/synapse/latest/reverse_proxy.html>`_
+- `Upgrading Synapse <https://element-hq.github.io/synapse/develop/upgrade.html>`_
 
-Security note
--------------
-
-Matrix serves raw, user-supplied data in some APIs -- specifically the `content
-repository endpoints`_.
-
-.. _content repository endpoints: https://matrix.org/docs/spec/client_server/latest.html#get-matrix-media-r0-download-servername-mediaid
-
-Whilst we make a reasonable effort to mitigate against XSS attacks (for
-instance, by using `CSP`_), a Matrix homeserver should not be hosted on a
-domain hosting other web applications. This especially applies to sharing
-the domain with Matrix web clients and other sensitive applications like
-webmail. See
-https://developer.github.com/changes/2014-04-25-user-content-security for more
-information.
-
-.. _CSP: https://github.com/matrix-org/synapse/pull/1021
-
-Ideally, the homeserver should not simply be on a different subdomain, but on
-a completely different `registered domain`_ (also known as top-level site or
-eTLD+1). This is because `some attacks`_ are still possible as long as the two
-applications share the same registered domain.
-
-.. _registered domain: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-2.3
-
-.. _some attacks: https://en.wikipedia.org/wiki/Session_fixation#Attacks_using_cross-subdomain_cookie
-
-To illustrate this with an example, if your Element Web or other sensitive web
-application is hosted on ``A.example1.com``, you should ideally host Synapse on
-``example2.com``. Some amount of protection is offered by hosting on
-``B.example1.com`` instead, so this is also acceptable in some scenarios.
-However, you should *not* host your Synapse on ``A.example1.com``.
-
-Note that all of the above refers exclusively to the domain used in Synapse's
-``public_baseurl`` setting. In particular, it has no bearing on the domain
-mentioned in MXIDs hosted on that server.
-
-Following this advice ensures that even if an XSS is found in Synapse, the
-impact to other applications will be minimal.
-
-
-🧪 Testing a new installation
-=============================
-
-The easiest way to try out your new Synapse installation is by connecting to it
-from a web client.
-
-Unless you are running a test instance of Synapse on your local machine, in
-general, you will need to enable TLS support before you can successfully
-connect from a client: see
-`TLS certificates <https://element-hq.github.io/synapse/latest/setup/installation.html#tls-certificates>`_.
-
-An easy way to get started is to login or register via Element at
-https://app.element.io/#/login or https://app.element.io/#/register respectively.
-You will need to change the server you are logging into from ``matrix.org``
-and instead specify a homeserver URL of ``https://<server_name>:8448``
-(or just ``https://<server_name>`` if you are using a reverse proxy).
-If you prefer to use another client, refer to our
-`client breakdown <https://matrix.org/ecosystem/clients/>`_.
-
-If all goes well you should at least be able to log in, create a room, and
-start sending messages.
-
-.. _`client-user-reg`:
-
-Registering a new user from a client
-------------------------------------
-
-By default, registration of new users via Matrix clients is disabled. To enable
-it:
-
-1. In the
-   `registration config section <https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#registration>`_
-   set ``enable_registration: true`` in ``homeserver.yaml``.
-2. Then **either**:
-
-   a. set up a `CAPTCHA <https://element-hq.github.io/synapse/latest/CAPTCHA_SETUP.html>`_, or
-   b. set ``enable_registration_without_verification: true`` in ``homeserver.yaml``.
-
-We **strongly** recommend using a CAPTCHA, particularly if your homeserver is exposed to
-the public internet. Without it, anyone can freely register accounts on your homeserver.
-This can be exploited by attackers to create spambots targeting the rest of the Matrix
-federation.
-
-Your new Matrix ID will be formed partly from the ``server_name``, and partly
-from a localpart you specify when you create the account in the form of::
-
-    @localpart:my.domain.name
-
-(pronounced "at localpart on my dot domain dot name").
-
-As when logging in, you will need to specify a "Custom server".  Specify your
-desired ``localpart`` in the 'Username' box.
 
 🎯 Troubleshooting and support
 ==============================
@@ -182,7 +60,7 @@ Enterprise quality support for Synapse including SLAs is available as part of an
 `Element Server Suite (ESS) <https://element.io/pricing>`_ subscription.
 
 If you are an existing ESS subscriber then you can raise a `support request <https://ems.element.io/support>`_
-and access the `knowledge base <https://ems-docs.element.io>`_.
+and access the `Element product documentation <https://docs.element.io>`_.
 
 🤝 Community support
 --------------------
@@ -201,35 +79,6 @@ issues for support requests, only for bug reports and feature requests.
 .. |docs| replace:: ``docs``
 .. _docs: docs
 
-🪪 Identity Servers
-===================
-
-Identity servers have the job of mapping email addresses and other 3rd Party
-IDs (3PIDs) to Matrix user IDs, as well as verifying the ownership of 3PIDs
-before creating that mapping.
-
-**Identity servers do not store accounts or credentials - these are stored and managed on homeservers.
-Identity Servers are just for mapping 3rd Party IDs to Matrix IDs.**
-
-This process is highly security-sensitive, as there is an obvious risk of spam if it
-is too easy to sign up for Matrix accounts or harvest 3PID data. In the longer
-term, we hope to create a decentralised system to manage it (`matrix-doc #712
-<https://github.com/matrix-org/matrix-doc/issues/712>`_), but in the meantime,
-the role of managing trusted identity in the Matrix ecosystem is farmed out to
-a cluster of known trusted ecosystem partners, who run 'Matrix Identity
-Servers' such as `Sydent <https://github.com/matrix-org/sydent>`_, whose role
-is purely to authenticate and track 3PID logins and publish end-user public
-keys.
-
-You can host your own copy of Sydent, but this will prevent you reaching other
-users in the Matrix ecosystem via their email address, and prevent them finding
-you. We therefore recommend that you use one of the centralised identity servers
-at ``https://matrix.org`` or ``https://vector.im`` for now.
-
-To reiterate: the Identity server will only be used if you choose to associate
-an email address with your account, or send an invite to another user via their
-email address.
-
 
 🛠️ Development
 ==============
@@ -252,18 +101,29 @@ Alongside all that, join our developer community on Matrix:
 Copyright and Licensing
 =======================
 
-| Copyright 2014-2017 OpenMarket Ltd
-| Copyright 2017 Vector Creations Ltd
-| Copyright 2017-2025 New Vector Ltd
-|
+  | Copyright 2014–2017 OpenMarket Ltd
+  | Copyright 2017 Vector Creations Ltd
+  | Copyright 2017–2025 New Vector Ltd
+  | Copyright 2025 Element Creations Ltd
 
-This software is dual-licensed by New Vector Ltd (Element). It can be used either:
+This software is dual-licensed by Element Creations Ltd (Element). It can be
+used either:
 
-(1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
+(1) for free under the terms of the GNU Affero General Public License (as
+    published by the Free Software Foundation, either version 3 of the License,
+    or (at your option) any later version); OR
 
-(2) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
+(2) under the terms of a paid-for Element Commercial License agreement between
+    you and Element (the terms of which may vary depending on what you and
+    Element have agreed to).
 
-Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
+Unless required by applicable law or agreed to in writing, software distributed
+under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the
+specific language governing permissions and limitations under the Licenses.
+
+Please contact `licensing@element.io <mailto:licensing@element.io>`_ to purchase
+an Element commercial license for this software.
 
 
 .. |support| image:: https://img.shields.io/badge/matrix-community%20support-success
diff --git a/book.toml b/book.toml
index 98d749ed39..99e4d03bf4 100644
--- a/book.toml
+++ b/book.toml
@@ -4,7 +4,6 @@
 title = "Synapse"
 authors = ["The Matrix.org Foundation C.I.C."]
 language = "en"
-multilingual = false
 
 # The directory that documentation files are stored in
 src = "docs"
@@ -31,13 +30,10 @@ site-url = "/synapse/"
 # Additional HTML, JS, CSS that's injected into each page of the book.
 # More information available in docs/website_files/README.md
 additional-css = [
-    "docs/website_files/table-of-contents.css",
-    "docs/website_files/remove-nav-buttons.css",
     "docs/website_files/indent-section-headers.css",
     "docs/website_files/version-picker.css",
 ]
 additional-js = [
-    "docs/website_files/table-of-contents.js",
     "docs/website_files/version-picker.js",
     "docs/website_files/version.js",
 ]
diff --git a/build_rust.py b/build_rust.py
index 5c796af461..a9e9265daf 100644
--- a/build_rust.py
+++ b/build_rust.py
@@ -2,13 +2,13 @@
 
 import itertools
 import os
-from typing import Any, Dict
+from typing import Any
 
 from packaging.specifiers import SpecifierSet
 from setuptools_rust import Binding, RustExtension
 
 
-def build(setup_kwargs: Dict[str, Any]) -> None:
+def build(setup_kwargs: dict[str, Any]) -> None:
     original_project_dir = os.path.dirname(os.path.realpath(__file__))
     cargo_toml_path = os.path.join(original_project_dir, "rust", "Cargo.toml")
 
@@ -27,12 +27,12 @@ def build(setup_kwargs: Dict[str, Any]) -> None:
     setup_kwargs["zip_safe"] = False
 
     # We look up the minimum supported Python version with
-    # `python_requires` (e.g. ">=3.9.0,<4.0.0") and finding the first Python
+    # `python_requires` (e.g. ">=3.10.0,<4.0.0") and finding the first Python
     # version that matches. We then convert that into the `py_limited_api` form,
-    # e.g. cp39 for Python 3.9.
+    # e.g. cp310 for Python 3.10.
     py_limited_api: str
     python_bounds = SpecifierSet(setup_kwargs["python_requires"])
-    for minor_version in itertools.count(start=8):
+    for minor_version in itertools.count(start=10):
         if f"3.{minor_version}.0" in python_bounds:
             py_limited_api = f"cp3{minor_version}"
             break
diff --git a/changelog.d/19615.doc b/changelog.d/19615.doc
new file mode 100644
index 0000000000..9e28ac8312
--- /dev/null
+++ b/changelog.d/19615.doc
@@ -0,0 +1 @@
+Include a workaround for running the unit tests with SQLite under recent versions of MacOS.
diff --git a/changelog.d/19633.misc b/changelog.d/19633.misc
new file mode 100644
index 0000000000..37efd5309f
--- /dev/null
+++ b/changelog.d/19633.misc
@@ -0,0 +1 @@
+Document context for why increase timeout for policy server requests.
diff --git a/changelog.d/19636.misc b/changelog.d/19636.misc
new file mode 100644
index 0000000000..9ea0f04603
--- /dev/null
+++ b/changelog.d/19636.misc
@@ -0,0 +1 @@
+Run lint script to format Complement tests introduced in [#19509](https://github.com/element-hq/synapse/pull/19509).
diff --git a/changelog.d/19643.feature b/changelog.d/19643.feature
new file mode 100644
index 0000000000..0851623fbf
--- /dev/null
+++ b/changelog.d/19643.feature
@@ -0,0 +1 @@
+Report the Rust compiler version used in the Prometheus metrics. Contributed by Noah Markert.
\ No newline at end of file
diff --git a/complement/.golangci.yml b/complement/.golangci.yml
new file mode 100644
index 0000000000..6ef564d4c4
--- /dev/null
+++ b/complement/.golangci.yml
@@ -0,0 +1,38 @@
+# Docs: https://golangci-lint.run/docs/configuration/file/
+#
+# Go formatting/linting rules
+#
+# This is run as part of the normal linting utility script,
+# `poetry run ./scripts-dev/lint.sh`
+
+version: "2"
+
+linters:
+  # Default set of linters.
+  # The value can be:
+  # - `standard`: https://golangci-lint.run/docs/linters/#enabled-by-default
+  # - `all`: enables all linters by default.
+  # - `none`: disables all linters by default.
+  # - `fast`: enables only linters considered as "fast" (`golangci-lint help linters --json | jq '[ .[] | select(.fast==true) ] | map(.name)'`).
+  # Default: standard
+  default: standard
+
+  # Enable specific linter.
+  # enable:
+  #   - example
+
+  # Disable specific linters.
+  disable:
+    # FIXME: Ideally, we'd enable the `bodyclose` lint but there are many
+    # false-positives (like https://github.com/timakin/bodyclose/issues/39) and just is
+    # not well-suited for our use case (https://github.com/timakin/bodyclose/issues/11 and
+    # https://github.com/timakin/bodyclose/issues/76).
+    - bodyclose
+
+formatters:
+  # Enable specific formatter.
+  # Default: [] (uses standard Go formatting)
+  enable:
+    - gofmt
+    - goimports
+    - golines
diff --git a/complement/README.md b/complement/README.md
new file mode 100644
index 0000000000..77f7ee182d
--- /dev/null
+++ b/complement/README.md
@@ -0,0 +1,95 @@
+# Complement testing
+
+Complement is a black box integration testing framework for Matrix homeservers. It
+allows us to write end-to-end tests that interact with real Synapse homeservers to
+ensure everything works at a holistic level.
+
+
+## Setup
+
+Nothing beyond a [normal Complement
+setup](https://github.com/matrix-org/complement#running) (just Go and Docker).
+
+
+## Running tests
+
+Run tests from the [Complement](https://github.com/matrix-org/complement) repo:
+
+```shell
+# Run the tests
+./scripts-dev/complement.sh
+
+# To run a whole group of tests, you can specify part of the test path:
+scripts-dev/complement.sh ./tests/csapi/... -run TestRoomCreate
+# To run a specific test, you can specify the whole name structure:
+scripts-dev/complement.sh ./tests/csapi/... -run TestRoomCreate/Parallel/POST_/createRoom_makes_a_public_room
+# Generally though, the `-run` parameter accepts regex patterns, so you can match however you like:
+scripts-dev/complement.sh ./tests/... -run 'TestRoomCreate/Parallel/POST_/createRoom_makes_a_(.*)'
+```
+
+It's often nice to develop on Synapse and write Complement tests at the same time.
+Here is how to run your local Synapse checkout against your local Complement checkout.
+
+```shell
+# To run a specific test
+COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh ./tests/csapi/... -run TestRoomCreate
+```
+
+The above will run a monolithic (single-process) Synapse with SQLite as the database.
+For other configurations, try:
+
+- Passing `POSTGRES=1` as an environment variable to use the Postgres database instead.
+- Passing `WORKERS=1` as an environment variable to use a workerised setup instead. This
+  option implies the use of Postgres.
+  - If setting `WORKERS=1`, optionally set `WORKER_TYPES=` to declare which worker types
+    you wish to test. A simple comma-delimited string containing the worker types
+    defined from the `WORKERS_CONFIG` template in
+    [here](https://github.com/element-hq/synapse/blob/develop/docker/configure_workers_and_start.py#L54).
+    A safe example would be `WORKER_TYPES="federation_inbound, federation_sender,
+    synchrotron"`. See the [worker documentation](../workers.md) for additional
+    information on workers.
+- Passing `ASYNCIO_REACTOR=1` as an environment variable to use the asyncio-backed
+  reactor with Twisted instead of the default one.
+- Passing `PODMAN=1` will use the [podman](https://podman.io/) container runtime,
+  instead of docker.
+- Passing `UNIX_SOCKETS=1` will utilise Unix socket functionality for Synapse, Redis,
+  and Postgres(when applicable).
+
+To increase the log level for the tests, set `SYNAPSE_TEST_LOG_LEVEL`, e.g:
+```sh
+SYNAPSE_TEST_LOG_LEVEL=DEBUG COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -run TestRoomCreate
+```
+
+
+### Running in-repo tests
+
+In-repo Complement tests are tests that are vendored into this project. We use the
+in-repo test suite to test Synapse specific behaviors like the admin API.
+
+To run the in-repo Complement tests, use the `--in-repo` command line argument.
+
+```shell
+# Run only a specific test package.
+# Note: test packages are relative to the `./complement` directory in this project
+./scripts-dev/complement.sh --in-repo ./tests/...
+
+# Similarly, you can also use `-run` to specify all or part of a specific test path to run
+scripts-dev/complement.sh --in-repo ./tests/... -run TestIntraShardFederation
+```
+
+### Access database for homeserver after Complement test runs.
+
+If you're curious what the database looks like after you run some tests, here are some
+steps to get you going in Synapse:
+
+1. In your Complement test comment out `defer deployment.Destroy(t)` and replace with
+   `defer time.Sleep(2 * time.Hour)` to keep the homeserver running after the tests
+   complete
+1. Start the Complement tests
+1. Find the name of the container, `docker ps -f name=complement_` (this will filter for
+   just the Complement related Docker containers)
+1. Access the container replacing the name with what you found in the previous step:
+   `docker exec -it complement_1_hs_with_application_service.hs1_2 /bin/bash`
+1. Install sqlite (database driver), `apt-get update && apt-get install -y sqlite3`
+1. Then run `sqlite3` and open the database `.open /conf/homeserver.db` (this db path
+   comes from the Synapse homeserver.yaml)
diff --git a/complement/go.mod b/complement/go.mod
new file mode 100644
index 0000000000..716aabdf32
--- /dev/null
+++ b/complement/go.mod
@@ -0,0 +1,58 @@
+module github.com/element-hq/synapse
+
+go 1.24.1
+
+toolchain go1.24.4
+
+require (
+	github.com/matrix-org/complement v0.0.0-20251120181401-44111a2a8a9d
+	github.com/matrix-org/gomatrixserverlib v0.0.0-20250813150445-9f5070a65744
+)
+
+require (
+	github.com/docker/docker v28.3.3+incompatible
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/hashicorp/go-set/v3 v3.0.0 // indirect
+	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/oleiade/lane/v2 v2.0.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.34.0 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
+	gotest.tools/v3 v3.4.0 // indirect
+)
+
+require (
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/matrix-org/gomatrix v0.0.0-20220926102614-ceba4d9f7530 // indirect
+	github.com/matrix-org/util v0.0.0-20221111132719-399730281e66 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+)
diff --git a/complement/go.sum b/complement/go.sum
new file mode 100644
index 0000000000..79a35aa14c
--- /dev/null
+++ b/complement/go.sum
@@ -0,0 +1,181 @@
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
+github.com/hashicorp/go-set/v3 v3.0.0 h1:CaJBQvQCOWoftrBcDt7Nwgo0kdpmrKxar/x2o6pV9JA=
+github.com/hashicorp/go-set/v3 v3.0.0/go.mod h1:IEghM2MpE5IaNvL+D7X480dfNtxjRXZ6VMpK3C8s2ok=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/matrix-org/complement v0.0.0-20251120181401-44111a2a8a9d h1:s2Xc9GB2E/pXdElP18h8+04Y3SmhaII7xh2YmCM7oZc=
+github.com/matrix-org/complement v0.0.0-20251120181401-44111a2a8a9d/go.mod h1:HioTV089DHLBfljH9QLGifJRE4Avnyk08BXXhCwd4gs=
+github.com/matrix-org/gomatrix v0.0.0-20220926102614-ceba4d9f7530 h1:kHKxCOLcHH8r4Fzarl4+Y3K5hjothkVW5z7T1dUM11U=
+github.com/matrix-org/gomatrix v0.0.0-20220926102614-ceba4d9f7530/go.mod h1:/gBX06Kw0exX1HrwmoBibFA98yBk/jxKpGVeyQbff+s=
+github.com/matrix-org/gomatrixserverlib v0.0.0-20250813150445-9f5070a65744 h1:5GvC2FD9O/PhuyY95iJQdNYHbDioEhMWdeMP9maDUL8=
+github.com/matrix-org/gomatrixserverlib v0.0.0-20250813150445-9f5070a65744/go.mod h1:b6KVfDjXjA5Q7vhpOaMqIhFYvu5BuFVZixlNeTV/CLc=
+github.com/matrix-org/util v0.0.0-20221111132719-399730281e66 h1:6z4KxomXSIGWqhHcfzExgkH3Z3UkIXry4ibJS4Aqz2Y=
+github.com/matrix-org/util v0.0.0-20221111132719-399730281e66/go.mod h1:iBI1foelCqA09JJgPV0FYz4qA5dUXYOxMi57FxKBdd4=
+github.com/miekg/dns v1.1.66 h1:FeZXOS3VCVsKnEAd+wBkjMC3D2K+ww66Cq3VnCINuJE=
+github.com/miekg/dns v1.1.66/go.mod h1:jGFzBsSNbJw6z1HYut1RKBKHA9PBdxeHrZG8J+gC2WE=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/oleiade/lane/v2 v2.0.0 h1:XW/ex/Inr+bPkLd3O240xrFOhUkTd4Wy176+Gv0E3Qw=
+github.com/oleiade/lane/v2 v2.0.0/go.mod h1:i5FBPFAYSWCgLh58UkUGCChjcCzef/MI7PlQm2TKCeg=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/shoenig/test v1.11.0 h1:NoPa5GIoBwuqzIviCrnUJa+t5Xb4xi5Z+zODJnIDsEQ=
+github.com/shoenig/test v1.11.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
+go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 h1:dNzwXjZKpMpE2JhmO+9HsPl42NIXFIFSUSSs0fiqra0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0/go.mod h1:90PoxvaEB5n6AOdZvi+yWJQoE95U8Dhhw2bSyRqnTD0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.34.0 h1:BEj3SPM81McUZHYjRS5pEgNgnmzGJ5tRpU5krWnV8Bs=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.34.0/go.mod h1:9cKLGBDzI/F3NoHLQGm4ZrYdIHsvGt6ej6hUowxY0J4=
+go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
+go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
+go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
+go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
+go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a h1:SGktgSolFCo75dnHJF2yMvnns6jCmHFJ0vE4Vn2JKvQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a/go.mod h1:a77HrdMjoeKbnd2jmgcWdaS++ZLZAEq3orIOAEIKiVw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:v2PbRU4K3llS09c7zodFpNePeamkAwG3mPrAery9VeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.72.2 h1:TdbGzwb82ty4OusHWepvFWGLgIbNo1/SUynEN0ssqv8=
+google.golang.org/grpc v1.72.2/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/h2non/gock.v1 v1.1.2 h1:jBbHXgGBK/AoPVfJh5x4r/WxIrElvbLel8TCZkkZJoY=
+gopkg.in/h2non/gock.v1 v1.1.2/go.mod h1:n7UGz/ckNChHiK05rDoiC4MYSunEC/lyaUm2WWaDva0=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
+gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
diff --git a/complement/tests/federation_test.go b/complement/tests/federation_test.go
new file mode 100644
index 0000000000..d423792a72
--- /dev/null
+++ b/complement/tests/federation_test.go
@@ -0,0 +1,65 @@
+// This file is licensed under the Affero General Public License (AGPL) version 3.
+//
+// Copyright (C) 2026 Element Creations Ltd
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// See the GNU Affero General Public License for more details:
+// <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+package synapse_tests
+
+import (
+	"testing"
+
+	"github.com/matrix-org/complement"
+	"github.com/matrix-org/complement/client"
+	"github.com/matrix-org/complement/helpers"
+	"github.com/matrix-org/gomatrixserverlib/spec"
+)
+
+// Stub test to ensure that homeservers can communicate with each other (federation works correctly).
+//
+// TODO: This test will disappear once we have other real Synapse specific tests in
+// place. This is simply here as an example without bloating the PR with some specific
+// new tests.
+func TestFederation(t *testing.T) {
+	// Create two homeservers
+	deployment := complement.Deploy(t, 2)
+	defer deployment.Destroy(t)
+
+	alice := deployment.Register(t, "hs1", helpers.RegistrationOpts{})
+	bob := deployment.Register(t, "hs2", helpers.RegistrationOpts{})
+
+	aliceRoomID := alice.MustCreateRoom(t, map[string]any{
+		"preset": "public_chat",
+	})
+	bobRoomID := bob.MustCreateRoom(t, map[string]any{
+		"preset": "public_chat",
+	})
+
+	t.Run("parallel", func(t *testing.T) {
+		t.Run("HS1 -> HS2", func(t *testing.T) {
+			t.Parallel()
+
+			alice.MustJoinRoom(t, bobRoomID, []spec.ServerName{
+				deployment.GetFullyQualifiedHomeserverName(t, "hs2"),
+			})
+
+			bob.MustSyncUntil(t, client.SyncReq{}, client.SyncJoinedTo(alice.UserID, bobRoomID))
+		})
+
+		t.Run("HS2 -> HS1", func(t *testing.T) {
+			t.Parallel()
+
+			bob.MustJoinRoom(t, aliceRoomID, []spec.ServerName{
+				deployment.GetFullyQualifiedHomeserverName(t, "hs1"),
+			})
+
+			alice.MustSyncUntil(t, client.SyncReq{}, client.SyncJoinedTo(bob.UserID, aliceRoomID))
+		})
+	})
+}
diff --git a/complement/tests/internal/dockerutil/files.go b/complement/tests/internal/dockerutil/files.go
new file mode 100644
index 0000000000..e19f684368
--- /dev/null
+++ b/complement/tests/internal/dockerutil/files.go
@@ -0,0 +1,68 @@
+package dockerutil
+
+import (
+	"archive/tar"
+	"bytes"
+	"fmt"
+	"testing"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
+)
+
+// Write `data` as a file into a container at the given `path`.
+//
+// Internally, produces an uncompressed single-file tape archive (tar) that is sent to the docker
+// daemon to be unpacked into the container filesystem.
+func WriteFileIntoContainer(
+	t *testing.T,
+	docker *client.Client,
+	containerID string,
+	path string,
+	data []byte,
+) error {
+	// Create a fake/virtual tar file in memory that we can copy to the container
+	// via https://stackoverflow.com/a/52131297/796832
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	err := tw.WriteHeader(&tar.Header{
+		Name: path,
+		Mode: 0777,
+		Size: int64(len(data)),
+	})
+	if err != nil {
+		return fmt.Errorf(
+			"WriteIntoContainer: failed to write tarball header for %s: %v",
+			path,
+			err,
+		)
+	}
+	_, err = tw.Write([]byte(data))
+	if err != nil {
+		return fmt.Errorf("WriteIntoContainer: failed to write tarball data for %s: %w", path, err)
+	}
+
+	err = tw.Close()
+	if err != nil {
+		return fmt.Errorf(
+			"WriteIntoContainer: failed to close tarball writer for %s: %w",
+			path,
+			err,
+		)
+	}
+
+	// Put our new fake file in the container volume
+	err = docker.CopyToContainer(
+		t.Context(),
+		containerID,
+		"/",
+		&buf,
+		container.CopyToContainerOptions{
+			AllowOverwriteDirWithFile: false,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("WriteIntoContainer: failed to copy: %s", err)
+	}
+	return nil
+}
diff --git a/complement/tests/main_test.go b/complement/tests/main_test.go
new file mode 100644
index 0000000000..1d62900d38
--- /dev/null
+++ b/complement/tests/main_test.go
@@ -0,0 +1,23 @@
+// This file is licensed under the Affero General Public License (AGPL) version 3.
+//
+// Copyright (C) 2026 Element Creations Ltd
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// See the GNU Affero General Public License for more details:
+// <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+package synapse_tests
+
+import (
+	"testing"
+
+	"github.com/matrix-org/complement"
+)
+
+func TestMain(m *testing.M) {
+	complement.TestMain(m, "synapse")
+}
diff --git a/complement/tests/oidc_test.go b/complement/tests/oidc_test.go
new file mode 100644
index 0000000000..deabf49950
--- /dev/null
+++ b/complement/tests/oidc_test.go
@@ -0,0 +1,120 @@
+// This file is licensed under the Affero General Public License (AGPL) version 3.
+//
+// Copyright (C) 2026 Element Creations Ltd
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// See the GNU Affero General Public License for more details:
+// <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+package synapse_tests
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	dockerClient "github.com/docker/docker/client"
+	"github.com/element-hq/synapse/tests/internal/dockerutil"
+	"github.com/matrix-org/complement"
+	"github.com/matrix-org/complement/client"
+	"github.com/matrix-org/complement/match"
+	"github.com/matrix-org/complement/must"
+)
+
+const OIDC_HOMESERVER_CONFIG string = `
+oidc_providers:
+ - idp_id: "test_provider"
+   idp_name: "Test OIDC Provider"
+   issuer: "https://example.invalid"
+   client_id: "test_client_id"
+   client_secret: "test_secret"
+   scopes: ["openid"]
+   discover: true
+   user_mapping_provider:
+     module: "synapse.handlers.oidc.JinjaOidcMappingProvider"
+     config:
+       display_name_template: "{{ user.given_name }}"
+       email_template: "{{ user.email }}"
+`
+
+// Test that Synapse still starts up when configured with an OIDC provider that is unavailable.
+//
+// This is a regression test: Synapse previously would fail to start up
+// at all if the OIDC provider was down on startup.
+// https://github.com/element-hq/synapse/issues/8088
+//
+// Now instead of failing to start, Synapse will produce a 503 response on the
+// `/_matrix/client/v3/login/sso/redirect/oidc-test_provider` endpoint.
+func TestOIDCProviderUnavailable(t *testing.T) {
+	// Deploy a single homeserver
+	deployment := complement.Deploy(t, 1)
+	defer deployment.Destroy(t)
+
+	// Get Docker client to manipulate container
+	dc, err := dockerClient.NewClientWithOpts(
+		dockerClient.FromEnv,
+		dockerClient.WithAPIVersionNegotiation(),
+	)
+	must.NotError(t, "failed creating docker client", err)
+
+	// Configure the OIDC Provider by writing a config fragment
+	err = dockerutil.WriteFileIntoContainer(
+		t,
+		dc,
+		deployment.ContainerID(t, "hs1"),
+		"/conf/homeserver.d/oidc_provider.yaml",
+		[]byte(OIDC_HOMESERVER_CONFIG),
+	)
+	if err != nil {
+		t.Fatalf("Failed to write updated config to container: %v", err)
+	}
+
+	// Restart the homeserver to apply the new config
+	deployment.StopServer(t, "hs1")
+	// Careful: port number changes here
+	deployment.StartServer(t, "hs1")
+	// Must get after the restart so the port number is correct
+	unauthedClient := deployment.UnauthenticatedClient(t, "hs1")
+
+	// Test that trying to log in with an OIDC provider that is down
+	// causes an HTML error page to be shown to the user.
+	// (This replaces the redirect that would happen if the provider was
+	// up.)
+	//
+	// More importantly, implicitly tests that Synapse can start up
+	// and answer requests even though an OIDC provider is down.
+	t.Run("/login/sso/redirect shows HTML error", func(t *testing.T) {
+		// Build a request to the /redirect/ endpoint, that would normally be navigated to
+		// by the user's browser in order to start the login flow.
+		queryParams := url.Values{}
+		queryParams.Add("redirectUrl", "http://redirect.invalid/redirect")
+		res := unauthedClient.Do(
+			t,
+			"GET",
+			[]string{"_matrix", "client", "v3", "login", "sso", "redirect", "oidc-test_provider"},
+			client.WithQueries(queryParams),
+		)
+
+		body := must.MatchResponse(t, res, match.HTTPResponse{
+			// Should get a 503
+			StatusCode: http.StatusServiceUnavailable,
+
+			Headers: map[string]string{
+				// Should get an HTML page explaining the problem to the user
+				"Content-Type": "text/html; charset=utf-8",
+			},
+		})
+
+		bodyText := string(body)
+
+		// The HTML page contains phrases from the template we expect
+		if !strings.Contains(bodyText, "login provider is unavailable right now") {
+			t.Fatalf("Keyword not found in HTML error page, got %s", bodyText)
+		}
+	})
+}
diff --git a/complement/tests/synapse_version_check_test.go b/complement/tests/synapse_version_check_test.go
new file mode 100644
index 0000000000..790a6a40ce
--- /dev/null
+++ b/complement/tests/synapse_version_check_test.go
@@ -0,0 +1,101 @@
+// This file is licensed under the Affero General Public License (AGPL) version 3.
+//
+// Copyright (C) 2026 Element Creations Ltd
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// See the GNU Affero General Public License for more details:
+// <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+package synapse_tests
+
+import (
+	"net/http"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"github.com/matrix-org/complement"
+	"github.com/matrix-org/complement/match"
+	"github.com/matrix-org/complement/must"
+	"github.com/tidwall/gjson"
+)
+
+func TestSynapseVersion(t *testing.T) {
+	deployment := complement.Deploy(t, 1)
+	defer deployment.Destroy(t)
+
+	unauthedClient := deployment.UnauthenticatedClient(t, "hs1")
+
+	// Sanity check that the version of Synapse used in the `COMPLEMENT_BASE_IMAGE`
+	// matches the same git commit we have checked out. This ensures that the image being
+	// used in Complement is the one that we just built locally with `complement.sh`
+	// instead of accidentally pulling in some remote one.
+	//
+	// This test is expected to pass if you use `complement.sh`.
+	//
+	// If this test fails, it probably means that Complement is using an image that
+	// doesn't encompass the changes you have checked out (unexpected). We want to yell
+	// loudly and point out what's wrong instead of silently letting your PRs pass
+	// without actually being tested.
+	t.Run("Synapse version matches current git checkout", func(t *testing.T) {
+		// Get the Synapse version details of the current git checkout
+		checkoutSynapseVersion := runCommand(
+			t,
+			[]string{
+				"poetry",
+				"run",
+				"python",
+				"-c",
+				"from synapse.util import SYNAPSE_VERSION; print(SYNAPSE_VERSION)",
+			},
+		)
+
+		// Find the version details of the Synapse instance deployed from the Docker image
+		res := unauthedClient.MustDo(t, "GET", []string{"_matrix", "federation", "v1", "version"})
+		body := must.MatchResponse(t, res, match.HTTPResponse{
+			StatusCode: http.StatusOK,
+			JSON: []match.JSON{
+				match.JSONKeyPresent("server"),
+			},
+		})
+		rawSynapseVersionString := gjson.GetBytes(body, "server.version").Str
+		t.Logf(
+			"Synapse version string from federation version endpoint: %s",
+			rawSynapseVersionString,
+		)
+
+		must.Equal(
+			t,
+			rawSynapseVersionString,
+			checkoutSynapseVersion,
+			"Synapse version in the checkout doesn't match the Synapse version that Complement is running. "+
+				"If this test fails, it probably means that Complement is using an image that "+
+				"doesn't encompass the changes you have checked out (unexpected). We want to yell "+
+				"loudly and point out what's wrong instead of silently letting your PRs pass "+
+				"without actually being tested.",
+		)
+	})
+}
+
+// runCommand will run the given command and return the stdout (whitespace
+// trimmed).
+func runCommand(t *testing.T, commandPieces []string) string {
+	t.Helper()
+
+	// Then run our actual command
+	cmd := exec.Command(commandPieces[0], commandPieces[1:]...)
+	output, err := cmd.Output()
+	if err != nil {
+		t.Fatalf(
+			"runCommand: failed to run command (%s): %v",
+			strings.Join(commandPieces, " "),
+			err,
+		)
+	}
+
+	return strings.TrimSpace(string(output))
+}
diff --git a/contrib/cmdclient/console.py b/contrib/cmdclient/console.py
index 9b5d33d2b1..1c867d5336 100755
--- a/contrib/cmdclient/console.py
+++ b/contrib/cmdclient/console.py
@@ -33,7 +33,6 @@ import sys
 import time
 import urllib
 from http import TwistedHttpClient
-from typing import Optional
 
 import urlparse
 from signedjson.key import NACL_ED25519, decode_verify_key_bytes
@@ -726,7 +725,7 @@ class SynapseCmd(cmd.Cmd):
         method,
         path,
         data=None,
-        query_params: Optional[dict] = None,
+        query_params: dict | None = None,
         alt_text=None,
     ):
         """Runs an HTTP request and pretty prints the output.
diff --git a/contrib/cmdclient/http.py b/contrib/cmdclient/http.py
index 54363e4259..b92ccdd932 100644
--- a/contrib/cmdclient/http.py
+++ b/contrib/cmdclient/http.py
@@ -22,7 +22,6 @@
 import json
 import urllib
 from pprint import pformat
-from typing import Optional
 
 from twisted.internet import defer, reactor
 from twisted.web.client import Agent, readBody
@@ -90,7 +89,7 @@ class TwistedHttpClient(HttpClient):
         body = yield readBody(response)
         return json.loads(body)
 
-    def _create_put_request(self, url, json_data, headers_dict: Optional[dict] = None):
+    def _create_put_request(self, url, json_data, headers_dict: dict | None = None):
         """Wrapper of _create_request to issue a PUT request"""
         headers_dict = headers_dict or {}
 
@@ -101,7 +100,7 @@ class TwistedHttpClient(HttpClient):
             "PUT", url, producer=_JsonProducer(json_data), headers_dict=headers_dict
         )
 
-    def _create_get_request(self, url, headers_dict: Optional[dict] = None):
+    def _create_get_request(self, url, headers_dict: dict | None = None):
         """Wrapper of _create_request to issue a GET request"""
         return self._create_request("GET", url, headers_dict=headers_dict or {})
 
@@ -113,7 +112,7 @@ class TwistedHttpClient(HttpClient):
         data=None,
         qparams=None,
         jsonreq=True,
-        headers: Optional[dict] = None,
+        headers: dict | None = None,
     ):
         headers = headers or {}
 
@@ -138,7 +137,7 @@ class TwistedHttpClient(HttpClient):
 
     @defer.inlineCallbacks
     def _create_request(
-        self, method, url, producer=None, headers_dict: Optional[dict] = None
+        self, method, url, producer=None, headers_dict: dict | None = None
     ):
         """Creates and sends a request to the given url"""
         headers_dict = headers_dict or {}
diff --git a/contrib/grafana/synapse.json b/contrib/grafana/synapse.json
index e23afcf2d3..ceacc10369 100644
--- a/contrib/grafana/synapse.json
+++ b/contrib/grafana/synapse.json
@@ -1,17 +1,21 @@
 {
+  "__inputs": [
+    {
+      "name": "DS_PROMETHEUS",
+      "label": "prometheus",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
   "__elements": {},
   "__requires": [
     {
       "type": "grafana",
       "id": "grafana",
       "name": "Grafana",
-      "version": "9.2.2"
-    },
-    {
-      "type": "panel",
-      "id": "graph",
-      "name": "Graph (old)",
-      "version": ""
+      "version": "12.3.1"
     },
     {
       "type": "panel",
@@ -53,7 +57,8 @@
           "uid": "${DS_PROMETHEUS}"
         },
         "enable": true,
-        "expr": "changes(process_start_time_seconds{instance=\"$instance\",job=~\"synapse\"}[$bucket_size]) * on (instance, job) group_left(version) synapse_build_info{instance=\"$instance\",job=\"synapse\"}",
+        "expr": "(\n  changes(process_start_time_seconds{job=\"synapse\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n) * on (instance, job, index) group_left(version) synapse_build_info{job=\"synapse\"}",
+        "hide": false,
         "iconColor": "purple",
         "name": "deploys",
         "titleFormat": "Deployed {{version}}"
@@ -77,14 +82,9 @@
       "type": "dashboards"
     }
   ],
-  "liveNow": false,
   "panels": [
     {
       "collapsed": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -93,31 +93,10 @@
       },
       "id": 73,
       "panels": [],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
-        }
-      ],
       "title": "Overview",
       "type": "row"
     },
     {
-      "cards": {
-        "cardPadding": -1,
-        "cardRound": 0
-      },
-      "color": {
-        "cardColor": "#b4ff00",
-        "colorScale": "sqrt",
-        "colorScheme": "interpolateInferno",
-        "exponent": 0.5,
-        "mode": "spectrum"
-      },
-      "dataFormat": "tsbuckets",
       "datasource": {
         "uid": "${DS_PROMETHEUS}"
       },
@@ -142,14 +121,7 @@
         "x": 0,
         "y": 1
       },
-      "heatmap": {},
-      "hideZeroBuckets": false,
-      "highlightCards": true,
       "id": 189,
-      "legend": {
-        "show": false
-      },
-      "links": [],
       "options": {
         "calculate": false,
         "calculation": {},
@@ -179,7 +151,8 @@
         },
         "showValue": "never",
         "tooltip": {
-          "show": true,
+          "mode": "single",
+          "showColorScale": false,
           "yHistogram": true
         },
         "yAxis": {
@@ -188,14 +161,13 @@
           "unit": "s"
         }
       },
-      "pluginVersion": "9.2.2",
-      "reverseYBuckets": false,
+      "pluginVersion": "12.3.1",
       "targets": [
         {
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',instance=\"$instance\",code=~\"2..\"}[$bucket_size])) by (le)",
+          "expr": "sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) by (le)",
           "format": "heatmap",
           "interval": "",
           "intervalFactor": 1,
@@ -204,33 +176,285 @@
         }
       ],
       "title": "Event Send Time (excluding errors, all workers)",
-      "tooltip": {
-        "show": true,
-        "showHistogram": true
-      },
-      "type": "heatmap",
-      "xAxis": {
-        "show": true
-      },
-      "yAxis": {
-        "format": "s",
-        "logBase": 2,
-        "show": true
-      },
-      "yBucketBound": "auto"
+      "type": "heatmap"
     },
     {
       "datasource": {
-        "uid": "${DS_PROMETHEUS}",
-        "type": "prometheus"
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
       },
-      "aliasColors": {},
-      "dashLength": 10,
+      "description": "",
       "fieldConfig": {
         "defaults": {
-          "links": []
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 35,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 0,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": true,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "line"
+            }
+          },
+          "links": [],
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "transparent",
+                "value": 0
+              },
+              {
+                "color": "orange",
+                "value": 1
+              },
+              {
+                "color": "red",
+                "value": 2
+              }
+            ]
+          },
+          "unit": "s"
         },
-        "overrides": []
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Avg"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineWidth",
+                "value": 3
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "99%"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#C4162A",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.fillBelowTo",
+                "value": "90%"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "90%"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#FF7383",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.fillBelowTo",
+                "value": "75%"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "75%"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#FFEE52",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.fillBelowTo",
+                "value": "50%"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "50%"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#73BF69",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.fillBelowTo",
+                "value": "25%"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "25%"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#1F60C4",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.fillBelowTo",
+                "value": "5%"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "5%"
+            },
+            "properties": [
+              {
+                "id": "custom.lineWidth",
+                "value": 0
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Average"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "rgb(255, 255, 255)",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.drawStyle",
+                "value": "line"
+              },
+              {
+                "id": "custom.lineWidth",
+                "value": 3
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Local events being persisted"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#96d98D",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.showPoints",
+                "value": "always"
+              },
+              {
+                "id": "unit",
+                "value": "hertz"
+              },
+              {
+                "id": "custom.axisPlacement",
+                "value": "right"
+              },
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "All events being persisted"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#B877D9",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.showPoints",
+                "value": "always"
+              },
+              {
+                "id": "unit",
+                "value": "hertz"
+              },
+              {
+                "id": "custom.axisPlacement",
+                "value": "right"
+              },
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              }
+            ]
+          }
+        ]
       },
       "gridPos": {
         "h": 9,
@@ -239,98 +463,27 @@
         "y": 1
       },
       "id": 152,
-      "legend": {
-        "avg": false,
-        "current": false,
-        "max": false,
-        "min": false,
-        "rightSide": false,
-        "show": true,
-        "total": false,
-        "values": false
-      },
-      "lines": true,
-      "nullPointMode": "connected",
       "options": {
-        "alertThreshold": true
-      },
-      "paceLength": 10,
-      "pluginVersion": "10.4.3",
-      "pointradius": 5,
-      "renderer": "flot",
-      "seriesOverrides": [
-        {
-          "alias": "Avg",
-          "fill": 0,
-          "linewidth": 3,
-          "$$hashKey": "object:48"
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
         },
-        {
-          "alias": "99%",
-          "color": "#C4162A",
-          "fillBelowTo": "90%",
-          "$$hashKey": "object:49"
-        },
-        {
-          "alias": "90%",
-          "color": "#FF7383",
-          "fillBelowTo": "75%",
-          "$$hashKey": "object:50"
-        },
-        {
-          "alias": "75%",
-          "color": "#FFEE52",
-          "fillBelowTo": "50%",
-          "$$hashKey": "object:51"
-        },
-        {
-          "alias": "50%",
-          "color": "#73BF69",
-          "fillBelowTo": "25%",
-          "$$hashKey": "object:52"
-        },
-        {
-          "alias": "25%",
-          "color": "#1F60C4",
-          "fillBelowTo": "5%",
-          "$$hashKey": "object:53"
-        },
-        {
-          "alias": "5%",
-          "lines": false,
-          "$$hashKey": "object:54"
-        },
-        {
-          "alias": "Average",
-          "color": "rgb(255, 255, 255)",
-          "lines": true,
-          "linewidth": 3,
-          "$$hashKey": "object:55"
-        },
-        {
-          "alias": "Local events being persisted",
-          "color": "#96d98D",
-          "points": true,
-          "yaxis": 2,
-          "zindex": -3,
-          "$$hashKey": "object:56"
-        },
-        {
-          "$$hashKey": "object:329",
-          "color": "#B877D9",
-          "alias": "All events being persisted",
-          "points": true,
-          "yaxis": 2,
-          "zindex": -3
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
         }
-      ],
-      "spaceLength": 10,
+      },
+      "pluginVersion": "12.3.1",
       "targets": [
         {
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "histogram_quantile(0.99, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) by (le))",
+          "expr": "histogram_quantile(0.99, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) by (le))",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "99%",
@@ -340,7 +493,7 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "histogram_quantile(0.9, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) by (le))",
+          "expr": "histogram_quantile(0.9, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) by (le))",
           "format": "time_series",
           "interval": "",
           "intervalFactor": 1,
@@ -351,7 +504,7 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "histogram_quantile(0.75, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) by (le))",
+          "expr": "histogram_quantile(0.75, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) by (le))",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "75%",
@@ -361,7 +514,7 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "histogram_quantile(0.5, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) by (le))",
+          "expr": "histogram_quantile(0.5, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) by (le))",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "50%",
@@ -371,7 +524,7 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "histogram_quantile(0.25, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) by (le))",
+          "expr": "histogram_quantile(0.25, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) by (le))",
           "legendFormat": "25%",
           "refId": "F"
         },
@@ -379,7 +532,7 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "histogram_quantile(0.05, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) by (le))",
+          "expr": "histogram_quantile(0.05, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) by (le))",
           "legendFormat": "5%",
           "refId": "G"
         },
@@ -387,161 +540,130 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "sum(rate(synapse_http_server_response_time_seconds_sum{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size])) / sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size]))",
-          "legendFormat": "Average",
-          "refId": "H",
           "editorMode": "code",
-          "range": true
+          "expr": "sum(rate(synapse_http_server_response_time_seconds_sum{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size])) / sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size]))",
+          "legendFormat": "Average",
+          "range": true,
+          "refId": "H"
         },
         {
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',index=~\"$index\",instance=\"$instance\",code=~\"2..\"}[$bucket_size]))",
+          "editorMode": "code",
+          "expr": "sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',index=~\"$index\",server_name=\"$server_name\",code=~\"2..\"}[$bucket_size]))",
           "hide": false,
           "instant": false,
           "legendFormat": "Local events being persisted",
-          "refId": "E",
-          "editorMode": "code"
+          "refId": "E"
         },
         {
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "sum(rate(synapse_storage_events_persisted_events_total{instance=\"$instance\"}[$bucket_size]))",
+          "editorMode": "code",
+          "expr": "sum(rate(synapse_storage_events_persisted_events_total{server_name=\"$server_name\"}[$bucket_size]))",
           "hide": false,
           "instant": false,
           "legendFormat": "All events being persisted",
-          "refId": "I",
-          "editorMode": "code"
+          "refId": "I"
         }
       ],
-      "thresholds": [
-        {
-          "$$hashKey": "object:283",
-          "colorMode": "warning",
-          "fill": false,
-          "line": true,
-          "op": "gt",
-          "value": 1,
-          "yaxis": "left"
-        },
-        {
-          "$$hashKey": "object:284",
-          "colorMode": "critical",
-          "fill": false,
-          "line": true,
-          "op": "gt",
-          "value": 2,
-          "yaxis": "left"
-        }
-      ],
-      "timeRegions": [],
       "title": "Event Send Time Quantiles (excluding errors, all workers)",
-      "tooltip": {
-        "shared": true,
-        "sort": 2,
-        "value_type": "individual"
-      },
-      "type": "graph",
-      "xaxis": {
-        "mode": "time",
-        "show": true,
-        "values": [],
-        "name": null,
-        "buckets": null
-      },
-      "yaxes": [
-        {
-          "$$hashKey": "object:255",
-          "format": "s",
-          "label": "",
-          "logBase": 1,
-          "min": "0",
-          "show": true
-        },
-        {
-          "$$hashKey": "object:256",
-          "format": "hertz",
-          "label": "",
-          "logBase": 1,
-          "min": "0",
-          "show": true
-        }
-      ],
-      "yaxis": {
-        "align": false
-      },
-      "bars": false,
-      "dashes": false,
-      "description": "",
-      "fill": 0,
-      "fillGradient": 0,
-      "hiddenSeries": false,
-      "linewidth": 0,
-      "percentage": false,
-      "points": false,
-      "stack": false,
-      "steppedLine": false,
-      "timeFrom": null,
-      "timeShift": null
+      "type": "timeseries"
     },
     {
-      "aliasColors": {},
-      "bars": false,
-      "dashLength": 10,
-      "dashes": false,
       "datasource": {
         "uid": "${DS_PROMETHEUS}"
       },
       "fieldConfig": {
         "defaults": {
-          "links": []
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 3,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "line+area"
+            }
+          },
+          "links": [],
+          "mappings": [],
+          "max": 1.5,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "transparent",
+                "value": 0
+              },
+              {
+                "color": "red",
+                "value": 1
+              }
+            ]
+          },
+          "unit": "percentunit"
         },
         "overrides": []
       },
-      "fill": 1,
-      "fillGradient": 0,
       "gridPos": {
         "h": 9,
         "w": 12,
         "x": 0,
         "y": 10
       },
-      "hiddenSeries": false,
       "id": 75,
-      "legend": {
-        "avg": false,
-        "current": false,
-        "max": false,
-        "min": false,
-        "show": true,
-        "total": false,
-        "values": false
-      },
-      "lines": true,
-      "linewidth": 3,
-      "links": [],
-      "nullPointMode": "null",
       "options": {
-        "alertThreshold": true
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
       },
-      "paceLength": 10,
-      "percentage": false,
-      "pluginVersion": "9.2.2",
-      "pointradius": 5,
-      "points": false,
-      "renderer": "flot",
-      "seriesOverrides": [],
-      "spaceLength": 10,
-      "stack": false,
-      "steppedLine": false,
+      "pluginVersion": "12.3.1",
       "targets": [
         {
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "rate(process_cpu_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+          "expr": "rate(process_cpu_seconds_total{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
           "format": "time_series",
           "interval": "",
           "intervalFactor": 1,
@@ -549,109 +671,100 @@
           "refId": "A"
         }
       ],
-      "thresholds": [
-        {
-          "$$hashKey": "object:566",
-          "colorMode": "critical",
-          "fill": true,
-          "line": true,
-          "op": "gt",
-          "value": 1,
-          "yaxis": "left"
-        }
-      ],
-      "timeRegions": [],
       "title": "CPU usage",
-      "tooltip": {
-        "shared": false,
-        "sort": 0,
-        "value_type": "individual"
-      },
-      "type": "graph",
-      "xaxis": {
-        "mode": "time",
-        "show": true,
-        "values": []
-      },
-      "yaxes": [
-        {
-          "$$hashKey": "object:538",
-          "format": "percentunit",
-          "logBase": 1,
-          "max": "1.5",
-          "min": "0",
-          "show": true
-        },
-        {
-          "$$hashKey": "object:539",
-          "format": "short",
-          "logBase": 1,
-          "show": true
-        }
-      ],
-      "yaxis": {
-        "align": false
-      }
+      "type": "timeseries"
     },
     {
-      "aliasColors": {},
-      "bars": false,
-      "dashLength": 10,
-      "dashes": false,
       "datasource": {
         "uid": "${DS_PROMETHEUS}"
       },
-      "editable": true,
-      "error": false,
       "fieldConfig": {
         "defaults": {
-          "links": []
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 3,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "links": [],
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "bytes"
         },
         "overrides": []
       },
-      "fill": 1,
-      "fillGradient": 0,
-      "grid": {},
       "gridPos": {
         "h": 9,
         "w": 12,
         "x": 12,
         "y": 10
       },
-      "hiddenSeries": false,
       "id": 198,
-      "legend": {
-        "avg": false,
-        "current": false,
-        "max": false,
-        "min": false,
-        "show": true,
-        "total": false,
-        "values": false
-      },
-      "lines": true,
-      "linewidth": 3,
-      "links": [],
-      "nullPointMode": "null",
       "options": {
-        "alertThreshold": true
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
       },
-      "paceLength": 10,
-      "percentage": false,
-      "pluginVersion": "9.2.2",
-      "pointradius": 5,
-      "points": false,
-      "renderer": "flot",
-      "seriesOverrides": [],
-      "spaceLength": 10,
-      "stack": false,
-      "steppedLine": false,
+      "pluginVersion": "12.3.1",
       "targets": [
         {
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "process_resident_memory_bytes{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+          "expr": "process_resident_memory_bytes{job=~\"$job\",index=~\"$index\"} * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
           "format": "time_series",
           "interval": "",
           "intervalFactor": 2,
@@ -664,46 +777,15 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "sum(process_resident_memory_bytes{instance=\"$instance\",job=~\"$job\",index=~\"$index\"})",
+          "expr": "sum(process_resident_memory_bytes{job=~\"$job\",index=~\"$index\"}) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
           "hide": true,
           "interval": "",
           "legendFormat": "total",
           "refId": "B"
         }
       ],
-      "thresholds": [],
-      "timeRegions": [],
       "title": "Memory",
-      "tooltip": {
-        "shared": false,
-        "sort": 0,
-        "value_type": "cumulative"
-      },
-      "transformations": [],
-      "type": "graph",
-      "xaxis": {
-        "mode": "time",
-        "show": true,
-        "values": []
-      },
-      "yaxes": [
-        {
-          "$$hashKey": "object:1560",
-          "format": "bytes",
-          "logBase": 1,
-          "min": "0",
-          "show": true
-        },
-        {
-          "$$hashKey": "object:1561",
-          "format": "short",
-          "logBase": 1,
-          "show": true
-        }
-      ],
-      "yaxis": {
-        "align": false
-      }
+      "type": "timeseries"
     },
     {
       "datasource": {
@@ -716,12 +798,14 @@
             "mode": "palette-classic"
           },
           "custom": {
+            "axisBorderShow": false,
             "axisCenteredZero": false,
             "axisColorMode": "text",
             "axisLabel": "",
             "axisPlacement": "auto",
             "axisSoftMax": 1,
             "barAlignment": 0,
+            "barWidthFactor": 0.6,
             "drawStyle": "line",
             "fillOpacity": 0,
             "gradientMode": "none",
@@ -730,6 +814,7 @@
               "tooltip": false,
               "viz": false
             },
+            "insertNulls": false,
             "lineInterpolation": "linear",
             "lineWidth": 10,
             "pointSize": 5,
@@ -737,6 +822,7 @@
               "type": "linear"
             },
             "showPoints": "never",
+            "showValues": false,
             "spanNulls": false,
             "stacking": {
               "group": "A",
@@ -752,7 +838,7 @@
             "steps": [
               {
                 "color": "green",
-                "value": null
+                "value": 0
               }
             ]
           }
@@ -774,10 +860,12 @@
           "showLegend": true
         },
         "tooltip": {
+          "hideZeros": false,
           "mode": "single",
           "sort": "none"
         }
       },
+      "pluginVersion": "12.3.1",
       "targets": [
         {
           "datasource": {
@@ -785,7 +873,7 @@
             "uid": "${DS_PROMETHEUS}"
           },
           "editorMode": "code",
-          "expr": "synapse_build_info{instance=\"$instance\", job=\"synapse\"} - 1",
+          "expr": "(\n  synapse_build_info{job=\"synapse\"} * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n) - 1",
           "legendFormat": "version {{version}}",
           "range": true,
           "refId": "deployed_synapse_versions"
@@ -795,69 +883,115 @@
       "type": "timeseries"
     },
     {
-      "aliasColors": {},
-      "bars": false,
-      "dashLength": 10,
-      "dashes": false,
       "datasource": {
         "uid": "${DS_PROMETHEUS}"
       },
       "fieldConfig": {
         "defaults": {
-          "links": []
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "links": [],
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
         },
-        "overrides": []
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byRegexp",
+              "options": "/max$/"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "#890F02",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              }
+            ]
+          }
+        ]
       },
-      "fill": 1,
-      "fillGradient": 0,
       "gridPos": {
         "h": 7,
         "w": 12,
         "x": 12,
         "y": 19
       },
-      "hiddenSeries": false,
       "id": 37,
-      "legend": {
-        "avg": false,
-        "current": false,
-        "max": false,
-        "min": false,
-        "show": true,
-        "total": false,
-        "values": false
-      },
-      "lines": true,
-      "linewidth": 1,
-      "links": [],
-      "nullPointMode": "null",
       "options": {
-        "alertThreshold": true
-      },
-      "paceLength": 10,
-      "percentage": false,
-      "pluginVersion": "9.2.2",
-      "pointradius": 5,
-      "points": false,
-      "renderer": "flot",
-      "seriesOverrides": [
-        {
-          "$$hashKey": "object:639",
-          "alias": "/max$/",
-          "color": "#890F02",
-          "fill": 0,
-          "legend": false
+        "alertThreshold": true,
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
         }
-      ],
-      "spaceLength": 10,
-      "stack": false,
-      "steppedLine": false,
+      },
+      "pluginVersion": "12.3.1",
       "targets": [
         {
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "process_open_fds{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+          "expr": "process_open_fds{job=~\"$job\",index=~\"$index\"} * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
           "format": "time_series",
           "hide": false,
           "interval": "",
@@ -870,7 +1004,7 @@
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "expr": "process_max_fds{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+          "expr": "process_max_fds{job=~\"$job\",index=~\"$index\"} * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
           "format": "time_series",
           "hide": true,
           "interval": "",
@@ -880,45 +1014,11 @@
           "step": 20
         }
       ],
-      "thresholds": [],
-      "timeRegions": [],
       "title": "Open FDs",
-      "tooltip": {
-        "shared": false,
-        "sort": 0,
-        "value_type": "individual"
-      },
-      "type": "graph",
-      "xaxis": {
-        "mode": "time",
-        "show": true,
-        "values": []
-      },
-      "yaxes": [
-        {
-          "$$hashKey": "object:650",
-          "format": "none",
-          "label": "",
-          "logBase": 1,
-          "show": true
-        },
-        {
-          "$$hashKey": "object:651",
-          "format": "short",
-          "logBase": 1,
-          "show": true
-        }
-      ],
-      "yaxis": {
-        "align": false
-      }
+      "type": "timeseries"
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -928,79 +1028,34 @@
       "id": 54,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 27
           },
-          "hiddenSeries": false,
           "id": 5,
-          "legend": {
-            "alignAsTable": false,
-            "avg": false,
-            "current": false,
-            "hideEmpty": false,
-            "hideZero": false,
-            "max": false,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 3,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "$$hashKey": "object:1240",
-              "alias": "/user/"
-            },
-            {
-              "$$hashKey": "object:1241",
-              "alias": "/system/"
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(process_cpu_system_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(process_cpu_system_seconds_total{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} system ",
@@ -1013,7 +1068,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(process_cpu_user_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(process_cpu_user_seconds_total{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -1023,70 +1078,8 @@
               "step": 20
             }
           ],
-          "thresholds": [
-            {
-              "$$hashKey": "object:1278",
-              "colorMode": "custom",
-              "fillColor": "rgba(255, 255, 255, 1)",
-              "line": true,
-              "lineColor": "rgba(216, 200, 27, 0.27)",
-              "op": "gt",
-              "value": 0.5,
-              "yaxis": "left"
-            },
-            {
-              "$$hashKey": "object:1279",
-              "colorMode": "custom",
-              "fillColor": "rgba(255, 255, 255, 1)",
-              "line": true,
-              "lineColor": "rgb(87, 6, 16)",
-              "op": "gt",
-              "value": 0.8,
-              "yaxis": "left"
-            },
-            {
-              "$$hashKey": "object:1498",
-              "colorMode": "critical",
-              "fill": true,
-              "line": true,
-              "op": "gt",
-              "value": 1,
-              "yaxis": "left"
-            }
-          ],
-          "timeRegions": [],
           "title": "CPU",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:1250",
-              "format": "percentunit",
-              "label": "",
-              "logBase": 1,
-              "max": "1.2",
-              "min": 0,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:1251",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
           "datasource": {
@@ -1154,8 +1147,6 @@
             "y": 27
           },
           "id": 105,
-          "interval": "",
-          "links": [],
           "options": {
             "legend": {
               "calcs": [],
@@ -1176,7 +1167,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "histogram_quantile(0.999, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",instance=\"$instance\",job=~\"$job\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.999, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",job=~\"$job\"}[$bucket_size])) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "hide": false,
               "interval": "",
               "legendFormat": "{{job}}-{{index}} 99.9%",
@@ -1188,7 +1179,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "histogram_quantile(0.99, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",instance=\"$instance\",job=~\"$job\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.99, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",job=~\"$job\"}[$bucket_size])) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -1202,7 +1193,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "histogram_quantile(0.95, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",instance=\"$instance\",job=~\"$job\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.95, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",job=~\"$job\"}[$bucket_size])) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -1214,7 +1205,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.90, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",instance=\"$instance\",job=~\"$job\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.90, rate(python_twisted_reactor_tick_time_bucket{index=~\"$index\",job=~\"$job\"}[$bucket_size])) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} 90%",
@@ -1225,7 +1216,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(python_twisted_reactor_tick_time_sum{index=~\"$index\",instance=\"$instance\",job=~\"$job\"}[$bucket_size]) / rate(python_twisted_reactor_tick_time_count{index=~\"$index\",instance=\"$instance\",job=~\"$job\"}[$bucket_size])",
+              "expr": "(\n\trate(python_twisted_reactor_tick_time_sum{index=~\"$index\",job=~\"$job\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\n\tsynapse_server_name_info{server_name=\"$server_name\"}\n) / (\n\trate(python_twisted_reactor_tick_time_count{index=~\"$index\",job=~\"$job\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\n\tsynapse_server_name_info{server_name=\"$server_name\"}\n)",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} mean",
@@ -1236,64 +1227,32 @@
           "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 34
           },
-          "hiddenSeries": false,
           "id": 34,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "process_resident_memory_bytes{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "process_resident_memory_bytes{job=~\"$job\",index=~\"$index\"} * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -1306,49 +1265,16 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(process_resident_memory_bytes{instance=\"$instance\",job=~\"$job\",index=~\"$index\"})",
+              "expr": "sum by (server_name) (\n  process_resident_memory_bytes{job=~\"$job\",index=~\"$index\"} * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n)",
               "interval": "",
               "legendFormat": "total",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Memory",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "transformations": [],
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "bytes",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -1358,54 +1284,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 34
           },
-          "hiddenSeries": false,
           "id": 49,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "alias": "/^up/",
-              "legend": false,
-              "yaxis": 2
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "scrape_duration_seconds{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "scrape_duration_seconds{job=~\"$job\",index=~\"$index\"} * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -1414,46 +1309,10 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Prometheus scrape time",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "s",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "decimals": 0,
-              "format": "none",
-              "label": "",
-              "logBase": 1,
-              "max": "0",
-              "min": "-1",
-              "show": false
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -1464,57 +1323,24 @@
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 41
           },
-          "hiddenSeries": false,
           "id": 53,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "$$hashKey": "object:116",
-              "alias": "/^version .*/",
-              "lines": true,
-              "linewidth": 6,
-              "points": false
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "min_over_time(up{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "min_over_time(up{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{job}}-{{index}}",
@@ -1527,48 +1353,17 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "synapse_build_info{instance=\"$instance\", job=\"synapse\"} - 1",
+              "expr": "(\n  synapse_build_info{job=\"synapse\"} * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n) - 1",
               "hide": false,
               "legendFormat": "version {{version}}",
               "range": true,
               "refId": "deployed_synapse_versions"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Up",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -1578,47 +1373,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 41
           },
-          "hiddenSeries": false,
           "id": 120,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null as zero",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": true,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_http_server_response_ru_utime_seconds{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_http_server_response_ru_stime_seconds{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_http_server_response_ru_utime_seconds{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_http_server_response_ru_stime_seconds{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "hide": false,
               "instant": false,
@@ -1630,7 +1401,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_background_process_ru_utime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_background_process_ru_stime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_background_process_ru_utime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_background_process_ru_stime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "hide": false,
               "instant": false,
@@ -1640,52 +1411,10 @@
               "refId": "B"
             }
           ],
-          "thresholds": [
-            {
-              "colorMode": "critical",
-              "fill": true,
-              "line": true,
-              "op": "gt",
-              "value": 1,
-              "yaxis": "left"
-            }
-          ],
-          "timeRegions": [],
           "title": "Stacked CPU usage",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:572",
-              "format": "percentunit",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:573",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -1696,48 +1425,24 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 48
           },
-          "hiddenSeries": false,
           "id": 136,
-          "interval": "",
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_http_client_requests_total{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_http_client_requests_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "legendFormat": "{{job}}-{{index}} {{method}}",
               "range": true,
               "refId": "A"
@@ -1747,43 +1452,14 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_http_matrixfederationclient_requests_total{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_http_matrixfederationclient_requests_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "legendFormat": "{{job}}-{{index}} {{method}} (federation)",
               "range": true,
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Outgoing HTTP request rate",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:123",
-              "format": "reqps",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:124",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
           "datasource": {
@@ -1867,7 +1543,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "synapse_threadpool_working_threads{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_threadpool_working_threads{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "interval": "",
               "legendFormat": "{{job}}-{{index}} {{name}}",
               "refId": "A"
@@ -1877,24 +1553,11 @@
           "type": "timeseries"
         }
       ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
-        }
-      ],
       "title": "Process info",
       "type": "row"
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -1904,18 +1567,6 @@
       "id": 56,
       "panels": [
         {
-          "cards": {
-            "cardPadding": -1,
-            "cardRound": 0
-          },
-          "color": {
-            "cardColor": "#b4ff00",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "mode": "spectrum"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -1940,14 +1591,7 @@
             "x": 0,
             "y": 28
           },
-          "heatmap": {},
-          "hideZeroBuckets": false,
-          "highlightCards": true,
           "id": 85,
-          "legend": {
-            "show": false
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -1987,13 +1631,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',instance=\"$instance\"}[$bucket_size])) by (le)",
+              "expr": "sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',server_name=\"$server_name\"}[$bucket_size])) by (le)",
               "format": "heatmap",
               "intervalFactor": 1,
               "legendFormat": "{{le}}",
@@ -2001,81 +1644,36 @@
             }
           ],
           "title": "Event Send Time (Including errors, across all workers)",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "format": "s",
-            "logBase": 2,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
           "description": "",
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 28
           },
-          "hiddenSeries": false,
           "id": 33,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": false,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_storage_events_persisted_events_total{instance=\"$instance\"}[$bucket_size])) without (job,index)",
+              "expr": "sum(rate(synapse_storage_events_persisted_events_total{server_name=\"$server_name\"}[$bucket_size])) without (job,index)",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -2085,176 +1683,68 @@
               "target": ""
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Events Persisted (all workers)",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:102",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:103",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "decimals": 1,
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 37
           },
-          "hiddenSeries": false,
           "id": 40,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_events_persisted_by_source_type{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_storage_events_persisted_events_sep_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "intervalFactor": 2,
-              "legendFormat": "{{type}}",
+              "legendFormat": "{{origin_type}}",
               "refId": "D"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Events/s Local vs Remote",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "decimals": 1,
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 37
           },
-          "hiddenSeries": false,
           "id": 46,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_events_persisted_by_event_type{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "sum by(type) (rate(synapse_storage_events_persisted_events_sep_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "instant": false,
               "intervalFactor": 2,
@@ -2263,185 +1753,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Events/s by Type",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {
-            "irc-freenode (local)": "#EAB839"
-          },
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
-          "datasource": {
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "decimals": 1,
-          "fill": 1,
-          "fillGradient": 0,
-          "gridPos": {
-            "h": 7,
-            "w": 12,
-            "x": 0,
-            "y": 44
-          },
-          "hiddenSeries": false,
-          "id": 44,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
-          "options": {
-            "alertThreshold": true
-          },
-          "percentage": false,
-          "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
-          "targets": [
-            {
-              "datasource": {
-                "uid": "${DS_PROMETHEUS}"
-              },
-              "expr": "rate(synapse_storage_events_persisted_by_origin{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
-              "format": "time_series",
-              "intervalFactor": 2,
-              "legendFormat": "{{origin_entity}} ({{origin_type}})",
-              "refId": "A",
-              "step": 20
-            }
-          ],
-          "thresholds": [],
-          "timeRegions": [],
-          "title": "Events/s by Origin",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        },
-        {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "decimals": 1,
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 44
           },
-          "hiddenSeries": false,
           "id": 45,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "sum(rate(synapse_storage_events_persisted_events_sep_total{job=~\"$job\",index=~\"$index\", type=\"m.room.member\",instance=\"$instance\", origin_type=\"local\"}[$bucket_size])) by (origin_type, origin_entity)",
+              "expr": "sum(rate(synapse_storage_events_persisted_events_sep_total{job=~\"$job\",index=~\"$index\", type=\"m.room.member\",server_name=\"$server_name\", origin_type=\"local\"}[$bucket_size])) by (origin_type, origin_entity)",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{origin_entity}} ({{origin_type}})",
@@ -2450,44 +1791,10 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Memberships/s by Origin",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:232",
-              "format": "hertz",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "$$hashKey": "object:233",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -2498,49 +1805,17 @@
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 51
           },
-          "hiddenSeries": false,
           "id": 118,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "repeatDirection": "h",
-          "seriesOverrides": [
-            {
-              "$$hashKey": "object:316",
-              "alias": "mean",
-              "linewidth": 2
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -2548,7 +1823,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "histogram_quantile(0.99, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',instance=\"$instance\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
+              "expr": "histogram_quantile(0.99, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',server_name=\"$server_name\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -2560,7 +1835,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.95, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',instance=\"$instance\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
+              "expr": "histogram_quantile(0.95, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',server_name=\"$server_name\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -2572,7 +1847,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.90, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',instance=\"$instance\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
+              "expr": "histogram_quantile(0.90, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',server_name=\"$server_name\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} 90%",
@@ -2583,7 +1858,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.50, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',instance=\"$instance\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
+              "expr": "histogram_quantile(0.50, sum(rate(synapse_http_server_response_time_seconds_bucket{servlet='RoomSendEventRestServlet',server_name=\"$server_name\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} 50%",
@@ -2595,7 +1870,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "sum(rate(synapse_http_server_response_time_seconds_sum{servlet='RoomSendEventRestServlet',instance=\"$instance\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method) / sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',instance=\"$instance\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method)",
+              "expr": "sum(rate(synapse_http_server_response_time_seconds_sum{servlet='RoomSendEventRestServlet',server_name=\"$server_name\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method) / sum(rate(synapse_http_server_response_time_seconds_count{servlet='RoomSendEventRestServlet',server_name=\"$server_name\",code=~\"2..\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (method)",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} mean",
@@ -2603,37 +1878,8 @@
               "refId": "E"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Event send time quantiles by worker",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:263",
-              "format": "s",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:264",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
           "datasource": {
@@ -2719,7 +1965,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": false,
-              "expr": "sum(rate(synapse_state_res_db_for_biggest_room_seconds_total{instance=\"$instance\"}[1m]))",
+              "expr": "sum(rate(synapse_state_res_db_for_biggest_room_seconds_total{server_name=\"$server_name\"}[1m]))",
               "format": "time_series",
               "hide": false,
               "instant": false,
@@ -2733,7 +1979,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": false,
-              "expr": "sum(rate(synapse_state_res_cpu_for_biggest_room_seconds_total{instance=\"$instance\"}[1m]))",
+              "expr": "sum(rate(synapse_state_res_cpu_for_biggest_room_seconds_total{server_name=\"$server_name\"}[1m]))",
               "format": "time_series",
               "hide": false,
               "instant": false,
@@ -2746,24 +1992,11 @@
           "type": "timeseries"
         }
       ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
-        }
-      ],
       "title": "Event persistence",
       "type": "row"
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -2773,68 +2006,33 @@
       "id": 57,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 2,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 29
           },
-          "hiddenSeries": false,
           "id": 4,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": false,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_http_server_requests_received_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_http_server_requests_received_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -2843,116 +2041,37 @@
               "step": 20
             }
           ],
-          "thresholds": [
-            {
-              "$$hashKey": "object:234",
-              "colorMode": "custom",
-              "fill": true,
-              "fillColor": "rgba(216, 200, 27, 0.27)",
-              "op": "gt",
-              "value": 100,
-              "yaxis": "left"
-            },
-            {
-              "$$hashKey": "object:235",
-              "colorMode": "custom",
-              "fill": true,
-              "fillColor": "rgba(234, 112, 112, 0.22)",
-              "op": "gt",
-              "value": 250,
-              "yaxis": "left"
-            }
-          ],
-          "timeRegions": [],
           "title": "Request Count by arrival time",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:206",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:207",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 29
           },
-          "hiddenSeries": false,
           "id": 32,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_http_server_requests_received_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\",method!=\"OPTIONS\"}[$bucket_size]) and topk(10,synapse_http_server_requests_received_total{instance=\"$instance\",job=~\"$job\",method!=\"OPTIONS\"})",
+              "expr": "rate(synapse_http_server_requests_received_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\",method!=\"OPTIONS\"}[$bucket_size]) and topk(10,synapse_http_server_requests_received_total{server_name=\"$server_name\",job=~\"$job\",method!=\"OPTIONS\"})",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{method}} {{servlet}} {{job}}-{{index}}",
@@ -2961,101 +2080,37 @@
               "target": ""
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Top 10 Request Counts",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:305",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:306",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 2,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 37
           },
-          "hiddenSeries": false,
           "id": 139,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": false,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_http_server_in_flight_requests_ru_utime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_http_server_in_flight_requests_ru_stime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_http_server_in_flight_requests_ru_utime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_http_server_in_flight_requests_ru_stime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -3064,120 +2119,37 @@
               "step": 20
             }
           ],
-          "thresholds": [
-            {
-              "$$hashKey": "object:135",
-              "colorMode": "custom",
-              "fill": true,
-              "fillColor": "rgba(216, 200, 27, 0.27)",
-              "op": "gt",
-              "value": 100,
-              "yaxis": "left"
-            },
-            {
-              "$$hashKey": "object:136",
-              "colorMode": "custom",
-              "fill": true,
-              "fillColor": "rgba(234, 112, 112, 0.22)",
-              "op": "gt",
-              "value": 250,
-              "yaxis": "left"
-            }
-          ],
-          "timeRegions": [],
           "title": "Total CPU Usage by Endpoint",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:107",
-              "format": "percentunit",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:108",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 37
           },
-          "hiddenSeries": false,
           "id": 52,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": false,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "(rate(synapse_http_server_in_flight_requests_ru_utime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_http_server_in_flight_requests_ru_stime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) / rate(synapse_http_server_requests_received_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "(rate(synapse_http_server_in_flight_requests_ru_utime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_http_server_in_flight_requests_ru_stime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) / rate(synapse_http_server_requests_received_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -3186,119 +2158,37 @@
               "step": 20
             }
           ],
-          "thresholds": [
-            {
-              "$$hashKey": "object:417",
-              "colorMode": "custom",
-              "fill": true,
-              "fillColor": "rgba(216, 200, 27, 0.27)",
-              "op": "gt",
-              "value": 100,
-              "yaxis": "left"
-            },
-            {
-              "$$hashKey": "object:418",
-              "colorMode": "custom",
-              "fill": true,
-              "fillColor": "rgba(234, 112, 112, 0.22)",
-              "op": "gt",
-              "value": 250,
-              "yaxis": "left"
-            }
-          ],
-          "timeRegions": [],
           "title": "Average CPU Usage by Endpoint",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:389",
-              "format": "s",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:390",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 45
           },
-          "hiddenSeries": false,
           "id": 7,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_http_server_in_flight_requests_db_txn_duration_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_http_server_in_flight_requests_db_txn_duration_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -3307,100 +2197,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "DB Usage by endpoint",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:488",
-              "format": "percentunit",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:489",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 2,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 45
           },
-          "hiddenSeries": false,
           "id": 47,
-          "legend": {
-            "alignAsTable": true,
-            "avg": true,
-            "current": false,
-            "hideEmpty": false,
-            "hideZero": true,
-            "max": true,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "total": false,
-            "values": true
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "(sum(rate(synapse_http_server_response_time_seconds_sum{instance=\"$instance\",job=~\"$job\",index=~\"$index\",tag!=\"incremental_sync\"}[$bucket_size])) without (code))/(sum(rate(synapse_http_server_response_time_seconds_count{instance=\"$instance\",job=~\"$job\",index=~\"$index\",tag!=\"incremental_sync\"}[$bucket_size])) without (code))",
+              "expr": "(sum(rate(synapse_http_server_response_time_seconds_sum{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\",tag!=\"incremental_sync\"}[$bucket_size])) without (code))/(sum(rate(synapse_http_server_response_time_seconds_count{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\",tag!=\"incremental_sync\"}[$bucket_size])) without (code))",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -3410,41 +2236,10 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Non-sync avg response time",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "s",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": false
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -3454,54 +2249,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 53
           },
-          "hiddenSeries": false,
           "id": 103,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "alias": "Total",
-              "color": "rgb(255, 255, 255)",
-              "fill": 0,
-              "linewidth": 3
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "topk(10,synapse_http_server_in_flight_requests_count{instance=\"$instance\",job=~\"$job\",index=~\"$index\"})",
+              "expr": "topk(10,synapse_http_server_in_flight_requests_count{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"})",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -3512,50 +2276,14 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(avg_over_time(synapse_http_server_in_flight_requests_count{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(avg_over_time(synapse_http_server_in_flight_requests_count{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]))",
               "interval": "",
               "legendFormat": "Total",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Requests in flight",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Requests",
@@ -3563,10 +2291,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -3576,10 +2300,6 @@
       "id": 97,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -3589,48 +2309,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 30
           },
-          "hiddenSeries": false,
           "id": 99,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_background_process_ru_utime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_background_process_ru_stime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_background_process_ru_utime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])+rate(synapse_background_process_ru_stime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -3638,41 +2333,10 @@
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "CPU usage by background jobs",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -3682,48 +2346,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 30
           },
-          "hiddenSeries": false,
           "id": 101,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_background_process_db_txn_duration_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) +  rate(synapse_background_process_db_sched_duration_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_background_process_db_txn_duration_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) +  rate(synapse_background_process_db_sched_duration_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 1,
@@ -3731,41 +2370,10 @@
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "DB usage by background jobs (including scheduling time)",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -3775,88 +2383,29 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 39
           },
-          "hiddenSeries": false,
           "id": 138,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_background_process_in_flight_count{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}",
+              "expr": "synapse_background_process_in_flight_count{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}",
               "legendFormat": "{{job}}-{{index}} {{name}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Background jobs in flight",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Background jobs",
@@ -3864,10 +2413,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -3877,10 +2422,6 @@
       "id": 81,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -3890,48 +2431,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 31
           },
-          "hiddenSeries": false,
           "id": 79,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_federation_client_sent_transactions_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_federation_client_sent_transactions_total{server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "successful txn rate",
@@ -3941,46 +2457,15 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_util_metrics_block_count_total{block_name=\"_send_new_transaction\",instance=\"$instance\"}[$bucket_size]) - ignoring (block_name) rate(synapse_federation_client_sent_transactions_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_util_metrics_block_count_total{block_name=\"_send_new_transaction\",server_name=\"$server_name\"}[$bucket_size]) - ignoring (block_name) rate(synapse_federation_client_sent_transactions_total{server_name=\"$server_name\"}[$bucket_size]))",
               "legendFormat": "failed txn rate",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Outgoing federation transaction rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -3990,48 +2475,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 31
           },
-          "hiddenSeries": false,
           "id": 83,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_federation_server_received_pdus_total{instance=~\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_federation_server_received_pdus_total{server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "pdus",
@@ -4041,48 +2501,17 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_federation_server_received_edus_total{instance=~\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_federation_server_received_edus_total{server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "edus",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Incoming PDU/EDU rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -4093,49 +2522,24 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 40
           },
-          "hiddenSeries": false,
           "id": 109,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "sum(rate(synapse_federation_client_sent_pdu_destinations_count_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_federation_client_sent_pdu_destinations_count_total{server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -4147,48 +2551,17 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_federation_client_sent_edus_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_federation_client_sent_edus_total{server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "edus",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Outgoing PDU/EDU rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -4199,49 +2572,24 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 40
           },
-          "hiddenSeries": false,
           "id": 111,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_federation_client_sent_edus_by_type_total{instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_federation_client_sent_edus_by_type_total{server_name=\"$server_name\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -4250,37 +2598,8 @@
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Outgoing EDUs by type",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:462",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:463",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
           "datasource": {
@@ -4359,7 +2678,7 @@
                     "id": "custom.hideFrom",
                     "value": {
                       "legend": false,
-                      "tooltip": false,
+                      "tooltip": true,
                       "viz": true
                     }
                   }
@@ -4481,7 +2800,7 @@
                     "id": "custom.hideFrom",
                     "value": {
                       "legend": false,
-                      "tooltip": false,
+                      "tooltip": true,
                       "viz": true
                     }
                   }
@@ -4527,10 +2846,6 @@
           "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -4542,40 +2857,17 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 57
           },
-          "hiddenSeries": false,
           "id": 142,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -4583,7 +2875,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "synapse_federation_transaction_queue_pending_pdus{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_transaction_queue_pending_pdus{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "interval": "",
               "legendFormat": "pending PDUs {{job}}-{{index}}",
               "range": true,
@@ -4594,52 +2886,16 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_federation_transaction_queue_pending_edus{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_transaction_queue_pending_edus{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "interval": "",
               "legendFormat": "pending EDUs {{job}}-{{index}}",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "In-memory federation transmission queues",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:547",
-              "format": "short",
-              "label": "events",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "$$hashKey": "object:548",
-              "format": "short",
-              "label": "",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -4650,48 +2906,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 57
           },
-          "hiddenSeries": false,
           "id": 140,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_federation_send_queue_presence_changed_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_send_queue_presence_changed_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -4702,7 +2933,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_federation_send_queue_presence_map_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_send_queue_presence_map_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -4714,7 +2945,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_federation_send_queue_presence_destinations_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_send_queue_presence_destinations_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -4726,7 +2957,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_federation_send_queue_keyed_edu_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_send_queue_keyed_edu_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -4738,7 +2969,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_federation_send_queue_edus_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_send_queue_edus_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -4750,7 +2981,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_federation_send_queue_pos_time_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_federation_send_queue_pos_time_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -4759,50 +2990,10 @@
               "refId": "F"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Outgoing EDU queues on master",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "none",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "cards": {
-            "cardPadding": -1
-          },
-          "color": {
-            "cardColor": "#b4ff00",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "spectrum"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -4827,14 +3018,7 @@
             "x": 0,
             "y": 66
           },
-          "heatmap": {},
-          "hideZeroBuckets": false,
-          "highlightCards": true,
           "id": 166,
-          "legend": {
-            "show": false
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -4877,13 +3061,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_event_processing_lag_by_event_bucket{instance=\"$instance\",name=\"federation_sender\"}[$bucket_size])) by (le)",
+              "expr": "sum(rate(synapse_event_processing_lag_by_event_bucket{server_name=\"$server_name\",name=\"federation_sender\"}[$bucket_size])) by (le)",
               "format": "heatmap",
               "instant": false,
               "interval": "",
@@ -4893,28 +3076,9 @@
             }
           ],
           "title": "Federation send PDU lag",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "tooltipDecimals": 2,
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "decimals": 0,
-            "format": "s",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -4924,90 +3088,23 @@
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 66
           },
-          "hiddenSeries": false,
           "id": 162,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 0,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "alias": "Avg",
-              "fill": 0,
-              "linewidth": 3
-            },
-            {
-              "alias": "99%",
-              "color": "#C4162A",
-              "fillBelowTo": "90%"
-            },
-            {
-              "alias": "90%",
-              "color": "#FF7383",
-              "fillBelowTo": "75%"
-            },
-            {
-              "alias": "75%",
-              "color": "#FFEE52",
-              "fillBelowTo": "50%"
-            },
-            {
-              "alias": "50%",
-              "color": "#73BF69",
-              "fillBelowTo": "25%"
-            },
-            {
-              "alias": "25%",
-              "color": "#1F60C4",
-              "fillBelowTo": "5%"
-            },
-            {
-              "alias": "5%",
-              "lines": false
-            },
-            {
-              "alias": "Average",
-              "color": "rgb(255, 255, 255)",
-              "lines": true,
-              "linewidth": 3
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.99, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.99, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -5018,7 +3115,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.9, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.9, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -5029,7 +3126,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.75, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.75, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -5040,7 +3137,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.5, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.5, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -5051,7 +3148,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.25, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.25, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "interval": "",
               "legendFormat": "25%",
               "refId": "F"
@@ -5060,7 +3157,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.05, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.05, sum(rate(synapse_event_processing_lag_by_event_bucket{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "interval": "",
               "legendFormat": "5%",
               "refId": "G"
@@ -5069,76 +3166,16 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_event_processing_lag_by_event_sum{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size])) / sum(rate(synapse_event_processing_lag_by_event_count{name='federation_sender',index=~\"$index\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_event_processing_lag_by_event_sum{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) / sum(rate(synapse_event_processing_lag_by_event_count{name='federation_sender',index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]))",
               "interval": "",
               "legendFormat": "Average",
               "refId": "H"
             }
           ],
-          "thresholds": [
-            {
-              "colorMode": "warning",
-              "fill": false,
-              "line": true,
-              "op": "gt",
-              "value": 0.25,
-              "yaxis": "left"
-            },
-            {
-              "colorMode": "critical",
-              "fill": false,
-              "line": true,
-              "op": "gt",
-              "value": 1,
-              "yaxis": "left"
-            }
-          ],
-          "timeRegions": [],
           "title": "Federation send PDU lag quantiles",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "s",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "hertz",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "cards": {
-            "cardPadding": -1
-          },
-          "color": {
-            "cardColor": "#b4ff00",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "spectrum"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -5163,14 +3200,7 @@
             "x": 0,
             "y": 75
           },
-          "heatmap": {},
-          "hideZeroBuckets": false,
-          "highlightCards": true,
           "id": 164,
-          "legend": {
-            "show": false
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -5213,13 +3243,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_federation_server_pdu_process_time_bucket{instance=\"$instance\"}[$bucket_size])) by (le)",
+              "expr": "sum(rate(synapse_federation_server_pdu_process_time_bucket{server_name=\"$server_name\"}[$bucket_size])) by (le)",
               "format": "heatmap",
               "instant": false,
               "interval": "",
@@ -5229,84 +3258,37 @@
             }
           ],
           "title": "Handle inbound PDU time",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "tooltipDecimals": 2,
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "decimals": 0,
-            "format": "s",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 75
           },
-          "hiddenSeries": false,
           "id": 203,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "synapse_federation_server_oldest_inbound_pdu_in_staging{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}",
+              "expr": "synapse_federation_server_oldest_inbound_pdu_in_staging{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -5316,101 +3298,38 @@
               "step": 4
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Age of oldest event in staging area",
-          "tooltip": {
-            "msResolution": false,
-            "shared": true,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:92",
-              "format": "ms",
-              "logBase": 1,
-              "min": 0,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:93",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 84
           },
-          "hiddenSeries": false,
           "id": 202,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "synapse_federation_server_number_inbound_pdu_in_staging{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}",
+              "expr": "synapse_federation_server_number_inbound_pdu_in_staging{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -5420,135 +3339,43 @@
               "step": 4
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Number of events in federation staging area",
-          "tooltip": {
-            "msResolution": false,
-            "shared": true,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:92",
-              "format": "none",
-              "logBase": 1,
-              "min": 0,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:93",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 84
           },
-          "hiddenSeries": false,
           "id": 205,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_federation_soft_failed_events_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_federation_soft_failed_events_total{server_name=\"$server_name\"}[$bucket_size]))",
               "interval": "",
               "legendFormat": "soft-failed events",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Soft-failed event rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:131",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:132",
-              "format": "short",
-              "logBase": 1,
-              "show": false
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Federation",
@@ -5645,7 +3472,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(increase(synapse_rate_limit_reject_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(increase(synapse_rate_limit_reject_total{server_name=\"$server_name\"}[$bucket_size]))",
               "refId": "A"
             }
           ],
@@ -5733,7 +3560,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(increase(synapse_rate_limit_sleep_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(increase(synapse_rate_limit_sleep_total{server_name=\"$server_name\"}[$bucket_size]))",
               "refId": "A"
             }
           ],
@@ -5823,7 +3650,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(increase(synapse_rate_limit_reject_affected_hosts{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(increase(synapse_rate_limit_reject_affected_hosts{server_name=\"$server_name\"}[$bucket_size]))",
               "refId": "A"
             }
           ],
@@ -5913,7 +3740,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(increase(synapse_rate_limit_sleep_affected_hosts{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(increase(synapse_rate_limit_sleep_affected_hosts{server_name=\"$server_name\"}[$bucket_size]))",
               "refId": "A"
             }
           ],
@@ -5921,10 +3748,6 @@
           "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -5936,106 +3759,24 @@
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 170
           },
-          "hiddenSeries": false,
           "id": 229,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 0,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "$$hashKey": "object:276",
-              "alias": "Avg",
-              "fill": 0,
-              "linewidth": 3
-            },
-            {
-              "$$hashKey": "object:277",
-              "alias": "99%",
-              "color": "#C4162A",
-              "fillBelowTo": "90%"
-            },
-            {
-              "$$hashKey": "object:278",
-              "alias": "90%",
-              "color": "#FF7383",
-              "fillBelowTo": "75%"
-            },
-            {
-              "$$hashKey": "object:279",
-              "alias": "75%",
-              "color": "#FFEE52",
-              "fillBelowTo": "50%"
-            },
-            {
-              "$$hashKey": "object:280",
-              "alias": "50%",
-              "color": "#73BF69",
-              "fillBelowTo": "25%"
-            },
-            {
-              "$$hashKey": "object:281",
-              "alias": "25%",
-              "color": "#1F60C4",
-              "fillBelowTo": "5%"
-            },
-            {
-              "$$hashKey": "object:282",
-              "alias": "5%",
-              "lines": false
-            },
-            {
-              "$$hashKey": "object:283",
-              "alias": "Average",
-              "color": "rgb(255, 255, 255)",
-              "lines": true,
-              "linewidth": 3
-            },
-            {
-              "$$hashKey": "object:284",
-              "alias": ">99%",
-              "color": "#B877D9",
-              "fill": 3,
-              "lines": true
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "histogram_quantile(0.9995, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.9995, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 1,
@@ -6048,7 +3789,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "histogram_quantile(0.99, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.99, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "99%",
@@ -6059,7 +3800,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.9, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.9, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -6070,7 +3811,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.75, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.75, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "75%",
@@ -6080,7 +3821,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.5, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.5, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "50%",
@@ -6090,7 +3831,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.25, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.25, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "legendFormat": "25%",
               "refId": "F"
             },
@@ -6098,7 +3839,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.05, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.05, sum(rate(synapse_rate_limit_queue_wait_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) by (le))",
               "legendFormat": "5%",
               "refId": "G"
             },
@@ -6106,65 +3847,13 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_rate_limit_queue_wait_time_seconds_sum{index=~\"$index\",instance=\"$instance\"}[$bucket_size])) / sum(rate(synapse_rate_limit_queue_wait_time_seconds_count{index=~\"$index\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_rate_limit_queue_wait_time_seconds_sum{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])) / sum(rate(synapse_rate_limit_queue_wait_time_seconds_count{index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]))",
               "legendFormat": "Average",
               "refId": "H"
             }
           ],
-          "thresholds": [
-            {
-              "$$hashKey": "object:283",
-              "colorMode": "warning",
-              "fill": false,
-              "line": true,
-              "op": "gt",
-              "value": 1,
-              "yaxis": "left"
-            },
-            {
-              "$$hashKey": "object:284",
-              "colorMode": "critical",
-              "fill": false,
-              "line": true,
-              "op": "gt",
-              "value": 2,
-              "yaxis": "left"
-            }
-          ],
-          "timeRegions": [],
           "title": "Rate limit queue wait time Quantiles (all workers)",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:255",
-              "format": "s",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "$$hashKey": "object:256",
-              "format": "hertz",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
           "datasource": {
@@ -6264,7 +3953,7 @@
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_rate_limit_sleep_total{instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_rate_limit_sleep_total{server_name=\"$server_name\"}[$bucket_size]))",
               "refId": "A"
             },
             {
@@ -6289,10 +3978,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -6366,7 +4051,6 @@
             "y": 155
           },
           "id": 51,
-          "links": [],
           "options": {
             "legend": {
               "calcs": [],
@@ -6386,7 +4070,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_http_httppusher_http_pushes_processed_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) and on (instance, job, index) (synapse_http_httppusher_http_pushes_failed_total + synapse_http_httppusher_http_pushes_processed_total) > 0",
+              "expr": "rate(synapse_http_httppusher_http_pushes_processed_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) and on (instance, job, index) (synapse_http_httppusher_http_pushes_failed_total + synapse_http_httppusher_http_pushes_processed_total) > 0",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -6400,7 +4084,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_http_httppusher_http_pushes_failed_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) and on (instance, job, index) (synapse_http_httppusher_http_pushes_failed_total + synapse_http_httppusher_http_pushes_processed_total) > 0",
+              "expr": "rate(synapse_http_httppusher_http_pushes_failed_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) and on (instance, job, index) (synapse_http_httppusher_http_pushes_failed_total + synapse_http_httppusher_http_pushes_processed_total) > 0",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "failed {{job}}-{{index}}",
@@ -6413,10 +4097,6 @@
           "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -6427,89 +4107,29 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 155
           },
-          "hiddenSeries": false,
           "id": 134,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "hideZero": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "topk(10,synapse_pushers{job=~\"$job\",index=~\"$index\", instance=\"$instance\"})",
+              "expr": "topk(10,synapse_pushers{job=~\"$job\",index=~\"$index\", server_name=\"$server_name\"})",
               "legendFormat": "{{kind}} {{app_id}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Active pusher instances by app",
-          "tooltip": {
-            "shared": false,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Pushes",
@@ -6517,10 +4137,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -6530,10 +4146,6 @@
       "id": 219,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -6545,42 +4157,17 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 33
           },
-          "hiddenSeries": false,
           "id": 209,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": false,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "8.4.3",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -6588,7 +4175,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_push_bulk_push_rule_evaluator_push_rules_state_size_counter_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_push_bulk_push_rule_evaluator_push_rules_state_size_counter_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -6598,43 +4185,10 @@
               "step": 2
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Iterations over State",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -6646,42 +4200,17 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 33
           },
-          "hiddenSeries": false,
           "id": 211,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": false,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "8.4.3",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -6689,7 +4218,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_push_bulk_push_rule_evaluator_push_rules_invalidation_counter_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_push_bulk_push_rule_evaluator_push_rules_invalidation_counter_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -6699,43 +4228,10 @@
               "step": 2
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Push Rule Invalidations",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -6747,47 +4243,17 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 40
           },
-          "hiddenSeries": false,
           "id": 213,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "8.4.3",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "alias": "Number of calls",
-              "yaxis": 2
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -6795,7 +4261,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_util_caches_cache_hits{job=\"$job\",index=~\"$index\",name=\"push_rules_delta_state_cache_metric\",instance=\"$instance\"}[$bucket_size]))/sum(rate(synapse_util_caches_cache{job=\"$job\",index=~\"$index\", name=\"push_rules_delta_state_cache_metric\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_util_caches_cache_hits{job=~\"$job\",index=~\"$index\",name=\"push_rules_delta_state_cache_metric\",server_name=\"$server_name\"}[$bucket_size]))/sum(rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\", name=\"push_rules_delta_state_cache_metric\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -6810,7 +4276,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_util_caches_cache{job=\"$job\",index=~\"$index\", name=\"push_rules_delta_state_cache_metric\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\", name=\"push_rules_delta_state_cache_metric\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -6819,46 +4285,10 @@
               "step": 2
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Delta Optimisation",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "label": "",
-              "logBase": 1,
-              "max": "1",
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "hertz",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -6870,47 +4300,17 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 40
           },
-          "hiddenSeries": false,
           "id": 215,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "8.4.3",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "alias": "Number of calls",
-              "yaxis": 2
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -6918,7 +4318,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_util_caches_cache_hits{job=\"$job\",index=~\"$index\",name=\"room_push_rule_cache\",instance=\"$instance\"}[$bucket_size]))/sum(rate(synapse_util_caches_cache{job=\"$job\",index=~\"$index\", name=\"room_push_rule_cache\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_util_caches_cache_hits{job=~\"$job\",index=~\"$index\",name=\"room_push_rule_cache\",server_name=\"$server_name\"}[$bucket_size]))/sum(rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\", name=\"room_push_rule_cache\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -6933,7 +4333,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_util_caches_cache{job=\"$job\",index=~\"$index\", name=\"room_push_rule_cache\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\", name=\"room_push_rule_cache\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -6942,44 +4342,10 @@
               "step": 2
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "How often we reuse existing calculated push rules",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "label": "",
-              "logBase": 1,
-              "max": "1",
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -6991,47 +4357,17 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 47
           },
-          "hiddenSeries": false,
           "id": 217,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "8.4.3",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "alias": "Number of calls",
-              "yaxis": 2
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -7039,7 +4375,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_util_caches_cache_hits{job=\"$job\",index=~\"$index\",name=\"_get_rules_for_room\",instance=\"$instance\"}[$bucket_size]))/sum(rate(synapse_util_caches_cache{job=\"$job\",index=~\"$index\", name=\"_get_rules_for_room\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_util_caches_cache_hits{job=~\"$job\",index=~\"$index\",name=\"_get_rules_for_room\",server_name=\"$server_name\"}[$bucket_size]))/sum(rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\", name=\"_get_rules_for_room\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -7054,7 +4390,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum(rate(synapse_util_caches_cache{job=\"$job\",index=~\"$index\", name=\"_get_rules_for_room\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\", name=\"_get_rules_for_room\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -7063,47 +4399,8 @@
               "step": 2
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "How often we have the RulesForRoom cached",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "label": "",
-              "logBase": 1,
-              "max": "1",
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Push Rule Cache",
@@ -7111,10 +4408,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -7186,7 +4479,6 @@
             "y": 35
           },
           "id": 48,
-          "links": [],
           "options": {
             "legend": {
               "calcs": [],
@@ -7205,7 +4497,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_schedule_time_sum{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(synapse_storage_schedule_time_count[$bucket_size])",
+              "expr": "rate(synapse_storage_schedule_time_sum{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(synapse_storage_schedule_time_count[$bucket_size])",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{job}}-{{index}}",
@@ -7217,10 +4509,6 @@
           "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -7231,49 +4519,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 35
           },
-          "hiddenSeries": false,
           "id": 104,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.99, rate(synapse_storage_schedule_time_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.99, rate(synapse_storage_schedule_time_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 1,
@@ -7285,7 +4547,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.95, rate(synapse_storage_schedule_time_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.95, rate(synapse_storage_schedule_time_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}} {{index}} 95%",
@@ -7295,7 +4557,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.90, rate(synapse_storage_schedule_time_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.90, rate(synapse_storage_schedule_time_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}} {{index}} 90%",
@@ -7305,7 +4567,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_schedule_time_sum{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(synapse_storage_schedule_time_count{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_storage_schedule_time_sum{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(synapse_storage_schedule_time_count{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -7313,99 +4575,36 @@
               "refId": "D"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Db scheduling time quantiles",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "s",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": false
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 42
           },
-          "hiddenSeries": false,
           "id": 10,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "topk(10, rate(synapse_storage_transaction_time_count_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "topk(10, rate(synapse_storage_transaction_time_count_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -7414,98 +4613,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Top DB transactions by txn rate",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "min": 0,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 42
           },
-          "hiddenSeries": false,
           "id": 11,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_transaction_time_sum_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_storage_transaction_time_sum_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "instant": false,
               "interval": "",
@@ -7515,97 +4652,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "DB transactions by total txn time",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 49
           },
-          "hiddenSeries": false,
           "id": 180,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": true,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": false
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_transaction_time_sum_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(synapse_storage_transaction_time_count_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_storage_transaction_time_sum_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(synapse_storage_transaction_time_count_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "instant": false,
               "interval": "",
@@ -7615,41 +4691,10 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Average DB txn time",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "s",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -7659,47 +4704,23 @@
             },
             "overrides": []
           },
-          "fill": 6,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 49
           },
-          "hiddenSeries": false,
           "id": 200,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.99, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",instance=\"$instance\",job=\"$job\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.99, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",server_name=\"$server_name\",job=~\"$job\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "99%",
@@ -7709,7 +4730,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.9, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",instance=\"$instance\",job=\"$job\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.9, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",server_name=\"$server_name\",job=~\"$job\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "90%",
@@ -7719,7 +4740,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.75, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",instance=\"$instance\",job=\"$job\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.75, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",server_name=\"$server_name\",job=~\"$job\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "75%",
@@ -7729,55 +4750,15 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.5, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",instance=\"$instance\",job=\"$job\"}[$bucket_size])) by (le))",
+              "expr": "histogram_quantile(0.5, sum(rate(synapse_storage_schedule_time_bucket{index=~\"$index\",server_name=\"$server_name\",job=~\"$job\"}[$bucket_size])) by (le))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "50%",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Time waiting for DB connection quantiles",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:203",
-              "format": "s",
-              "label": "",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "$$hashKey": "object:204",
-              "format": "short",
-              "logBase": 1,
-              "show": false
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Database",
@@ -7785,10 +4766,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -7798,65 +4775,32 @@
       "id": 59,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 13,
             "w": 12,
             "x": 0,
             "y": 158
           },
-          "hiddenSeries": false,
           "id": 12,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_metrics_block_ru_utime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\",block_name!=\"wrapped_request_handler\"}[$bucket_size]) + rate(synapse_util_metrics_block_ru_stime_seconds_total[$bucket_size])",
+              "expr": "rate(synapse_util_metrics_block_ru_utime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\",block_name!=\"wrapped_request_handler\"}[$bucket_size]) + rate(synapse_util_metrics_block_ru_stime_seconds_total[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -7865,96 +4809,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Total CPU Usage by Block",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 13,
             "w": 12,
             "x": 12,
             "y": 158
           },
-          "hiddenSeries": false,
           "id": 26,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "(rate(synapse_util_metrics_block_ru_utime_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) + rate(synapse_util_metrics_block_ru_stime_seconds_total[$bucket_size])) / rate(synapse_util_metrics_block_count_total[$bucket_size])",
+              "expr": "(rate(synapse_util_metrics_block_ru_utime_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) + rate(synapse_util_metrics_block_ru_stime_seconds_total[$bucket_size])) / rate(synapse_util_metrics_block_count_total[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -7963,91 +4847,31 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Average CPU Time per Block",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "ms",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 13,
             "w": 12,
             "x": 0,
             "y": 171
           },
-          "hiddenSeries": false,
           "id": 13,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
@@ -8055,7 +4879,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "rate(synapse_util_metrics_block_db_txn_duration_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_util_metrics_block_db_txn_duration_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -8064,100 +4888,37 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Total DB Usage by Block",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:196",
-              "format": "percentunit",
-              "logBase": 1,
-              "min": 0,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:197",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
           "description": "The time each database transaction takes to execute, on average, broken down by metrics block.",
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 13,
             "w": 12,
             "x": 12,
             "y": 171
           },
-          "hiddenSeries": false,
           "id": 27,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_metrics_block_db_txn_duration_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) / rate(synapse_util_metrics_block_db_txn_count_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_util_metrics_block_db_txn_duration_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) / rate(synapse_util_metrics_block_db_txn_count_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -8166,95 +4927,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Average Database Transaction time, by Block",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "ms",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 13,
             "w": 12,
             "x": 0,
             "y": 184
           },
-          "hiddenSeries": false,
           "id": 28,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": false,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_metrics_block_db_txn_duration_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) / rate(synapse_util_metrics_block_db_txn_count_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_util_metrics_block_db_txn_duration_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) / rate(synapse_util_metrics_block_db_txn_count_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -8263,95 +4965,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Average Transactions per Block",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "none",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 13,
             "w": 12,
             "x": 12,
             "y": 184
           },
-          "hiddenSeries": false,
           "id": 25,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": false,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_metrics_block_time_seconds_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) / rate(synapse_util_metrics_block_count_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_util_metrics_block_time_seconds_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]) / rate(synapse_util_metrics_block_count_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -8360,130 +5003,41 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Average Wallclock Time per Block",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:180",
-              "format": "s",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:181",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 15,
             "w": 12,
             "x": 0,
             "y": 197
           },
-          "hiddenSeries": false,
           "id": 154,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_metrics_block_count_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_util_metrics_block_count_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{job}}-{{index}} {{block_name}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Block count",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Per-block metrics",
@@ -8491,10 +5045,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -8504,67 +5054,32 @@
       "id": 61,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "decimals": 2,
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 10,
             "w": 12,
             "x": 0,
             "y": 36
           },
-          "hiddenSeries": false,
           "id": 1,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_caches_cache_hits{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])/rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_util_caches_cache_hits{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])/rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{name}} {{job}}-{{index}}",
@@ -8572,100 +5087,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Cache Hit Ratio",
-          "tooltip": {
-            "msResolution": true,
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "label": "",
-              "logBase": 1,
-              "max": "1",
-              "min": 0,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": false
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 10,
             "w": 12,
             "x": 12,
             "y": 36
           },
-          "hiddenSeries": false,
           "id": 8,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideZero": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_util_caches_cache_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_util_caches_cache_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -8675,97 +5126,36 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Cache Size",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "min": 0,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "links": []
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 10,
             "w": 12,
             "x": 0,
             "y": 46
           },
-          "hiddenSeries": false,
           "id": 38,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideZero": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -8774,42 +5164,10 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Cache request rate",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "rps",
-              "logBase": 1,
-              "min": 0,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -8819,53 +5177,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 10,
             "w": 12,
             "x": 12,
             "y": 46
           },
-          "hiddenSeries": false,
           "id": 39,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "hideEmpty": false,
-            "hideZero": false,
-            "max": true,
-            "min": false,
-            "rightSide": false,
-            "show": true,
-            "sort": "max",
-            "sortDesc": true,
-            "total": false,
-            "values": true
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "topk(10, rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size]) - rate(synapse_util_caches_cache_hits{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size]))",
+              "expr": "topk(10, rate(synapse_util_caches_cache{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]) - rate(synapse_util_caches_cache_hits{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -8874,43 +5202,10 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Top 10 cache misses",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:101",
-              "format": "rps",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:102",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -8920,48 +5215,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 56
           },
-          "hiddenSeries": false,
           "id": 65,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.0.4",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_caches_cache_evicted_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_util_caches_cache_evicted_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -8969,45 +5239,8 @@
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Cache eviction rate",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "label": "entries / second",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Caches",
@@ -9015,10 +5248,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -9028,10 +5257,6 @@
       "id": 148,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -9042,86 +5267,32 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 29
           },
-          "hiddenSeries": false,
           "id": 146,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "7.3.7",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_util_caches_response_cache_size{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_util_caches_response_cache_size{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "interval": "",
               "legendFormat": "{{name}} {{job}}-{{index}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Response cache size",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -9132,46 +5303,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 29
           },
-          "hiddenSeries": false,
           "id": 150,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "7.3.7",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_util_caches_response_cache_hits{instance=\"$instance\", job=~\"$job\", index=~\"$index\"}[$bucket_size])/rate(synapse_util_caches_response_cache{instance=\"$instance\", job=~\"$job\", index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_util_caches_response_cache_hits{server_name=\"$server_name\", job=~\"$job\", index=~\"$index\"}[$bucket_size])/rate(synapse_util_caches_response_cache{server_name=\"$server_name\", job=~\"$job\", index=~\"$index\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{name}} {{job}}-{{index}}",
               "refId": "A"
@@ -9186,46 +5334,8 @@
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Response cache hit rate",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "logBase": 1,
-              "max": "1",
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Response caches",
@@ -9233,10 +5343,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -9246,10 +5352,6 @@
       "id": 62,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -9260,47 +5362,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 30
           },
-          "hiddenSeries": false,
           "id": 91,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "7.3.7",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": true,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(python_gc_time_sum{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[10m])",
+              "expr": "rate(python_gc_time_sum{job=~\"$job\",index=~\"$index\"}[10m]) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "instant": false,
               "intervalFactor": 1,
@@ -9308,48 +5386,13 @@
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Total GC time by bucket (10m smoothing)",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "percentunit",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "decimals": 3,
-          "editable": true,
-          "error": false,
           "fieldConfig": {
             "defaults": {
               "custom": {},
@@ -9357,49 +5400,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
-          "grid": {},
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 30
           },
-          "hiddenSeries": false,
           "id": 21,
-          "legend": {
-            "alignAsTable": true,
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 2,
-          "links": [],
-          "nullPointMode": "null as zero",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "7.3.7",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(python_gc_time_sum{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(python_gc_time_count[$bucket_size])",
+              "expr": "(\n  rate(python_gc_time_sum{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n) / (\n  rate(python_gc_time_count{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n)",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{job}} {{index}} gen {{gen}} ",
@@ -9408,41 +5425,10 @@
               "target": ""
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Average GC Time Per Collection",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "cumulative"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "s",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -9454,97 +5440,33 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 39
           },
-          "hiddenSeries": false,
           "id": 89,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "hideEmpty": true,
-            "hideZero": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "7.3.7",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "alias": "/gen 0$/",
-              "yaxis": 2
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "python_gc_counts{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}",
+              "expr": "python_gc_counts{job=~\"$job\",index=~\"$index\"} * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} gen {{gen}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Allocation counts",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "label": "Gen N-1 GCs since last Gen N GC",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "label": "Objects since last Gen 0 GC",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -9555,88 +5477,33 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 39
           },
-          "hiddenSeries": false,
           "id": 93,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "7.3.7",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(python_gc_unreachable_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/rate(python_gc_time_count{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "(\n  rate(python_gc_unreachable_total{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n) / (\n  rate(python_gc_time_count{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\n  synapse_server_name_info{server_name=\"$server_name\"}\n)",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} gen {{gen}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Object counts per collection",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -9647,96 +5514,33 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 48
           },
-          "hiddenSeries": false,
           "id": 95,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "7.3.7",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(python_gc_time_count{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(python_gc_time_count{job=~\"$job\",index=~\"$index\"}[$bucket_size]) * on (instance, job, index) group_left(server_name)\nsynapse_server_name_info{server_name=\"$server_name\"}",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} gen {{gen}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "GC frequency",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "cards": {
-            "cardPadding": 0
-          },
-          "color": {
-            "cardColor": "#b4ff00",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateSpectral",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "spectrum"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -9753,15 +5557,8 @@
             "x": 12,
             "y": 48
           },
-          "heatmap": {},
-          "hideZeroBuckets": true,
-          "highlightCards": true,
           "id": 87,
-          "legend": {
-            "show": true
-          },
-          "links": [],
-          "reverseYBuckets": false,
+          "options": {},
           "targets": [
             {
               "datasource": {
@@ -9776,29 +5573,7 @@
             }
           ],
           "title": "GC durations",
-          "tooltip": {
-            "show": true,
-            "showHistogram": false
-          },
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "format": "s",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "heatmap"
         }
       ],
       "title": "GC",
@@ -9806,10 +5581,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -9819,10 +5590,6 @@
       "id": 63,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -9833,48 +5600,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 162
           },
-          "hiddenSeries": false,
           "id": 43,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum (rate(synapse_replication_tcp_protocol_outbound_commands_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (name, conn_id)",
+              "expr": "sum (rate(synapse_replication_tcp_protocol_outbound_commands_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (name, conn_id)",
               "format": "time_series",
               "intervalFactor": 2,
               "legendFormat": "{{job}}-{{index}} {{command}}",
@@ -9882,37 +5624,8 @@
               "step": 20
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Rate of outgoing commands",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:89",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:90",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
           "datasource": {
@@ -9979,7 +5692,6 @@
             "y": 162
           },
           "id": 41,
-          "links": [],
           "options": {
             "legend": {
               "calcs": [],
@@ -10000,7 +5712,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "rate(synapse_replication_tcp_resource_stream_updates_total{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_replication_tcp_resource_stream_updates_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -10078,7 +5790,6 @@
             "y": 169
           },
           "id": 42,
-          "links": [],
           "options": {
             "legend": {
               "calcs": [],
@@ -10099,7 +5810,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "sum (rate(synapse_replication_tcp_protocol_inbound_commands_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (name, conn_id)",
+              "expr": "sum (rate(synapse_replication_tcp_protocol_inbound_commands_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])) without (name, conn_id)",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -10178,7 +5889,6 @@
             "y": 169
           },
           "id": 220,
-          "links": [],
           "options": {
             "legend": {
               "calcs": [],
@@ -10199,7 +5909,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "exemplar": true,
-              "expr": "rate(synapse_replication_tcp_protocol_inbound_rdata_count_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_replication_tcp_protocol_inbound_rdata_count_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -10212,10 +5922,6 @@
           "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -10227,89 +5933,33 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 176
           },
-          "hiddenSeries": false,
           "id": 144,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "type": "prometheus",
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_replication_tcp_command_queue{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "synapse_replication_tcp_command_queue{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "interval": "",
               "legendFormat": "{{stream_name}} {{job}}-{{index}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Queued incoming RDATA commands, by stream",
-          "tooltip": {
-            "shared": false,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:218",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:219",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -10320,91 +5970,33 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 176
           },
-          "hiddenSeries": false,
           "id": 115,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_replication_tcp_protocol_close_reason_total{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_replication_tcp_protocol_close_reason_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} {{reason_type}}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Replication connection close reasons",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:260",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:261",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -10414,48 +6006,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 183
           },
-          "hiddenSeries": false,
           "id": 113,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_replication_tcp_resource_connections_per_stream{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}",
+              "expr": "synapse_replication_tcp_resource_connections_per_stream{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}} {{stream_name}}",
@@ -10465,52 +6032,15 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_replication_tcp_resource_total_connections{job=~\"$job\",index=~\"$index\",instance=\"$instance\"}",
+              "expr": "synapse_replication_tcp_resource_total_connections{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "{{job}}-{{index}}",
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Replication connections",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Replication",
@@ -10518,10 +6048,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -10531,10 +6057,6 @@
       "id": 69,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -10544,48 +6066,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 163
           },
-          "hiddenSeries": false,
           "id": 67,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "max(synapse_event_persisted_position{instance=\"$instance\"}) - on() group_right() synapse_event_processing_positions{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "max(synapse_event_persisted_position{server_name=\"$server_name\"}) - on () group_right() synapse_event_processing_positions{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -10593,43 +6090,10 @@
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Event processing lag",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "label": "events",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -10639,48 +6103,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 12,
             "y": 163
           },
-          "hiddenSeries": false,
           "id": 71,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "time()*1000-synapse_event_processing_last_ts{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}",
+              "expr": "time()*1000-synapse_event_processing_last_ts{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -10689,42 +6128,10 @@
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Age of last processed event",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "ms",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -10734,49 +6141,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 9,
             "w": 12,
             "x": 0,
             "y": 172
           },
-          "hiddenSeries": false,
           "id": 121,
-          "interval": "",
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "paceLength": 10,
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "deriv(synapse_event_processing_last_ts{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/1000 - 1",
+              "expr": "deriv(synapse_event_processing_last_ts{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])/1000 - 1",
               "format": "time_series",
               "hide": false,
               "interval": "",
@@ -10785,45 +6166,8 @@
               "refId": "B"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Event processing catchup rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "none",
-              "label": "fallbehind(-) / catchup(+):  s/sec",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Event processing loop positions",
@@ -10831,10 +6175,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -10844,18 +6184,6 @@
       "id": 126,
       "panels": [
         {
-          "cards": {
-            "cardPadding": 0
-          },
-          "color": {
-            "cardColor": "#B877D9",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "opacity"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -10881,14 +6209,7 @@
             "x": 0,
             "y": 42
           },
-          "heatmap": {},
-          "hideZeroBuckets": true,
-          "highlightCards": true,
           "id": 122,
-          "legend": {
-            "show": true
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -10929,13 +6250,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_forward_extremities_bucket{instance=\"$instance\"} and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0)",
+              "expr": "synapse_forward_extremities_bucket{server_name=\"$server_name\"} and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0)",
               "format": "heatmap",
               "intervalFactor": 1,
               "legendFormat": "{{le}}",
@@ -10943,27 +6263,9 @@
             }
           ],
           "title": "Number of rooms, by number of forward extremities in room",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "decimals": 0,
-            "format": "short",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -10974,48 +6276,23 @@
             },
             "overrides": []
           },
-          "fill": 0,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 42
           },
-          "hiddenSeries": false,
           "id": 124,
-          "interval": "",
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "connected",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_forward_extremities_bucket{instance=\"$instance\"} > 0",
+              "expr": "synapse_forward_extremities_bucket{server_name=\"$server_name\"} > 0",
               "format": "heatmap",
               "interval": "",
               "intervalFactor": 1,
@@ -11023,50 +6300,10 @@
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Room counts, by number of extremities",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "none",
-              "label": "Number of rooms",
-              "logBase": 10,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": false
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "cards": {
-            "cardPadding": 0
-          },
-          "color": {
-            "cardColor": "#5794F2",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "opacity"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -11092,14 +6329,7 @@
             "x": 0,
             "y": 50
           },
-          "heatmap": {},
-          "hideZeroBuckets": true,
-          "highlightCards": true,
           "id": 127,
-          "legend": {
-            "show": true
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -11140,13 +6370,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_events_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0)",
+              "expr": "rate(synapse_storage_events_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0)",
               "format": "heatmap",
               "intervalFactor": 1,
               "legendFormat": "{{le}}",
@@ -11154,27 +6383,9 @@
             }
           ],
           "title": "Events persisted, by number of forward extremities in room (heatmap)",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "decimals": 0,
-            "format": "short",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -11185,47 +6396,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 50
           },
-          "hiddenSeries": false,
           "id": 128,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.5, rate(synapse_storage_events_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.5, rate(synapse_storage_events_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "50%",
@@ -11235,7 +6422,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.75, rate(synapse_storage_events_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.75, rate(synapse_storage_events_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "75%",
@@ -11245,7 +6432,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.90, rate(synapse_storage_events_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.90, rate(synapse_storage_events_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "90%",
@@ -11255,58 +6442,17 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.99, rate(synapse_storage_events_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.99, rate(synapse_storage_events_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "99%",
               "refId": "D"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Events persisted, by number of forward extremities in room (quantiles)",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "label": "Number of extremities in room",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "cards": {
-            "cardPadding": 0
-          },
-          "color": {
-            "cardColor": "#FF9830",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "opacity"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -11332,14 +6478,7 @@
             "x": 0,
             "y": 58
           },
-          "heatmap": {},
-          "hideZeroBuckets": true,
-          "highlightCards": true,
           "id": 129,
-          "legend": {
-            "show": true
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -11380,13 +6519,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0)",
+              "expr": "rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0)",
               "format": "heatmap",
               "intervalFactor": 1,
               "legendFormat": "{{le}}",
@@ -11394,27 +6532,9 @@
             }
           ],
           "title": "Events persisted, by number of stale forward extremities in room (heatmap)",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "decimals": 0,
-            "format": "short",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -11425,47 +6545,23 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 58
           },
-          "hiddenSeries": false,
           "id": 130,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.5, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.5, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "50%",
@@ -11475,7 +6571,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.75, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.75, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "75%",
@@ -11485,7 +6581,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.90, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.90, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "90%",
@@ -11495,58 +6591,17 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.99, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{instance=\"$instance\"}[$bucket_size]) and on (index, instance, job) (synapse_storage_events_persisted_events_total > 0))",
+              "expr": "histogram_quantile(0.99, rate(synapse_storage_events_stale_forward_extremities_persisted_bucket{server_name=\"$server_name\"}[$bucket_size]) and on (instance, job, index) (synapse_storage_events_persisted_events_total > 0))",
               "format": "time_series",
               "intervalFactor": 1,
               "legendFormat": "99%",
               "refId": "D"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Events persisted, by number of stale forward extremities in room (quantiles)",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "label": "Number of stale forward extremities in room",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "cards": {
-            "cardPadding": 0
-          },
-          "color": {
-            "cardColor": "#73BF69",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "opacity"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
@@ -11572,14 +6627,7 @@
             "x": 0,
             "y": 66
           },
-          "heatmap": {},
-          "hideZeroBuckets": true,
-          "highlightCards": true,
           "id": 131,
-          "legend": {
-            "show": true
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -11620,13 +6668,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_state_number_state_groups_in_resolution_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_state_number_state_groups_in_resolution_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size])",
               "format": "heatmap",
               "interval": "",
               "intervalFactor": 1,
@@ -11635,27 +6682,9 @@
             }
           ],
           "title": "Number of state resolution performed, by number of state groups involved (heatmap)",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "decimals": 0,
-            "format": "short",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -11667,49 +6696,24 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 66
           },
-          "hiddenSeries": false,
           "id": 132,
-          "interval": "",
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "histogram_quantile(0.5, rate(synapse_state_number_state_groups_in_resolution_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.5, rate(synapse_state_number_state_groups_in_resolution_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -11721,7 +6725,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.75, rate(synapse_state_number_state_groups_in_resolution_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.75, rate(synapse_state_number_state_groups_in_resolution_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -11732,7 +6736,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.90, rate(synapse_state_number_state_groups_in_resolution_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.90, rate(synapse_state_number_state_groups_in_resolution_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -11743,7 +6747,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "histogram_quantile(0.99, rate(synapse_state_number_state_groups_in_resolution_bucket{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "histogram_quantile(0.99, rate(synapse_state_number_state_groups_in_resolution_bucket{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -11751,87 +6755,35 @@
               "refId": "D"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Number of state resolutions performed, by number of state groups involved (quantiles)",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "label": "Number of state groups",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
           "description": "When we do a state res while persisting events we try and see if we can prune any stale extremities.",
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 74
           },
-          "hiddenSeries": false,
           "id": 179,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_storage_events_state_resolutions_during_persistence_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_storage_events_state_resolutions_during_persistence_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "interval": "",
               "legendFormat": "State res ",
               "refId": "A"
@@ -11840,7 +6792,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_storage_events_potential_times_prune_extremities_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_storage_events_potential_times_prune_extremities_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "interval": "",
               "legendFormat": "Potential to prune",
               "refId": "B"
@@ -11849,50 +6801,14 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_storage_events_times_pruned_extremities_total{instance=\"$instance\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
+              "expr": "sum(rate(synapse_storage_events_times_pruned_extremities_total{server_name=\"$server_name\",job=~\"$job\",index=~\"$index\"}[$bucket_size]))",
               "interval": "",
               "legendFormat": "Pruned",
               "refId": "C"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Stale extremity dropping",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Extremities",
@@ -11900,10 +6816,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -11913,10 +6825,6 @@
       "id": 158,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -11927,56 +6835,24 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 43
           },
-          "hiddenSeries": false,
           "id": 156,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [
-            {
-              "$$hashKey": "object:632",
-              "alias": "Max",
-              "color": "#bf1b00",
-              "fill": 0,
-              "linewidth": 2
-            }
-          ],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "max(synapse_admin_mau_max{instance=\"$instance\"})",
+              "expr": "max(synapse_admin_mau_max{server_name=\"$server_name\"})",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 1,
@@ -11990,137 +6866,48 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "max(synapse_admin_mau_current{instance=\"$instance\"})",
+              "expr": "max(synapse_admin_mau_current{server_name=\"$server_name\"})",
               "hide": false,
               "legendFormat": "Current",
               "range": true,
               "refId": "C"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "MAU Limits",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:176",
-              "format": "short",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "$$hashKey": "object:177",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 43
           },
-          "hiddenSeries": false,
           "id": 160,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "synapse_admin_mau_current_mau_by_service{instance=\"$instance\"}",
+              "expr": "synapse_admin_mau_current_mau_by_service{server_name=\"$server_name\"}",
               "interval": "",
               "legendFormat": "{{ app_service }}",
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "MAU by Appservice",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "MAU",
@@ -12128,10 +6915,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -12141,10 +6924,6 @@
       "id": 177,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -12155,48 +6934,24 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 0,
             "y": 44
           },
-          "hiddenSeries": false,
           "id": 173,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_notifier_users_woken_by_stream_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_notifier_users_woken_by_stream_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "format": "time_series",
               "hide": false,
               "intervalFactor": 2,
@@ -12207,43 +6962,10 @@
               "step": 2
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Notifier Streams Woken",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:734",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:735",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -12254,48 +6976,24 @@
             },
             "overrides": []
           },
-          "fill": 1,
-          "fillGradient": 0,
           "gridPos": {
             "h": 7,
             "w": 12,
             "x": 12,
             "y": 44
           },
-          "hiddenSeries": false,
           "id": 175,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "links": [],
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 5,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_handler_presence_get_updates_total{job=~\"$job\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_get_updates_total{job=~\"$job\",server_name=\"$server_name\"}[$bucket_size])",
               "format": "time_series",
               "interval": "",
               "intervalFactor": 2,
@@ -12305,47 +7003,8 @@
               "step": 2
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Presence Stream Fetch Type Rates",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:819",
-              "format": "hertz",
-              "logBase": 1,
-              "min": "0",
-              "show": true
-            },
-            {
-              "$$hashKey": "object:820",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Notifier",
@@ -12353,10 +7012,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -12366,189 +7021,76 @@
       "id": 170,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 45
           },
-          "hiddenSeries": false,
           "id": 168,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_appservice_api_sent_events_total{instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_appservice_api_sent_events_total{server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{service}}",
               "range": true,
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Sent Events rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:177",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:178",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 45
           },
-          "hiddenSeries": false,
           "id": 171,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_appservice_api_sent_transactions_total{instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_appservice_api_sent_transactions_total{server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{exported_service }} {{ service }}",
               "range": true,
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Transactions rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 0,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:260",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:261",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Appservices",
@@ -12556,10 +7098,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -12569,53 +7107,30 @@
       "id": 188,
       "panels": [
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 46
           },
-          "hiddenSeries": false,
           "id": 182,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_handler_presence_notified_presence_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_notified_presence_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "Notified",
               "refId": "A"
@@ -12624,7 +7139,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_handler_presence_federation_presence_out_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_federation_presence_out_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "Remote ping",
               "refId": "B"
@@ -12633,7 +7148,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_handler_presence_presence_updates_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_presence_updates_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "Total updates",
               "refId": "C"
@@ -12642,7 +7157,7 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_handler_presence_federation_presence_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_federation_presence_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "Remote updates",
               "refId": "D"
@@ -12651,226 +7166,86 @@
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "rate(synapse_handler_presence_bump_active_time_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_bump_active_time_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "Bump active time",
               "refId": "E"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Presence",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 46
           },
-          "hiddenSeries": false,
           "id": 184,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_handler_presence_state_transition_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_state_transition_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{from}} -> {{to}}",
               "range": true,
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Presence state transitions",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:1090",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:1091",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 0,
             "y": 54
           },
-          "hiddenSeries": false,
           "id": 186,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_handler_presence_notify_reason_total{job=\"$job\",index=~\"$index\",instance=\"$instance\"}[$bucket_size])",
+              "expr": "rate(synapse_handler_presence_notify_reason_total{job=~\"$job\",index=~\"$index\",server_name=\"$server_name\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{reason}}",
               "range": true,
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "Presence  notify reason",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:165",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:166",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
-        }
-      ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
+          "type": "timeseries"
         }
       ],
       "title": "Presence",
@@ -12878,10 +7253,6 @@
     },
     {
       "collapsed": true,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
       "gridPos": {
         "h": 1,
         "w": 24,
@@ -12973,7 +7344,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_external_cache_set{job=~\"$job\", instance=\"$instance\", index=~\"$index\"}[$bucket_size])",
+              "expr": "rate(synapse_external_cache_set{job=~\"$job\", server_name=\"$server_name\", index=~\"$index\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{ cache_name }} {{job}}-{{ index }}",
               "range": true,
@@ -12984,107 +7355,43 @@
           "type": "timeseries"
         },
         {
-          "aliasColors": {},
-          "bars": false,
-          "dashLength": 10,
-          "dashes": false,
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
           "description": "",
-          "fill": 1,
-          "fillGradient": 0,
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
           "gridPos": {
             "h": 8,
             "w": 12,
             "x": 12,
             "y": 47
           },
-          "hiddenSeries": false,
           "id": 193,
-          "legend": {
-            "avg": false,
-            "current": false,
-            "max": false,
-            "min": false,
-            "show": true,
-            "total": false,
-            "values": false
-          },
-          "lines": true,
-          "linewidth": 1,
-          "nullPointMode": "null",
           "options": {
             "alertThreshold": true
           },
-          "percentage": false,
           "pluginVersion": "9.2.2",
-          "pointradius": 2,
-          "points": false,
-          "renderer": "flot",
-          "seriesOverrides": [],
-          "spaceLength": 10,
-          "stack": false,
-          "steppedLine": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "sum without (hit) (rate(synapse_external_cache_get{job=~\"$job\", instance=\"$instance\", index=~\"$index\"}[$bucket_size]))",
+              "expr": "sum without (hit) (rate(synapse_external_cache_get{job=~\"$job\", server_name=\"$server_name\", index=~\"$index\"}[$bucket_size]))",
               "interval": "",
               "legendFormat": "{{ cache_name }} {{job}}-{{ index }}",
               "range": true,
               "refId": "A"
             }
           ],
-          "thresholds": [],
-          "timeRegions": [],
           "title": "External Cache Get Rate",
-          "tooltip": {
-            "shared": true,
-            "sort": 2,
-            "value_type": "individual"
-          },
-          "type": "graph",
-          "xaxis": {
-            "mode": "time",
-            "show": true,
-            "values": []
-          },
-          "yaxes": [
-            {
-              "$$hashKey": "object:390",
-              "format": "hertz",
-              "logBase": 1,
-              "show": true
-            },
-            {
-              "$$hashKey": "object:391",
-              "format": "short",
-              "logBase": 1,
-              "show": true
-            }
-          ],
-          "yaxis": {
-            "align": false
-          }
+          "type": "timeseries"
         },
         {
-          "cards": {
-            "cardPadding": -1
-          },
-          "color": {
-            "cardColor": "#b4ff00",
-            "colorScale": "sqrt",
-            "colorScheme": "interpolateInferno",
-            "exponent": 0.5,
-            "min": 0,
-            "mode": "spectrum"
-          },
-          "dataFormat": "tsbuckets",
           "datasource": {
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
@@ -13110,14 +7417,7 @@
             "x": 0,
             "y": 55
           },
-          "heatmap": {},
-          "hideZeroBuckets": false,
-          "highlightCards": true,
           "id": 195,
-          "legend": {
-            "show": false
-          },
-          "links": [],
           "options": {
             "calculate": false,
             "calculation": {},
@@ -13160,13 +7460,12 @@
             }
           },
           "pluginVersion": "9.2.2",
-          "reverseYBuckets": false,
           "targets": [
             {
               "datasource": {
                 "uid": "${DS_PROMETHEUS}"
               },
-              "expr": "sum(rate(synapse_external_cache_response_time_seconds_bucket{index=~\"$index\",instance=\"$instance\",job=~\"$job\"}[$bucket_size])) by (le)",
+              "expr": "sum(rate(synapse_external_cache_response_time_seconds_bucket{index=~\"$index\",server_name=\"$server_name\",job=~\"$job\"}[$bucket_size])) by (le)",
               "format": "heatmap",
               "instant": false,
               "interval": "",
@@ -13176,22 +7475,7 @@
             }
           ],
           "title": "External Cache Response Time",
-          "tooltip": {
-            "show": true,
-            "showHistogram": true
-          },
-          "tooltipDecimals": 2,
-          "type": "heatmap",
-          "xAxis": {
-            "show": true
-          },
-          "yAxis": {
-            "decimals": 0,
-            "format": "s",
-            "logBase": 1,
-            "show": true
-          },
-          "yBucketBound": "auto"
+          "type": "heatmap"
         },
         {
           "datasource": {
@@ -13273,7 +7557,7 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "rate(synapse_external_cache_get{job=~\"$job\", instance=\"$instance\", index=~\"$index\", hit=\"False\"}[$bucket_size])",
+              "expr": "rate(synapse_external_cache_get{job=~\"$job\", server_name=\"$server_name\", index=~\"$index\", hit=\"False\"}[$bucket_size])",
               "interval": "",
               "legendFormat": "{{ cache_name }} {{job}}-{{ index }}",
               "range": true,
@@ -13284,22 +7568,13 @@
           "type": "timeseries"
         }
       ],
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "refId": "A"
-        }
-      ],
       "title": "External Cache",
       "type": "row"
     }
   ],
-  "refresh": false,
-  "schemaVersion": 37,
-  "style": "dark",
+  "preload": false,
+  "refresh": "",
+  "schemaVersion": 42,
   "tags": [
     "matrix"
   ],
@@ -13307,45 +7582,30 @@
     "list": [
       {
         "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
+          "text": "",
+          "value": "${DS_PROMETHEUS}",
+          "selected": true
         },
-        "hide": 0,
         "includeAll": false,
-        "multi": false,
-        "name": "DS_PROMETHEUS",
         "label": "Datasource",
+        "name": "DS_PROMETHEUS",
         "options": [],
         "query": "prometheus",
-        "queryValue": "",
         "refresh": 1,
         "regex": "",
-        "skipUrlSync": false,
         "type": "datasource"
       },
       {
-        "allFormat": "glob",
         "auto": true,
         "auto_count": 100,
         "auto_min": "30s",
         "current": {
-          "selected": false,
-          "text": "auto",
-          "value": "$__auto_interval_bucket_size"
+          "text": "$__auto",
+          "value": "$__auto"
         },
-        "hide": 0,
-        "includeAll": false,
         "label": "Bucket Size",
-        "multi": false,
-        "multiFormat": "glob",
         "name": "bucket_size",
         "options": [
-          {
-            "selected": true,
-            "text": "auto",
-            "value": "$__auto_interval_bucket_size"
-          },
           {
             "selected": false,
             "text": "30s",
@@ -13378,9 +7638,7 @@
           }
         ],
         "query": "30s,1m,2m,5m,10m,15m",
-        "queryValue": "",
         "refresh": 2,
-        "skipUrlSync": false,
         "type": "interval"
       },
       {
@@ -13389,38 +7647,27 @@
           "uid": "${DS_PROMETHEUS}"
         },
         "definition": "",
-        "hide": 0,
         "includeAll": false,
-        "multi": false,
-        "name": "instance",
+        "name": "server_name",
         "options": [],
         "query": {
-          "query": "label_values(synapse_util_metrics_block_ru_utime_seconds_total, instance)",
+          "query": "label_values(synapse_util_metrics_block_ru_utime_seconds_total, server_name)",
           "refId": "Prometheus-instance-Variable-Query"
         },
         "refresh": 2,
         "regex": "",
-        "skipUrlSync": false,
         "sort": 1,
-        "tagValuesQuery": "",
-        "tagsQuery": "",
-        "type": "query",
-        "useTags": false
+        "type": "query"
       },
       {
-        "allFormat": "regex wildcard",
-        "allValue": "",
         "current": {},
         "datasource": {
           "uid": "${DS_PROMETHEUS}"
         },
         "definition": "",
-        "hide": 0,
-        "hideLabel": false,
         "includeAll": true,
         "label": "Job",
         "multi": true,
-        "multiFormat": "regex values",
         "name": "job",
         "options": [],
         "query": {
@@ -13428,29 +7675,19 @@
           "refId": "Prometheus-job-Variable-Query"
         },
         "refresh": 2,
-        "refresh_on_load": false,
         "regex": "",
-        "skipUrlSync": false,
         "sort": 1,
-        "tagValuesQuery": "",
-        "tagsQuery": "",
-        "type": "query",
-        "useTags": false
+        "type": "query"
       },
       {
-        "allFormat": "regex wildcard",
         "allValue": ".*",
         "current": {},
         "datasource": {
           "uid": "${DS_PROMETHEUS}"
         },
         "definition": "",
-        "hide": 0,
-        "hideLabel": false,
         "includeAll": true,
-        "label": "",
         "multi": true,
-        "multiFormat": "regex values",
         "name": "index",
         "options": [],
         "query": {
@@ -13458,14 +7695,9 @@
           "refId": "Prometheus-index-Variable-Query"
         },
         "refresh": 2,
-        "refresh_on_load": false,
         "regex": "",
-        "skipUrlSync": false,
         "sort": 3,
-        "tagValuesQuery": "",
-        "tagsQuery": "",
-        "type": "query",
-        "useTags": false
+        "type": "query"
       }
     ]
   },
@@ -13473,35 +7705,10 @@
     "from": "now-3h",
     "to": "now"
   },
-  "timepicker": {
-    "now": true,
-    "refresh_intervals": [
-      "5s",
-      "10s",
-      "30s",
-      "1m",
-      "5m",
-      "15m",
-      "30m",
-      "1h",
-      "2h",
-      "1d"
-    ],
-    "time_options": [
-      "5m",
-      "15m",
-      "1h",
-      "6h",
-      "12h",
-      "24h",
-      "2d",
-      "7d",
-      "30d"
-    ]
-  },
+  "timepicker": {},
   "timezone": "",
   "title": "Synapse",
   "uid": "000000012",
-  "version": 160,
+  "version": 1,
   "weekStart": ""
 }
diff --git a/contrib/graph/graph.py b/contrib/graph/graph.py
index 9d5f3c7f4f..2898bb3448 100644
--- a/contrib/graph/graph.py
+++ b/contrib/graph/graph.py
@@ -24,7 +24,6 @@ import datetime
 import html
 import json
 import urllib.request
-from typing import List
 
 import pydot
 
@@ -33,7 +32,7 @@ def make_name(pdu_id: str, origin: str) -> str:
     return f"{pdu_id}@{origin}"
 
 
-def make_graph(pdus: List[dict], filename_prefix: str) -> None:
+def make_graph(pdus: list[dict], filename_prefix: str) -> None:
     """
     Generate a dot and SVG file for a graph of events in the room based on the
     topological ordering by querying a homeserver.
@@ -127,7 +126,7 @@ def make_graph(pdus: List[dict], filename_prefix: str) -> None:
     graph.write_svg("%s.svg" % filename_prefix, prog="dot")
 
 
-def get_pdus(host: str, room: str) -> List[dict]:
+def get_pdus(host: str, room: str) -> list[dict]:
     transaction = json.loads(
         urllib.request.urlopen(
             f"http://{host}/_matrix/federation/v1/context/{room}/"
diff --git a/contrib/prometheus/synapse-v2.rules b/contrib/prometheus/synapse-v2.rules
index dde311322f..3a5de8f528 100644
--- a/contrib/prometheus/synapse-v2.rules
+++ b/contrib/prometheus/synapse-v2.rules
@@ -44,31 +44,3 @@ groups:
   ###
   ### End of 'Prometheus Console Only' rules block
   ###
-
-
-  ###
-  ### Grafana Only
-  ### The following rules are only needed if you use the Grafana dashboard
-  ### in contrib/grafana/synapse.json
-  ###
-  - record: synapse_storage_events_persisted_by_source_type
-    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep_total{origin_type="remote"})
-    labels:
-      type: remote
-  - record: synapse_storage_events_persisted_by_source_type
-    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep_total{origin_entity="*client*",origin_type="local"})
-    labels:
-      type: local
-  - record: synapse_storage_events_persisted_by_source_type
-    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep_total{origin_entity!="*client*",origin_type="local"})
-    labels:
-      type: bridges
-
-  - record: synapse_storage_events_persisted_by_event_type
-    expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep_total)
-
-  - record: synapse_storage_events_persisted_by_origin
-    expr: sum without(type) (synapse_storage_events_persisted_events_sep_total)
-  ###
-  ### End of 'Grafana Only' rules block
-  ###
diff --git a/contrib/systemd/README.md b/contrib/systemd/README.md
index d12d8ec37b..456b4e9a16 100644
--- a/contrib/systemd/README.md
+++ b/contrib/systemd/README.md
@@ -16,3 +16,9 @@ appropriate locations of your installation.
 5. Start Synapse: `sudo systemctl start matrix-synapse`
 6. Verify Synapse is running: `sudo systemctl status matrix-synapse`
 7. *optional* Enable Synapse to start at system boot: `sudo systemctl enable matrix-synapse`
+
+## Logging
+
+If you use `contrib/systemd/log_config.yaml`, install `systemd-python` in the
+same Python environment as Synapse. The config uses
+`systemd.journal.JournalHandler`, which requires that package.
diff --git a/contrib/systemd/log_config.yaml b/contrib/systemd/log_config.yaml
index 22f67a50ce..4c29787647 100644
--- a/contrib/systemd/log_config.yaml
+++ b/contrib/systemd/log_config.yaml
@@ -1,5 +1,6 @@
 version: 1
 
+# Requires the `systemd-python` package in Synapse's runtime environment.
 # In systemd's journal, loglevel is implicitly stored, so let's omit it
 # from the message text.
 formatters:
diff --git a/debian/build_virtualenv b/debian/build_virtualenv
index 9e7fb95c8e..7bbf52ddd9 100755
--- a/debian/build_virtualenv
+++ b/debian/build_virtualenv
@@ -35,12 +35,14 @@ TEMP_VENV="$(mktemp -d)"
 python3 -m venv "$TEMP_VENV"
 source "$TEMP_VENV/bin/activate"
 pip install -U pip
-pip install poetry==2.1.1 poetry-plugin-export==1.9.0
+pip install poetry==2.2.1 poetry-plugin-export==1.9.0
 poetry export \
     --extras all \
     --extras test \
-    --extras systemd \
     -o exported_requirements.txt
+# Keep journald logging support in the packaged virtualenv when using
+# systemd.journal.JournalHandler in /etc/matrix-synapse/log.yaml.
+echo "systemd-python==235 --hash=sha256:4e57f39797fd5d9e2d22b8806a252d7c0106c936039d1e71c8c6b8008e695c0a" >> exported_requirements.txt
 deactivate
 rm -rf "$TEMP_VENV"
 
@@ -57,7 +59,7 @@ dh_virtualenv \
     --extra-pip-arg="--no-deps" \
     --extra-pip-arg="--no-cache-dir" \
     --extra-pip-arg="--compile" \
-    --extras="all,systemd,test" \
+    --extras="all,test" \
     --requirements="exported_requirements.txt"
 
 PACKAGE_BUILD_DIR="$(pwd)/debian/matrix-synapse-py3"
diff --git a/debian/changelog b/debian/changelog
index c9b86aea2a..f3dc1eb0c2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,280 @@
+matrix-synapse-py3 (1.151.0) stable; urgency=medium
+
+  * New synapse release 1.151.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 07 Apr 2026 12:15:10 +0000
+
+matrix-synapse-py3 (1.151.0~rc1) stable; urgency=medium
+
+  * New synapse release 1.151.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 31 Mar 2026 12:23:34 +0000
+
+matrix-synapse-py3 (1.150.0) stable; urgency=medium
+
+  * New synapse release 1.150.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 24 Mar 2026 14:17:04 +0000
+
+matrix-synapse-py3 (1.150.0~rc1) stable; urgency=medium
+
+  [ Quentin Gliech ]
+  * Change how the systemd journald integration is installed.
+  * Update Poetry used at build time to 2.2.1.
+
+  [ Synapse Packaging team ]
+  * New synapse release 1.150.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 17 Mar 2026 14:56:35 +0000
+
+matrix-synapse-py3 (1.149.1) stable; urgency=medium
+
+  * New synapse release 1.149.1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Wed, 11 Mar 2026 09:30:24 +0000
+
+matrix-synapse-py3 (1.149.0) stable; urgency=medium
+
+  * New synapse release 1.149.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 10 Mar 2026 13:02:53 +0000
+
+matrix-synapse-py3 (1.149.0~rc1) stable; urgency=medium
+
+  * New synapse release 1.149.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 03 Mar 2026 14:37:57 +0000
+
+matrix-synapse-py3 (1.148.0) stable; urgency=medium
+
+  * New synapse release 1.148.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 24 Feb 2026 11:17:49 +0000
+
+matrix-synapse-py3 (1.148.0~rc1) stable; urgency=medium
+
+  * New synapse release 1.148.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 17 Feb 2026 16:44:08 +0000
+
+matrix-synapse-py3 (1.147.1) stable; urgency=medium
+
+  * New synapse release 1.147.1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Thu, 12 Feb 2026 15:45:15 +0000
+
+matrix-synapse-py3 (1.147.0) stable; urgency=medium
+
+  * New synapse release 1.147.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 10 Feb 2026 12:39:58 +0000
+
+matrix-synapse-py3 (1.147.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.147.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 03 Feb 2026 08:53:17 -0700
+
+matrix-synapse-py3 (1.146.0) stable; urgency=medium
+
+  * New Synapse release 1.146.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 27 Jan 2026 08:43:59 -0700
+
+matrix-synapse-py3 (1.146.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.146.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 20 Jan 2026 08:42:10 -0700
+
+matrix-synapse-py3 (1.145.0) stable; urgency=medium
+
+  * New Synapse release 1.145.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 13 Jan 2026 08:37:42 -0700
+
+matrix-synapse-py3 (1.145.0~rc4) stable; urgency=medium
+
+  * New Synapse release 1.145.0rc4.
+
+ -- Synapse Packaging team <packages@matrix.org>  Thu, 08 Jan 2026 12:06:35 -0700
+
+matrix-synapse-py3 (1.145.0~rc3) stable; urgency=medium
+
+  * New Synapse release 1.145.0rc3.
+
+ -- Synapse Packaging team <packages@matrix.org>  Wed, 07 Jan 2026 15:32:07 -0700
+
+matrix-synapse-py3 (1.145.0~rc2) stable; urgency=medium
+
+  * New Synapse release 1.145.0rc2.
+
+ -- Synapse Packaging team <packages@matrix.org>  Wed, 07 Jan 2026 10:10:07 -0700
+
+matrix-synapse-py3 (1.145.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.145.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 06 Jan 2026 09:29:39 -0700
+
+matrix-synapse-py3 (1.144.0) stable; urgency=medium
+
+  * New Synapse release 1.144.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 09 Dec 2025 08:30:40 -0700
+
+matrix-synapse-py3 (1.144.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.144.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 02 Dec 2025 09:11:19 -0700
+
+matrix-synapse-py3 (1.143.0) stable; urgency=medium
+
+  * New Synapse release 1.143.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 25 Nov 2025 08:44:56 -0700
+
+matrix-synapse-py3 (1.143.0~rc2) stable; urgency=medium
+
+  * New Synapse release 1.143.0rc2.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 18 Nov 2025 17:36:08 -0700
+
+matrix-synapse-py3 (1.143.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.143.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 18 Nov 2025 13:08:39 -0700
+
+matrix-synapse-py3 (1.142.1) stable; urgency=medium
+
+  * New Synapse release 1.142.1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 18 Nov 2025 12:25:23 -0700
+
+matrix-synapse-py3 (1.142.0) stable; urgency=medium
+
+  * New Synapse release 1.142.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 11 Nov 2025 09:45:51 +0000
+
+matrix-synapse-py3 (1.142.0~rc4) stable; urgency=medium
+
+  * New Synapse release 1.142.0rc4.
+
+ -- Synapse Packaging team <packages@matrix.org>  Fri, 07 Nov 2025 10:54:42 +0000
+
+matrix-synapse-py3 (1.142.0~rc3) stable; urgency=medium
+
+  * New Synapse release 1.142.0rc3.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 04 Nov 2025 17:39:11 +0000
+
+matrix-synapse-py3 (1.142.0~rc2) stable; urgency=medium
+
+  * New Synapse release 1.142.0rc2.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 04 Nov 2025 16:21:30 +0000
+
+matrix-synapse-py3 (1.142.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.142.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 04 Nov 2025 13:20:15 +0000
+
+matrix-synapse-py3 (1.141.0) stable; urgency=medium
+
+  * New Synapse release 1.141.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Wed, 29 Oct 2025 11:01:43 +0000
+
+matrix-synapse-py3 (1.141.0~rc2) stable; urgency=medium
+
+  * New Synapse release 1.141.0rc2.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 28 Oct 2025 10:20:26 +0000
+
+matrix-synapse-py3 (1.141.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.141.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 21 Oct 2025 11:01:44 +0100
+
+matrix-synapse-py3 (1.140.0) stable; urgency=medium
+
+  * New Synapse release 1.140.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 14 Oct 2025 15:22:36 +0100
+
+matrix-synapse-py3 (1.140.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.140.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Fri, 10 Oct 2025 10:56:51 +0100
+
+matrix-synapse-py3 (1.139.2) stable; urgency=medium
+
+  * New Synapse release 1.139.2.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 07 Oct 2025 16:29:47 +0100
+
+matrix-synapse-py3 (1.139.1) stable; urgency=medium
+
+  * New Synapse release 1.139.1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 07 Oct 2025 11:46:51 +0100
+
+matrix-synapse-py3 (1.138.4) stable; urgency=medium
+
+  * New Synapse release 1.138.4.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 07 Oct 2025 16:28:38 +0100
+
+matrix-synapse-py3 (1.138.3) stable; urgency=medium
+
+  * New Synapse release 1.138.3.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 07 Oct 2025 12:54:18 +0100
+
+matrix-synapse-py3 (1.139.0) stable; urgency=medium
+
+  * New Synapse release 1.139.0.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 30 Sep 2025 11:58:55 +0100
+
+matrix-synapse-py3 (1.139.0~rc3) stable; urgency=medium
+
+  * New Synapse release 1.139.0rc3.
+
+ -- Synapse Packaging team <packages@matrix.org>  Thu, 25 Sep 2025 12:13:23 +0100
+
+matrix-synapse-py3 (1.138.2) stable; urgency=medium
+
+  * The licensing specifier has been updated to add an optional
+    `LicenseRef-Element-Commercial` license. The code was already licensed in
+    this manner - the debian metadata was just not updated to reflect it.
+
+ -- Synapse Packaging team <packages@matrix.org>  Thu, 25 Sep 2025 12:17:17 +0100
+
+matrix-synapse-py3 (1.138.1) stable; urgency=medium
+
+  * New Synapse release 1.138.1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Wed, 24 Sep 2025 11:32:38 +0100
+
+matrix-synapse-py3 (1.139.0~rc2) stable; urgency=medium
+
+  * New Synapse release 1.139.0rc2.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 23 Sep 2025 15:31:42 +0100
+
+matrix-synapse-py3 (1.139.0~rc1) stable; urgency=medium
+
+  * New Synapse release 1.139.0rc1.
+
+ -- Synapse Packaging team <packages@matrix.org>  Tue, 23 Sep 2025 13:24:50 +0100
+
 matrix-synapse-py3 (1.138.0~rc1) stable; urgency=medium
 
   * New synapse release 1.138.0rc1.
diff --git a/debian/copyright b/debian/copyright
index 9e407ce425..9814133edf 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -8,7 +8,7 @@ License: Apache-2.0
 
 Files: *
 Copyright: 2023 New Vector Ltd
-License: AGPL-3.0-or-later
+License: AGPL-3.0-or-later or LicenseRef-Element-Commercial
 
 Files: synapse/config/saml2.py
 Copyright: 2015, Ericsson
diff --git a/demo/start.sh b/demo/start.sh
index e010302bf4..471e881f46 100755
--- a/demo/start.sh
+++ b/demo/start.sh
@@ -49,7 +49,7 @@ for port in 8080 8081 8082; do
 			# Please don't accidentally bork me with your fancy settings.
 			listeners=$(cat <<-PORTLISTENERS
 			# Configure server to listen on both $https_port and $port
-			# This overides some of the default settings above
+			# This overrides some of the default settings above
 			listeners:
 			  - port: $https_port
 			    type: http
@@ -145,6 +145,12 @@ for port in 8080 8081 8082; do
 			rc_delayed_event_mgmt:
 			  per_second: 1000
 			  burst_count: 1000
+			rc_room_creation:
+			  per_second: 1000
+			  burst_count: 1000
+			rc_user_directory:
+			  per_second: 1000
+			  burst_count: 1000
 			RC
 			)
             echo "${ratelimiting}" >> "$port.config"
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 15c458fa28..6070d5c355 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -20,9 +20,9 @@
 # `poetry export | pip install -r /dev/stdin`, but beware: we have experienced bugs in
 # in `poetry export` in the past.
 
-ARG DEBIAN_VERSION=bookworm
-ARG PYTHON_VERSION=3.12
-ARG POETRY_VERSION=2.1.1
+ARG DEBIAN_VERSION=trixie
+ARG PYTHON_VERSION=3.13
+ARG POETRY_VERSION=2.2.1
 
 ###
 ### Stage 0: generate requirements.txt
@@ -142,10 +142,10 @@ RUN \
       libwebp7 \
       xmlsec1 \
       libjemalloc2 \
-      libicu \
     | grep '^\w' > /tmp/pkg-list && \
   for arch in arm64 amd64; do \
     mkdir -p /tmp/debs-${arch} && \
+    chown _apt:root /tmp/debs-${arch} && \
     cd /tmp/debs-${arch} && \
     apt-get -o APT::Architecture="${arch}" download $(cat /tmp/pkg-list); \
   done
@@ -171,24 +171,37 @@ FROM docker.io/library/python:${PYTHON_VERSION}-slim-${DEBIAN_VERSION}
 
 ARG TARGETARCH
 
-LABEL org.opencontainers.image.url='https://matrix.org/docs/projects/server/synapse'
-LABEL org.opencontainers.image.documentation='https://github.com/element-hq/synapse/blob/master/docker/README.md'
-LABEL org.opencontainers.image.source='https://github.com/element-hq/synapse.git'
-LABEL org.opencontainers.image.licenses='AGPL-3.0-or-later'
+# If specified, Synapse will use this as the version string in the app.
+#
+# This can be useful to capture the git info of the build as `.git/` won't be
+# available in the Docker image for Synapse to generate from.
+ARG SYNAPSE_VERSION_STRING
+# Pass it through to Synapse as an environment variable.
+ENV SYNAPSE_VERSION_STRING=${SYNAPSE_VERSION_STRING}
+
+LABEL org.opencontainers.image.url='https://github.com/element-hq/synapse'
+LABEL org.opencontainers.image.documentation='https://element-hq.github.io/synapse/latest/'
+LABEL org.opencontainers.image.source='https://github.com/element-hq/synapse.git'
+LABEL org.opencontainers.image.licenses='AGPL-3.0-or-later OR LicenseRef-Element-Commercial'
 
-# On the runtime image, /lib is a symlink to /usr/lib, so we need to copy the
-# libraries to the right place, else the `COPY` won't work.
-# On amd64, we'll also have a /lib64 folder with ld-linux-x86-64.so.2, which is
-# already present in the runtime image.
-COPY --from=runtime-deps /install-${TARGETARCH}/lib /usr/lib
 COPY --from=runtime-deps /install-${TARGETARCH}/etc /etc
 COPY --from=runtime-deps /install-${TARGETARCH}/usr /usr
 COPY --from=runtime-deps /install-${TARGETARCH}/var /var
-COPY --from=builder /install /usr/local
+
+# Copy the installed python packages from the builder stage.
+#
+# uv will generate a `.lock` file when installing packages, which we don't want
+# to copy to the final image.
+COPY --from=builder  --exclude=.lock /install /usr/local
 COPY ./docker/start.py /start.py
 COPY ./docker/conf /conf
 
-EXPOSE 8008/tcp 8009/tcp 8448/tcp
+# 8008: CS Matrix API port from Synapse
+# 8448: SS Matrix API port from Synapse
+EXPOSE 8008/tcp 8448/tcp
+# 19090: Metrics listener port for the main process (metrics must be enabled with
+# SYNAPSE_ENABLE_METRICS=1).
+EXPOSE 19090/tcp
 
 ENTRYPOINT ["/start.py"]
 
diff --git a/docker/Dockerfile-workers b/docker/Dockerfile-workers
index 6d0fc1440b..52dacad65a 100644
--- a/docker/Dockerfile-workers
+++ b/docker/Dockerfile-workers
@@ -1,9 +1,10 @@
-# syntax=docker/dockerfile:1
+# syntax=docker/dockerfile:1-labs
 
 ARG SYNAPSE_VERSION=latest
 ARG FROM=matrixdotorg/synapse:$SYNAPSE_VERSION
-ARG DEBIAN_VERSION=bookworm
-ARG PYTHON_VERSION=3.12
+ARG DEBIAN_VERSION=trixie
+ARG PYTHON_VERSION=3.13
+ARG REDIS_VERSION=7.2
 
 # first of all, we create a base image with dependencies which we can copy into the
 # target image. For repeated rebuilds, this is much faster than apt installing
@@ -11,15 +12,27 @@ ARG PYTHON_VERSION=3.12
 
 FROM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS deps_base
 
+    ARG DEBIAN_VERSION
+    ARG REDIS_VERSION
+
     # Tell apt to keep downloaded package files, as we're using cache mounts.
     RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
 
+    # The upstream redis-server deb has fewer dynamic libraries than Debian's package which makes it easier to copy later on
+    RUN \
+      curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg && \
+      chmod 644 /usr/share/keyrings/redis-archive-keyring.gpg && \
+      echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb ${DEBIAN_VERSION} main" | tee /etc/apt/sources.list.d/redis.list
+
     RUN \
        --mount=type=cache,target=/var/cache/apt,sharing=locked \
        --mount=type=cache,target=/var/lib/apt,sharing=locked \
       apt-get update -qq && \
       DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends \
-          nginx-light
+          nginx-light \
+          redis-server="6:${REDIS_VERSION}.*" redis-tools="6:${REDIS_VERSION}.*" \
+          # libicu is required by postgres, see `docker/complement/Dockerfile`
+          libicu76
 
     RUN \
     # remove default page
@@ -35,19 +48,12 @@ FROM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS deps_base
 
     RUN mkdir -p /uv/etc/supervisor/conf.d
 
-# Similarly, a base to copy the redis server from.
-#
-# The redis docker image has fewer dynamic libraries than the debian package,
-# which makes it much easier to copy (but we need to make sure we use an image
-# based on the same debian version as the synapse image, to make sure we get
-# the expected version of libc.
-FROM docker.io/library/redis:7-${DEBIAN_VERSION} AS redis_base
-
 # now build the final image, based on the the regular Synapse docker image
 FROM $FROM
 
     # Copy over dependencies
-    COPY --from=redis_base /usr/local/bin/redis-server /usr/local/bin
+    COPY --from=deps_base --parents /usr/lib/*-linux-gnu/libicu* /
+    COPY --from=deps_base /usr/bin/redis-server /usr/local/bin
     COPY --from=deps_base /uv /
     COPY --from=deps_base /usr/sbin/nginx /usr/sbin
     COPY --from=deps_base /usr/share/nginx /usr/share/nginx
@@ -65,6 +71,15 @@ FROM $FROM
 
     # Expose nginx listener port
     EXPOSE 8080/tcp
+    # Metrics for workers are on ports starting from 19091 but since these are dynamic
+    # we don't expose them by default (metrics must be enabled with
+    # SYNAPSE_ENABLE_METRICS=1)
+    #
+    # Instead, we expose a single port used for Prometheus HTTP service discovery
+    # (`http://<synapse_container>:9469/metrics/service_discovery`) and proxy all of the
+    # workers' metrics endpoints through that
+    # (`http://<synapse_container>:9469/metrics/worker/<worker_name>`).
+    EXPOSE 9469/tcp
 
     # A script to read environment variables and create the necessary
     # files to run the desired worker configuration. Will start supervisord.
diff --git a/docker/README-testing.md b/docker/README-testing.md
index db88598b8c..8ce7dffc33 100644
--- a/docker/README-testing.md
+++ b/docker/README-testing.md
@@ -12,11 +12,9 @@ Note that running Synapse's unit tests from within the docker image is not suppo
 
 `scripts-dev/complement.sh` is a script that will automatically build
 and run Synapse against Complement.
-Consult the [contributing guide][guideComplementSh] for instructions on how to use it.
+Consult our [Complement docs][https://github.com/element-hq/synapse/tree/develop/complement] for instructions on how to use it.
 
 
-[guideComplementSh]: https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-integration-tests-complement
-
 ## Building and running the images manually
 
 Under some circumstances, you may wish to build the images manually.
@@ -31,23 +29,23 @@ release of Synapse, instead of your current checkout, you can skip this step. Fr
 root of the repository:
 
 ```sh
-docker build -t matrixdotorg/synapse -f docker/Dockerfile .
+docker build -t localhost/synapse -f docker/Dockerfile .
 ```
 
 Next, build the workerised Synapse docker image, which is a layer over the base
 image.
 
 ```sh
-docker build -t matrixdotorg/synapse-workers -f docker/Dockerfile-workers .
+docker build -t localhost/synapse-workers --build-arg FROM=localhost/synapse -f docker/Dockerfile-workers .
 ```
 
 Finally, build the multi-purpose image for Complement, which is a layer over the workers image.
 
 ```sh
-docker build -t complement-synapse -f docker/complement/Dockerfile docker/complement
+docker build -t localhost/complement-synapse -f docker/complement/Dockerfile --build-arg FROM=localhost/synapse-workers docker/complement
 ```
 
-This will build an image with the tag `complement-synapse`, which can be handed to
+This will build an image with the tag `localhost/complement-synapse`, which can be handed to
 Complement for testing via the `COMPLEMENT_BASE_IMAGE` environment variable. Refer to
 [Complement's documentation](https://github.com/matrix-org/complement/#running) for
 how to run the tests, as well as the various available command line flags.
@@ -135,3 +133,49 @@ but it does not serve TLS by default.
 You can configure `SYNAPSE_TLS_CERT` and `SYNAPSE_TLS_KEY` to point to a
 TLS certificate and key (respectively), both in PEM (textual) format.
 In this case, Nginx will additionally serve using HTTPS on port 8448.
+
+
+### Metrics
+
+Set `SYNAPSE_ENABLE_METRICS=1` to configure `enable_metrics: true` and setup the
+`metrics` listener on the main and worker processes. Defaults to `0` (disabled). The
+main process will listen on port `19090` and workers on port `19091 + <worker index>`.
+
+When using `docker/Dockerfile-workers`, to ease the complexity with the metrics setup,
+we also have a [Prometheus HTTP service
+discovery](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config)
+endpoint available at `http://<synapse_container>:9469/metrics/service_discovery`.
+
+The metrics from each worker can also be accessed via
+`http://<synapse_container>:9469/metrics/worker/<worker_name>` which is what the service
+discovery response points to behind the scenes. This way, you only need to expose a
+single port (9469) to access all metrics.
+
+```yaml
+global:
+  scrape_interval: 15s
+  scrape_timeout: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: synapse
+    scrape_interval: 15s
+    metrics_path: /_synapse/metrics
+    scheme: http
+    # We set `honor_labels` so that each service can set their own `job`/`instance` label
+    #
+    # > honor_labels controls how Prometheus handles conflicts between labels that are
+    # > already present in scraped data and labels that Prometheus would attach
+    # > server-side ("job" and "instance" labels, manually configured target
+    # > labels, and labels generated by service discovery implementations).
+    # >
+    # > *-- https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config*
+    honor_labels: true
+    # Use HTTP service discovery
+    #
+    # Reference:
+    #  - https://prometheus.io/docs/prometheus/latest/http_sd/
+    #  - https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config
+    http_sd_configs:
+      - url: 'http://localhost:9469/metrics/service_discovery'
+```
diff --git a/docker/README.md b/docker/README.md
index 3438e9c441..ed5155f541 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -75,6 +75,9 @@ The following environment variables are supported in `generate` mode:
   particularly tricky.
 * `SYNAPSE_LOG_TESTING`: if set, Synapse will log additional information useful
   for testing.
+* `SYNAPSE_ENABLE_METRICS`: if set to `1`, the metrics listener will be enabled on the
+  main and worker processes. Defaults to `0` (disabled). The main process will listen on
+  port `19090` and workers on port `19091 + <worker index>`.
 
 ## Postgres
 
diff --git a/docker/complement/Dockerfile b/docker/complement/Dockerfile
index 6ed084fe5d..ec4bca232c 100644
--- a/docker/complement/Dockerfile
+++ b/docker/complement/Dockerfile
@@ -9,24 +9,24 @@
 ARG SYNAPSE_VERSION=latest
 # This is an intermediate image, to be built locally (not pulled from a registry).
 ARG FROM=matrixdotorg/synapse-workers:$SYNAPSE_VERSION
-ARG DEBIAN_VERSION=bookworm
+ARG DEBIAN_VERSION=trixie
 
-FROM docker.io/library/postgres:13-${DEBIAN_VERSION} AS postgres_base
+FROM docker.io/library/postgres:14-${DEBIAN_VERSION} AS postgres_base
 
 FROM $FROM
 # First of all, we copy postgres server from the official postgres image,
 # since for repeated rebuilds, this is much faster than apt installing
 # postgres each time.
 
-# This trick only works because (a) the Synapse image happens to have all the
-# shared libraries that postgres wants, (b) we use a postgres image based on
-# the same debian version as Synapse's docker image (so the versions of the
-# shared libraries match).
+# This trick only works because we use a postgres image based on the same
+# debian version as Synapse's docker image (so the versions of the shared
+# libraries match). Any missing libraries need to be added to either the
+# Synapse image or docker/Dockerfile-workers.
 RUN adduser --system --uid 999 postgres --home /var/lib/postgresql
 COPY --from=postgres_base /usr/lib/postgresql /usr/lib/postgresql
 COPY --from=postgres_base /usr/share/postgresql /usr/share/postgresql
 COPY --from=postgres_base --chown=postgres /var/run/postgresql /var/run/postgresql
-ENV PATH="${PATH}:/usr/lib/postgresql/13/bin"
+ENV PATH="${PATH}:/usr/lib/postgresql/14/bin"
 ENV PGDATA=/var/lib/postgresql/data
 
 # We also initialize the database at build time, rather than runtime, so that it's faster to spin up the image.
diff --git a/docker/complement/conf/start_for_complement.sh b/docker/complement/conf/start_for_complement.sh
index da1b26a283..e0d30abed3 100755
--- a/docker/complement/conf/start_for_complement.sh
+++ b/docker/complement/conf/start_for_complement.sh
@@ -128,6 +128,10 @@ openssl x509 -req -in /conf/server.tls.csr \
 export SYNAPSE_TLS_CERT=/conf/server.tls.crt
 export SYNAPSE_TLS_KEY=/conf/server.tls.key
 
+# Add a directory for tests to add config overrides if they want
+mkdir --parents /conf/homeserver.d
+export _SYNAPSE_COMPLEMENT_EXTRA_CONFIG_DIR=/conf/homeserver.d
+
 # Run the script that writes the necessary config files and starts supervisord, which in turn
 # starts everything else
 exec /configure_workers_and_start.py "$@"
diff --git a/docker/complement/conf/workers-shared-extra.yaml.j2 b/docker/complement/conf/workers-shared-extra.yaml.j2
index 168c385191..9fd7fc954a 100644
--- a/docker/complement/conf/workers-shared-extra.yaml.j2
+++ b/docker/complement/conf/workers-shared-extra.yaml.j2
@@ -102,6 +102,10 @@ rc_room_creation:
   per_second: 9999
   burst_count: 9999
 
+rc_user_directory:
+  per_second: 9999
+  burst_count: 9999
+
 federation_rr_transactions_per_room_per_second: 9999
 
 allow_device_name_lookup_over_federation: true
@@ -133,6 +137,12 @@ experimental_features:
   msc3984_appservice_key_query: true
   # Invite filtering
   msc4155_enabled: true
+  # Thread Subscriptions
+  msc4306_enabled: true
+  # Sticky Events
+  msc4354_enabled: true
+  # `/sync` `state_after`
+  msc4222_enabled: true
 
 server_notices:
   system_mxid_localpart: _server
diff --git a/docker/conf-workers/nginx.conf.j2 b/docker/conf-workers/nginx.conf.j2
index 95d2f760d2..3d5e02c28c 100644
--- a/docker/conf-workers/nginx.conf.j2
+++ b/docker/conf-workers/nginx.conf.j2
@@ -48,3 +48,5 @@ server {
         proxy_set_header Host $host:$server_port;
     }
 }
+
+{{ nginx_prometheus_metrics_service_discovery }}
diff --git a/docker/conf-workers/shared.yaml.j2 b/docker/conf-workers/shared.yaml.j2
index 1dfc60ad11..6efbd05472 100644
--- a/docker/conf-workers/shared.yaml.j2
+++ b/docker/conf-workers/shared.yaml.j2
@@ -20,4 +20,9 @@ app_service_config_files:
 {%- endfor %}
 {%- endif %}
 
+{# Controlled by SYNAPSE_ENABLE_METRICS #}
+{% if enable_metrics %}
+enable_metrics: true
+{% endif %}
+
 {{ shared_worker_config }}
diff --git a/docker/conf-workers/synapse.supervisord.conf.j2 b/docker/conf-workers/synapse.supervisord.conf.j2
index 4fb11b259e..9388b1ff0e 100644
--- a/docker/conf-workers/synapse.supervisord.conf.j2
+++ b/docker/conf-workers/synapse.supervisord.conf.j2
@@ -5,10 +5,16 @@ command=/usr/local/bin/python -m synapse.app.complement_fork_starter
   {{ main_config_path }}
   synapse.app.homeserver
   --config-path="{{ main_config_path }}"
+  {%- if extra_config_dir %}
+    --config-path="{{ extra_config_dir }}"
+  {%- endif %}
   --config-path=/conf/workers/shared.yaml
   {%- for worker in workers %}
     -- {{ worker.app }}
     --config-path="{{ main_config_path }}"
+    {%- if extra_config_dir %}
+      --config-path="{{ extra_config_dir }}"
+    {%- endif %}
     --config-path=/conf/workers/shared.yaml
     --config-path=/conf/workers/{{ worker.name }}.yaml
   {%- endfor %}
@@ -24,6 +30,9 @@ exitcodes=0
 environment=http_proxy="%(ENV_SYNAPSE_HTTP_PROXY)s",https_proxy="%(ENV_SYNAPSE_HTTPS_PROXY)s",no_proxy="%(ENV_SYNAPSE_NO_PROXY)s"
 command=/usr/local/bin/prefix-log /usr/local/bin/python -m synapse.app.homeserver
   --config-path="{{ main_config_path }}"
+  {%- if extra_config_dir %}
+    --config-path="{{ extra_config_dir }}"
+  {%- endif %}
   --config-path=/conf/workers/shared.yaml
 priority=10
 # Log startup failures to supervisord's stdout/err
diff --git a/docker/conf-workers/worker.yaml.j2 b/docker/conf-workers/worker.yaml.j2
index 29ec74b4ea..d4d2d4d4cf 100644
--- a/docker/conf-workers/worker.yaml.j2
+++ b/docker/conf-workers/worker.yaml.j2
@@ -21,6 +21,14 @@ worker_listeners:
 {%- endfor %}
 {% endif %}
 
+{# Controlled by SYNAPSE_ENABLE_METRICS #}
+{% if metrics_port %}
+  - type: metrics
+    # Prometheus does not support Unix sockets so we don't bother with
+    # `SYNAPSE_USE_UNIX_SOCKET`, https://github.com/prometheus/prometheus/issues/12024
+    port: {{ metrics_port }}
+{% endif %}
+
 worker_log_config: {{ worker_log_config_filepath }}
 
 {{ worker_extra_conf }}
diff --git a/docker/conf/homeserver.yaml b/docker/conf/homeserver.yaml
index 2890990705..e2e1338673 100644
--- a/docker/conf/homeserver.yaml
+++ b/docker/conf/homeserver.yaml
@@ -53,6 +53,15 @@ listeners:
       - names: [federation]
         compress: false
 
+{% if SYNAPSE_ENABLE_METRICS %}
+  - type: metrics
+    # The main process always uses the same port 19090
+    #
+    # Prometheus does not support Unix sockets so we don't bother with
+    # `SYNAPSE_USE_UNIX_SOCKET`, https://github.com/prometheus/prometheus/issues/12024
+    port: 19090
+{% endif %}
+
 ## Database ##
 
 {% if POSTGRES_PASSWORD %}
diff --git a/docker/conf/log.config b/docker/conf/log.config
index 5772321202..6fe7db66da 100644
--- a/docker/conf/log.config
+++ b/docker/conf/log.config
@@ -77,6 +77,13 @@ loggers:
     #}
     synapse.visibility.filtered_event_debug:
         level: DEBUG
+
+    {#
+      If Synapse is under test, we don't care about seeing the "Applying schema" log
+      lines at the INFO level every time we run the tests (it's 100 lines of bulk)
+    #}
+    synapse.storage.prepare_database:
+      level: WARN
     {% endif %}
 
 root:
diff --git a/docker/configure_workers_and_start.py b/docker/configure_workers_and_start.py
index 6f25653bb7..1b8d4f9989 100755
--- a/docker/configure_workers_and_start.py
+++ b/docker/configure_workers_and_start.py
@@ -49,11 +49,16 @@
 #         regardless of the SYNAPSE_LOG_LEVEL setting.
 #   * SYNAPSE_LOG_TESTING: if set, Synapse will log additional information useful
 #     for testing.
+#   * SYNAPSE_USE_UNIX_SOCKET: TODO
+#   * `SYNAPSE_ENABLE_METRICS`: if set to `1`, the metrics listener will be enabled on the
+#      main and worker processes. Defaults to `0` (disabled). The main process will listen on
+#      port `19090` and workers on port `19091 + <worker index>`.
 #
 # NOTE: According to Complement's ENTRYPOINT expectations for a homeserver image (as defined
 # in the project's README), this script may be run multiple times, and functionality should
 # continue to work if so.
 
+import json
 import os
 import platform
 import re
@@ -65,16 +70,13 @@ from itertools import chain
 from pathlib import Path
 from typing import (
     Any,
-    Dict,
-    List,
     Mapping,
     MutableMapping,
     NoReturn,
-    Optional,
-    Set,
     SupportsIndex,
 )
 
+import attr
 import yaml
 from jinja2 import Environment, FileSystemLoader
 
@@ -96,7 +98,7 @@ WORKER_PLACEHOLDER_NAME = "placeholder_name"
 # Watching /_matrix/media and related needs a "media" listener
 # Stream Writers require "client" and "replication" listeners because they
 #   have to attach by instance_map to the master process and have client endpoints.
-WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
+WORKERS_CONFIG: dict[str, dict[str, Any]] = {
     "pusher": {
         "app": "synapse.app.generic_worker",
         "listener_resources": [],
@@ -200,6 +202,7 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
             "^/_matrix/client/(api/v1|r0|v3|unstable)/keys/upload",
             "^/_matrix/client/(api/v1|r0|v3|unstable)/keys/device_signing/upload$",
             "^/_matrix/client/(api/v1|r0|v3|unstable)/keys/signatures/upload$",
+            "^/_matrix/client/unstable/org.matrix.msc4140/delayed_events(/.*/restart)?$",
         ],
         "shared_extra_conf": {},
         "worker_extra_conf": "",
@@ -340,7 +343,7 @@ WORKERS_CONFIG: Dict[str, Dict[str, Any]] = {
 }
 
 # Templates for sections that may be inserted multiple times in config files
-NGINX_LOCATION_CONFIG_BLOCK = """
+NGINX_LOCATION_REGEX_CONFIG_BLOCK = """
     location ~* {endpoint} {{
         proxy_pass {upstream};
         proxy_set_header X-Forwarded-For $remote_addr;
@@ -349,6 +352,25 @@ NGINX_LOCATION_CONFIG_BLOCK = """
     }}
 """
 
+# Having both **regex** (`NGINX_LOCATION_REGEX_CONFIG_BLOCK`) match vs **exact**
+# (`NGINX_LOCATION_EXACT_CONFIG_BLOCK`) match is necessary because we can't use a URI
+# path in `proxy_pass http://localhost:19090/_synapse/metrics` with the regex version.
+#
+# Example of what happens if you try to use `proxy_pass http://localhost:19090/_synapse/metrics`
+# with `NGINX_LOCATION_REGEX_CONFIG_BLOCK`:
+# ```
+# nginx | 2025/12/31 22:58:34 [emerg] 21#21: "proxy_pass" cannot have URI part in location given by regular expression, or inside named location, or inside "if" statement, or inside "limit_except" block in /etc/nginx/conf.d/matrix-synapse.conf:732
+# ```
+NGINX_LOCATION_EXACT_CONFIG_BLOCK = """
+    location = {endpoint} {{
+        proxy_pass {upstream};
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+    }}
+"""
+
+
 NGINX_UPSTREAM_CONFIG_BLOCK = """
 upstream {upstream_worker_base_name} {{
 {body}
@@ -356,6 +378,63 @@ upstream {upstream_worker_base_name} {{
 """
 
 
+PROMETHEUS_METRICS_SERVICE_DISCOVERY_FILE_PATH = (
+    "/data/prometheus_service_discovery.json"
+)
+"""
+We serve this file with nginx so people can use it with `http_sd_config` in their
+Prometheus config.
+"""
+
+NGINX_HOST_PLACEHOLDER = "<HOST_PLACEHOLDER>"
+"""Will be replaced with the whatever hostname:port used to access the nginx metrics endpoint."""
+
+NGINX_PROMETHEUS_METRICS_SERVICE_DISCOVERY = """
+server {{
+    listen 9469;
+    location = /metrics/service_discovery {{
+        alias {service_discovery_file_path};
+        default_type application/json;
+
+        # Find/replace the host placeholder in the response body with the actual
+        # host used to access this endpoint.
+        #
+        # We want to reflect back whatever host the client used to access this file.
+        # For example, if they accessed it via `localhost:9469`, then they
+        # can also reach all of the proxied metrics endpoints at the same address.
+        # Or if it's Prometheus in another container, it will access this via
+        # `host.docker.internal:9469`, etc. Or perhaps it's even some randomly assigned
+        # port mapping.
+        sub_filter '{host_placeholder}' '$http_host';
+        # By default, `ngx_http_sub_module` only works on `text/html` responses. We want
+        # to find/replace in `application/JSON`.
+        sub_filter_types application/json;
+        # Replace all occurences
+        sub_filter_once off;
+    }}
+
+    # Make the service discovery endpoint easy to find; redirect to the correct spot.
+    location = / {{
+        return 302 /metrics/service_discovery;
+    }}
+
+    {metrics_proxy_locations}
+}}
+"""
+"""
+Setup the nginx config necessary to serve the JSON file for Prometheus HTTP service discovery
+(`http_sd_config`). Served at `/metrics/service_discovery`.
+
+Reference:
+ - https://prometheus.io/docs/prometheus/latest/http_sd/
+ - https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config
+
+We also proxy all of the Synapse metrics endpoints through a central place so that
+people only need to expose the single 9469 port and service discovery can take care of
+the rest: `/metrics/worker/<worker_name>` -> http://localhost:19090/_synapse/metrics
+"""
+
+
 # Utility functions
 def log(txt: str) -> None:
     print(txt)
@@ -408,7 +487,7 @@ def convert(src: str, dst: str, **template_vars: object) -> None:
 
 def add_worker_roles_to_shared_config(
     shared_config: dict,
-    worker_types_set: Set[str],
+    worker_types_set: set[str],
     worker_name: str,
     worker_port: int,
 ) -> None:
@@ -471,9 +550,9 @@ def add_worker_roles_to_shared_config(
 
 
 def merge_worker_template_configs(
-    existing_dict: Optional[Dict[str, Any]],
-    to_be_merged_dict: Dict[str, Any],
-) -> Dict[str, Any]:
+    existing_dict: dict[str, Any] | None,
+    to_be_merged_dict: dict[str, Any],
+) -> dict[str, Any]:
     """When given an existing dict of worker template configuration consisting with both
         dicts and lists, merge new template data from WORKERS_CONFIG(or create) and
         return new dict.
@@ -484,7 +563,7 @@ def merge_worker_template_configs(
             existing_dict.
     Returns: The newly merged together dict values.
     """
-    new_dict: Dict[str, Any] = {}
+    new_dict: dict[str, Any] = {}
     if not existing_dict:
         # It doesn't exist yet, just use the new dict(but take a copy not a reference)
         new_dict = to_be_merged_dict.copy()
@@ -509,8 +588,8 @@ def merge_worker_template_configs(
 
 
 def insert_worker_name_for_worker_config(
-    existing_dict: Dict[str, Any], worker_name: str
-) -> Dict[str, Any]:
+    existing_dict: dict[str, Any], worker_name: str
+) -> dict[str, Any]:
     """Insert a given worker name into the worker's configuration dict.
 
     Args:
@@ -526,7 +605,7 @@ def insert_worker_name_for_worker_config(
     return dict_to_edit
 
 
-def apply_requested_multiplier_for_worker(worker_types: List[str]) -> List[str]:
+def apply_requested_multiplier_for_worker(worker_types: list[str]) -> list[str]:
     """
     Apply multiplier(if found) by returning a new expanded list with some basic error
     checking.
@@ -587,7 +666,7 @@ def is_sharding_allowed_for_worker_type(worker_type: str) -> bool:
 
 def split_and_strip_string(
     given_string: str, split_char: str, max_split: SupportsIndex = -1
-) -> List[str]:
+) -> list[str]:
     """
     Helper to split a string on split_char and strip whitespace from each end of each
         element.
@@ -615,9 +694,42 @@ def generate_base_homeserver_config() -> None:
     subprocess.run([sys.executable, "/start.py", "migrate_config"], check=True)
 
 
+@attr.s(auto_attribs=True)
+class Worker:
+    worker_name: str
+    """
+    ex.
+    `event_persister:2` -> `event_persister1` and `event_persister2`
+    `stream_writers=account_data+presence+receipts+to_device+typing"` -> `stream_writers`
+    """
+
+    worker_base_name: str
+    """
+    ex.
+    `event_persister:2` -> `event_persister`
+    `stream_writers=account_data+presence+receipts+to_device+typing"` -> `stream_writers`
+    """
+
+    worker_index: int
+    """
+    The index of the worker starting from 1 for each worker type requested.
+
+    ex.
+    `event_persister:2` -> `1` and `2`
+    `stream_writers=account_data+presence+receipts+to_device+typing"` -> `1`
+    """
+
+    worker_types: set[str]
+    """
+    ex.
+    `event_persister:2` -> `{"event_persister"}`
+    `stream_writers=account_data+presence+receipts+to_device+typing"` -> `{"account_data", "presence", "receipts","to_device", "typing"}
+    """
+
+
 def parse_worker_types(
-    requested_worker_types: List[str],
-) -> Dict[str, Set[str]]:
+    requested_worker_types: list[str],
+) -> list[Worker]:
     """Read the desired list of requested workers and prepare the data for use in
         generating worker config files while also checking for potential gotchas.
 
@@ -625,22 +737,19 @@ def parse_worker_types(
         requested_worker_types: The list formed from the split environment variable
             containing the unprocessed requests for workers.
 
-    Returns: A dict of worker names to set of worker types. Format:
-        {'worker_name':
-            {'worker_type', 'worker_type2'}
-        }
+    Returns: A list of requested workers
     """
     # A counter of worker_base_name -> int. Used for determining the name for a given
     # worker when generating its config file, as each worker's name is just
     # worker_base_name followed by instance number
-    worker_base_name_counter: Dict[str, int] = defaultdict(int)
+    worker_base_name_counter: dict[str, int] = defaultdict(int)
 
     # Similar to above, but more finely grained. This is used to determine we don't have
     # more than a single worker for cases where multiples would be bad(e.g. presence).
-    worker_type_shard_counter: Dict[str, int] = defaultdict(int)
+    worker_type_shard_counter: dict[str, int] = defaultdict(int)
 
-    # The final result of all this processing
-    dict_to_return: Dict[str, Set[str]] = {}
+    # Map from worker name to `Worker`
+    worker_dict: dict[str, Worker] = {}
 
     # Handle any multipliers requested for given workers.
     multiple_processed_worker_types = apply_requested_multiplier_for_worker(
@@ -684,7 +793,7 @@ def parse_worker_types(
 
         # Split the worker_type_string on "+", remove whitespace from ends then make
         # the list a set so it's deduplicated.
-        worker_types_set: Set[str] = set(
+        worker_types_set: set[str] = set(
             split_and_strip_string(worker_type_string, "+")
         )
 
@@ -726,24 +835,30 @@ def parse_worker_types(
         if worker_number > 1:
             # If this isn't the first worker, check that we don't have a confusing
             # mixture of worker types with the same base name.
-            first_worker_with_base_name = dict_to_return[f"{worker_base_name}1"]
-            if first_worker_with_base_name != worker_types_set:
+            first_worker_with_base_name = worker_dict[f"{worker_base_name}1"]
+            if first_worker_with_base_name.worker_types != worker_types_set:
                 error(
                     f"Can not use worker_name: '{worker_name}' for worker_type(s): "
                     f"{worker_types_set!r}. It is already in use by "
-                    f"worker_type(s): {first_worker_with_base_name!r}"
+                    f"worker_type(s): {first_worker_with_base_name.worker_types!r}"
                 )
 
-        dict_to_return[worker_name] = worker_types_set
+        worker_dict[worker_name] = Worker(
+            worker_name=worker_name,
+            worker_base_name=worker_base_name,
+            worker_index=worker_number,
+            worker_types=worker_types_set,
+        )
 
-    return dict_to_return
+    return list(worker_dict.values())
 
 
 def generate_worker_files(
     environ: Mapping[str, str],
     config_path: str,
+    extra_config_dir: str | None,
     data_dir: str,
-    requested_worker_types: Dict[str, Set[str]],
+    requested_workers: list[Worker],
 ) -> None:
     """Read the desired workers(if any) that is passed in and generate shared
         homeserver, nginx and supervisord configs.
@@ -751,20 +866,23 @@ def generate_worker_files(
     Args:
         environ: os.environ instance.
         config_path: The location of the generated Synapse main worker config file.
+        extra_config_dir: A directory in which extra Synapse configuration files will be loaded.
         data_dir: The location of the synapse data directory. Where log and
             user-facing config files live.
-        requested_worker_types: A Dict containing requested workers in the format of
-            {'worker_name1': {'worker_type', ...}}
+        requested_workers: A list of requested workers
     """
     # Note that yaml cares about indentation, so care should be taken to insert lines
     # into files at the correct indentation below.
 
     # Convenience helper for if using unix sockets instead of host:port
     using_unix_sockets = environ.get("SYNAPSE_USE_UNIX_SOCKET", False)
+
+    enable_metrics = environ.get("SYNAPSE_ENABLE_METRICS", "0") == "1"
+
     # First read the original config file and extract the listeners block. Then we'll
     # add another listener for replication. Later we'll write out the result to the
     # shared config file.
-    listeners: List[Any]
+    listeners: list[Any]
     if using_unix_sockets:
         listeners = [
             {
@@ -792,12 +910,16 @@ def generate_worker_files(
     # base shared worker jinja2 template. This config file will be passed to all
     # workers, included Synapse's main process. It is intended mainly for disabling
     # functionality when certain workers are spun up, and adding a replication listener.
-    shared_config: Dict[str, Any] = {"listeners": listeners}
+    shared_config: dict[str, Any] = {
+        "listeners": listeners,
+        # Controls `enable_metrics: true`
+        "enable_metrics": enable_metrics,
+    }
 
     # List of dicts that describe workers.
     # We pass this to the Supervisor template later to generate the appropriate
     # program blocks.
-    worker_descriptors: List[Dict[str, Any]] = []
+    worker_descriptors: list[dict[str, Any]] = []
 
     # Upstreams for load-balancing purposes. This dict takes the form of the worker
     # type to the ports of each worker. For example:
@@ -805,20 +927,22 @@ def generate_worker_files(
     #   worker_type: {1234, 1235, ...}}
     # }
     # and will be used to construct 'upstream' nginx directives.
-    nginx_upstreams: Dict[str, Set[int]] = {}
+    nginx_upstreams: dict[str, set[int]] = {}
 
     # A map of: {"endpoint": "upstream"}, where "upstream" is a str representing what
     # will be placed after the proxy_pass directive. The main benefit to representing
     # this data as a dict over a str is that we can easily deduplicate endpoints
     # across multiple instances of the same worker. The final rendering will be combined
     # with nginx_upstreams and placed in /etc/nginx/conf.d.
-    nginx_locations: Dict[str, str] = {}
+    nginx_locations: dict[str, str] = {}
 
     # Create the worker configuration directory if it doesn't already exist
     os.makedirs("/conf/workers", exist_ok=True)
 
     # Start worker ports from this arbitrary port
     worker_port = 18009
+    # The main process metrics port is 19090, so start workers from 19091
+    worker_metrics_port = 19091
 
     # A list of internal endpoints to healthcheck, starting with the main process
     # which exists even if no workers do.
@@ -835,7 +959,9 @@ def generate_worker_files(
         healthcheck_urls = ["http://localhost:8080/health"]
 
     # Get the set of all worker types that we have configured
-    all_worker_types_in_use = set(chain(*requested_worker_types.values()))
+    all_worker_types_in_use = set(
+        chain(*[worker.worker_types for worker in requested_workers])
+    )
     # Map locations to upstreams (corresponding to worker types) in Nginx
     # but only if we use the appropriate worker type
     for worker_type in all_worker_types_in_use:
@@ -844,12 +970,13 @@ def generate_worker_files(
 
     # For each worker type specified by the user, create config values and write it's
     # yaml config file
-    for worker_name, worker_types_set in requested_worker_types.items():
+    worker_name_to_metrics_port_map: dict[str, int] = {}
+    for worker in requested_workers:
         # The collected and processed data will live here.
-        worker_config: Dict[str, Any] = {}
+        worker_config: dict[str, Any] = {}
 
         # Merge all worker config templates for this worker into a single config
-        for worker_type in worker_types_set:
+        for worker_type in worker.worker_types:
             copy_of_template_config = WORKERS_CONFIG[worker_type].copy()
 
             # Merge worker type template configuration data. It's a combination of lists
@@ -859,16 +986,27 @@ def generate_worker_files(
             )
 
         # Replace placeholder names in the config template with the actual worker name.
-        worker_config = insert_worker_name_for_worker_config(worker_config, worker_name)
-
-        worker_config.update(
-            {"name": worker_name, "port": str(worker_port), "config_path": config_path}
+        worker_config = insert_worker_name_for_worker_config(
+            worker_config, worker.worker_name
         )
 
-        # Update the shared config with any worker_type specific options. The first of a
-        # given worker_type needs to stay assigned and not be replaced.
-        worker_config["shared_extra_conf"].update(shared_config)
-        shared_config = worker_config["shared_extra_conf"]
+        worker_config.update(
+            {
+                "name": worker.worker_name,
+                "port": str(worker_port),
+                "config_path": config_path,
+            }
+        )
+
+        # Keep the `shared_config` up to date with the `shared_extra_conf` from each
+        # worker.
+        shared_config = {
+            **worker_config["shared_extra_conf"],
+            # We combine `shared_config` second to avoid overwriting existing keys just
+            # for sanity sake (always use the first worker).
+            **shared_config,
+        }
+
         if using_unix_sockets:
             healthcheck_urls.append(
                 f"--unix-socket /run/worker.{worker_port} http://localhost/health"
@@ -880,39 +1018,51 @@ def generate_worker_files(
         # the `events` stream. For other workers, the worker name is the same
         # name of the stream they write to, but for some reason it is not the
         # case for event_persister.
-        if "event_persister" in worker_types_set:
-            worker_types_set.add("events")
+        if "event_persister" in worker.worker_types:
+            worker.worker_types.add("events")
 
         # Update the shared config with sharding-related options if necessary
         add_worker_roles_to_shared_config(
-            shared_config, worker_types_set, worker_name, worker_port
+            shared_config, worker.worker_types, worker.worker_name, worker_port
         )
 
         # Enable the worker in supervisord
         worker_descriptors.append(worker_config)
 
         # Write out the worker's logging config file
-        log_config_filepath = generate_worker_log_config(environ, worker_name, data_dir)
+        log_config_filepath = generate_worker_log_config(
+            environ, worker.worker_name, data_dir
+        )
+
+        worker_name_to_metrics_port_map[worker.worker_name] = worker_metrics_port
+        if enable_metrics:
+            # Enable prometheus metrics endpoint on this worker
+            worker_config["metrics_port"] = worker_metrics_port
+
+        if enable_metrics:
+            # Enable prometheus metrics endpoint on this worker
+            worker_config["metrics_port"] = worker_metrics_port
 
         # Then a worker config file
         convert(
             "/conf/worker.yaml.j2",
-            f"/conf/workers/{worker_name}.yaml",
+            f"/conf/workers/{worker.worker_name}.yaml",
             **worker_config,
             worker_log_config_filepath=log_config_filepath,
             using_unix_sockets=using_unix_sockets,
         )
 
         # Save this worker's port number to the correct nginx upstreams
-        for worker_type in worker_types_set:
+        for worker_type in worker.worker_types:
             nginx_upstreams.setdefault(worker_type, set()).add(worker_port)
 
         worker_port += 1
+        worker_metrics_port += 1
 
     # Build the nginx location config blocks
     nginx_location_config = ""
     for endpoint, upstream in nginx_locations.items():
-        nginx_location_config += NGINX_LOCATION_CONFIG_BLOCK.format(
+        nginx_location_config += NGINX_LOCATION_REGEX_CONFIG_BLOCK.format(
             endpoint=endpoint,
             upstream=upstream,
         )
@@ -935,6 +1085,111 @@ def generate_worker_files(
             body=body,
         )
 
+    # Provide a Prometheus metrics service discovery endpoint to easily be able to pick
+    # up all of the workers
+    nginx_prometheus_metrics_service_discovery = ""
+    if enable_metrics:
+        # Write JSON file for Prometheus service discovery pointing to all of the
+        # workers. We serve this file with nginx so people can use it with
+        # `http_sd_config` in their Prometheus config.
+        #
+        # > It fetches targets from an HTTP endpoint containing a list of zero or more
+        # > `<static_config>`s. The target must reply with an HTTP 200 response. The HTTP
+        # > header `Content-Type` must be `application/json`, and the body must be valid
+        # > JSON.
+        # >
+        # > *-- https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config*
+        #
+        # Another reference: https://prometheus.io/docs/prometheus/latest/http_sd/
+        prometheus_http_service_discovery_content = [
+            {
+                "targets": [NGINX_HOST_PLACEHOLDER],
+                "labels": {
+                    # The downstream user should also configure `honor_labels: true` in
+                    # their Prometheus config to prevent Prometheus from overwriting the
+                    # `job` labels.
+                    #
+                    # > honor_labels controls how Prometheus handles conflicts between labels that are
+                    # > already present in scraped data and labels that Prometheus would attach
+                    # > server-side ("job" and "instance" labels, manually configured target
+                    # > labels, and labels generated by service discovery implementations).
+                    # >
+                    # > *-- https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config*
+                    #
+                    # Reference:
+                    # - https://prometheus.io/docs/concepts/jobs_instances/
+                    # - https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config
+                    "job": worker.worker_base_name,
+                    "index": f"{worker.worker_index}",
+                    # This allows us to change the `metrics_path` on a per-target basis.
+                    # We want to grab the metrics from our nginx proxied location (setup
+                    # below).
+                    #
+                    # While there doesn't seem to be official docs on these special
+                    # labels (`__metrics_path__`, `__scheme__`, `__scrape_interval__`,
+                    # `__scrape_timeout__`), this discussion best summarizes how this
+                    # works: https://github.com/prometheus/prometheus/discussions/13217
+                    "__metrics_path__": f"/metrics/worker/{worker.worker_name}",
+                },
+            }
+            for worker in requested_workers
+        ]
+        # Add the main Synapse process as well
+        prometheus_http_service_discovery_content.append(
+            {
+                "targets": [NGINX_HOST_PLACEHOLDER],
+                "labels": {
+                    # We use `"synapse"` as the job name for the main process because it
+                    # matches what we expect people to use from a monolith setup with
+                    # their static scrape config. It's `job` name used in our Grafana
+                    # dashboard for the main process.
+                    "job": "synapse",
+                    "index": "1",
+                    "__metrics_path__": "/metrics/worker/main",
+                },
+            }
+        )
+
+        # Check to make sure the file doesn't already exist
+        if os.path.isfile(PROMETHEUS_METRICS_SERVICE_DISCOVERY_FILE_PATH):
+            error(
+                f"Prometheus service discovery file "
+                f"'{PROMETHEUS_METRICS_SERVICE_DISCOVERY_FILE_PATH}' already exists (unexpected)! "
+                f"This is a problem because the existing file probably doesn't match the "
+                "Synapse workers we're setting up now."
+            )
+
+        # Write the file
+        with open(PROMETHEUS_METRICS_SERVICE_DISCOVERY_FILE_PATH, "w") as outfile:
+            outfile.write(
+                json.dumps(prometheus_http_service_discovery_content, indent=4)
+            )
+
+        # Proxy all of the Synapse metrics endpoints through a central place so that
+        # people only need to expose the single 9469 port and service discovery can take
+        # care of the rest: `/metrics/worker/<worker_name>` ->
+        # http://localhost:19090/_synapse/metrics
+        #
+        # Build the nginx location config blocks
+        metrics_proxy_locations = ""
+        for worker in requested_workers:
+            metrics_proxy_locations += NGINX_LOCATION_EXACT_CONFIG_BLOCK.format(
+                endpoint=f"/metrics/worker/{worker.worker_name}",
+                upstream=f"http://localhost:{worker_name_to_metrics_port_map[worker.worker_name]}/_synapse/metrics",
+            )
+        # Add the main Synapse process as well
+        metrics_proxy_locations += NGINX_LOCATION_EXACT_CONFIG_BLOCK.format(
+            endpoint="/metrics/worker/main",
+            upstream="http://localhost:19090/_synapse/metrics",
+        )
+
+        # Add a nginx server/location to serve the JSON file
+        nginx_prometheus_metrics_service_discovery = NGINX_PROMETHEUS_METRICS_SERVICE_DISCOVERY.format(
+            service_discovery_file_path=PROMETHEUS_METRICS_SERVICE_DISCOVERY_FILE_PATH,
+            host_placeholder=NGINX_HOST_PLACEHOLDER,
+            metrics_proxy_locations=metrics_proxy_locations,
+        )
+
     # Finally, we'll write out the config files.
 
     # log config for the master process
@@ -952,7 +1207,7 @@ def generate_worker_files(
             if reg_path.suffix.lower() in (".yaml", ".yml")
         ]
 
-    workers_in_use = len(requested_worker_types) > 0
+    workers_in_use = len(requested_workers) > 0
 
     # If there are workers, add the main process to the instance_map too.
     if workers_in_use:
@@ -987,6 +1242,7 @@ def generate_worker_files(
         tls_cert_path=os.environ.get("SYNAPSE_TLS_CERT"),
         tls_key_path=os.environ.get("SYNAPSE_TLS_KEY"),
         using_unix_sockets=using_unix_sockets,
+        nginx_prometheus_metrics_service_discovery=nginx_prometheus_metrics_service_discovery,
     )
 
     # Supervisord config
@@ -1004,6 +1260,7 @@ def generate_worker_files(
         "/etc/supervisor/conf.d/synapse.conf",
         workers=worker_descriptors,
         main_config_path=config_path,
+        extra_config_dir=extra_config_dir,
         use_forking_launcher=environ.get("SYNAPSE_USE_EXPERIMENTAL_FORKING_LAUNCHER"),
     )
 
@@ -1029,7 +1286,7 @@ def generate_worker_log_config(
     Returns: the path to the generated file
     """
     # Check whether we should write worker logs to disk, in addition to the console
-    extra_log_template_args: Dict[str, Optional[str]] = {}
+    extra_log_template_args: dict[str, str | None] = {}
     if environ.get("SYNAPSE_WORKERS_WRITE_LOGS_TO_DISK"):
         extra_log_template_args["LOG_FILE_PATH"] = f"{data_dir}/logs/{worker_name}.log"
 
@@ -1053,7 +1310,7 @@ def generate_worker_log_config(
     return log_config_filepath
 
 
-def main(args: List[str], environ: MutableMapping[str, str]) -> None:
+def main(args: list[str], environ: MutableMapping[str, str]) -> None:
     parser = ArgumentParser()
     parser.add_argument(
         "--generate-only",
@@ -1064,6 +1321,9 @@ def main(args: List[str], environ: MutableMapping[str, str]) -> None:
 
     config_dir = environ.get("SYNAPSE_CONFIG_DIR", "/data")
     config_path = environ.get("SYNAPSE_CONFIG_PATH", config_dir + "/homeserver.yaml")
+    # All files in this directory will be loaded as `homeserver.yaml` snippets
+    # Currently only intended for use by Complement
+    extra_config_dir = environ.get("_SYNAPSE_COMPLEMENT_EXTRA_CONFIG_DIR", None)
     data_dir = environ.get("SYNAPSE_DATA_DIR", "/data")
 
     # override SYNAPSE_NO_TLS, we don't support TLS in worker mode,
@@ -1087,15 +1347,21 @@ def main(args: List[str], environ: MutableMapping[str, str]) -> None:
         if not worker_types_env:
             # No workers, just the main process
             worker_types = []
-            requested_worker_types: Dict[str, Any] = {}
+            requested_workers: list[Worker] = []
         else:
             # Split type names by comma, ignoring whitespace.
             worker_types = split_and_strip_string(worker_types_env, ",")
-            requested_worker_types = parse_worker_types(worker_types)
+            requested_workers = parse_worker_types(worker_types)
 
         # Always regenerate all other config files
         log("Generating worker config files")
-        generate_worker_files(environ, config_path, data_dir, requested_worker_types)
+        generate_worker_files(
+            environ=environ,
+            config_path=config_path,
+            extra_config_dir=extra_config_dir,
+            data_dir=data_dir,
+            requested_workers=requested_workers,
+        )
 
         # Mark workers as being configured
         with open(mark_filepath, "w") as f:
diff --git a/docker/editable.Dockerfile b/docker/editable.Dockerfile
index f18cf6a5d9..b2aff9cb53 100644
--- a/docker/editable.Dockerfile
+++ b/docker/editable.Dockerfile
@@ -3,14 +3,14 @@
 #
 # Used by `complement.sh`. Not suitable for production use.
 
-ARG PYTHON_VERSION=3.9
+ARG PYTHON_VERSION=3.10
 
 ###
 ### Stage 0: generate requirements.txt
 ###
-# We hardcode the use of Debian bookworm here because this could change upstream
-# and other Dockerfiles used for testing are expecting bookworm.
-FROM docker.io/library/python:${PYTHON_VERSION}-slim-bookworm
+# We hardcode the use of Debian trixie here because this could change upstream
+# and other Dockerfiles used for testing are expecting trixie.
+FROM docker.io/library/python:${PYTHON_VERSION}-slim-trixie
 
 # Install Rust and other dependencies (stolen from normal Dockerfile)
 # install the OS build deps
diff --git a/docker/start.py b/docker/start.py
index 0be9976a0c..19f1ab5075 100755
--- a/docker/start.py
+++ b/docker/start.py
@@ -6,7 +6,7 @@ import os
 import platform
 import subprocess
 import sys
-from typing import Any, Dict, List, Mapping, MutableMapping, NoReturn, Optional
+from typing import Any, Mapping, MutableMapping, NoReturn
 
 import jinja2
 
@@ -31,6 +31,25 @@ def flush_buffers() -> None:
     sys.stderr.flush()
 
 
+def strtobool(val: str) -> bool:
+    """Convert a string representation of truth to True or False
+
+    True values are 'y', 'yes', 't', 'true', 'on', and '1'; false values
+    are 'n', 'no', 'f', 'false', 'off', and '0'.  Raises ValueError if
+    'val' is anything else.
+
+    This is lifted from distutils.util.strtobool, with the exception that it actually
+    returns a bool, rather than an int.
+    """
+    val = val.lower()
+    if val in ("y", "yes", "t", "true", "on", "1"):
+        return True
+    elif val in ("n", "no", "f", "false", "off", "0"):
+        return False
+    else:
+        raise ValueError("invalid truth value %r" % (val,))
+
+
 def convert(src: str, dst: str, environ: Mapping[str, object]) -> None:
     """Generate a file from a template
 
@@ -50,7 +69,7 @@ def generate_config_from_template(
     config_dir: str,
     config_path: str,
     os_environ: Mapping[str, str],
-    ownership: Optional[str],
+    ownership: str | None,
 ) -> None:
     """Generate a homeserver.yaml from environment variables
 
@@ -69,7 +88,7 @@ def generate_config_from_template(
             )
 
     # populate some params from data files (if they exist, else create new ones)
-    environ: Dict[str, Any] = dict(os_environ)
+    environ: dict[str, Any] = dict(os_environ)
     secrets = {
         "registration": "SYNAPSE_REGISTRATION_SHARED_SECRET",
         "macaroon": "SYNAPSE_MACAROON_SECRET_KEY",
@@ -98,19 +117,16 @@ def generate_config_from_template(
         os.mkdir(config_dir)
 
     # Convert SYNAPSE_NO_TLS to boolean if exists
-    if "SYNAPSE_NO_TLS" in environ:
-        tlsanswerstring = str.lower(environ["SYNAPSE_NO_TLS"])
-        if tlsanswerstring in ("true", "on", "1", "yes"):
-            environ["SYNAPSE_NO_TLS"] = True
-        else:
-            if tlsanswerstring in ("false", "off", "0", "no"):
-                environ["SYNAPSE_NO_TLS"] = False
-            else:
-                error(
-                    'Environment variable "SYNAPSE_NO_TLS" found but value "'
-                    + tlsanswerstring
-                    + '" unrecognized; exiting.'
-                )
+    tlsanswerstring = environ.get("SYNAPSE_NO_TLS")
+    if tlsanswerstring is not None:
+        try:
+            environ["SYNAPSE_NO_TLS"] = strtobool(tlsanswerstring)
+        except ValueError:
+            error(
+                'Environment variable "SYNAPSE_NO_TLS" found but value "'
+                + tlsanswerstring
+                + '" unrecognized; exiting.'
+            )
 
     if "SYNAPSE_LOG_CONFIG" not in environ:
         environ["SYNAPSE_LOG_CONFIG"] = config_dir + "/log.config"
@@ -147,7 +163,7 @@ def generate_config_from_template(
     subprocess.run(args, check=True)
 
 
-def run_generate_config(environ: Mapping[str, str], ownership: Optional[str]) -> None:
+def run_generate_config(environ: Mapping[str, str], ownership: str | None) -> None:
     """Run synapse with a --generate-config param to generate a template config file
 
     Args:
@@ -164,6 +180,18 @@ def run_generate_config(environ: Mapping[str, str], ownership: Optional[str]) ->
     config_dir = environ.get("SYNAPSE_CONFIG_DIR", "/data")
     config_path = environ.get("SYNAPSE_CONFIG_PATH", config_dir + "/homeserver.yaml")
     data_dir = environ.get("SYNAPSE_DATA_DIR", "/data")
+    enable_metrics_raw = environ.get("SYNAPSE_ENABLE_METRICS", "0")
+
+    enable_metrics = False
+    if enable_metrics_raw is not None:
+        try:
+            enable_metrics = strtobool(enable_metrics_raw)
+        except ValueError:
+            error(
+                'Environment variable "SYNAPSE_ENABLE_METRICS" found but value "'
+                + enable_metrics_raw
+                + '" unrecognized; exiting.'
+            )
 
     # create a suitable log config from our template
     log_config_file = "%s/%s.log.config" % (config_dir, server_name)
@@ -190,6 +218,9 @@ def run_generate_config(environ: Mapping[str, str], ownership: Optional[str]) ->
         "--open-private-ports",
     ]
 
+    if enable_metrics:
+        args.append("--enable-metrics")
+
     if ownership is not None:
         # make sure that synapse has perms to write to the data dir.
         log(f"Setting ownership on {data_dir} to {ownership}")
@@ -200,7 +231,7 @@ def run_generate_config(environ: Mapping[str, str], ownership: Optional[str]) ->
     subprocess.run(args, check=True)
 
 
-def main(args: List[str], environ: MutableMapping[str, str]) -> None:
+def main(args: list[str], environ: MutableMapping[str, str]) -> None:
     mode = args[1] if len(args) > 1 else "run"
 
     # if we were given an explicit user to switch to, do so
diff --git a/docs/.htmltest.yml b/docs/.htmltest.yml
new file mode 100644
index 0000000000..59d34ce0a0
--- /dev/null
+++ b/docs/.htmltest.yml
@@ -0,0 +1,5 @@
+# Configuration for htmltest, which we run in CI to check that links aren't broken in the built documentation.
+# See all config options: https://github.com/wjdp/htmltest#wrench-configuration
+
+# Don't check external links, as that requires network access and is slow.
+CheckExternal: false
\ No newline at end of file
diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md
index 52f827c8df..980f51d078 100644
--- a/docs/SUMMARY.md
+++ b/docs/SUMMARY.md
@@ -5,6 +5,7 @@
 
 # Setup
   - [Installation](setup/installation.md)
+  - [Security](setup/security.md)
   - [Using Postgres](postgres.md)
   - [Configuring a Reverse Proxy](reverse_proxy.md)
   - [Configuring a Forward/Outbound Proxy](setup/forward_proxy.md)
@@ -60,6 +61,7 @@
     - [Admin API](usage/administration/admin_api/README.md)
       - [Account Validity](admin_api/account_validity.md)
       - [Background Updates](usage/administration/admin_api/background_updates.md)
+      - [Fetch Event](admin_api/fetch_event.md)
       - [Event Reports](admin_api/event_reports.md)
       - [Experimental Features](admin_api/experimental_features.md)
       - [Media](admin_api/media_admin_api.md)
@@ -115,6 +117,8 @@
       - [The Auth Chain Difference Algorithm](auth_chain_difference_algorithm.md)
     - [Media Repository](media_repository.md)
     - [Room and User Statistics](room_and_user_statistics.md)
+    - [Releasing]()
+      - [Release Notes Review Checklist](development/internal_documentation/release_notes_review_checklist.md)
   - [Scripts]()
 
 # Other
diff --git a/docs/admin_api/fetch_event.md b/docs/admin_api/fetch_event.md
new file mode 100644
index 0000000000..baf45b8aa7
--- /dev/null
+++ b/docs/admin_api/fetch_event.md
@@ -0,0 +1,53 @@
+# Fetch Event API
+
+The fetch event API allows admins to fetch an event regardless of their membership in the room it
+originated in.
+
+To use it, you will need to authenticate by providing an `access_token`
+for a server admin: see [Admin API](../usage/administration/admin_api/).
+
+Request:
+```http
+GET /_synapse/admin/v1/fetch_event/<event_id>
+```
+
+The API returns a JSON body like the following:
+
+Response:
+```json
+{
+    "event": {
+        "auth_events": [
+            "$WhLChbYg6atHuFRP7cUd95naUtc8L0f7fqeizlsUVvc",
+            "$9Wj8dt02lrNEWweeq-KjRABUYKba0K9DL2liRvsAdtQ",
+            "$qJxBFxBt8_ODd9b3pgOL_jXP98S_igc1_kizuPSZFi4"
+        ],
+        "content": {
+            "body": "Hey now",
+            "msgtype": "m.text"
+        },
+        "depth": 6,
+        "event_id": "$hJ_kcXbVMcI82JDrbqfUJIHu61tJD86uIFJ_8hNHi7s",
+        "hashes": {
+            "sha256": "LiNw8DtrRVf55EgAH8R42Wz7WCJUqGsPt2We6qZO5Rg"
+        },
+        "origin_server_ts": 799,
+        "prev_events": [
+            "$cnSUrNMnC3Ywh9_W7EquFxYQjC_sT3BAAVzcUVxZq1g"
+        ],
+        "room_id": "!aIhKToCqgPTBloWMpf:test",
+        "sender": "@user:test",
+        "signatures": {
+            "test": {
+                "ed25519:a_lPym": "7mqSDwK1k7rnw34Dd8Fahu0rhPW7jPmcWPRtRDoEN9Yuv+BCM2+Rfdpv2MjxNKy3AYDEBwUwYEuaKMBaEMiKAQ"
+            }
+        },
+        "type": "m.room.message",
+        "unsigned": {
+            "age_ts": 799
+        }
+    }
+}
+```
+
+
diff --git a/docs/admin_api/media_admin_api.md b/docs/admin_api/media_admin_api.md
index 1177711c1e..6b96eb3356 100644
--- a/docs/admin_api/media_admin_api.md
+++ b/docs/admin_api/media_admin_api.md
@@ -39,6 +39,40 @@ the use of the
 [List media uploaded by a user](user_admin_api.md#list-media-uploaded-by-a-user)
 Admin API.
 
+## Query a piece of media by ID
+
+This API returns information about a piece of local or cached remote media given the origin server name and media id. If
+information is requested for remote media which is not cached the endpoint will return 404. 
+
+Request:
+```http
+GET /_synapse/admin/v1/media/<origin>/<media_id>
+```
+
+The API returns a JSON body with media info like the following:
+
+Response:
+```json
+{
+  "media_info": {
+    "media_origin": "remote.com",
+    "user_id": null,
+    "media_id": "sdginwegWEG",
+    "media_type": "img/png",
+    "media_length": 67,
+    "upload_name":  "test.png",
+    "created_ts":  300,
+    "filesystem_id":  "wgeweg",
+    "url_cache": null,
+    "last_access_ts": 400,
+    "quarantined_by":  null,
+    "authenticated":  false,
+    "safe_from_quarantine": null,
+    "sha256": "ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a"
+  }
+}
+```
+
 # Quarantine media
 
 Quarantining media means that it is marked as inaccessible by users. It applies
@@ -54,6 +88,20 @@ is quarantined, Synapse will:
  - Quarantine any existing cached remote media.
  - Quarantine any future remote media.
 
+## Downloading quarantined media
+
+Normally, when media is quarantined, it will return a 404 error when downloaded.
+Admins can bypass this by adding `?admin_unsafely_bypass_quarantine=true`
+to the [normal download URL](https://spec.matrix.org/v1.16/client-server-api/#get_matrixclientv1mediadownloadservernamemediaid).
+
+Bypassing the quarantine check is not recommended. Media is typically quarantined
+to prevent harmful content from being served to users, which includes admins. Only
+set the bypass parameter if you intentionally want to access potentially harmful
+content.
+
+Non-admin users cannot bypass quarantine checks, even when specifying the above
+query parameter.
+
 ## Quarantining media by ID
 
 This API quarantines a single piece of local or remote media.
diff --git a/docs/admin_api/rooms.md b/docs/admin_api/rooms.md
index 12af87148d..11e787c236 100644
--- a/docs/admin_api/rooms.md
+++ b/docs/admin_api/rooms.md
@@ -1115,3 +1115,76 @@ Example response:
   ]
 }
 ```
+
+# Admin Space Hierarchy Endpoint
+
+This API allows an admin to fetch the space/room hierarchy for a given space, 
+returning details about that room and any children the room may have, paginating
+over the space tree in a depth-first manner to locate child rooms. This is
+functionally similar to the [CS Hierarchy](https://spec.matrix.org/v1.16/client-server-api/#get_matrixclientv1roomsroomidhierarchy) endpoint but does not check for
+room membership when returning room summaries.
+
+The endpoint does not query other servers over federation about remote rooms
+that the server has not joined. This is a deliberate trade-off: while this
+means it will leave some holes in the hierarchy that we could otherwise
+sometimes fill in, it significantly improves the endpoint's response time and
+the admin endpoint is designed for managing rooms local to the homeserver
+anyway.
+
+**Parameters**
+
+The following query parameters are available:
+
+* `from` - An optional pagination token, provided when there are more rooms to 
+    return than the limit. 
+* `limit` - Maximum amount of rooms to return. Must be a non-negative integer,
+   defaults to `50`.
+* `max_depth` - The maximum depth in the tree to explore, must be a non-negative
+   integer. 0 would correspond to just the root room, 1 would include just the
+   root room's children, etc.  If not provided will recurse into the space tree without limit.
+
+Request:
+
+```http
+GET /_synapse/admin/v1/rooms/<room_id>/hierarchy
+```
+
+Response:
+
+```json
+{
+  "rooms":
+      [
+        { "children_state": [
+            {
+              "content": {
+                "via": ["local_test_server"]
+              },
+              "origin_server_ts": 1500,
+              "sender": "@user:test",
+              "state_key": "!QrMkkqBSwYRIFNFCso:test",
+              "type": "m.space.child"
+            }
+        ],
+        "name": "space room",
+        "guest_can_join": false,
+        "join_rule": "public",
+        "num_joined_members": 1,
+        "room_id": "!sPOpNyMHbZAoAOsOFL:test",
+        "room_type": "m.space",
+        "world_readable": false
+      },
+
+      {
+        "children_state": [],
+        "guest_can_join": true,
+        "join_rule": "invite",
+        "name": "nefarious",
+        "num_joined_members": 1,
+        "room_id": "!QrMkkqBSwYRIFNFCso:test",
+        "topic": "being bad",
+        "world_readable": false}
+    ],
+  "next_batch": "KUYmRbeSpAoaAIgOKGgyaCEn"
+}
+```
diff --git a/docs/admin_api/scheduled_tasks.md b/docs/admin_api/scheduled_tasks.md
index b80da5083c..949a03ee39 100644
--- a/docs/admin_api/scheduled_tasks.md
+++ b/docs/admin_api/scheduled_tasks.md
@@ -36,9 +36,10 @@ It returns a JSON body like the following:
     - "scheduled" - Task is scheduled but not active
     - "active" - Task is active and probably running, and if not will be run on next scheduler loop run
     - "complete" - Task has completed successfully
+    - "cancelled" - Task has been cancelled
     - "failed" - Task is over and either returned a failed status, or had an exception
 
-* `max_timestamp`: int - Is optional. Returns only the scheduled tasks with a timestamp inferior to the specified one.
+* `max_timestamp`: int - Is optional. Returns only the scheduled tasks with a timestamp (in milliseconds since the unix epoch) inferior to the specified one.
 
 **Response**
 
diff --git a/docs/admin_api/user_admin_api.md b/docs/admin_api/user_admin_api.md
index 4de7e85642..14f86fa976 100644
--- a/docs/admin_api/user_admin_api.md
+++ b/docs/admin_api/user_admin_api.md
@@ -403,6 +403,7 @@ is set to `true`:
 
 - Remove the user's display name
 - Remove the user's avatar URL
+- Remove the user's custom profile fields
 - Mark the user as erased
 
 The following actions are **NOT** performed. The list may be incomplete.
@@ -505,6 +506,55 @@ with a body of:
 }
 ```
 
+## List room memberships of a user
+
+Gets a list of room memberships for a specific `user_id`. This
+endpoint differs from
+[`GET /_synapse/admin/v1/users/<user_id>/joined_rooms`](#list-joined-rooms-of-a-user)
+in that it returns rooms with memberships other than "join".
+
+The API is:
+
+```
+GET /_synapse/admin/v1/users/<user_id>/memberships
+```
+
+A response body like the following is returned:
+
+```json
+    {
+        "memberships": {
+            "!DuGcnbhHGaSZQoNQR:matrix.org": "join",
+            "!ZtSaPCawyWtxfWiIy:matrix.org": "leave",
+        }
+    }
+```
+
+which is a list of room membership states for the given user. This endpoint can
+be used with both local and remote users, with the caveat that the homeserver will
+only be aware of the memberships for rooms that one of its local users has joined.
+
+Remote user memberships may also be out of date if all local users have since left
+a room. The homeserver will thus no longer receive membership updates about it.
+
+The list includes rooms that the user has since left; other membership states (knock,
+invite, etc.) are also possible.
+
+Note that rooms will only disappear from this list if they are
+[purged](./rooms.md#delete-room-api) from the homeserver.
+
+**Parameters**
+
+The following parameters should be set in the URL:
+
+- `user_id` - fully qualified: for example, `@user:server.com`.
+
+**Response**
+
+The following fields are returned in the JSON response body:
+
+- `memberships` - A map of `room_id` (string) to `membership` state (string).
+
 ## List joined rooms of a user
 
 Gets a list of all `room_id` that a specific `user_id` is joined to and is a member of (participating in).
@@ -550,7 +600,7 @@ Fetches the number of invites sent by the provided user ID across all rooms
 after the given timestamp.
 
 ```
-GET /_synapse/admin/v1/users/$user_id/sent_invite_count
+GET /_synapse/admin/v1/users/<user_id>/sent_invite_count
 ```
 
 **Parameters**
@@ -584,7 +634,7 @@ Fetches the number of rooms that the user joined after the given timestamp, even
 if they have subsequently left/been banned from those rooms.
 
 ```
-GET /_synapse/admin/v1/users/$<user_id/cumulative_joined_room_count
+GET /_synapse/admin/v1/users/<user_id>/cumulative_joined_room_count
 ```
 
 **Parameters**
@@ -1389,7 +1439,7 @@ The request and response format is the same as the
 The API is:
 
 ```
-GET /_synapse/admin/v1/auth_providers/$provider/users/$external_id
+GET /_synapse/admin/v1/auth_providers/<provider>/users/<external_id>
 ```
 
 When a user matched the given ID for the given provider, an HTTP code `200` with a response body like the following is returned:
@@ -1428,7 +1478,7 @@ _Added in Synapse 1.68.0._
 The API is:
 
 ```
-GET /_synapse/admin/v1/threepid/$medium/users/$address
+GET /_synapse/admin/v1/threepid/<medium>/users/<address>
 ```
 
 When a user matched the given address for the given medium, an HTTP code `200` with a response body like the following is returned:
@@ -1472,7 +1522,7 @@ is provided to override the default and allow the admin to issue the redactions
 
 The API is 
 ```
-POST /_synapse/admin/v1/user/$user_id/redact
+POST /_synapse/admin/v1/user/<user_id>/redact
 
 {
   "rooms": ["!roomid1", "!roomid2"]
@@ -1521,7 +1571,7 @@ or until Synapse is restarted (whichever happens first).
 The API is:
 
 ```
-GET /_synapse/admin/v1/user/redact_status/$redact_id
+GET /_synapse/admin/v1/user/redact_status/<redact_id>
 ```
 
 A response body like the following is returned:
diff --git a/docs/deprecation_policy.md b/docs/deprecation_policy.md
index 8403664850..06c724d348 100644
--- a/docs/deprecation_policy.md
+++ b/docs/deprecation_policy.md
@@ -1,13 +1,11 @@
-Deprecation Policy for Platform Dependencies
-============================================
+# Deprecation Policy
 
-Synapse has a number of platform dependencies, including Python, Rust, 
-PostgreSQL and SQLite. This document outlines the policy towards which versions 
-we support, and when we drop support for versions in the future.
+Synapse has a number of **platform dependencies** (Python, Rust, PostgreSQL, and SQLite)
+and **application dependencies** (Python and Rust packages). This document outlines the
+policy towards which versions we support, and when we drop support for versions in the
+future.
 
-
-Policy
-------
+## Platform Dependencies
 
 Synapse follows the upstream support life cycles for Python and PostgreSQL,
 i.e. when a version reaches End of Life Synapse will withdraw support for that
@@ -23,11 +21,11 @@ people building from source should ensure they can fetch recent versions of Rust
 (e.g. by using [rustup](https://rustup.rs/)).
 
 The oldest supported version of SQLite is the version
-[provided](https://packages.debian.org/bullseye/libsqlite3-0) by
+[provided](https://packages.debian.org/oldstable/libsqlite3-0) by
 [Debian oldstable](https://wiki.debian.org/DebianOldStable).
 
-Context
--------
+
+### Context
 
 It is important for system admins to have a clear understanding of the platform
 requirements of Synapse and its deprecation policies so that they can
@@ -50,4 +48,42 @@ the ecosystem.
 On a similar note, SQLite does not generally have a concept of "supported 
 release"; bugfixes are published for the latest minor release only. We chose to
 track Debian's oldstable as this is relatively conservative, predictably updated
-and is consistent with the `.deb` packages released by Matrix.org.
\ No newline at end of file
+and is consistent with the `.deb` packages released by Matrix.org.
+
+
+## Application dependencies
+
+For application-level Python dependencies, we often specify loose version constraints
+(ex. `>=X.Y.Z`) to be forwards compatible with any new versions. Upper bounds (`<A.B.C`)
+are only added when necessary to prevent known incompatibilities.
+
+When selecting a minimum version, while we are mindful of the impact on downstream
+package maintainers, our primary focus is on the maintainability and progress of Synapse
+itself.
+
+For developers, a Python dependency version can be considered a "no-brainer" upgrade once it is
+available in both the latest [Debian Stable](https://packages.debian.org/stable/) and
+[Ubuntu LTS](https://launchpad.net/ubuntu) repositories. No need to burden yourself with
+extra scrutiny or consideration at this point.
+
+We aggressively update Rust dependencies. Since these are statically linked and managed
+entirely by `cargo` during build, they *can* pose no ongoing maintenance burden on others.
+This allows us to freely upgrade to leverage the latest ecosystem advancements assuming
+they don't have their own system-level dependencies.
+
+
+### Context
+
+Because Python dependencies can easily be managed in a virtual environment, we are less
+concerned about the criteria for selecting minimum versions. The only thing of concern
+is making sure we're not making it unnecessarily difficult for downstream package
+maintainers. Generally, this just means avoiding the bleeding edge for a few months.
+
+The situation for Rust dependencies is fundamentally different. For packagers, the
+concerns around Python dependency versions do not apply. The `cargo` tool handles
+downloading and building all libraries to satisfy dependencies, and these libraries are
+statically linked into the final binary. This means that from a packager's perspective,
+the Rust dependency versions are an internal build detail, not a runtime dependency to
+be managed on the target system. Consequently, we have even greater flexibility to
+upgrade Rust dependencies as needed for the project. Some distros (e.g. Fedora) do
+package Rust libraries, but this appears to be the outlier rather than the norm.
diff --git a/docs/development/contributing_guide.md b/docs/development/contributing_guide.md
index eb6f04e301..7e0dd4059d 100644
--- a/docs/development/contributing_guide.md
+++ b/docs/development/contributing_guide.md
@@ -309,6 +309,21 @@ works without further arguments).
 Your Postgres account needs to be able to create databases; see the postgres
 docs for [`ALTER ROLE`](https://www.postgresql.org/docs/current/sql-alterrole.html).
 
+### Running the tests on MacOS
+
+To run the unit tests with SQLite on MacOS you will need to swap out the default MacOS
+python interpreter with the homebrew version. This is due to the default using a
+locked down version of Python and sqlite3. After installing python from homebrew:
+
+```
+  poetry env remove --all
+  poetry env use /opt/homebrew/bin/python3.13
+  poetry install
+  poetry run trial tests
+```
+
+This example uses python 3.13, but choose whichever version you want.
+
 ## Run the integration tests ([Sytest](https://github.com/matrix-org/sytest)).
 
 The integration tests are a more comprehensive suite of tests. They
@@ -320,7 +335,7 @@ The following command will let you run the integration test with the most common
 configuration:
 
 ```sh
-$ docker run --rm -it -v /path/where/you/have/cloned/the/repository\:/src:ro -v /path/to/where/you/want/logs\:/logs matrixdotorg/sytest-synapse:bullseye
+$ docker run --rm -it -v /path/where/you/have/cloned/the/repository\:/src:ro -v /path/to/where/you/want/logs\:/logs matrixdotorg/sytest-synapse:bookworm
 ```
 (Note that the paths must be full paths! You could also write `$(realpath relative/path)` if needed.)
 
@@ -334,46 +349,9 @@ For more details about other configurations, see the [Docker-specific documentat
 
 ## Run the integration tests ([Complement](https://github.com/matrix-org/complement)).
 
-[Complement](https://github.com/matrix-org/complement) is a suite of black box tests that can be run on any homeserver implementation. It can also be thought of as end-to-end (e2e) tests.
+See our [Complement docs](https://github.com/element-hq/synapse/tree/develop/complement)
+for how to use the `./scripts-dev/complement.sh` test runner script.
 
-It's often nice to develop on Synapse and write Complement tests at the same time.
-Here is how to run your local Synapse checkout against your local Complement checkout.
-
-(checkout [`complement`](https://github.com/matrix-org/complement) alongside your `synapse` checkout)
-```sh
-COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh
-```
-
-To run a specific test file, you can pass the test name at the end of the command. The name passed comes from the naming structure in your Complement tests. If you're unsure of the name, you can do a full run and copy it from the test output:
-
-```sh
-COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -run TestImportHistoricalMessages
-```
-
-To run a specific test, you can specify the whole name structure:
-
-```sh
-COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -run TestImportHistoricalMessages/parallel/Historical_events_resolve_in_the_correct_order
-```
-
-The above will run a monolithic (single-process) Synapse with SQLite as the database. For other configurations, try:
-
-- Passing `POSTGRES=1` as an environment variable to use the Postgres database instead.
-- Passing `WORKERS=1` as an environment variable to use a workerised setup instead. This option implies the use of Postgres.
-  - If setting `WORKERS=1`, optionally set `WORKER_TYPES=` to declare which worker
-    types you wish to test. A simple comma-delimited string containing the worker types
-    defined from the `WORKERS_CONFIG` template in
-    [here](https://github.com/element-hq/synapse/blob/develop/docker/configure_workers_and_start.py#L54).
-    A safe example would be `WORKER_TYPES="federation_inbound, federation_sender, synchrotron"`.
-    See the [worker documentation](../workers.md) for additional information on workers.
-- Passing `ASYNCIO_REACTOR=1` as an environment variable to use the Twisted asyncio reactor instead of the default one.
-- Passing `PODMAN=1` will use the [podman](https://podman.io/) container runtime, instead of docker.
-- Passing `UNIX_SOCKETS=1` will utilise Unix socket functionality for Synapse, Redis, and Postgres(when applicable).
-
-To increase the log level for the tests, set `SYNAPSE_TEST_LOG_LEVEL`, e.g:
-```sh
-SYNAPSE_TEST_LOG_LEVEL=DEBUG COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -run TestImportHistoricalMessages
-```
 
 ### Prettier formatting with `gotestfmt`
 
@@ -389,18 +367,6 @@ COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -json | gotestfmt -hide
 (Remove `-hide successful-tests` if you don't want to hide successful tests.)
 
 
-### Access database for homeserver after Complement test runs.
-
-If you're curious what the database looks like after you run some tests, here are some steps to get you going in Synapse:
-
-1. In your Complement test comment out `defer deployment.Destroy(t)` and replace with `defer time.Sleep(2 * time.Hour)` to keep the homeserver running after the tests complete
-1. Start the Complement tests
-1. Find the name of the container, `docker ps -f name=complement_` (this will filter for just the Compelement related Docker containers)
-1. Access the container replacing the name with what you found in the previous step: `docker exec -it complement_1_hs_with_application_service.hs1_2 /bin/bash`
-1. Install sqlite (database driver), `apt-get update && apt-get install -y sqlite3`
-1. Then run `sqlite3` and open the database `.open /conf/homeserver.db` (this db path comes from the Synapse homeserver.yaml)
-
-
 # 9. Submit your patch.
 
 Once you're happy with your patch, it's time to prepare a Pull Request.
diff --git a/docs/development/dependencies.md b/docs/development/dependencies.md
index e381b3d155..fe0667194a 100644
--- a/docs/development/dependencies.md
+++ b/docs/development/dependencies.md
@@ -6,7 +6,7 @@ This is a quick cheat sheet for developers on how to use [`poetry`](https://pyth
 
 See the [contributing guide](contributing_guide.md#4-install-the-dependencies).
 
-Developers should use Poetry 1.3.2 or higher. If you encounter problems related
+Developers should use Poetry 2.2.0 or higher. If you encounter problems related
 to poetry, please [double-check your poetry version](#check-the-version-of-poetry-with-poetry---version).
 
 # Background
@@ -79,17 +79,17 @@ phonenumbers = [
 We can see this pinned version inside the docker image for that release:
 
 ```
-$ docker pull vectorim/synapse:v1.97.0
+$ docker pull matrixdotorg/synapse:latest
 ...
-$ docker run --entrypoint pip vectorim/synapse:v1.97.0 show phonenumbers
+$ docker run --entrypoint pip matrixdotorg/synapse:latest show phonenumbers
 Name: phonenumbers
-Version: 8.12.44
+Version: 9.0.15
 Summary: Python version of Google's common library for parsing, formatting, storing and validating international phone numbers.
 Home-page: https://github.com/daviddrysdale/python-phonenumbers
 Author: David Drysdale
 Author-email: dmd@lurklurk.org
 License: Apache License 2.0
-Location: /usr/local/lib/python3.9/site-packages
+Location: /usr/local/lib/python3.12/site-packages
 Requires:
 Required-by: matrix-synapse
 ```
diff --git a/docs/development/experimental_features.md b/docs/development/experimental_features.md
index d6b11496cc..a852fb88fd 100644
--- a/docs/development/experimental_features.md
+++ b/docs/development/experimental_features.md
@@ -32,6 +32,33 @@ expected and not an issue.
 It is not a requirement for experimental features to be behind a configuration flag,
 but one should be used if unsure.
 
-New experimental configuration flags should be added under the `experimental`
+New experimental configuration flags should be added under the `experimental_features`
 configuration key (see the `synapse.config.experimental` file) and either explain
 (briefly) what is being enabled, or include the MSC number.
+The configuration flag should link to the tracking issue for the experimental feature (see below).
+
+
+## Tracking issues for experimental features
+
+In the interest of having some documentation around experimental features, without
+polluting the stable documentation, all new experimental features should have a tracking issue with
+[the `T-ExperimentalFeature` label](https://github.com/element-hq/synapse/issues?q=sort%3Aupdated-desc+state%3Aopen+label%3A%22T-ExperimentalFeature%22),
+kept open as long as the experimental feature is present in Synapse.
+
+The configuration option for the feature should have a comment linking to the tracking issue,
+for ease of discoverability.
+
+As a guideline, the issue should contain:
+
+- Context for why this experimental feature is in Synapse
+  - This could well be a link to somewhere else, where this context is already available.
+- If applicable, why the feature is enabled by default. (Why do we need to enable it by default and why is it safe?)
+- If applicable, setup instructions for any non-standard components or configuration needed by the feature.
+  (Ideally this will be moved to the configuration manual after stabilisation.)
+- Design decisions behind the Synapse implementation.
+  (Ideally this will be moved to the developers' documentation after stabilisation.)
+- Any caveats around the current implementation of the feature, such as:
+  - missing aspects
+  - breakage or incompatibility that is expected if/when the feature is stabilised,
+    or when the feature is turned on/off
+- Criteria for how we know whether we can remove the feature in the future.
diff --git a/docs/development/internal_documentation/release_notes_review_checklist.md b/docs/development/internal_documentation/release_notes_review_checklist.md
new file mode 100644
index 0000000000..c3d4d665be
--- /dev/null
+++ b/docs/development/internal_documentation/release_notes_review_checklist.md
@@ -0,0 +1,12 @@
+# Release notes review checklist
+
+The Synapse release process includes a step to review the changelog before
+publishing it. The following is a list of common points to check for:
+
+1. Check whether any similar entries that can be merged together (make sure to include all mentioned PRs at the end of the line, i.e. (#1234, #1235, ...)).
+2. Link any MSCXXXX lines to the Matrix Spec Change itself: <https://github.com/matrix-org/matrix-spec-proposals/pull/xxxx>.
+3. Wrap any class names, variable names, etc. in back-ticks, if needed.
+4. Hoist any relevant security, deprecation, etc. announcements to the top of this version's changelog for visibility. This includes any announcements in RCs for this release.
+5. Check the upgrade notes for any important announcements, and link to them from the changelog if warranted.
+6. Quickly skim and check that each entry is in the appropriate section.
+7. Entries under the Bugfixes section should ideally state what Synapse version the bug was introduced in. For example: "Fixed a bug introduced in v1.x.y" or if no version can be identified, "Fixed a long-standing bug ...".
\ No newline at end of file
diff --git a/docs/development/synapse_architecture/cancellation.md b/docs/development/synapse_architecture/cancellation.md
index ef9e022635..a12f119fb5 100644
--- a/docs/development/synapse_architecture/cancellation.md
+++ b/docs/development/synapse_architecture/cancellation.md
@@ -299,7 +299,7 @@ logcontext is not finished before the `async` processing completes.
 
 **Bad**:
 ```python
-cache: Optional[ObservableDeferred[None]] = None
+cache: ObservableDeferred[None] | None = None
 
 async def do_something_else(
     to_resolve: Deferred[None]
@@ -326,7 +326,7 @@ with LoggingContext("request-1"):
 
 **Good**:
 ```python
-cache: Optional[ObservableDeferred[None]] = None
+cache: ObservableDeferred[None] | None = None
 
 async def do_something_else(
     to_resolve: Deferred[None]
@@ -358,7 +358,7 @@ with LoggingContext("request-1"):
 
 **OK**:
 ```python
-cache: Optional[ObservableDeferred[None]] = None
+cache: ObservableDeferred[None] | None = None
 
 async def do_something_else(
     to_resolve: Deferred[None]
diff --git a/docs/development/synapse_architecture/streams.md b/docs/development/synapse_architecture/streams.md
index 4981416835..364f90af75 100644
--- a/docs/development/synapse_architecture/streams.md
+++ b/docs/development/synapse_architecture/streams.md
@@ -1,4 +1,4 @@
-## Streams
+# Streams
 
 Synapse has a concept of "streams", which are roughly described in [`id_generators.py`](
     https://github.com/element-hq/synapse/blob/develop/synapse/storage/util/id_generators.py
@@ -19,7 +19,7 @@ To that end, let's describe streams formally, paraphrasing from the docstring of
     https://github.com/element-hq/synapse/blob/a719b703d9bd0dade2565ddcad0e2f3a7a9d4c37/synapse/storage/util/id_generators.py#L96
 ).
 
-### Definition
+## Definition
 
 A stream is an append-only log `T1, T2, ..., Tn, ...` of facts[^1] which grows over time.
 Only "writers" can add facts to a stream, and there may be multiple writers.
@@ -47,7 +47,7 @@ But unhappy cases (e.g. transaction rollback due to an error) also count as comp
 Once completed, the rows written with that stream ID are fixed, and no new rows
 will be inserted with that ID.
 
-### Current stream ID
+## Current stream ID
 
 For any given stream reader (including writers themselves), we may define a per-writer current stream ID:
 
@@ -93,7 +93,7 @@ Consider a single-writer stream which is initially at ID 1.
 | Complete 6 | 6                 |                                                 |
 
 
-### Multi-writer streams
+## Multi-writer streams
 
 There are two ways to view a multi-writer stream.
 
@@ -115,7 +115,7 @@ The facts this stream holds are instructions to "you should now invalidate these
 We only ever treat this as a multiple single-writer streams as there is no important ordering between cache invalidations.
 (Invalidations are self-contained facts; and the invalidations commute/are idempotent).
 
-### Writing to streams
+## Writing to streams
 
 Writers need to track:
  - track their current position (i.e. its own per-writer stream ID).
@@ -133,7 +133,7 @@ To complete a fact, first remove it from your map of facts currently awaiting co
 Then, if no earlier fact is awaiting completion, the writer can advance its current position in that stream.
 Upon doing so it should emit an `RDATA` message[^3], once for every fact between the old and the new stream ID.
 
-### Subscribing to streams
+## Subscribing to streams
 
 Readers need to track the current position of every writer.
 
@@ -146,10 +146,44 @@ The `RDATA` itself is not a self-contained representation of the fact;
 readers will have to query the stream tables for the full details.
 Readers must also advance their record of the writer's current position for that stream.
 
-# Summary
+## Summary
 
 In a nutshell: we have an append-only log with a "buffer/scratchpad" at the end where we have to wait for the sequence to be linear and contiguous.
 
+---
+
+## Cheatsheet for creating a new stream
+
+These rough notes and links may help you to create a new stream and add all the
+necessary registration and event handling.
+
+**Create your stream:**
+- [create a stream class and stream row class](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/replication/tcp/streams/_base.py#L728)
+  - will need an [ID generator](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/storage/databases/main/thread_subscriptions.py#L75)
+    - may need [writer configuration](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/config/workers.py#L177), if there isn't already an obvious source of configuration for which workers should be designated as writers to your new stream.
+      - if adding new writer configuration, add Docker-worker configuration, which lets us configure the writer worker in Complement tests: [[1]](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/docker/configure_workers_and_start.py#L331), [[2]](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/docker/configure_workers_and_start.py#L440)
+- most of the time, you will likely introduce a new datastore class for the concept represented by the new stream, unless there is already an obvious datastore that covers it.
+- consider whether it may make sense to introduce a handler
+
+**Register your stream in:**
+- [`STREAMS_MAP`](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/replication/tcp/streams/__init__.py#L71)
+
+**Advance your stream in:**
+- [`process_replication_position` of your appropriate datastore](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/storage/databases/main/thread_subscriptions.py#L111)
+  - don't forget the super call
+
+**If you're going to do any caching that needs invalidation from new rows:**
+- add invalidations to [`process_replication_rows` of your appropriate datastore](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/storage/databases/main/thread_subscriptions.py#L91)
+  - don't forget the super call
+- add local-only [invalidations to your writer transactions](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/storage/databases/main/thread_subscriptions.py#L201)
+
+**For streams to be used in sync:**
+- add a new field to [`StreamToken`](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/types/__init__.py#L1003)
+  - add a new [`StreamKeyType`](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/types/__init__.py#L999)
+- add appropriate wake-up rules
+  - in [`on_rdata`](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/replication/tcp/client.py#L260)
+  - locally on the same worker when completing a write, [e.g. in your handler](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/handlers/thread_subscriptions.py#L139)
+- add the stream in [`bound_future_token`](https://github.com/element-hq/synapse/blob/4367fb2d078c52959aeca0fe6874539c53e8360d/synapse/streams/events.py#L127)
 
 ---
 
diff --git a/docs/log_contexts.md b/docs/log_contexts.md
index 9d087d11ef..76710e10e0 100644
--- a/docs/log_contexts.md
+++ b/docs/log_contexts.md
@@ -59,6 +59,28 @@ def do_request_handling():
     logger.debug("phew")
 ```
 
+### The `sentinel` context
+
+The default logcontext is `synapse.logging.context.SENTINEL_CONTEXT`, which is an empty
+sentinel value to represent the root logcontext. This is what is used when there is no
+other logcontext set. The phrase "clear/reset the logcontext" means to set the current
+logcontext to the `sentinel` logcontext.
+
+No CPU/database usage metrics are recorded against the `sentinel` logcontext.
+
+Ideally, nothing from the Synapse homeserver would be logged against the `sentinel`
+logcontext as we want to know which server the logs came from. In practice, this is not
+always the case yet especially outside of request handling.
+
+Global things outside of Synapse (e.g. Twisted reactor code) should run in the
+`sentinel` logcontext. It's only when it calls into application code that a logcontext
+gets activated. This means the reactor should be started in the `sentinel` logcontext,
+and any time an awaitable yields control back to the reactor, it should reset the
+logcontext to be the `sentinel` logcontext. This is important to avoid leaking the
+current logcontext to the reactor (which would then get picked up and associated with
+the next thing the reactor does).
+
+
 ## Using logcontexts with awaitables
 
 Awaitables break the linear flow of code so that there is no longer a single entry point
@@ -121,8 +143,7 @@ cares about.
 The following sections describe pitfalls and helpful patterns when
 implementing these rules.
 
-Always await your awaitables
-----------------------------
+## Always await your awaitables
 
 Whenever you get an awaitable back from a function, you should `await` on
 it as soon as possible. Do not pass go; do not do any logging; do not
@@ -181,6 +202,171 @@ async def sleep(seconds):
     return await context.make_deferred_yieldable(get_sleep_deferred(seconds))
 ```
 
+## Deferred callbacks
+
+When a deferred callback is called, it inherits the current logcontext. The deferred
+callback chain can resume a coroutine, which if following our logcontext rules, will
+restore its own logcontext, then run:
+
+ - until it yields control back to the reactor, setting the sentinel logcontext
+ - or until it finishes, restoring the logcontext it was started with (calling context)
+
+This behavior creates two specific issues:
+
+**Issue 1:** The first issue is that the callback may have reset the logcontext to the
+sentinel before returning. This means our calling function will continue with the
+sentinel logcontext instead of the logcontext it was started with (bad).
+
+**Issue 2:** The second issue is that the current logcontext that called the deferred
+callback could finish before the callback finishes (bad).
+
+In the following example, the deferred callback is called with the "main" logcontext and
+runs until we yield control back to the reactor in the `await` inside `clock.sleep(0)`.
+Since `clock.sleep(0)` follows our logcontext rules, it sets the logcontext to the
+sentinel before yielding control back to the reactor. Our `main` function continues with
+the sentinel logcontext (first bad thing) instead of the "main" logcontext. Then the
+`with LoggingContext("main")` block exits, finishing the "main" logcontext and yielding
+control back to the reactor again. Finally, later on when `clock.sleep(0)` completes,
+our `with LoggingContext("competing")` block exits, and restores the previous "main"
+logcontext which has already finished, resulting in `WARNING: Re-starting finished log
+context main` and leaking the `main` logcontext into the reactor which will then
+erronously be associated with the next task the reactor picks up.
+
+```python
+async def competing_callback():
+    # Since this is run with the "main" logcontext, when the "competing"
+    # logcontext exits, it will restore the previous "main" logcontext which has
+    # already finished and results in "WARNING: Re-starting finished log context main"
+    # and leaking the `main` logcontext into the reactor.
+    with LoggingContext("competing"):
+        await clock.sleep(0)
+
+def main():
+    with LoggingContext("main"):
+        d = defer.Deferred()
+        d.addCallback(lambda _: defer.ensureDeferred(competing_callback()))
+        # Call the callback within the "main" logcontext.
+        d.callback(None)
+        # Bad: This will be logged against sentinel logcontext
+        logger.debug("ugh")
+
+main()
+```
+
+**Solution 1:** We could of course fix this by following the general rule of "always
+await your awaitables":
+
+```python
+async def main():
+    with LoggingContext("main"):
+        d = defer.Deferred()
+        d.addCallback(lambda _: defer.ensureDeferred(competing_callback()))
+        d.callback(None)
+        # Wait for `d` to finish before continuing so the "main" logcontext is
+        # still active. This works because `d` already follows our logcontext
+        # rules. If not, we would also have to use `make_deferred_yieldable(d)`.
+        await d
+        # Good: This will be logged against the "main" logcontext
+        logger.debug("phew")
+``` 
+
+**Solution 2:** We could also fix this by surrounding the call to `d.callback` with a
+`PreserveLoggingContext`, which will reset the logcontext to the sentinel before calling
+the callback, and restore the "main" logcontext afterwards before continuing the `main`
+function. This solves the problem because when the "competing" logcontext exits, it will
+restore the sentinel logcontext which is never finished by its nature, so there is no
+warning and no leakage into the reactor.
+
+```python
+async def main():
+    with LoggingContext("main"):
+        d = defer.Deferred()
+        d.addCallback(lambda _: defer.ensureDeferred(competing_callback()))
+        d.callback(None)
+        with PreserveLoggingContext():
+            # Call the callback with the sentinel logcontext.
+            d.callback(None)
+        # Good: This will be logged against the "main" logcontext
+        logger.debug("phew")
+```
+
+**Solution 3:** But let's say you *do* want to run (fire-and-forget) the deferred
+callback in the current context without running into issues:
+
+We can solve the first issue by using `run_in_background(...)` to run the callback in
+the current logcontext and it handles the magic behind the scenes of a) restoring the
+calling logcontext before returning to the caller and b) resetting the logcontext to the
+sentinel after the deferred completes and we yield control back to the reactor to avoid
+leaking the logcontext into the reactor.
+
+To solve the second issue, we can extend the lifetime of the "main" logcontext by
+avoiding the `LoggingContext`'s context manager lifetime methods
+(`__enter__`/`__exit__`). We can still set "main" as the current logcontext by using
+`PreserveLoggingContext` and passing in the "main" logcontext.
+
+
+```python
+async def main():
+    main_context = LoggingContext("main")
+    with PreserveLoggingContext(main_context):
+        d = defer.Deferred()
+        d.addCallback(lambda _: defer.ensureDeferred(competing_callback()))
+        # The whole lambda will be run in the "main" logcontext. But we're using
+        # a trick to return the deferred `d` itself so that `run_in_background`
+        # will wait on that to complete and reset the logcontext to the sentinel
+        # when it does to avoid leaking the "main" logcontext into the reactor.
+        run_in_background(lambda: (d.callback(None), d)[1])
+        # Good: This will be logged against the "main" logcontext
+        logger.debug("phew")
+
+...
+
+# Wherever possible, it's best to finish the logcontext by calling `__exit__` at some
+# point. This allows us to catch bugs if we later try to erroneously restart a finished
+# logcontext.
+#
+# Since the "main" logcontext stores the `LoggingContext.previous_context` when it is
+# created, we can wrap this call in `PreserveLoggingContext()` to restore the correct
+# previous logcontext. Our goal is to have the calling context remain unchanged after
+# finishing the "main" logcontext.
+with PreserveLoggingContext():
+    # Finish the "main" logcontext
+    with main_context:
+        # Empty block - We're just trying to call `__exit__` on the "main" context
+        # manager to finish it. We can't call `__exit__` directly as the code expects us
+        # to `__enter__` before calling `__exit__` to `start`/`stop` things
+        # appropriately. And in any case, it's probably best not to call the internal
+        # methods directly.
+        pass
+```
+
+The same thing applies if you have some deferreds stored somewhere which you want to
+callback in the current logcontext.
+
+
+### Deferred errbacks and cancellations
+
+The same care should be taken when calling errbacks on deferreds. An errback and
+callback act the same in this regard (see section above).
+
+```python
+d = defer.Deferred()
+d.addErrback(some_other_function)
+d.errback(failure)
+```
+
+Additionally, cancellation is the same as directly calling the errback with a
+`twisted.internet.defer.CancelledError`:
+
+```python
+d = defer.Deferred()
+d.addErrback(some_other_function)
+d.cancel()
+```
+
+
+
+
 ## Fire-and-forget
 
 Sometimes you want to fire off a chain of execution, but not wait for
@@ -362,3 +548,19 @@ chain are dropped. Dropping the the reference to an awaitable you're
 supposed to be awaiting is bad practice, so this doesn't
 actually happen too much. Unfortunately, when it does happen, it will
 lead to leaked logcontexts which are incredibly hard to track down.
+
+
+## Debugging logcontext issues
+
+Debugging logcontext issues can be tricky as leaking or losing a logcontext will surface
+downstream and can point to an unrelated part of the codebase. It's best to enable debug
+logging for `synapse.logging.context.debug` (needs to be explicitly configured) and go
+backwards in the logs from the point where the issue is observed to find the root cause.
+
+`log.config.yaml`
+```yaml
+loggers:
+    # Unlike other loggers, this one needs to be explicitly configured to see debug logs.
+    synapse.logging.context.debug:
+        level: DEBUG
+```
diff --git a/docs/metrics-howto.md b/docs/metrics-howto.md
index eb6b90cec9..d322de9204 100644
--- a/docs/metrics-howto.md
+++ b/docs/metrics-howto.md
@@ -123,193 +123,21 @@ Example Prometheus target for Synapse with workers:
     static_configs:
       - targets: ["my.server.here:port"]
         labels:
-          instance: "my.server"
           job: "master"
           index: 1
       - targets: ["my.workerserver.here:port"]
         labels:
-          instance: "my.server"
           job: "generic_worker"
           index: 1
       - targets: ["my.workerserver.here:port"]
         labels:
-          instance: "my.server"
           job: "generic_worker"
           index: 2
       - targets: ["my.workerserver.here:port"]
         labels:
-          instance: "my.server"
           job: "media_repository"
           index: 1
 ```
 
-Labels (`instance`, `job`, `index`) can be defined as anything.
+Labels (`job`, `index`) can be defined as anything.
 The labels are used to group graphs in grafana.
-
-## Renaming of metrics & deprecation of old names in 1.2
-
-Synapse 1.2 updates the Prometheus metrics to match the naming
-convention of the upstream `prometheus_client`. The old names are
-considered deprecated and will be removed in a future version of
-Synapse.
-**The old names will be disabled by default in Synapse v1.71.0 and removed
-altogether in Synapse v1.73.0.**
-
-| New Name                                                                     | Old Name                                                               |
-| ---------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
-| python_gc_objects_collected_total                                            | python_gc_objects_collected                                            |
-| python_gc_objects_uncollectable_total                                        | python_gc_objects_uncollectable                                        |
-| python_gc_collections_total                                                  | python_gc_collections                                                  |
-| process_cpu_seconds_total                                                    | process_cpu_seconds                                                    |
-| synapse_federation_client_sent_transactions_total                            | synapse_federation_client_sent_transactions                            |
-| synapse_federation_client_events_processed_total                             | synapse_federation_client_events_processed                             |
-| synapse_event_processing_loop_count_total                                    | synapse_event_processing_loop_count                                    |
-| synapse_event_processing_loop_room_count_total                               | synapse_event_processing_loop_room_count                               |
-| synapse_util_caches_cache_hits                                               | synapse_util_caches_cache:hits                                         |
-| synapse_util_caches_cache_size                                               | synapse_util_caches_cache:size                                         |
-| synapse_util_caches_cache_evicted_size                                       | synapse_util_caches_cache:evicted_size                                 |
-| synapse_util_caches_cache                                                    | synapse_util_caches_cache:total                                        |
-| synapse_util_caches_response_cache_size                                      | synapse_util_caches_response_cache:size                                |
-| synapse_util_caches_response_cache_hits                                      | synapse_util_caches_response_cache:hits                                |
-| synapse_util_caches_response_cache_evicted_size                              | synapse_util_caches_response_cache:evicted_size                        |
-| synapse_util_metrics_block_count_total                                       | synapse_util_metrics_block_count                                       |
-| synapse_util_metrics_block_time_seconds_total                                | synapse_util_metrics_block_time_seconds                                |
-| synapse_util_metrics_block_ru_utime_seconds_total                            | synapse_util_metrics_block_ru_utime_seconds                            |
-| synapse_util_metrics_block_ru_stime_seconds_total                            | synapse_util_metrics_block_ru_stime_seconds                            |
-| synapse_util_metrics_block_db_txn_count_total                                | synapse_util_metrics_block_db_txn_count                                |
-| synapse_util_metrics_block_db_txn_duration_seconds_total                     | synapse_util_metrics_block_db_txn_duration_seconds                     |
-| synapse_util_metrics_block_db_sched_duration_seconds_total                   | synapse_util_metrics_block_db_sched_duration_seconds                   |
-| synapse_background_process_start_count_total                                 | synapse_background_process_start_count                                 |
-| synapse_background_process_ru_utime_seconds_total                            | synapse_background_process_ru_utime_seconds                            |
-| synapse_background_process_ru_stime_seconds_total                            | synapse_background_process_ru_stime_seconds                            |
-| synapse_background_process_db_txn_count_total                                | synapse_background_process_db_txn_count                                |
-| synapse_background_process_db_txn_duration_seconds_total                     | synapse_background_process_db_txn_duration_seconds                     |
-| synapse_background_process_db_sched_duration_seconds_total                   | synapse_background_process_db_sched_duration_seconds                   |
-| synapse_storage_events_persisted_events_total                                | synapse_storage_events_persisted_events                                |
-| synapse_storage_events_persisted_events_sep_total                            | synapse_storage_events_persisted_events_sep                            |
-| synapse_storage_events_state_delta_total                                     | synapse_storage_events_state_delta                                     |
-| synapse_storage_events_state_delta_single_event_total                        | synapse_storage_events_state_delta_single_event                        |
-| synapse_storage_events_state_delta_reuse_delta_total                         | synapse_storage_events_state_delta_reuse_delta                         |
-| synapse_federation_server_received_pdus_total                                | synapse_federation_server_received_pdus                                |
-| synapse_federation_server_received_edus_total                                | synapse_federation_server_received_edus                                |
-| synapse_handler_presence_notified_presence_total                             | synapse_handler_presence_notified_presence                             |
-| synapse_handler_presence_federation_presence_out_total                       | synapse_handler_presence_federation_presence_out                       |
-| synapse_handler_presence_presence_updates_total                              | synapse_handler_presence_presence_updates                              |
-| synapse_handler_presence_timers_fired_total                                  | synapse_handler_presence_timers_fired                                  |
-| synapse_handler_presence_federation_presence_total                           | synapse_handler_presence_federation_presence                           |
-| synapse_handler_presence_bump_active_time_total                              | synapse_handler_presence_bump_active_time                              |
-| synapse_federation_client_sent_edus_total                                    | synapse_federation_client_sent_edus                                    |
-| synapse_federation_client_sent_pdu_destinations_count_total                  | synapse_federation_client_sent_pdu_destinations:count                  |
-| synapse_federation_client_sent_pdu_destinations_total                        | synapse_federation_client_sent_pdu_destinations:total                  |
-| synapse_handlers_appservice_events_processed_total                           | synapse_handlers_appservice_events_processed                           |
-| synapse_notifier_notified_events_total                                       | synapse_notifier_notified_events                                       |
-| synapse_push_bulk_push_rule_evaluator_push_rules_invalidation_counter_total  | synapse_push_bulk_push_rule_evaluator_push_rules_invalidation_counter  |
-| synapse_push_bulk_push_rule_evaluator_push_rules_state_size_counter_total    | synapse_push_bulk_push_rule_evaluator_push_rules_state_size_counter    |
-| synapse_http_httppusher_http_pushes_processed_total                          | synapse_http_httppusher_http_pushes_processed                          |
-| synapse_http_httppusher_http_pushes_failed_total                             | synapse_http_httppusher_http_pushes_failed                             |
-| synapse_http_httppusher_badge_updates_processed_total                        | synapse_http_httppusher_badge_updates_processed                        |
-| synapse_http_httppusher_badge_updates_failed_total                           | synapse_http_httppusher_badge_updates_failed                           |
-| synapse_admin_mau_current                                                    | synapse_admin_mau:current                                              |
-| synapse_admin_mau_max                                                        | synapse_admin_mau:max                                                  |
-| synapse_admin_mau_registered_reserved_users                                  | synapse_admin_mau:registered_reserved_users                            |
-
-Removal of deprecated metrics & time based counters becoming histograms in 0.31.0
----------------------------------------------------------------------------------
-
-The duplicated metrics deprecated in Synapse 0.27.0 have been removed.
-
-All time duration-based metrics have been changed to be seconds. This
-affects:
-
-| msec -> sec metrics                    |
-| -------------------------------------- |
-| python_gc_time                         |
-| python_twisted_reactor_tick_time       |
-| synapse_storage_query_time             |
-| synapse_storage_schedule_time          |
-| synapse_storage_transaction_time       |
-
-Several metrics have been changed to be histograms, which sort entries
-into buckets and allow better analysis. The following metrics are now
-histograms:
-
-| Altered metrics                                  |
-| ------------------------------------------------ |
-| python_gc_time                                   |
-| python_twisted_reactor_pending_calls             |
-| python_twisted_reactor_tick_time                 |
-| synapse_http_server_response_time_seconds        |
-| synapse_storage_query_time                       |
-| synapse_storage_schedule_time                    |
-| synapse_storage_transaction_time                 |
-
-Block and response metrics renamed for 0.27.0
----------------------------------------------
-
-Synapse 0.27.0 begins the process of rationalising the duplicate
-`*:count` metrics reported for the resource tracking for code blocks and
-HTTP requests.
-
-At the same time, the corresponding `*:total` metrics are being renamed,
-as the `:total` suffix no longer makes sense in the absence of a
-corresponding `:count` metric.
-
-To enable a graceful migration path, this release just adds new names
-for the metrics being renamed. A future release will remove the old
-ones.
-
-The following table shows the new metrics, and the old metrics which
-they are replacing.
-
-| New name                                                      | Old name                                                   |
-| ------------------------------------------------------------- | ---------------------------------------------------------- |
-| synapse_util_metrics_block_count                              | synapse_util_metrics_block_timer:count                     |
-| synapse_util_metrics_block_count                              | synapse_util_metrics_block_ru_utime:count                  |
-| synapse_util_metrics_block_count                              | synapse_util_metrics_block_ru_stime:count                  |
-| synapse_util_metrics_block_count                              | synapse_util_metrics_block_db_txn_count:count              |
-| synapse_util_metrics_block_count                              | synapse_util_metrics_block_db_txn_duration:count           |
-| synapse_util_metrics_block_time_seconds                       | synapse_util_metrics_block_timer:total                     |
-| synapse_util_metrics_block_ru_utime_seconds                   | synapse_util_metrics_block_ru_utime:total                  |
-| synapse_util_metrics_block_ru_stime_seconds                   | synapse_util_metrics_block_ru_stime:total                  |
-| synapse_util_metrics_block_db_txn_count                       | synapse_util_metrics_block_db_txn_count:total              |
-| synapse_util_metrics_block_db_txn_duration_seconds            | synapse_util_metrics_block_db_txn_duration:total           |
-| synapse_http_server_response_count                            | synapse_http_server_requests                               |
-| synapse_http_server_response_count                            | synapse_http_server_response_time:count                    |
-| synapse_http_server_response_count                            | synapse_http_server_response_ru_utime:count                |
-| synapse_http_server_response_count                            | synapse_http_server_response_ru_stime:count                |
-| synapse_http_server_response_count                            | synapse_http_server_response_db_txn_count:count            |
-| synapse_http_server_response_count                            | synapse_http_server_response_db_txn_duration:count         |
-| synapse_http_server_response_time_seconds                     | synapse_http_server_response_time:total                    |
-| synapse_http_server_response_ru_utime_seconds                 | synapse_http_server_response_ru_utime:total                |
-| synapse_http_server_response_ru_stime_seconds                 | synapse_http_server_response_ru_stime:total                |
-| synapse_http_server_response_db_txn_count                     | synapse_http_server_response_db_txn_count:total            |
-| synapse_http_server_response_db_txn_duration_seconds          | synapse_http_server_response_db_txn_duration:total         |
-
-Standard Metric Names
----------------------
-
-As of synapse version 0.18.2, the format of the process-wide metrics has
-been changed to fit prometheus standard naming conventions. Additionally
-the units have been changed to seconds, from milliseconds.
-
-| New name                                 | Old name                          |
-| ---------------------------------------- | --------------------------------- |
-| process_cpu_user_seconds_total           | process_resource_utime / 1000     |
-| process_cpu_system_seconds_total         | process_resource_stime / 1000     |
-| process_open_fds (no \'type\' label)     | process_fds                       |
-
-The python-specific counts of garbage collector performance have been
-renamed.
-
-| New name                         | Old name                   |
-| -------------------------------- | -------------------------- |
-| python_gc_time                   | reactor_gc_time            |
-| python_gc_unreachable_total      | reactor_gc_unreachable     |
-| python_gc_counts                 | reactor_gc_counts          |
-
-The twisted-specific reactor metrics have been renamed.
-
-| New name                               | Old name                |
-| -------------------------------------- | ----------------------- |
-| python_twisted_reactor_pending_calls   | reactor_pending_calls   |
-| python_twisted_reactor_tick_time       | reactor_tick_time       |
diff --git a/docs/modules/account_data_callbacks.md b/docs/modules/account_data_callbacks.md
index 25de911627..02b8c18bbf 100644
--- a/docs/modules/account_data_callbacks.md
+++ b/docs/modules/account_data_callbacks.md
@@ -15,7 +15,7 @@ _First introduced in Synapse v1.57.0_
 ```python
 async def on_account_data_updated(
     user_id: str,
-    room_id: Optional[str],
+    room_id: str | None,
     account_data_type: str,
     content: "synapse.module_api.JsonDict",
 ) -> None:
@@ -82,7 +82,7 @@ class CustomAccountDataModule:
     async def log_new_account_data(
         self,
         user_id: str,
-        room_id: Optional[str],
+        room_id: str | None,
         account_data_type: str,
         content: JsonDict,
     ) -> None:
diff --git a/docs/modules/account_validity_callbacks.md b/docs/modules/account_validity_callbacks.md
index f5eefcd7d6..2deb43c1be 100644
--- a/docs/modules/account_validity_callbacks.md
+++ b/docs/modules/account_validity_callbacks.md
@@ -12,7 +12,7 @@ The available account validity callbacks are:
 _First introduced in Synapse v1.39.0_
 
 ```python
-async def is_user_expired(user: str) -> Optional[bool]
+async def is_user_expired(user: str) -> bool | None
 ```
 
 Called when processing any authenticated request (except for logout requests). The module
diff --git a/docs/modules/media_repository_callbacks.md b/docs/modules/media_repository_callbacks.md
index fc37130439..d7c9074bde 100644
--- a/docs/modules/media_repository_callbacks.md
+++ b/docs/modules/media_repository_callbacks.md
@@ -11,7 +11,7 @@ The available media repository callbacks are:
 _First introduced in Synapse v1.132.0_
 
 ```python
-async def get_media_config_for_user(user_id: str) -> Optional[JsonDict]
+async def get_media_config_for_user(user_id: str) -> JsonDict | None
 ```
 
 **<span style="color:red">
@@ -64,3 +64,68 @@ If multiple modules implement this callback, they will be considered in order. I
 returns `True`, Synapse falls through to the next one. The value of the first callback that
 returns `False` will be used. If this happens, Synapse will not call any of the subsequent
 implementations of this callback.
+
+### `get_media_upload_limits_for_user`
+
+_First introduced in Synapse v1.139.0_
+
+```python
+async def get_media_upload_limits_for_user(user_id: str, size: int) -> list[synapse.module_api.MediaUploadLimit] | None
+```
+
+**<span style="color:red">
+Caution: This callback is currently experimental. The method signature or behaviour
+may change without notice.
+</span>**
+
+Called when processing a request to store content in the media repository. This can be used to dynamically override
+the [media upload limits configuration](../usage/configuration/config_documentation.html#media_upload_limits).
+
+The arguments passed to this callback are:
+
+* `user_id`: The Matrix user ID of the user (e.g. `@alice:example.com`) making the request.
+
+If the callback returns a list then it will be used as the limits instead of those in the configuration (if any).
+
+If an empty list is returned then no limits are applied (**warning:** users will be able
+to upload as much data as they desire).
+
+If multiple modules implement this callback, they will be considered in order. If a
+callback returns `None`, Synapse falls through to the next one. The value of the first
+callback that does not return `None` will be used. If this happens, Synapse will not call
+any of the subsequent implementations of this callback.
+
+If there are no registered modules, or if all modules return `None`, then
+the default
+[media upload limits configuration](../usage/configuration/config_documentation.html#media_upload_limits)
+will be used.
+
+### `on_media_upload_limit_exceeded`
+
+_First introduced in Synapse v1.139.0_
+
+```python
+async def on_media_upload_limit_exceeded(user_id: str, limit: synapse.module_api.MediaUploadLimit, sent_bytes: int, attempted_bytes: int) -> None
+```
+
+**<span style="color:red">
+Caution: This callback is currently experimental. The method signature or behaviour
+may change without notice.
+</span>**
+
+Called when a user attempts to upload media that would exceed a
+[configured media upload limit](../usage/configuration/config_documentation.html#media_upload_limits).
+
+This callback will only be called on workers which handle
+[POST /_matrix/media/v3/upload](https://spec.matrix.org/v1.15/client-server-api/#post_matrixmediav3upload)
+requests.
+
+This could be used to inform the user that they have reached a media upload limit through
+some external method.
+
+The arguments passed to this callback are:
+
+* `user_id`: The Matrix user ID of the user (e.g. `@alice:example.com`) making the request.
+* `limit`: The `synapse.module_api.MediaUploadLimit` representing the limit that was reached.
+* `sent_bytes`: The number of bytes already sent during the period of the limit.
+* `attempted_bytes`: The number of bytes that the user attempted to send.
diff --git a/docs/modules/password_auth_provider_callbacks.md b/docs/modules/password_auth_provider_callbacks.md
index d66ac7df31..88b22fdf21 100644
--- a/docs/modules/password_auth_provider_callbacks.md
+++ b/docs/modules/password_auth_provider_callbacks.md
@@ -23,12 +23,7 @@ async def check_auth(
     user: str,
     login_type: str,
     login_dict: "synapse.module_api.JsonDict",
-) -> Optional[
-    Tuple[
-        str, 
-        Optional[Callable[["synapse.module_api.LoginResponse"], Awaitable[None]]]
-    ]
-]
+) -> tuple[str, Callable[["synapse.module_api.LoginResponse"], Awaitable[None]] | None] | None
 ```
 
 The login type and field names should be provided by the user in the
@@ -67,12 +62,7 @@ async def check_3pid_auth(
     medium: str, 
     address: str,
     password: str,
-) -> Optional[
-    Tuple[
-        str, 
-        Optional[Callable[["synapse.module_api.LoginResponse"], Awaitable[None]]]
-    ]
-]
+) -> tuple[str, Callable[["synapse.module_api.LoginResponse"], Awaitable[None]] | None]
 ```
 
 Called when a user attempts to register or log in with a third party identifier,
@@ -98,7 +88,7 @@ _First introduced in Synapse v1.46.0_
 ```python
 async def on_logged_out(
     user_id: str,
-    device_id: Optional[str],
+    device_id: str | None,
     access_token: str
 ) -> None
 ``` 
@@ -119,7 +109,7 @@ _First introduced in Synapse v1.52.0_
 async def get_username_for_registration(
     uia_results: Dict[str, Any],
     params: Dict[str, Any],
-) -> Optional[str]
+) -> str | None
 ```
 
 Called when registering a new user. The module can return a username to set for the user
@@ -180,7 +170,7 @@ _First introduced in Synapse v1.54.0_
 async def get_displayname_for_registration(
     uia_results: Dict[str, Any],
     params: Dict[str, Any],
-) -> Optional[str]
+) -> str | None
 ```
 
 Called when registering a new user. The module can return a display name to set for the
@@ -259,12 +249,7 @@ class MyAuthProvider:
         username: str,
         login_type: str,
         login_dict: "synapse.module_api.JsonDict",
-    ) -> Optional[
-        Tuple[
-            str,
-            Optional[Callable[["synapse.module_api.LoginResponse"], Awaitable[None]]],
-        ]
-    ]:
+    ) -> tuple[str, Callable[["synapse.module_api.LoginResponse"], Awaitable[None]] | None] | None:
         if login_type != "my.login_type":
             return None
 
@@ -276,12 +261,7 @@ class MyAuthProvider:
         username: str,
         login_type: str,
         login_dict: "synapse.module_api.JsonDict",
-    ) -> Optional[
-        Tuple[
-            str,
-            Optional[Callable[["synapse.module_api.LoginResponse"], Awaitable[None]]],
-        ]
-    ]:
+    ) -> tuple[str, Callable[["synapse.module_api.LoginResponse"], Awaitable[None]] | None] | None:
         if login_type != "m.login.password":
             return None
 
diff --git a/docs/modules/presence_router_callbacks.md b/docs/modules/presence_router_callbacks.md
index b210f0e3cd..f865e79f53 100644
--- a/docs/modules/presence_router_callbacks.md
+++ b/docs/modules/presence_router_callbacks.md
@@ -23,7 +23,7 @@ _First introduced in Synapse v1.42.0_
 ```python 
 async def get_users_for_states(
     state_updates: Iterable["synapse.api.UserPresenceState"],
-) -> Dict[str, Set["synapse.api.UserPresenceState"]]
+) -> dict[str, set["synapse.api.UserPresenceState"]]
 ```
 **Requires** `get_interested_users` to also be registered
 
@@ -45,7 +45,7 @@ _First introduced in Synapse v1.42.0_
 ```python
 async def get_interested_users(
     user_id: str
-) -> Union[Set[str], "synapse.module_api.PRESENCE_ALL_USERS"]
+) -> set[str] | "synapse.module_api.PRESENCE_ALL_USERS"
 ```
 **Requires** `get_users_for_states` to also be registered
 
@@ -73,7 +73,7 @@ that `@alice:example.org` receives all presence updates from `@bob:example.com`
 `@charlie:somewhere.org`, regardless of whether Alice shares a room with any of them.
 
 ```python
-from typing import Dict, Iterable, Set, Union
+from typing import Iterable
 
 from synapse.module_api import ModuleApi
 
@@ -90,7 +90,7 @@ class CustomPresenceRouter:
     async def get_users_for_states(
         self,
         state_updates: Iterable["synapse.api.UserPresenceState"],
-    ) -> Dict[str, Set["synapse.api.UserPresenceState"]]:
+    ) -> dict[str, set["synapse.api.UserPresenceState"]]:
         res = {}
         for update in state_updates:
             if (
@@ -104,7 +104,7 @@ class CustomPresenceRouter:
     async def get_interested_users(
         self,
         user_id: str,
-    ) -> Union[Set[str], "synapse.module_api.PRESENCE_ALL_USERS"]:
+    ) -> set[str] | "synapse.module_api.PRESENCE_ALL_USERS":
         if user_id == "@alice:example.com":
             return {"@bob:example.com", "@charlie:somewhere.org"}
 
diff --git a/docs/modules/ratelimit_callbacks.md b/docs/modules/ratelimit_callbacks.md
index 30d94024fa..048bdc6f9e 100644
--- a/docs/modules/ratelimit_callbacks.md
+++ b/docs/modules/ratelimit_callbacks.md
@@ -11,7 +11,7 @@ The available ratelimit callbacks are:
 _First introduced in Synapse v1.132.0_
 
 ```python
-async def get_ratelimit_override_for_user(user: str, limiter_name: str) -> Optional[synapse.module_api.RatelimitOverride]
+async def get_ratelimit_override_for_user(user: str, limiter_name: str) -> synapse.module_api.RatelimitOverride | None
 ```
 
 **<span style="color:red">
diff --git a/docs/modules/spam_checker_callbacks.md b/docs/modules/spam_checker_callbacks.md
index 49b7e06bb3..0d261e844f 100644
--- a/docs/modules/spam_checker_callbacks.md
+++ b/docs/modules/spam_checker_callbacks.md
@@ -195,12 +195,15 @@ _Changed in Synapse v1.132.0: Added the `room_config` argument. Callbacks that o
 async def user_may_create_room(user_id: str, room_config: synapse.module_api.JsonDict) -> Union["synapse.module_api.NOT_SPAM", "synapse.module_api.errors.Codes", bool]
 ```
 
-Called when processing a room creation request.
+Called when processing a room creation or room upgrade request.
 
 The arguments passed to this callback are:
 
 * `user_id`: The Matrix user ID of the user (e.g. `@alice:example.com`).
-* `room_config`: The contents of the body of a [/createRoom request](https://spec.matrix.org/latest/client-server-api/#post_matrixclientv3createroom) as a dictionary.
+* `room_config`: The contents of the body of the [`/createRoom` request](https://spec.matrix.org/v1.15/client-server-api/#post_matrixclientv3createroom) as a dictionary.
+  For a [room upgrade request](https://spec.matrix.org/v1.15/client-server-api/#post_matrixclientv3roomsroomidupgrade) it is a synthesised subset of what an equivalent
+  `/createRoom` request would have looked like. Specifically, it contains the `creation_content` (linking to the previous room) and `initial_state` (containing a
+  subset of the state of the previous room).
 
 The callback must return one of:
   - `synapse.module_api.NOT_SPAM`, to allow the operation. Other callbacks may still 
@@ -328,9 +331,9 @@ search results; otherwise return `False`.
 The profile is represented as a dictionary with the following keys:
 
 * `user_id: str`. The Matrix ID for this user.
-* `display_name: Optional[str]`. The user's display name, or `None` if this user
+* `display_name: str | None`. The user's display name, or `None` if this user
   has not set a display name.
-* `avatar_url: Optional[str]`. The `mxc://` URL to the user's avatar, or `None`
+* `avatar_url: str | None`. The `mxc://` URL to the user's avatar, or `None`
   if this user has not set an avatar.
 
 The module is given a copy of the original dictionary, so modifying it from within the
@@ -349,10 +352,10 @@ _First introduced in Synapse v1.37.0_
 
 ```python
 async def check_registration_for_spam(
-    email_threepid: Optional[dict],
-    username: Optional[str],
+    email_threepid: dict | None,
+    username: str | None,
     request_info: Collection[Tuple[str, str]],
-    auth_provider_id: Optional[str] = None,
+    auth_provider_id: str | None = None,
 ) -> "synapse.spam_checker_api.RegistrationBehaviour"
 ```
 
@@ -435,10 +438,10 @@ _First introduced in Synapse v1.87.0_
 ```python
 async def check_login_for_spam(
     user_id: str,
-    device_id: Optional[str],
-    initial_display_name: Optional[str],
-    request_info: Collection[Tuple[Optional[str], str]],
-    auth_provider_id: Optional[str] = None,
+    device_id: str | None,
+    initial_display_name: str | None,
+    request_info: Collection[tuple[str | None, str]],
+    auth_provider_id: str | None = None,
 ) -> Union["synapse.module_api.NOT_SPAM", "synapse.module_api.errors.Codes"]
 ```
 
@@ -506,7 +509,7 @@ class ListSpamChecker:
             resource=IsUserEvilResource(config),
         )
 
-    async def check_event_for_spam(self, event: "synapse.events.EventBase") -> Union[Literal["NOT_SPAM"], Codes]:
+    async def check_event_for_spam(self, event: "synapse.events.EventBase") -> Literal["NOT_SPAM"] | Codes:
         if event.sender in self.evil_users:
           return Codes.FORBIDDEN
         else:
diff --git a/docs/modules/third_party_rules_callbacks.md b/docs/modules/third_party_rules_callbacks.md
index b97e28db11..1474b2dfd5 100644
--- a/docs/modules/third_party_rules_callbacks.md
+++ b/docs/modules/third_party_rules_callbacks.md
@@ -16,7 +16,7 @@ _First introduced in Synapse v1.39.0_
 async def check_event_allowed(
     event: "synapse.events.EventBase",
     state_events: "synapse.types.StateMap",
-) -> Tuple[bool, Optional[dict]]
+) -> tuple[bool, dict | None]
 ```
 
 **<span style="color:red">
@@ -340,7 +340,7 @@ class EventCensorer:
         self,
         event: "synapse.events.EventBase",
         state_events: "synapse.types.StateMap",
-    ) -> Tuple[bool, Optional[dict]]:
+    ) -> Tuple[bool, dict | None]:
         event_dict = event.get_dict()
         new_event_content = await self.api.http_client.post_json_get_json(
             uri=self._endpoint, post_json=event_dict,
diff --git a/docs/openid.md b/docs/openid.md
index f86ba189c7..e91d375c41 100644
--- a/docs/openid.md
+++ b/docs/openid.md
@@ -50,6 +50,11 @@ setting in your configuration file.
 See the [configuration manual](usage/configuration/config_documentation.md#oidc_providers) for some sample settings, as well as
 the text below for example configurations for specific providers.
 
+For setups using [`.well-known` delegation](delegate.md), make sure
+[`public_baseurl`](usage/configuration/config_documentation.md#public_baseurl) is set
+appropriately. If unset, Synapse defaults to `https://<server_name>/` which is used in
+the OIDC callback URL.
+
 ## OIDC Back-Channel Logout
 
 Synapse supports receiving [OpenID Connect Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) notifications.
@@ -186,6 +191,7 @@ oidc_providers:
 4. Note the slug of your application, Client ID and Client Secret.
 
 Note: RSA keys must be used for signing for Authentik, ECC keys do not work.
+Note: The provider must have a signing key set and must not use an encryption key.
 
 Synapse config:
 ```yaml
@@ -204,6 +210,12 @@ oidc_providers:
       config:
         localpart_template: "{{ user.preferred_username }}"
         display_name_template: "{{ user.preferred_username|capitalize }}" # TO BE FILLED: If your users have names in Authentik and you want those in Synapse, this should be replaced with user.name|capitalize.
+[...]
+jwt_config:
+    enabled: true
+    secret: "your client secret" # TO BE FILLED (same as `client_secret` above)
+    algorithm: "RS256"
+    # (...other fields)
 ```
 
 ### Dex
diff --git a/docs/presence_router_module.md b/docs/presence_router_module.md
index face54fe2b..092b566c5f 100644
--- a/docs/presence_router_module.md
+++ b/docs/presence_router_module.md
@@ -76,7 +76,7 @@ possible.
 #### `get_interested_users`
 
 ```python
-async def get_interested_users(self, user_id: str) -> Union[Set[str], str]
+async def get_interested_users(self, user_id: str) -> set[str] | str
 ```
 
 **Required.** An asynchronous method that is passed a single Matrix User ID. This
@@ -182,7 +182,7 @@ class ExamplePresenceRouter:
     async def get_interested_users(
         self,
         user_id: str,
-    ) -> Union[Set[str], PresenceRouter.ALL_USERS]:
+    ) -> set[str] | PresenceRouter.ALL_USERS:
         """
         Retrieve a list of users that `user_id` is interested in receiving the
         presence of. This will be in addition to those they share a room with.
diff --git a/docs/reverse_proxy.md b/docs/reverse_proxy.md
index f871a39939..0e3303df57 100644
--- a/docs/reverse_proxy.md
+++ b/docs/reverse_proxy.md
@@ -86,6 +86,45 @@ server {
 }
 ```
 
+### Nginx Proxy Manager or NPMPlus
+
+```nginx
+Add New Proxy-Host
+	- Tab Details
+		- Domain Names: matrix.example.com
+		- Scheme: http
+		- Forward Hostname / IP: localhost # IP address or hostname where Synapse is hosted. Bare-metal or Container.
+		- Forward Port: 8008
+
+	- Tab Custom locations
+		- Add Location
+		- Define Location: /_matrix
+		- Scheme: http
+		- Forward Hostname / IP: localhost # IP address or hostname where Synapse is hosted. Bare-metal or Container.
+		- Forward Port: 8008
+		- Click on the gear icon to display a custom configuration field. Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
+			- Enter this in the Custom Field: client_max_body_size 50M;
+
+	- Tab SSL/TLS
+		- Choose your SSL/TLS certificate and preferred settings.
+
+	- Tab Advanced
+		- Enter this in the Custom Field. This means that port 8448 no longer needs to be opened in your Firewall.
+		  The Federation communication use now Port 443.
+
+			location /.well-known/matrix/server {
+			  return 200 '{"m.server": "matrix.example.com:443"}';
+      		  add_header Content-Type application/json;
+			}
+
+ 			location /.well-known/matrix/client {
+      		  return 200 '{"m.homeserver": {"base_url": "https://matrix.example.com"}}';
+      		  add_header Content-Type application/json;
+      		  add_header "Access-Control-Allow-Origin" *;
+			}
+
+```
+
 ### Caddy v2
 
 ```
diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml
index 0d75e6d4a1..470e44a8ed 100644
--- a/docs/sample_config.yaml
+++ b/docs/sample_config.yaml
@@ -24,14 +24,18 @@
 server_name: "SERVERNAME"
 pid_file: DATADIR/homeserver.pid
 listeners:
-  - port: 8008
+  - bind_addresses:
+    - ::1
+    - 127.0.0.1
+    port: 8008
+    resources:
+    - compress: false
+      names:
+      - client
+      - federation
     tls: false
     type: http
     x_forwarded: true
-    bind_addresses: ['::1', '127.0.0.1']
-    resources:
-      - names: [client, federation]
-        compress: false
 database:
   name: sqlite3
   args:
diff --git a/docs/setup/installation.md b/docs/setup/installation.md
index 0840f532b0..c887f9900c 100644
--- a/docs/setup/installation.md
+++ b/docs/setup/installation.md
@@ -16,8 +16,15 @@ that your email address is probably `user@example.com` rather than
 `user@email.example.com`) - but doing so may require more advanced setup: see
 [Setting up Federation](../federate.md).
 
+⚠️ Before setting up Synapse please consult the [security page](security.md) for
+best practices. ⚠️
+
 ## Installing Synapse
 
+Note: Synapse uses a number of platform dependencies such as Python and PostgreSQL,
+and aims to follow supported upstream versions. See the [deprecation
+policy](../deprecation_policy.md) for more details.
+
 ### Prebuilt packages
 
 Prebuilt packages are available for a number of platforms. These are recommended
@@ -87,17 +94,13 @@ file when you upgrade the Debian package to a later version.
 Andrej Shadura maintains a
 [`matrix-synapse`](https://packages.debian.org/sid/matrix-synapse) package in
 the Debian repositories.
-For `bookworm` and `sid`, it can be installed simply with:
+For `forky` (14) and `sid` (rolling release), it can be installed simply with:
 
 ```sh
 sudo apt install matrix-synapse
 ```
 
-Synapse is also available in `bullseye-backports`.  Please
-see the [Debian documentation](https://backports.debian.org/Instructions/)
-for information on how to use backports.
-
-`matrix-synapse` is no longer maintained for `buster` and older.
+The downstream Debian `matrix-synapse` package is not available for `trixie` (13) and older. Consider using the Matrix.org packages (above).
 
 ##### Downstream Ubuntu packages
 
@@ -208,7 +211,7 @@ When following this route please make sure that the [Platform-specific prerequis
 System requirements:
 
 - POSIX-compliant system (tested on Linux & OS X)
-- Python 3.9 or later, up to Python 3.13.
+- Python 3.10 or later, up to Python 3.13.
 - At least 1GB of free RAM if you want to join large public rooms like #matrix:matrix.org
 
 If building on an uncommon architecture for which pre-built wheels are
@@ -226,6 +229,11 @@ pip install --upgrade setuptools
 pip install matrix-synapse
 ```
 
+If you want to use a logging configuration that references
+`systemd.journal.JournalHandler` (for example `contrib/systemd/log_config.yaml`),
+you must install `systemd-python` separately in the same environment.
+Synapse no longer provides a `matrix-synapse[systemd]` extra.
+
 This will download Synapse from [PyPI](https://pypi.org/project/matrix-synapse)
 and install it, along with the python libraries it uses, into a virtual environment
 under `~/synapse/env`.  Feel free to pick a different directory if you
@@ -311,11 +319,16 @@ sudo dnf group install "Development Tools"
 
 ##### Red Hat Enterprise Linux / Rocky Linux / Oracle Linux
 
-*Note: The term "RHEL" below refers to Red Hat Enterprise Linux, Oracle Linux and Rocky Linux. The distributions are 1:1 binary compatible.*
+*Note: The term "RHEL" below refers to Red Hat Enterprise Linux, Oracle Linux and Rocky Linux.
+The distributions are 1:1 binary compatible.*
 
 It's recommended to use the latest Python versions.
 
-RHEL 8 in particular ships with Python 3.6 by default which is EOL and therefore no longer supported by Synapse. RHEL 9 ships with Python 3.9 which is still supported by the Python core team as of this writing. However, newer Python versions provide significant performance improvements and they're available in official distributions' repositories. Therefore it's recommended to use them.
+RHEL 8 & 9 in particular ship with Python 3.6 & 3.9 respectively by default
+which are EOL and therefore no longer supported by Synapse.
+However, newer Python versions provide significant performance improvements
+and they're available in official distributions' repositories.
+Therefore it's recommended to use them.
 
 Python 3.11 and 3.12 are available for both RHEL 8 and 9.
 
diff --git a/docs/setup/security.md b/docs/setup/security.md
new file mode 100644
index 0000000000..2c21b494e5
--- /dev/null
+++ b/docs/setup/security.md
@@ -0,0 +1,41 @@
+# Security
+
+This page lays out security best-practices when running Synapse.
+
+If you believe you have encountered a security issue, see our [Security
+Disclosure Policy](https://element.io/en/security/security-disclosure-policy).
+
+## Content repository
+
+Matrix serves raw, user-supplied data in some APIs — specifically the [content
+repository endpoints](https://matrix.org/docs/spec/client_server/latest.html#get-matrix-media-r0-download-servername-mediaid).
+
+Whilst we make a reasonable effort to mitigate against XSS attacks (for
+instance, by using [CSP](https://github.com/matrix-org/synapse/pull/1021)), a
+Matrix homeserver should not be hosted on a domain hosting other web
+applications. This especially applies to sharing the domain with Matrix web
+clients and other sensitive applications like webmail. See
+https://developer.github.com/changes/2014-04-25-user-content-security for more
+information.
+
+Ideally, the homeserver should not simply be on a different subdomain, but on a
+completely different [registered
+domain](https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-2.3)
+(also known as top-level site or eTLD+1). This is because [some
+attacks](https://en.wikipedia.org/wiki/Session_fixation#Attacks_using_cross-subdomain_cookie)
+are still possible as long as the two applications share the same registered
+domain.
+
+
+To illustrate this with an example, if your Element Web or other sensitive web
+application is hosted on `A.example1.com`, you should ideally host Synapse on
+`example2.com`. Some amount of protection is offered by hosting on
+`B.example1.com` instead, so this is also acceptable in some scenarios.
+However, you should *not* host your Synapse on `A.example1.com`.
+
+Note that all of the above refers exclusively to the domain used in Synapse's
+`public_baseurl` setting. In particular, it has no bearing on the domain
+mentioned in MXIDs hosted on that server.
+
+Following this advice ensures that even if an XSS is found in Synapse, the
+impact to other applications will be minimal.
diff --git a/docs/structured_logging.md b/docs/structured_logging.md
index 002565b223..761d6466dd 100644
--- a/docs/structured_logging.md
+++ b/docs/structured_logging.md
@@ -35,7 +35,7 @@ handlers:
 loggers:
     synapse:
         level: INFO
-        handlers: [remote]
+        handlers: [file]
     synapse.storage.SQL:
         level: WARNING
 ```
diff --git a/docs/upgrade.md b/docs/upgrade.md
index 082d204b58..aeae82c114 100644
--- a/docs/upgrade.md
+++ b/docs/upgrade.md
@@ -117,6 +117,151 @@ each upgrade are complete before moving on to the next upgrade, to avoid
 stacking them up. You can monitor the currently running background updates with
 [the Admin API](usage/administration/admin_api/background_updates.html#status).
 
+# Upgrading to v1.150.0
+
+## Removal of the `systemd` pip extra
+
+The `matrix-synapse[systemd]` pip extra has been removed.
+If you use `systemd.journal.JournalHandler` in your logging configuration
+(e.g. `contrib/systemd/log_config.yaml`), you must now install
+`systemd-python` manually in Synapse's runtime environment:
+
+```bash
+pip install systemd-python
+```
+
+No action is needed if you do not use journal logging, or if you installed
+Synapse from the Debian packages (which handle this automatically).
+
+## Module API: Deprecation of the `deactivation` parameter in the `set_displayname` method
+
+If you have Synapse modules installed that use the `set_displayname` method to change
+the display name of your users, please ensure that it doesn't pass the optional
+`deactivation` parameter.
+
+This parameter is now deprecated and it is intended to be removed in 2027.
+No immediate change is necessary, however once the parameter is removed, modules passing it will produce errors.
+[Issue #19546](https://github.com/element-hq/synapse/issues/19546) tracks this removal.
+
+From this version, when the parameter is passed, an error such as
+``Deprecated `deactivation` parameter passed to `set_displayname` Module API (value: False). This will break in 2027.`` will be logged. The method will otherwise continue to work.
+
+## Updated request log format (`Processed request: ...`)
+
+The [request log format](usage/administration/request_log.md) has slightly changed to
+include `ru=(...)` and `db=(...)` labels to better disambiguate the number groupings.
+Previously, these values appeared without labels.
+
+This only matters if you have third-party tooling that parses the Synapse logs.
+
+# Upgrading to v1.146.0
+
+## Drop support for Ubuntu 25.04 Plucky Puffin, and add support for 25.10 Questing Quokka
+
+Ubuntu 25.04 Plucky Puffin [is end-of-life as of 17 Jan
+2026](https://endoflife.date/ubuntu). This release drops support for Ubuntu
+25.04, and in its place adds support for Ubuntu 25.10 Questing Quokka.
+
+## Removal of MSC2697 (Legacy) Dehydrated devices
+
+The endpoints for
+[MSC2697](https://github.com/matrix-org/matrix-spec-proposals/pull/2697) have now
+been removed, since the MSC is closed. Developers who rely on this feature should
+migrate to [MSC3814](https://github.com/matrix-org/matrix-spec-proposals/pull/3814)
+which introduces support for a newer version of dehydrated devices.
+
+# Upgrading to v1.144.0
+
+## Worker support for unstable MSC4140 `/restart` endpoint
+
+The following unstable endpoint pattern may now be routed to worker processes:
+
+```
+^/_matrix/client/unstable/org.matrix.msc4140/delayed_events/.*/restart$
+```
+
+## Unstable mutual rooms endpoint is now behind an experimental feature flag
+
+The unstable mutual rooms endpoint from
+[MSC2666](https://github.com/matrix-org/matrix-spec-proposals/pull/2666)
+(`/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms`) is now
+disabled by default.  If you rely on this unstable endpoint, you must now set
+`experimental_features.msc2666_enabled: true` in your configuration to keep
+using it.
+
+# Upgrading to v1.143.0
+
+## Dropping support for PostgreSQL 13
+
+In line with our [deprecation policy](deprecation_policy.md), we've dropped
+support for PostgreSQL 13, as it is no longer supported upstream.
+This release of Synapse requires PostgreSQL 14+.
+
+# Upgrading to v1.142.0
+
+## Python 3.10+ is now required
+
+The minimum supported Python version has been increased from v3.9 to v3.10.
+You will need Python 3.10+ to run Synapse v1.142.0.
+
+If you use current versions of the
+[matrixorg/synapse](setup/installation.html#docker-images-and-ansible-playbooks)
+Docker images, no action is required.
+
+## SQLite 3.40.0+ is now required
+
+The minimum supported SQLite version has been increased from 3.27.0 to 3.40.0.
+
+If you use current versions of the
+[matrixorg/synapse](setup/installation.html#docker-images-and-ansible-playbooks)
+Docker images, no action is required.
+
+
+# Upgrading to v1.141.0
+
+## Docker images now based on Debian `trixie` with Python 3.13
+
+The Docker images are now based on Debian `trixie` and use Python 3.13. If you
+are using the Docker images as a base image you may need to e.g. adjust the
+paths you mount any additional Python packages at.
+
+# Upgrading to v1.140.0
+
+## Users of `synapse-s3-storage-provider` must update the module to `v1.6.0`
+
+Deployments that make use of the
+[synapse-s3-storage-provider](https://github.com/matrix-org/synapse-s3-storage-provider/)
+module must update it to
+[v1.6.0](https://github.com/matrix-org/synapse-s3-storage-provider/releases/tag/v1.6.0),
+otherwise users will be unable to upload or download media.
+
+# Upgrading to v1.139.0
+
+## `/register` requests from old application service implementations may break when using MAS
+
+Application Services that do not set `inhibit_login=true` when calling `POST
+/_matrix/client/v3/register` will receive the error
+`IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED` in response. This is a
+result of [MSC4190: Device management for application
+services](https://github.com/matrix-org/matrix-spec-proposals/pull/4190) which
+adds new endpoints for application services to create encryption-ready devices
+with other than `/login` or `/register` without `inhibit_login=true`.
+
+If an application service you use starts to fail with the mentioned error,
+ensure it is up to date. If it is, then kindly let the author know that they
+need to update their implementation to call `/register` with
+`inhibit_login=true`.
+
+# Upgrading to v1.138.2
+
+## Drop support for Ubuntu 24.10 Oracular Oriole, and add support for Ubuntu 25.04 Plucky Puffin
+
+Ubuntu 24.10 Oracular Oriole [has been end-of-life since 10 Jul
+2025](https://endoflife.date/ubuntu). This release drops support for Ubuntu
+24.10, and in its place adds support for Ubuntu 25.04 Plucky Puffin.
+
+This notice also applies to the v1.139.0 release.
+
 # Upgrading to v1.136.0
 
 ## Deprecate `run_as_background_process` exported as part of the module API interface in favor of `ModuleApi.run_as_background_process`
@@ -736,7 +881,7 @@ the names of Prometheus metrics.
 If you want to test your changes before legacy names are disabled by default,
 you may specify `enable_legacy_metrics: false` in your homeserver configuration.
 
-A list of affected metrics is available on the [Metrics How-to page](https://element-hq.github.io/synapse/v1.69/metrics-howto.html?highlight=metrics%20deprecated#renaming-of-metrics--deprecation-of-old-names-in-12).
+A list of affected metrics is available on the [Metrics How-to page](https://element-hq.github.io/synapse/v1.69/metrics-howto.html#renaming-of-metrics--deprecation-of-old-names-in-12).
 
 
 ## Deprecation of the `generate_short_term_login_token` module API method
@@ -2331,7 +2476,7 @@ back to v1.3.1, subject to the following:
 
 Some counter metrics have been renamed, with the old names deprecated.
 See [the metrics
-documentation](metrics-howto.md#renaming-of-metrics--deprecation-of-old-names-in-12)
+documentation](https://element-hq.github.io/synapse/v1.69/metrics-howto.html#renaming-of-metrics--deprecation-of-old-names-in-12)
 for details.
 
 # Upgrading to v1.1.0
diff --git a/docs/usage/administration/request_log.md b/docs/usage/administration/request_log.md
index 6154108934..7e3047eb62 100644
--- a/docs/usage/administration/request_log.md
+++ b/docs/usage/administration/request_log.md
@@ -5,8 +5,8 @@ HTTP request logs are written by synapse (see [`synapse/http/site.py`](https://g
 See the following for how to decode the dense data available from the default logging configuration.
 
 ```
-2020-10-01 12:00:00,000 - synapse.access.http.8008 - 311 - INFO - PUT-1000- 192.168.0.1 - 8008 - {another-matrix-server.com} Processed request: 0.100sec/-0.000sec (0.000sec, 0.000sec) (0.001sec/0.090sec/3) 11B !200 "PUT /_matrix/federation/v1/send/1600000000000 HTTP/1.1" "Synapse/1.20.1" [0 dbevts]
--AAAAAAAAAAAAAAAAAAAAA-   -BBBBBBBBBBBBBBBBBBBBBB-   -C-   -DD-   -EEEEEE-  -FFFFFFFFF-   -GG-    -HHHHHHHHHHHHHHHHHHHHHHH-                     -IIIIII- -JJJJJJJ-  -KKKKKK-, -LLLLLL-  -MMMMMMM- -NNNNNN- O  -P- -QQ-  -RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR-   -SSSSSSSSSSSS-   -TTTTTT-
+2020-10-01 12:00:00,000 - synapse.access.http.8008 - 311 - INFO - PUT-1000- 192.168.0.1 - 8008 - {another-matrix-server.com} Processed request: 0.100sec/-0.000sec ru=(0.000sec, 0.000sec) db=(0.001sec/0.090sec/3) 11B !200 "PUT /_matrix/federation/v1/send/1600000000000 HTTP/1.1" "Synapse/1.20.1" [0 dbevts]
+-AAAAAAAAAAAAAAAAAAAAA-   -BBBBBBBBBBBBBBBBBBBBBB-   -C-   -DD-   -EEEEEE-  -FFFFFFFFF-   -GG-    -HHHHHHHHHHHHHHHHHHHHHHH-                     -IIIIII- -JJJJJJJ-     -KKKKKK-, -LLLLLL-      -MMMMMM- -NNNNNN- O  -P- -QQ-  -RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR-   -SSSSSSSSSSSS-   -TTTTTT-
 ```
 
 
diff --git a/docs/usage/configuration/config_documentation.md b/docs/usage/configuration/config_documentation.md
index 68303308cd..48f33d5427 100644
--- a/docs/usage/configuration/config_documentation.md
+++ b/docs/usage/configuration/config_documentation.md
@@ -653,6 +653,8 @@ This setting has the following sub-options:
 
 * `endpoint` (string): The URL where Synapse can reach MAS. This *must* have the `discovery` and `oauth` resources mounted. Defaults to `"http://localhost:8080"`.
 
+* `force_http2` (boolean): Force HTTP/2 over plaintext (H2C) when connecting to MAS. MAS supports this natively, but a reverse proxy between Synapse and MAS may not. Defaults to `false`.
+
 * `secret` (string|null): A shared secret that will be used to authenticate requests from and to MAS.
 
 * `secret_path` (string|null): Alternative to `secret`, reading the shared secret from a file. The file should be a plain text file, containing only the secret. Synapse reads the secret from the given file once at startup.
@@ -956,7 +958,7 @@ server_context: context
 ---
 ### `limit_remote_rooms`
 
-*(object)* When this option is enabled, the room "complexity" will be checked before a user joins a new remote room. If it is above the complexity limit, the server will disallow joining, or will instantly leave. This is useful for homeservers that are resource-constrained. Room complexity is an arbitrary measure based on factors such as the number of users in the room.
+*(object)* When this option is enabled, the room "complexity" will be checked before a user joins a new remote room. If it is above the complexity limit, the server will disallow joining, or will instantly leave. This is useful for homeservers that are resource-constrained. In Synapse, the complexity of a room is measured by the number of current state events in a room, divided by 500. "Current" here means the latest state, i.e. if a user joins, then leaves, then joins, that will count as 1 current `m.room.member` state event.
 
 This setting has the following sub-options:
 
@@ -2006,9 +2008,8 @@ This setting has the following sub-options:
 Default configuration:
 ```yaml
 rc_reports:
-  per_user:
-    per_second: 1.0
-    burst_count: 5.0
+  per_second: 1.0
+  burst_count: 5.0
 ```
 
 Example configuration:
@@ -2031,9 +2032,8 @@ This setting has the following sub-options:
 Default configuration:
 ```yaml
 rc_room_creation:
-  per_user:
-    per_second: 0.016
-    burst_count: 10.0
+  per_second: 0.016
+  burst_count: 10.0
 ```
 
 Example configuration:
@@ -2043,6 +2043,25 @@ rc_room_creation:
   burst_count: 5.0
 ```
 ---
+### `rc_user_directory`
+
+*(object)* This option allows admins to ratelimit searches in the user directory.
+
+_Added in Synapse 1.145.0._
+
+This setting has the following sub-options:
+
+* `per_second` (number): Maximum number of requests a client can send per second.
+
+* `burst_count` (number): Maximum number of requests a client can send before being throttled.
+
+Default configuration:
+```yaml
+rc_user_directory:
+  per_second: 0.016
+  burst_count: 200.0
+```
+---
 ### `federation_rr_transactions_per_room_per_second`
 
 *(integer)* Sets outgoing federation transaction frequency for sending read-receipts, per-room.
@@ -2094,6 +2113,16 @@ Example configuration:
 enable_media_repo: false
 ```
 ---
+### `enable_local_media_storage`
+
+*(boolean)* Enable the local on-disk media storage provider. When disabled, media is stored only in configured `media_storage_providers` and temporary files are used for processing.
+**Warning:** If this option is set to `false` and no `media_storage_providers` are configured, all media requests will return 404 errors as there will be no storage backend available. Defaults to `true`.
+
+Example configuration:
+```yaml
+enable_local_media_storage: false
+```
+---
 ### `media_store_path`
 
 *(string)* Directory where uploaded images and attachments are stored. Defaults to `"media_store"`.
@@ -2168,9 +2197,12 @@ max_upload_size: 60M
 ### `media_upload_limits`
 
 *(array)* A list of media upload limits defining how much data a given user can upload in a given time period.
+These limits are applied in addition to the `max_upload_size` limit above (which applies to individual uploads).
 
 An empty list means no limits are applied.
 
+These settings can be overridden using the `get_media_upload_limits_for_user` module API [callback](../../modules/media_repository_callbacks.md#get_media_upload_limits_for_user).
+
 Defaults to `[]`.
 
 Example configuration:
@@ -2572,6 +2604,28 @@ Example configuration:
 turn_allow_guests: false
 ```
 ---
+### `matrix_rtc`
+
+*(object)* Options related to MatrixRTC. Defaults to `{}`.
+
+This setting has the following sub-options:
+
+* `transports` (array): A list of transport types and arguments to use for MatrixRTC connections. Defaults to `[]`.
+
+  Options for each entry include:
+
+  * `type` (string): The type of transport to use to connect to the selective forwarding unit (SFU).
+
+  * `livekit_service_url` (string): The base URL of the LiveKit service. Should only be used with LiveKit-based transports.
+
+Example configuration:
+```yaml
+matrix_rtc:
+  transports:
+  - type: livekit
+    livekit_service_url: https://matrix-rtc.example.com/livekit/jwt
+```
+---
 ## Registration
 
 Registration can be rate-limited using the parameters in the [Ratelimiting](#ratelimiting) section of this manual.
@@ -3792,7 +3846,7 @@ This setting has the following sub-options:
 
 * `localdb_enabled` (boolean): Set to false to disable authentication against the local password database. This is ignored if `enabled` is false, and is only useful if you have other `password_providers`. Defaults to `true`.
 
-* `pepper` (string|null): Set the value here to a secret random string for extra security. DO NOT CHANGE THIS AFTER INITIAL SETUP! Defaults to `null`.
+* `pepper` (string|null): A secret random string that will be appended to user's passwords before they are hashed. This improves the security of short passwords. DO NOT CHANGE THIS AFTER INITIAL SETUP! Defaults to `null`.
 
 * `policy` (object): Define and enforce a password policy, such as minimum lengths for passwords, etc. This is an implementation of MSC2000.
 
@@ -4432,7 +4486,7 @@ stream_writers:
 ---
 ### `outbound_federation_restricted_to`
 
-*(array)* When using workers, you can restrict outbound federation traffic to only go through a specific subset of workers. Any worker specified here must also be in the [`instance_map`](#instance_map). [`worker_replication_secret`](#worker_replication_secret) must also be configured to authorize inter-worker communication.
+*(array)* You can restrict outbound federation traffic to only go through a specific subset of workers including the [Secure Border Gateway (SBG)](https://element.io/en/server-suite/secure-border-gateways). Any worker specified here (including the SBG) must also be in the [`instance_map`](#instance_map). [`worker_replication_secret`](#worker_replication_secret) must also be configured to authorize inter-worker communication.
 
 Also see the [worker documentation](../../workers.md#restrict-outbound-federation-traffic-to-a-specific-set-of-workers) for more info.
 
diff --git a/docs/usage/configuration/logging_sample_config.md b/docs/usage/configuration/logging_sample_config.md
index 23a55abdcc..9cc96df73c 100644
--- a/docs/usage/configuration/logging_sample_config.md
+++ b/docs/usage/configuration/logging_sample_config.md
@@ -14,6 +14,9 @@ It should be named `<SERVERNAME>.log.config` by default.
 Hint: If you're looking for a guide on what each of the fields in the "Processed request" log lines mean,
 see [Request log format](../administration/request_log.md).
 
+If you use `systemd.journal.JournalHandler` in your own logging config, ensure
+`systemd-python` is installed in Synapse's runtime environment.
+
 ```yaml
 {{#include ../../sample_log_config.yaml}}
 ```
diff --git a/docs/website_files/README.md b/docs/website_files/README.md
index bc51c4865e..b5521997d5 100644
--- a/docs/website_files/README.md
+++ b/docs/website_files/README.md
@@ -9,27 +9,18 @@ point to additional JS/CSS in this directory that are added on each page load. I
 addition, the `theme` directory contains files that overwrite their counterparts in
 each of the default themes included with mdbook.
 
-Currently we use these files to generate a floating Table of Contents panel. The code for
-which was partially taken from
-[JorelAli/mdBook-pagetoc](https://github.com/JorelAli/mdBook-pagetoc/)
-before being modified such that it scrolls with the content of the page. This is handled
-by the `table-of-contents.js/css` files. The table of contents panel only appears on pages
-that have more than one header, as well as only appearing on desktop-sized monitors.
+Currently we use these files to make a few modifications:
 
-We remove the navigation arrows which typically appear on the left and right side of the
-screen on desktop as they interfere with the table of contents. This is handled by
-the `remove-nav-buttons.css` file.
+* We stylise the chapter titles in the left sidebar by indenting them
+  slightly so that they are more visually distinguishable from the section headers
+  (the bold titles). This is done through the `indent-section-headers.css` file.
 
-Finally, we also stylise the chapter titles in the left sidebar by indenting them
-slightly so that they are more visually distinguishable from the section headers
-(the bold titles). This is done through the `indent-section-headers.css` file.
-
-In addition to these modifications, we have added a version picker to the documentation.
-Users can switch between documentations for different versions of Synapse.
-This functionality was implemented through the `version-picker.js` and
-`version-picker.css` files.
+* We add a version picker pertaining to the different documentation versions
+  shipped with each version of Synapse. This functionality was implemented through
+  the `version-picker.js` and `version-picker.css` files, and is currently the only
+  requirement for the custom `theme/`.
 
 More information can be found in mdbook's official documentation for
 [injecting page JS/CSS](https://rust-lang.github.io/mdBook/format/config.html)
 and
-[customising the default themes](https://rust-lang.github.io/mdBook/format/theme/index.html).
\ No newline at end of file
+[customising the default themes](https://rust-lang.github.io/mdBook/format/theme/index.html).
diff --git a/docs/website_files/remove-nav-buttons.css b/docs/website_files/remove-nav-buttons.css
deleted file mode 100644
index 4b280794ea..0000000000
--- a/docs/website_files/remove-nav-buttons.css
+++ /dev/null
@@ -1,8 +0,0 @@
-/* Remove the prev, next chapter buttons as they interfere with the
- * table of contents.
- * Note that the table of contents only appears on desktop, thus we
- * only remove the desktop (wide) chapter buttons.
- */
-.nav-wide-wrapper {
-    display: none
-}
\ No newline at end of file
diff --git a/docs/website_files/table-of-contents.css b/docs/website_files/table-of-contents.css
deleted file mode 100644
index 1b6f44b66a..0000000000
--- a/docs/website_files/table-of-contents.css
+++ /dev/null
@@ -1,47 +0,0 @@
-:root {
-    --pagetoc-width: 250px;
-}
-
-@media only screen and (max-width:1439px) {
-    .sidetoc {
-        display: none;
-    }
-}
-
-@media only screen and (min-width:1440px) {
-    main {
-        position: relative;
-        margin-left: 100px !important;
-        margin-right: var(--pagetoc-width) !important;
-    }
-    .sidetoc {
-        margin-left: auto;
-        margin-right: auto;
-        left: calc(100% + (var(--content-max-width))/4 - 140px);
-        position: absolute;
-        text-align: right;
-    }
-    .pagetoc {
-        position: fixed;
-        width: var(--pagetoc-width);
-        overflow: auto;
-        right: 20px;
-        height: calc(100% - var(--menu-bar-height));
-    }
-    .pagetoc a {
-        color: var(--fg) !important;
-        display: block;
-        padding: 5px 15px 5px 10px;
-        text-align: left;
-        text-decoration: none;
-    }
-    .pagetoc a:hover,
-    .pagetoc a.active {
-        background: var(--sidebar-bg) !important;
-        color: var(--sidebar-fg) !important;
-    }
-    .pagetoc .active {
-        background: var(--sidebar-bg);
-        color: var(--sidebar-fg);
-    }
-}
diff --git a/docs/website_files/table-of-contents.js b/docs/website_files/table-of-contents.js
deleted file mode 100644
index 772da97fb9..0000000000
--- a/docs/website_files/table-of-contents.js
+++ /dev/null
@@ -1,148 +0,0 @@
-const getPageToc = () => document.getElementsByClassName('pagetoc')[0];
-
-const pageToc = getPageToc();
-const pageTocChildren = [...pageToc.children];
-const headers = [...document.getElementsByClassName('header')];
-
-
-// Select highlighted item in ToC when clicking an item
-pageTocChildren.forEach(child => {
-    child.addEventHandler('click', () => {
-        pageTocChildren.forEach(child => {
-            child.classList.remove('active');
-        });
-        child.classList.add('active');
-    });
-});
-
-
-/**
- * Test whether a node is in the viewport
- */
-function isInViewport(node) {
-    const rect = node.getBoundingClientRect();
-    return rect.top >= 0 && rect.left >= 0 && rect.bottom <= (window.innerHeight || document.documentElement.clientHeight) && rect.right <= (window.innerWidth || document.documentElement.clientWidth);
-}
-
-
-/**
- * Set a new ToC entry.
- * Clear any previously highlighted ToC items, set the new one,
- * and adjust the ToC scroll position.
- */
-function setTocEntry() {
-    let activeEntry;
-    const pageTocChildren = [...getPageToc().children];
-
-    // Calculate which header is the current one at the top of screen
-    headers.forEach(header => {
-        if (window.pageYOffset >= header.offsetTop) {
-            activeEntry = header;
-        }
-    });
-
-    // Update selected item in ToC when scrolling
-    pageTocChildren.forEach(child => {
-        if (activeEntry.href.localeCompare(child.href) === 0) {
-            child.classList.add('active');
-        } else {
-            child.classList.remove('active');
-        }
-    });
-
-    let tocEntryForLocation = document.querySelector(`nav a[href="${activeEntry.href}"]`);
-    if (tocEntryForLocation) {
-        const headingForLocation = document.querySelector(activeEntry.hash);
-        if (headingForLocation && isInViewport(headingForLocation)) {
-            // Update ToC scroll
-            const nav = getPageToc();
-            const content = document.querySelector('html');
-            if (content.scrollTop !== 0) {
-                nav.scrollTo({
-                    top: tocEntryForLocation.offsetTop - 100,
-                    left: 0,
-                    behavior: 'smooth',
-                });
-            } else {
-                nav.scrollTop = 0;
-            }
-        }
-    }
-}
-
-
-/**
- * Populate sidebar on load
- */
-window.addEventListener('load', () => {
-    // Prevent rendering the table of contents of the "print book" page, as it
-    // will end up being rendered into the output (in a broken-looking way)
-
-    // Get the name of the current page (i.e. 'print.html')
-    const pageNameExtension = window.location.pathname.split('/').pop();
-
-    // Split off the extension (as '.../print' is also a valid page name), which
-    // should result in 'print'
-    const pageName = pageNameExtension.split('.')[0];
-    if (pageName === "print") {
-        // Don't render the table of contents on this page
-        return;
-    }
-
-    // Only create table of contents if there is more than one header on the page
-    if (headers.length <= 1) {
-        return;
-    }
-
-    // Create an entry in the page table of contents for each header in the document
-    headers.forEach((header, index) => {
-        const link = document.createElement('a');
-
-        // Indent shows hierarchy
-        let indent = '0px';
-        switch (header.parentElement.tagName) {
-            case 'H1':
-                indent = '5px';
-                break;
-            case 'H2':
-                indent = '20px';
-                break;
-            case 'H3':
-                indent = '30px';
-                break;
-            case 'H4':
-                indent = '40px';
-                break;
-            case 'H5':
-                indent = '50px';
-                break;
-            case 'H6':
-                indent = '60px';
-                break;
-            default:
-                break;
-        }
-
-        let tocEntry;
-        if (index == 0) {
-            // Create a bolded title for the first element
-            tocEntry = document.createElement("strong");
-            tocEntry.innerHTML = header.text;
-        } else {
-            // All other elements are non-bold
-            tocEntry = document.createTextNode(header.text);
-        }
-        link.appendChild(tocEntry);
-
-        link.style.paddingLeft = indent;
-        link.href = header.href;
-        pageToc.appendChild(link);
-    });
-    setTocEntry.call();
-});
-
-
-// Handle active headers on scroll, if there is more than one header on the page
-if (headers.length > 1) {
-    window.addEventListener('scroll', setTocEntry);
-}
diff --git a/docs/website_files/theme/index.hbs b/docs/website_files/theme/index.hbs
index 9cf7521e80..3126184c9b 100644
--- a/docs/website_files/theme/index.hbs
+++ b/docs/website_files/theme/index.hbs
@@ -1,11 +1,11 @@
 <!DOCTYPE HTML>
-<html lang="{{ language }}" class="sidebar-visible no-js {{ default_theme }}">
+<html lang="{{ language }}" class="{{ default_theme }} sidebar-visible" dir="{{ text_direction }}">
     <head>
         <!-- Book generated using mdBook -->
         <meta charset="UTF-8">
         <title>{{ title }}</title>
         {{#if is_print }}
-        <meta name="robots" content="noindex" />
+        <meta name="robots" content="noindex">
         {{/if}}
         {{#if base_url}}
         <base href="{{ base_url }}">
@@ -15,60 +15,78 @@
         <!-- Custom HTML head -->
         {{> head}}
 
-        <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
         <meta name="description" content="{{ description }}">
         <meta name="viewport" content="width=device-width, initial-scale=1">
-        <meta name="theme-color" content="#ffffff" />
+        <meta name="theme-color" content="#ffffff">
 
         {{#if favicon_svg}}
-        <link rel="icon" href="{{ path_to_root }}favicon.svg">
+        <link rel="icon" href="{{ resource "favicon.svg" }}">
         {{/if}}
         {{#if favicon_png}}
-        <link rel="shortcut icon" href="{{ path_to_root }}favicon.png">
+        <link rel="shortcut icon" href="{{ resource "favicon.png" }}">
         {{/if}}
-        <link rel="stylesheet" href="{{ path_to_root }}css/variables.css">
-        <link rel="stylesheet" href="{{ path_to_root }}css/general.css">
-        <link rel="stylesheet" href="{{ path_to_root }}css/chrome.css">
+        <link rel="stylesheet" href="{{ resource "css/variables.css" }}">
+        <link rel="stylesheet" href="{{ resource "css/general.css" }}">
+        <link rel="stylesheet" href="{{ resource "css/chrome.css" }}">
         {{#if print_enable}}
-        <link rel="stylesheet" href="{{ path_to_root }}css/print.css" media="print">
+        <link rel="stylesheet" href="{{ resource "css/print.css" }}" media="print">
         {{/if}}
 
         <!-- Fonts -->
-        <link rel="stylesheet" href="{{ path_to_root }}FontAwesome/css/font-awesome.css">
-        {{#if copy_fonts}}
-        <link rel="stylesheet" href="{{ path_to_root }}fonts/fonts.css">
-        {{/if}}
+        <link rel="stylesheet" href="{{ resource "fonts/fonts.css" }}">
 
         <!-- Highlight.js Stylesheets -->
-        <link rel="stylesheet" href="{{ path_to_root }}highlight.css">
-        <link rel="stylesheet" href="{{ path_to_root }}tomorrow-night.css">
-        <link rel="stylesheet" href="{{ path_to_root }}ayu-highlight.css">
+        <link rel="stylesheet" id="mdbook-highlight-css" href="{{ resource "highlight.css" }}">
+        <link rel="stylesheet" id="mdbook-tomorrow-night-css" href="{{ resource "tomorrow-night.css" }}">
+        <link rel="stylesheet" id="mdbook-ayu-highlight-css" href="{{ resource "ayu-highlight.css" }}">
 
         <!-- Custom theme stylesheets -->
         {{#each additional_css}}
-        <link rel="stylesheet" href="{{ ../path_to_root }}{{ this }}">
+        <link rel="stylesheet" href="{{ resource this }}">
         {{/each}}
 
         {{#if mathjax_support}}
         <!-- MathJax -->
-        <script async type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script>
+        <script async src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script>
         {{/if}}
+
+        <!-- Provide site root and default themes to javascript -->
+        <script>
+            const path_to_root = "{{ path_to_root }}";
+            const default_light_theme = "{{ default_theme }}";
+            const default_dark_theme = "{{ preferred_dark_theme }}";
+        {{#if search_js}}
+            window.path_to_searchindex_js = "{{ resource "searchindex.js" }}";
+        {{/if}}
+        </script>
+        <!-- Start loading toc.js asap -->
+        <script src="{{ resource "toc.js" }}"></script>
     </head>
     <body>
-        <!-- Provide site root to javascript -->
-        <script type="text/javascript">
-            var path_to_root = "{{ path_to_root }}";
-            var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "{{ preferred_dark_theme }}" : "{{ default_theme }}";
-        </script>
-
+    <div id="mdbook-help-container">
+        <div id="mdbook-help-popup">
+            <h2 class="mdbook-help-title">Keyboard shortcuts</h2>
+            <div>
+                <p>Press <kbd>←</kbd> or <kbd>→</kbd> to navigate between chapters</p>
+                {{#if search_enabled}}
+                <p>Press <kbd>S</kbd> or <kbd>/</kbd> to search in the book</p>
+                {{/if}}
+                <p>Press <kbd>?</kbd> to show this help</p>
+                <p>Press <kbd>Esc</kbd> to hide this help</p>
+            </div>
+        </div>
+    </div>
+    <div id="mdbook-body-container">
         <!-- Work around some values being stored in localStorage wrapped in quotes -->
-        <script type="text/javascript">
+        <script>
             try {
-                var theme = localStorage.getItem('mdbook-theme');
-                var sidebar = localStorage.getItem('mdbook-sidebar');
+                let theme = localStorage.getItem('mdbook-theme');
+                let sidebar = localStorage.getItem('mdbook-sidebar');
+
                 if (theme.startsWith('"') && theme.endsWith('"')) {
                     localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
                 }
+
                 if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
                     localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
                 }
@@ -76,91 +94,107 @@
         </script>
 
         <!-- Set the theme before any content is loaded, prevents flash -->
-        <script type="text/javascript">
-            var theme;
+        <script>
+            const default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? default_dark_theme : default_light_theme;
+            let theme;
             try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
             if (theme === null || theme === undefined) { theme = default_theme; }
-            var html = document.querySelector('html');
-            html.classList.remove('no-js')
+            const html = document.documentElement;
             html.classList.remove('{{ default_theme }}')
             html.classList.add(theme);
-            html.classList.add('js');
+            html.classList.add("js");
         </script>
 
+        <input type="checkbox" id="mdbook-sidebar-toggle-anchor" class="hidden">
+
         <!-- Hide / unhide sidebar before it is displayed -->
-        <script type="text/javascript">
-            var html = document.querySelector('html');
-            var sidebar = 'hidden';
+        <script>
+            let sidebar = null;
+            const sidebar_toggle = document.getElementById("mdbook-sidebar-toggle-anchor");
             if (document.body.clientWidth >= 1080) {
                 try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
                 sidebar = sidebar || 'visible';
+            } else {
+                sidebar = 'hidden';
+                sidebar_toggle.checked = false;
+            }
+            if (sidebar === 'visible') {
+                sidebar_toggle.checked = true;
+            } else {
+                html.classList.remove('sidebar-visible');
             }
-            html.classList.remove('sidebar-visible');
-            html.classList.add("sidebar-" + sidebar);
         </script>
 
-        <nav id="sidebar" class="sidebar" aria-label="Table of contents">
-            <div class="sidebar-scrollbox">
-                {{#toc}}{{/toc}}
+        <nav id="mdbook-sidebar" class="sidebar" aria-label="Table of contents">
+            <!-- populated by js -->
+            <mdbook-sidebar-scrollbox class="sidebar-scrollbox"></mdbook-sidebar-scrollbox>
+            <noscript>
+                <iframe class="sidebar-iframe-outer" src="{{ path_to_root }}toc.html"></iframe>
+            </noscript>
+            <div id="mdbook-sidebar-resize-handle" class="sidebar-resize-handle">
+                <div class="sidebar-resize-indicator"></div>
             </div>
-            <div id="sidebar-resize-handle" class="sidebar-resize-handle"></div>
         </nav>
 
-        <div id="page-wrapper" class="page-wrapper">
+        <div id="mdbook-page-wrapper" class="page-wrapper">
 
             <div class="page">
                 {{> header}}
-                <div id="menu-bar-hover-placeholder"></div>
-                <div id="menu-bar" class="menu-bar sticky bordered">
+                <div id="mdbook-menu-bar-hover-placeholder"></div>
+                <div id="mdbook-menu-bar" class="menu-bar sticky">
                     <div class="left-buttons">
-                        <button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
-                            <i class="fa fa-bars"></i>
+                        <label id="mdbook-sidebar-toggle" class="icon-button" for="mdbook-sidebar-toggle-anchor" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="mdbook-sidebar">
+                            {{fa "solid" "bars"}}
+                        </label>
+                        <button id="mdbook-theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="mdbook-theme-list">
+                            {{fa "solid" "paintbrush"}}
                         </button>
-                        <button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
-                            <i class="fa fa-paint-brush"></i>
-                        </button>
-                        <ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
-                            <li role="none"><button role="menuitem" class="theme" id="light">{{ theme_option "Light" }}</button></li>
-                            <li role="none"><button role="menuitem" class="theme" id="rust">{{ theme_option "Rust" }}</button></li>
-                            <li role="none"><button role="menuitem" class="theme" id="coal">{{ theme_option "Coal" }}</button></li>
-                            <li role="none"><button role="menuitem" class="theme" id="navy">{{ theme_option "Navy" }}</button></li>
-                            <li role="none"><button role="menuitem" class="theme" id="ayu">{{ theme_option "Ayu" }}</button></li>
+                        <ul id="mdbook-theme-list" class="theme-popup" aria-label="Themes" role="menu">
+                            <li role="none"><button role="menuitem" class="theme" id="mdbook-theme-default_theme">Auto</button></li>
+                            <li role="none"><button role="menuitem" class="theme" id="mdbook-theme-light">Light</button></li>
+                            <li role="none"><button role="menuitem" class="theme" id="mdbook-theme-rust">Rust</button></li>
+                            <li role="none"><button role="menuitem" class="theme" id="mdbook-theme-coal">Coal</button></li>
+                            <li role="none"><button role="menuitem" class="theme" id="mdbook-theme-navy">Navy</button></li>
+                            <li role="none"><button role="menuitem" class="theme" id="mdbook-theme-ayu">Ayu</button></li>
                         </ul>
                         {{#if search_enabled}}
-                        <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
-                            <i class="fa fa-search"></i>
+                        <button id="mdbook-search-toggle" class="icon-button" type="button" title="Search (`/`)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="/ s" aria-controls="mdbook-searchbar">
+                            {{fa "solid" "magnifying-glass"}}
                         </button>
                         {{/if}}
-                        <div class="version-picker">
-                            <div class="dropdown">
-                                <div class="select">
-                                    <span></span>
-                                    <i class="fa fa-chevron-down"></i>
-                                </div>
-                                <input type="hidden" name="version">
-                                <ul class="dropdown-menu">
-                                    <!-- Versions will be added dynamically in version-picker.js -->
-                                </ul>
+                    </div>
+
+                    <!-- BEGIN CUSTOM SYNAPSE MODIFICATIONS -->
+                    <div class="version-picker">
+                        <div class="dropdown">
+                            <div class="select">
+                                <span></span>
+                                <i class="fa fa-chevron-down"></i>
                             </div>
+                            <input type="hidden" name="version">
+                            <ul class="dropdown-menu">
+                                <!-- Versions will be added dynamically in version-picker.js -->
+                            </ul>
                         </div>
                     </div>
+                    <!-- END CUSTOM SYNAPSE MODIFICATIONS -->
 
                     <h1 class="menu-title">{{ book_title }}</h1>
 
                     <div class="right-buttons">
                         {{#if print_enable}}
                         <a href="{{ path_to_root }}print.html" title="Print this book" aria-label="Print this book">
-                            <i id="print-button" class="fa fa-print"></i>
+                            {{fa "solid" "print" "print-button"}}
                         </a>
                         {{/if}}
                         {{#if git_repository_url}}
                         <a href="{{git_repository_url}}" title="Git repository" aria-label="Git repository">
-                            <i id="git-repository-button" class="fa {{git_repository_icon}}"></i>
+                            {{fa git_repository_icon_class git_repository_icon}}
                         </a>
                         {{/if}}
                         {{#if git_repository_edit_url}}
-                        <a href="{{git_repository_edit_url}}" title="Suggest an edit" aria-label="Suggest an edit">
-                            <i id="git-edit-button" class="fa fa-edit"></i>
+                        <a href="{{git_repository_edit_url}}" title="Suggest an edit" aria-label="Suggest an edit" rel="edit">
+                            {{fa "solid" "pencil" "git-edit-button"}}
                         </a>
                         {{/if}}
 
@@ -168,50 +202,58 @@
                 </div>
 
                 {{#if search_enabled}}
-                <div id="search-wrapper" class="hidden">
-                    <form id="searchbar-outer" class="searchbar-outer">
-                        <input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
+                <div id="mdbook-search-wrapper" class="hidden">
+                    <form id="mdbook-searchbar-outer" class="searchbar-outer">
+                        <div class="search-wrapper">
+                            <input type="search" id="mdbook-searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="mdbook-searchresults-outer" aria-describedby="searchresults-header">
+                            <div class="spinner-wrapper">
+                                {{fa "solid" "spinner" "fa-spin"}}
+                            </div>
+                        </div>
                     </form>
-                    <div id="searchresults-outer" class="searchresults-outer hidden">
-                        <div id="searchresults-header" class="searchresults-header"></div>
-                        <ul id="searchresults">
+                    <div id="mdbook-searchresults-outer" class="searchresults-outer hidden">
+                        <div id="mdbook-searchresults-header" class="searchresults-header"></div>
+                        <ul id="mdbook-searchresults">
                         </ul>
                     </div>
                 </div>
                 {{/if}}
 
                 <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
-                <script type="text/javascript">
-                    document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
-                    document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
-                    Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
+                <script>
+                    document.getElementById('mdbook-sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
+                    document.getElementById('mdbook-sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
+                    Array.from(document.querySelectorAll('#mdbook-sidebar a')).forEach(function(link) {
                         link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
                     });
                 </script>
 
-                <div id="content" class="content">
+                <div id="mdbook-content" class="content">
                     <main>
-                        <!-- Page table of contents -->
-                        <div class="sidetoc">
-                            <nav class="pagetoc"></nav>
-                        </div>
-
                         {{{ content }}}
                     </main>
 
                     <nav class="nav-wrapper" aria-label="Page navigation">
                         <!-- Mobile navigation buttons -->
-                        {{#previous}}
-                            <a rel="prev" href="{{ path_to_root }}{{link}}" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
-                                <i class="fa fa-angle-left"></i>
+                        {{#if previous}}
+                            <a rel="prev" href="{{ path_to_root }}{{previous.link}}" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
+                                {{#if (eq ../text_direction "rtl")}}
+                                {{fa "solid" "angle-right"}}
+                                {{else}}
+                                {{fa "solid" "angle-left"}}
+                                {{/if}}
                             </a>
-                        {{/previous}}
+                        {{/if}}
 
-                        {{#next}}
-                            <a rel="next" href="{{ path_to_root }}{{link}}" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
-                                <i class="fa fa-angle-right"></i>
+                        {{#if next}}
+                            <a rel="next prefetch" href="{{ path_to_root }}{{next.link}}" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
+                                {{#if (eq ../text_direction "rtl")}}
+                                {{fa "solid" "angle-left"}}
+                                {{else}}
+                                {{fa "solid" "angle-right"}}
+                                {{/if}}
                             </a>
-                        {{/next}}
+                        {{/if}}
 
                         <div style="clear: both"></div>
                     </nav>
@@ -219,92 +261,92 @@
             </div>
 
             <nav class="nav-wide-wrapper" aria-label="Page navigation">
-                {{#previous}}
-                    <a rel="prev" href="{{ path_to_root }}{{link}}" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
-                        <i class="fa fa-angle-left"></i>
+                {{#if previous}}
+                    <a rel="prev" href="{{ path_to_root }}{{previous.link}}" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
+                        {{#if (eq ../text_direction "rtl")}}
+                        {{fa "solid" "angle-right"}}
+                        {{else}}
+                        {{fa "solid" "angle-left"}}
+                        {{/if}}
                     </a>
-                {{/previous}}
+                {{/if}}
 
-                {{#next}}
-                    <a rel="next" href="{{ path_to_root }}{{link}}" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
-                        <i class="fa fa-angle-right"></i>
+                {{#if next}}
+                    <a rel="next prefetch" href="{{ path_to_root }}{{next.link}}" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
+                        {{#if (eq text_direction "rtl")}}
+                        {{fa "solid" "angle-left"}}
+                        {{else}}
+                        {{fa "solid" "angle-right"}}
+                        {{/if}}
                     </a>
-                {{/next}}
+                {{/if}}
             </nav>
 
         </div>
 
-        {{#if livereload}}
+        <template id=fa-eye>{{fa "solid" "eye"}}</template>
+        <template id=fa-eye-slash>{{fa "solid" "eye-slash"}}</template>
+        <template id=fa-copy>{{fa "regular" "copy"}}</template>
+        <template id=fa-play>{{fa "solid" "play"}}</template>
+        <template id=fa-clock-rotate-left>{{fa "solid" "clock-rotate-left"}}</template>
+
+        {{#if live_reload_endpoint}}
         <!-- Livereload script (if served using the cli tool) -->
-        <script type="text/javascript">
-            var socket = new WebSocket("{{{livereload}}}");
+        <script>
+            const wsProtocol = location.protocol === 'https:' ? 'wss:' : 'ws:';
+            const wsAddress = wsProtocol + "//" + location.host + "/" + "{{{live_reload_endpoint}}}";
+            const socket = new WebSocket(wsAddress);
             socket.onmessage = function (event) {
                 if (event.data === "reload") {
                     socket.close();
                     location.reload();
                 }
             };
+
             window.onbeforeunload = function() {
                 socket.close();
             }
         </script>
         {{/if}}
 
-        {{#if google_analytics}}
-        <!-- Google Analytics Tag -->
-        <script type="text/javascript">
-            var localAddrs = ["localhost", "127.0.0.1", ""];
-            // make sure we don't activate google analytics if the developer is
-            // inspecting the book locally...
-            if (localAddrs.indexOf(document.location.hostname) === -1) {
-                (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
-                (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
-                m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
-                })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
-                ga('create', '{{google_analytics}}', 'auto');
-                ga('send', 'pageview');
-            }
-        </script>
-        {{/if}}
-
         {{#if playground_line_numbers}}
-        <script type="text/javascript">
+        <script>
             window.playground_line_numbers = true;
         </script>
         {{/if}}
 
         {{#if playground_copyable}}
-        <script type="text/javascript">
+        <script>
             window.playground_copyable = true;
         </script>
         {{/if}}
 
         {{#if playground_js}}
-        <script src="{{ path_to_root }}ace.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}editor.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}mode-rust.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}theme-dawn.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}theme-tomorrow_night.js" type="text/javascript" charset="utf-8"></script>
+        <script src="{{ resource "ace.js" }}"></script>
+        <script src="{{ resource "mode-rust.js" }}"></script>
+        <script src="{{ resource "editor.js" }}"></script>
+        <script src="{{ resource "theme-dawn.js" }}"></script>
+        <script src="{{ resource "theme-tomorrow_night.js" }}"></script>
         {{/if}}
 
         {{#if search_js}}
-        <script src="{{ path_to_root }}elasticlunr.min.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}mark.min.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}searcher.js" type="text/javascript" charset="utf-8"></script>
+        <script src="{{ resource "elasticlunr.min.js" }}"></script>
+        <script src="{{ resource "mark.min.js" }}"></script>
+        <script src="{{ resource "searcher.js" }}"></script>
         {{/if}}
 
-        <script src="{{ path_to_root }}clipboard.min.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}highlight.js" type="text/javascript" charset="utf-8"></script>
-        <script src="{{ path_to_root }}book.js" type="text/javascript" charset="utf-8"></script>
+        <script src="{{ resource "clipboard.min.js" }}"></script>
+        <script src="{{ resource "highlight.js" }}"></script>
+        <script src="{{ resource "book.js" }}"></script>
 
         <!-- Custom JS scripts -->
         {{#each additional_js}}
-        <script type="text/javascript" src="{{ ../path_to_root }}{{this}}"></script>
+        <script src="{{ resource this}}"></script>
         {{/each}}
 
         {{#if is_print}}
         {{#if mathjax_support}}
-        <script type="text/javascript">
+        <script>
         window.addEventListener('load', function() {
             MathJax.Hub.Register.StartupHook('End', function() {
                 window.setTimeout(window.print, 100);
@@ -312,7 +354,7 @@
         });
         </script>
         {{else}}
-        <script type="text/javascript">
+        <script>
         window.addEventListener('load', function() {
             window.setTimeout(window.print, 100);
         });
@@ -320,5 +362,21 @@
         {{/if}}
         {{/if}}
 
+        {{#if fragment_map}}
+        <script>
+            document.addEventListener('DOMContentLoaded', function() {
+                const fragmentMap =
+                    {{{fragment_map}}}
+                ;
+                const target = fragmentMap[window.location.hash];
+                if (target) {
+                    let url = new URL(target, window.location.href);
+                    window.location.replace(url.href);
+                }
+            });
+        </script>
+        {{/if}}
+
+    </div>
     </body>
 </html>
diff --git a/docs/workers.md b/docs/workers.md
index 18bb0b76f6..c2aef33e16 100644
--- a/docs/workers.md
+++ b/docs/workers.md
@@ -120,6 +120,9 @@ worker_replication_secret: ""
 
 redis:
     enabled: true
+    # For additional Redis configuration options (TLS, authentication, etc.), 
+    # see the Synapse configuration documentation:
+    # https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#redis
 
 instance_map:
     main:
@@ -252,6 +255,8 @@ information.
     ^/_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$
     ^/_matrix/client/(r0|v3|unstable)/capabilities$
     ^/_matrix/client/(r0|v3|unstable)/notifications$
+
+    # Admin API requests
     ^/_synapse/admin/v1/rooms/[^/]+$
 
     # Encryption requests
@@ -282,10 +287,13 @@ information.
     # User directory search requests
     ^/_matrix/client/(r0|v3|unstable)/user_directory/search$
 
+    # Unstable MSC4140 support
+    ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events(/.*/restart)?$
+
 Additionally, the following REST endpoints can be handled for GET requests:
 
+    # Push rules requests
     ^/_matrix/client/(api/v1|r0|v3|unstable)/pushrules/
-    ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events
 
     # Account data requests
     ^/_matrix/client/(r0|v3|unstable)/.*/tags
@@ -294,6 +302,9 @@ Additionally, the following REST endpoints can be handled for GET requests:
     # Presence requests
     ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/
 
+    # Admin API requests
+    ^/_synapse/admin/v2/users/[^/]+$
+
 Pagination requests can also be handled, but all requests for a given
 room must be routed to the same instance. Additionally, care must be taken to
 ensure that the purge history admin API is not used while pagination requests
diff --git a/mypy.ini b/mypy.ini
index ae903f858a..ec73ce9f6e 100644
--- a/mypy.ini
+++ b/mypy.ini
@@ -37,7 +37,7 @@ strict_equality = True
 
 # Run mypy type checking with the minimum supported Python version to catch new usage
 # that isn't backwards-compatible (types, overloads, etc).
-python_version = 3.9
+python_version = 3.10
 
 files =
   docker/,
@@ -69,7 +69,7 @@ warn_unused_ignores = False
 ;;     https://github.com/python/typeshed/tree/master/stubs
 ;; and for each package `foo` there's a corresponding `types-foo` package on PyPI,
 ;; which we can pull in as a dev dependency by adding to `pyproject.toml`'s
-;; `[tool.poetry.dev-dependencies]` list.
+;; `[dependency-groups]` `dev` list.
 
 # https://github.com/lepture/authlib/issues/460
 [mypy-authlib.*]
diff --git a/poetry.lock b/poetry.lock
index 866d52bc1e..d9a223dab2 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.1.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
 
 [[package]]
 name = "annotated-types"
@@ -6,7 +6,7 @@ version = "0.7.0"
 description = "Reusable constraint types to use with typing.Annotated"
 optional = false
 python-versions = ">=3.8"
-groups = ["main", "dev"]
+groups = ["main"]
 files = [
     {file = "annotated_types-0.7.0-py3-none-any.whl", hash = "sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53"},
     {file = "annotated_types-0.7.0.tar.gz", hash = "sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89"},
@@ -14,35 +14,27 @@ files = [
 
 [[package]]
 name = "attrs"
-version = "25.3.0"
+version = "25.4.0"
 description = "Classes Without Boilerplate"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["main", "dev"]
 files = [
-    {file = "attrs-25.3.0-py3-none-any.whl", hash = "sha256:427318ce031701fea540783410126f03899a97ffc6f61596ad581ac2e40e3bc3"},
-    {file = "attrs-25.3.0.tar.gz", hash = "sha256:75d7cefc7fb576747b2c81b4442d4d4a1ce0900973527c011d1030fd3bf4af1b"},
+    {file = "attrs-25.4.0-py3-none-any.whl", hash = "sha256:adcf7e2a1fb3b36ac48d97835bb6d8ade15b8dcce26aba8bf1d14847b57a3373"},
+    {file = "attrs-25.4.0.tar.gz", hash = "sha256:16d5969b87f0859ef33a48b35d55ac1be6e42ae49d5e853b597db70c35c57e11"},
 ]
 
-[package.extras]
-benchmark = ["cloudpickle ; platform_python_implementation == \"CPython\"", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pympler", "pytest (>=4.3.0)", "pytest-codspeed", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-cov = ["cloudpickle ; platform_python_implementation == \"CPython\"", "coverage[toml] (>=5.3)", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-dev = ["cloudpickle ; platform_python_implementation == \"CPython\"", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pre-commit-uv", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-docs = ["cogapp", "furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier"]
-tests = ["cloudpickle ; platform_python_implementation == \"CPython\"", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-tests-mypy = ["mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\""]
-
 [[package]]
 name = "authlib"
-version = "1.6.1"
+version = "1.6.9"
 description = "The ultimate Python library in building OAuth and OpenID Connect servers and clients."
 optional = true
 python-versions = ">=3.9"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"jwt\" or extra == \"oidc\""
 files = [
-    {file = "authlib-1.6.1-py2.py3-none-any.whl", hash = "sha256:e9d2031c34c6309373ab845afc24168fe9e93dc52d252631f52642f21f5ed06e"},
-    {file = "authlib-1.6.1.tar.gz", hash = "sha256:4dffdbb1460ba6ec8c17981a4c67af7d8af131231b5a36a88a1e8c80c111cdfd"},
+    {file = "authlib-1.6.9-py2.py3-none-any.whl", hash = "sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3"},
+    {file = "authlib-1.6.9.tar.gz", hash = "sha256:d8f2421e7e5980cc1ddb4e32d3f5fa659cfaf60d8eaf3281ebed192e4ab74f04"},
 ]
 
 [package.dependencies]
@@ -60,71 +52,97 @@ files = [
     {file = "automat-25.4.16.tar.gz", hash = "sha256:0017591a5477066e90d26b0e696ddc143baafd87b588cfac8100bc6be9634de0"},
 ]
 
-[package.dependencies]
-typing_extensions = {version = "*", markers = "python_version < \"3.10\""}
-
 [package.extras]
 visualize = ["Twisted (>=16.1.1)", "graphviz (>0.5.1)"]
 
+[[package]]
+name = "backports-tarfile"
+version = "1.2.0"
+description = "Backport of CPython tarfile module"
+optional = false
+python-versions = ">=3.8"
+groups = ["dev"]
+markers = "python_version < \"3.12\" and platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
+files = [
+    {file = "backports.tarfile-1.2.0-py3-none-any.whl", hash = "sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34"},
+    {file = "backports_tarfile-1.2.0.tar.gz", hash = "sha256:d75e02c268746e1b8144c278978b6e98e85de6ad16f8e4b0844a154557eca991"},
+]
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9.3)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["jaraco.test", "pytest (!=8.0.*)", "pytest (>=6,!=8.1.*)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)"]
+
 [[package]]
 name = "bcrypt"
-version = "4.3.0"
+version = "5.0.0"
 description = "Modern password hashing for your software and your servers"
 optional = false
 python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "bcrypt-4.3.0-cp313-cp313t-macosx_10_12_universal2.whl", hash = "sha256:f01e060f14b6b57bbb72fc5b4a83ac21c443c9a2ee708e04a10e9192f90a6281"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c5eeac541cefd0bb887a371ef73c62c3cd78535e4887b310626036a7c0a817bb"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:59e1aa0e2cd871b08ca146ed08445038f42ff75968c7ae50d2fdd7860ade2180"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:0042b2e342e9ae3d2ed22727c1262f76cc4f345683b5c1715f0250cf4277294f"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:74a8d21a09f5e025a9a23e7c0fd2c7fe8e7503e4d356c0a2c1486ba010619f09"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:0142b2cb84a009f8452c8c5a33ace5e3dfec4159e7735f5afe9a4d50a8ea722d"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-manylinux_2_34_aarch64.whl", hash = "sha256:12fa6ce40cde3f0b899729dbd7d5e8811cb892d31b6f7d0334a1f37748b789fd"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-manylinux_2_34_x86_64.whl", hash = "sha256:5bd3cca1f2aa5dbcf39e2aa13dd094ea181f48959e1071265de49cc2b82525af"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-musllinux_1_1_aarch64.whl", hash = "sha256:335a420cfd63fc5bc27308e929bee231c15c85cc4c496610ffb17923abf7f231"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-musllinux_1_1_x86_64.whl", hash = "sha256:0e30e5e67aed0187a1764911af023043b4542e70a7461ad20e837e94d23e1d6c"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:3b8d62290ebefd49ee0b3ce7500f5dbdcf13b81402c05f6dafab9a1e1b27212f"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:2ef6630e0ec01376f59a006dc72918b1bf436c3b571b80fa1968d775fa02fe7d"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-win32.whl", hash = "sha256:7a4be4cbf241afee43f1c3969b9103a41b40bcb3a3f467ab19f891d9bc4642e4"},
-    {file = "bcrypt-4.3.0-cp313-cp313t-win_amd64.whl", hash = "sha256:5c1949bf259a388863ced887c7861da1df681cb2388645766c89fdfd9004c669"},
-    {file = "bcrypt-4.3.0-cp38-abi3-macosx_10_12_universal2.whl", hash = "sha256:f81b0ed2639568bf14749112298f9e4e2b28853dab50a8b357e31798686a036d"},
-    {file = "bcrypt-4.3.0-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:864f8f19adbe13b7de11ba15d85d4a428c7e2f344bac110f667676a0ff84924b"},
-    {file = "bcrypt-4.3.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3e36506d001e93bffe59754397572f21bb5dc7c83f54454c990c74a468cd589e"},
-    {file = "bcrypt-4.3.0-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:842d08d75d9fe9fb94b18b071090220697f9f184d4547179b60734846461ed59"},
-    {file = "bcrypt-4.3.0-cp38-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:7c03296b85cb87db865d91da79bf63d5609284fc0cab9472fdd8367bbd830753"},
-    {file = "bcrypt-4.3.0-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:62f26585e8b219cdc909b6a0069efc5e4267e25d4a3770a364ac58024f62a761"},
-    {file = "bcrypt-4.3.0-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:beeefe437218a65322fbd0069eb437e7c98137e08f22c4660ac2dc795c31f8bb"},
-    {file = "bcrypt-4.3.0-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:97eea7408db3a5bcce4a55d13245ab3fa566e23b4c67cd227062bb49e26c585d"},
-    {file = "bcrypt-4.3.0-cp38-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:191354ebfe305e84f344c5964c7cd5f924a3bfc5d405c75ad07f232b6dffb49f"},
-    {file = "bcrypt-4.3.0-cp38-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:41261d64150858eeb5ff43c753c4b216991e0ae16614a308a15d909503617732"},
-    {file = "bcrypt-4.3.0-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:33752b1ba962ee793fa2b6321404bf20011fe45b9afd2a842139de3011898fef"},
-    {file = "bcrypt-4.3.0-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:50e6e80a4bfd23a25f5c05b90167c19030cf9f87930f7cb2eacb99f45d1c3304"},
-    {file = "bcrypt-4.3.0-cp38-abi3-win32.whl", hash = "sha256:67a561c4d9fb9465ec866177e7aebcad08fe23aaf6fbd692a6fab69088abfc51"},
-    {file = "bcrypt-4.3.0-cp38-abi3-win_amd64.whl", hash = "sha256:584027857bc2843772114717a7490a37f68da563b3620f78a849bcb54dc11e62"},
-    {file = "bcrypt-4.3.0-cp39-abi3-macosx_10_12_universal2.whl", hash = "sha256:0d3efb1157edebfd9128e4e46e2ac1a64e0c1fe46fb023158a407c7892b0f8c3"},
-    {file = "bcrypt-4.3.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:08bacc884fd302b611226c01014eca277d48f0a05187666bca23aac0dad6fe24"},
-    {file = "bcrypt-4.3.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f6746e6fec103fcd509b96bacdfdaa2fbde9a553245dbada284435173a6f1aef"},
-    {file = "bcrypt-4.3.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:afe327968aaf13fc143a56a3360cb27d4ad0345e34da12c7290f1b00b8fe9a8b"},
-    {file = "bcrypt-4.3.0-cp39-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d9af79d322e735b1fc33404b5765108ae0ff232d4b54666d46730f8ac1a43676"},
-    {file = "bcrypt-4.3.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:f1e3ffa1365e8702dc48c8b360fef8d7afeca482809c5e45e653af82ccd088c1"},
-    {file = "bcrypt-4.3.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:3004df1b323d10021fda07a813fd33e0fd57bef0e9a480bb143877f6cba996fe"},
-    {file = "bcrypt-4.3.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:531457e5c839d8caea9b589a1bcfe3756b0547d7814e9ce3d437f17da75c32b0"},
-    {file = "bcrypt-4.3.0-cp39-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:17a854d9a7a476a89dcef6c8bd119ad23e0f82557afbd2c442777a16408e614f"},
-    {file = "bcrypt-4.3.0-cp39-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:6fb1fd3ab08c0cbc6826a2e0447610c6f09e983a281b919ed721ad32236b8b23"},
-    {file = "bcrypt-4.3.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:e965a9c1e9a393b8005031ff52583cedc15b7884fce7deb8b0346388837d6cfe"},
-    {file = "bcrypt-4.3.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:79e70b8342a33b52b55d93b3a59223a844962bef479f6a0ea318ebbcadf71505"},
-    {file = "bcrypt-4.3.0-cp39-abi3-win32.whl", hash = "sha256:b4d4e57f0a63fd0b358eb765063ff661328f69a04494427265950c71b992a39a"},
-    {file = "bcrypt-4.3.0-cp39-abi3-win_amd64.whl", hash = "sha256:e53e074b120f2877a35cc6c736b8eb161377caae8925c17688bd46ba56daaa5b"},
-    {file = "bcrypt-4.3.0-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c950d682f0952bafcceaf709761da0a32a942272fad381081b51096ffa46cea1"},
-    {file = "bcrypt-4.3.0-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:107d53b5c67e0bbc3f03ebf5b030e0403d24dda980f8e244795335ba7b4a027d"},
-    {file = "bcrypt-4.3.0-pp310-pypy310_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:b693dbb82b3c27a1604a3dff5bfc5418a7e6a781bb795288141e5f80cf3a3492"},
-    {file = "bcrypt-4.3.0-pp310-pypy310_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:b6354d3760fcd31994a14c89659dee887f1351a06e5dac3c1142307172a79f90"},
-    {file = "bcrypt-4.3.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:a839320bf27d474e52ef8cb16449bb2ce0ba03ca9f44daba6d93fa1d8828e48a"},
-    {file = "bcrypt-4.3.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:bdc6a24e754a555d7316fa4774e64c6c3997d27ed2d1964d55920c7c227bc4ce"},
-    {file = "bcrypt-4.3.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:55a935b8e9a1d2def0626c4269db3fcd26728cbff1e84f0341465c31c4ee56d8"},
-    {file = "bcrypt-4.3.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:57967b7a28d855313a963aaea51bf6df89f833db4320da458e5b3c5ab6d4c938"},
-    {file = "bcrypt-4.3.0.tar.gz", hash = "sha256:3a3fd2204178b6d2adcf09cb4f6426ffef54762577a7c9b54c159008cb288c18"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-macosx_10_12_universal2.whl", hash = "sha256:f3c08197f3039bec79cee59a606d62b96b16669cff3949f21e74796b6e3cd2be"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:200af71bc25f22006f4069060c88ed36f8aa4ff7f53e67ff04d2ab3f1e79a5b2"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:baade0a5657654c2984468efb7d6c110db87ea63ef5a4b54732e7e337253e44f"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:c58b56cdfb03202b3bcc9fd8daee8e8e9b6d7e3163aa97c631dfcfcc24d36c86"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4bfd2a34de661f34d0bda43c3e4e79df586e4716ef401fe31ea39d69d581ef23"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:ed2e1365e31fc73f1825fa830f1c8f8917ca1b3ca6185773b349c20fd606cec2"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-manylinux_2_34_aarch64.whl", hash = "sha256:83e787d7a84dbbfba6f250dd7a5efd689e935f03dd83b0f919d39349e1f23f83"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-manylinux_2_34_x86_64.whl", hash = "sha256:137c5156524328a24b9fac1cb5db0ba618bc97d11970b39184c1d87dc4bf1746"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-musllinux_1_1_aarch64.whl", hash = "sha256:38cac74101777a6a7d3b3e3cfefa57089b5ada650dce2baf0cbdd9d65db22a9e"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-musllinux_1_1_x86_64.whl", hash = "sha256:d8d65b564ec849643d9f7ea05c6d9f0cd7ca23bdd4ac0c2dbef1104ab504543d"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:741449132f64b3524e95cd30e5cd3343006ce146088f074f31ab26b94e6c75ba"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:212139484ab3207b1f0c00633d3be92fef3c5f0af17cad155679d03ff2ee1e41"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-win32.whl", hash = "sha256:9d52ed507c2488eddd6a95bccee4e808d3234fa78dd370e24bac65a21212b861"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-win_amd64.whl", hash = "sha256:f6984a24db30548fd39a44360532898c33528b74aedf81c26cf29c51ee47057e"},
+    {file = "bcrypt-5.0.0-cp313-cp313t-win_arm64.whl", hash = "sha256:9fffdb387abe6aa775af36ef16f55e318dcda4194ddbf82007a6f21da29de8f5"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-macosx_10_12_universal2.whl", hash = "sha256:4870a52610537037adb382444fefd3706d96d663ac44cbb2f37e3919dca3d7ef"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48f753100931605686f74e27a7b49238122aa761a9aefe9373265b8b7aa43ea4"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f70aadb7a809305226daedf75d90379c397b094755a710d7014b8b117df1ebbf"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:744d3c6b164caa658adcb72cb8cc9ad9b4b75c7db507ab4bc2480474a51989da"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a28bc05039bdf3289d757f49d616ab3efe8cf40d8e8001ccdd621cd4f98f4fc9"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:7f277a4b3390ab4bebe597800a90da0edae882c6196d3038a73adf446c4f969f"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:79cfa161eda8d2ddf29acad370356b47f02387153b11d46042e93a0a95127493"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:a5393eae5722bcef046a990b84dff02b954904c36a194f6cfc817d7dca6c6f0b"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7f4c94dec1b5ab5d522750cb059bb9409ea8872d4494fd152b53cca99f1ddd8c"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:0cae4cb350934dfd74c020525eeae0a5f79257e8a201c0c176f4b84fdbf2a4b4"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-win32.whl", hash = "sha256:b17366316c654e1ad0306a6858e189fc835eca39f7eb2cafd6aaca8ce0c40a2e"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:92864f54fb48b4c718fc92a32825d0e42265a627f956bc0361fe869f1adc3e7d"},
+    {file = "bcrypt-5.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:dd19cf5184a90c873009244586396a6a884d591a5323f0e8a5922560718d4993"},
+    {file = "bcrypt-5.0.0-cp38-abi3-macosx_10_12_universal2.whl", hash = "sha256:fc746432b951e92b58317af8e0ca746efe93e66555f1b40888865ef5bf56446b"},
+    {file = "bcrypt-5.0.0-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c2388ca94ffee269b6038d48747f4ce8df0ffbea43f31abfa18ac72f0218effb"},
+    {file = "bcrypt-5.0.0-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:560ddb6ec730386e7b3b26b8b4c88197aaed924430e7b74666a586ac997249ef"},
+    {file = "bcrypt-5.0.0-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:d79e5c65dcc9af213594d6f7f1fa2c98ad3fc10431e7aa53c176b441943efbdd"},
+    {file = "bcrypt-5.0.0-cp38-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2b732e7d388fa22d48920baa267ba5d97cca38070b69c0e2d37087b381c681fd"},
+    {file = "bcrypt-5.0.0-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:0c8e093ea2532601a6f686edbc2c6b2ec24131ff5c52f7610dd64fa4553b5464"},
+    {file = "bcrypt-5.0.0-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5b1589f4839a0899c146e8892efe320c0fa096568abd9b95593efac50a87cb75"},
+    {file = "bcrypt-5.0.0-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:89042e61b5e808b67daf24a434d89bab164d4de1746b37a8d173b6b14f3db9ff"},
+    {file = "bcrypt-5.0.0-cp38-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:e3cf5b2560c7b5a142286f69bde914494b6d8f901aaa71e453078388a50881c4"},
+    {file = "bcrypt-5.0.0-cp38-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:f632fd56fc4e61564f78b46a2269153122db34988e78b6be8b32d28507b7eaeb"},
+    {file = "bcrypt-5.0.0-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:801cad5ccb6b87d1b430f183269b94c24f248dddbbc5c1f78b6ed231743e001c"},
+    {file = "bcrypt-5.0.0-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:3cf67a804fc66fc217e6914a5635000259fbbbb12e78a99488e4d5ba445a71eb"},
+    {file = "bcrypt-5.0.0-cp38-abi3-win32.whl", hash = "sha256:3abeb543874b2c0524ff40c57a4e14e5d3a66ff33fb423529c88f180fd756538"},
+    {file = "bcrypt-5.0.0-cp38-abi3-win_amd64.whl", hash = "sha256:35a77ec55b541e5e583eb3436ffbbf53b0ffa1fa16ca6782279daf95d146dcd9"},
+    {file = "bcrypt-5.0.0-cp38-abi3-win_arm64.whl", hash = "sha256:cde08734f12c6a4e28dc6755cd11d3bdfea608d93d958fffbe95a7026ebe4980"},
+    {file = "bcrypt-5.0.0-cp39-abi3-macosx_10_12_universal2.whl", hash = "sha256:0c418ca99fd47e9c59a301744d63328f17798b5947b0f791e9af3c1c499c2d0a"},
+    {file = "bcrypt-5.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ddb4e1500f6efdd402218ffe34d040a1196c072e07929b9820f363a1fd1f4191"},
+    {file = "bcrypt-5.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7aeef54b60ceddb6f30ee3db090351ecf0d40ec6e2abf41430997407a46d2254"},
+    {file = "bcrypt-5.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:f0ce778135f60799d89c9693b9b398819d15f1921ba15fe719acb3178215a7db"},
+    {file = "bcrypt-5.0.0-cp39-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a71f70ee269671460b37a449f5ff26982a6f2ba493b3eabdd687b4bf35f875ac"},
+    {file = "bcrypt-5.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:f8429e1c410b4073944f03bd778a9e066e7fad723564a52ff91841d278dfc822"},
+    {file = "bcrypt-5.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:edfcdcedd0d0f05850c52ba3127b1fce70b9f89e0fe5ff16517df7e81fa3cbb8"},
+    {file = "bcrypt-5.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:611f0a17aa4a25a69362dcc299fda5c8a3d4f160e2abb3831041feb77393a14a"},
+    {file = "bcrypt-5.0.0-cp39-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:db99dca3b1fdc3db87d7c57eac0c82281242d1eabf19dcb8a6b10eb29a2e72d1"},
+    {file = "bcrypt-5.0.0-cp39-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:5feebf85a9cefda32966d8171f5db7e3ba964b77fdfe31919622256f80f9cf42"},
+    {file = "bcrypt-5.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:3ca8a166b1140436e058298a34d88032ab62f15aae1c598580333dc21d27ef10"},
+    {file = "bcrypt-5.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:61afc381250c3182d9078551e3ac3a41da14154fbff647ddf52a769f588c4172"},
+    {file = "bcrypt-5.0.0-cp39-abi3-win32.whl", hash = "sha256:64d7ce196203e468c457c37ec22390f1a61c85c6f0b8160fd752940ccfb3a683"},
+    {file = "bcrypt-5.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:64ee8434b0da054d830fa8e89e1c8bf30061d539044a39524ff7dec90481e5c2"},
+    {file = "bcrypt-5.0.0-cp39-abi3-win_arm64.whl", hash = "sha256:f2347d3534e76bf50bca5500989d6c1d05ed64b440408057a37673282c654927"},
+    {file = "bcrypt-5.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:7edda91d5ab52b15636d9c30da87d2cc84f426c72b9dba7a9b4fe142ba11f534"},
+    {file = "bcrypt-5.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:046ad6db88edb3c5ece4369af997938fb1c19d6a699b9c1b27b0db432faae4c4"},
+    {file = "bcrypt-5.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:dcd58e2b3a908b5ecc9b9df2f0085592506ac2d5110786018ee5e160f28e0911"},
+    {file = "bcrypt-5.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:6b8f520b61e8781efee73cba14e3e8c9556ccfb375623f4f97429544734545b4"},
+    {file = "bcrypt-5.0.0.tar.gz", hash = "sha256:f748f7c2d6fd375cc93d3fba7ef4a9e3a092421b8dbf34d8d4dc06be9492dfdd"},
 ]
 
 [package.extras]
@@ -133,14 +151,14 @@ typecheck = ["mypy"]
 
 [[package]]
 name = "bleach"
-version = "6.2.0"
+version = "6.3.0"
 description = "An easy safelist-based HTML-sanitizing tool."
 optional = false
-python-versions = ">=3.9"
-groups = ["main", "dev"]
+python-versions = ">=3.10"
+groups = ["main"]
 files = [
-    {file = "bleach-6.2.0-py3-none-any.whl", hash = "sha256:117d9c6097a7c3d22fd578fcd8d35ff1e125df6736f554da4e432fdd63f31e5e"},
-    {file = "bleach-6.2.0.tar.gz", hash = "sha256:123e894118b8a599fd80d3ec1a6d4cc7ce4e5882b1317a7e1ba69b56e95f991f"},
+    {file = "bleach-6.3.0-py3-none-any.whl", hash = "sha256:fe10ec77c93ddf3d13a73b035abaac7a9f5e436513864ccdad516693213c65d6"},
+    {file = "bleach-6.3.0.tar.gz", hash = "sha256:6f3b91b1c0a02bb9a78b5a454c92506aa0fdf197e1d5e114d2e00c6f64306d22"},
 ]
 
 [package.dependencies]
@@ -163,191 +181,246 @@ files = [
 
 [[package]]
 name = "certifi"
-version = "2024.7.4"
+version = "2026.2.25"
 description = "Python package for providing Mozilla's CA Bundle."
 optional = false
-python-versions = ">=3.6"
+python-versions = ">=3.7"
 groups = ["main", "dev"]
 files = [
-    {file = "certifi-2024.7.4-py3-none-any.whl", hash = "sha256:c198e21b1289c2ab85ee4e67bb4b4ef3ead0892059901a8d5b622f24a1101e90"},
-    {file = "certifi-2024.7.4.tar.gz", hash = "sha256:5a1e7645bc0ec61a09e26c36f6106dd4cf40c6db3a1fb6352b0244e7fb057c7b"},
+    {file = "certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa"},
+    {file = "certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7"},
 ]
 
 [[package]]
 name = "cffi"
-version = "1.17.1"
+version = "2.0.0"
 description = "Foreign Function Interface for Python calling C code."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["main", "dev"]
 files = [
-    {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"},
-    {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"},
-    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382"},
-    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702"},
-    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3"},
-    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6"},
-    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17"},
-    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8"},
-    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e"},
-    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be"},
-    {file = "cffi-1.17.1-cp310-cp310-win32.whl", hash = "sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c"},
-    {file = "cffi-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15"},
-    {file = "cffi-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401"},
-    {file = "cffi-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf"},
-    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4"},
-    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41"},
-    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1"},
-    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6"},
-    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d"},
-    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6"},
-    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f"},
-    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b"},
-    {file = "cffi-1.17.1-cp311-cp311-win32.whl", hash = "sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655"},
-    {file = "cffi-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0"},
-    {file = "cffi-1.17.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4"},
-    {file = "cffi-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c"},
-    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36"},
-    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5"},
-    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff"},
-    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99"},
-    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93"},
-    {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3"},
-    {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8"},
-    {file = "cffi-1.17.1-cp312-cp312-win32.whl", hash = "sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65"},
-    {file = "cffi-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903"},
-    {file = "cffi-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e"},
-    {file = "cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2"},
-    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3"},
-    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683"},
-    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5"},
-    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4"},
-    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd"},
-    {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed"},
-    {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9"},
-    {file = "cffi-1.17.1-cp313-cp313-win32.whl", hash = "sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d"},
-    {file = "cffi-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a"},
-    {file = "cffi-1.17.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b"},
-    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964"},
-    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9"},
-    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc"},
-    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c"},
-    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1"},
-    {file = "cffi-1.17.1-cp38-cp38-win32.whl", hash = "sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8"},
-    {file = "cffi-1.17.1-cp38-cp38-win_amd64.whl", hash = "sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1"},
-    {file = "cffi-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16"},
-    {file = "cffi-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36"},
-    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8"},
-    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576"},
-    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87"},
-    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0"},
-    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3"},
-    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595"},
-    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a"},
-    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e"},
-    {file = "cffi-1.17.1-cp39-cp39-win32.whl", hash = "sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7"},
-    {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"},
-    {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"},
+    {file = "cffi-2.0.0-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44"},
+    {file = "cffi-2.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49"},
+    {file = "cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c"},
+    {file = "cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb"},
+    {file = "cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0"},
+    {file = "cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4"},
+    {file = "cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453"},
+    {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495"},
+    {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5"},
+    {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb"},
+    {file = "cffi-2.0.0-cp310-cp310-win32.whl", hash = "sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a"},
+    {file = "cffi-2.0.0-cp310-cp310-win_amd64.whl", hash = "sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739"},
+    {file = "cffi-2.0.0-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe"},
+    {file = "cffi-2.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c"},
+    {file = "cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92"},
+    {file = "cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93"},
+    {file = "cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5"},
+    {file = "cffi-2.0.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664"},
+    {file = "cffi-2.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26"},
+    {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9"},
+    {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414"},
+    {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743"},
+    {file = "cffi-2.0.0-cp311-cp311-win32.whl", hash = "sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5"},
+    {file = "cffi-2.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5"},
+    {file = "cffi-2.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d"},
+    {file = "cffi-2.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d"},
+    {file = "cffi-2.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c"},
+    {file = "cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe"},
+    {file = "cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062"},
+    {file = "cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e"},
+    {file = "cffi-2.0.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037"},
+    {file = "cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba"},
+    {file = "cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94"},
+    {file = "cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187"},
+    {file = "cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18"},
+    {file = "cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5"},
+    {file = "cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6"},
+    {file = "cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb"},
+    {file = "cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca"},
+    {file = "cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b"},
+    {file = "cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b"},
+    {file = "cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2"},
+    {file = "cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3"},
+    {file = "cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26"},
+    {file = "cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c"},
+    {file = "cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b"},
+    {file = "cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27"},
+    {file = "cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75"},
+    {file = "cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91"},
+    {file = "cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5"},
+    {file = "cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13"},
+    {file = "cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b"},
+    {file = "cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c"},
+    {file = "cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef"},
+    {file = "cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775"},
+    {file = "cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205"},
+    {file = "cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1"},
+    {file = "cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f"},
+    {file = "cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25"},
+    {file = "cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad"},
+    {file = "cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9"},
+    {file = "cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d"},
+    {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c"},
+    {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8"},
+    {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc"},
+    {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592"},
+    {file = "cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512"},
+    {file = "cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4"},
+    {file = "cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e"},
+    {file = "cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6"},
+    {file = "cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9"},
+    {file = "cffi-2.0.0-cp39-cp39-macosx_10_13_x86_64.whl", hash = "sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf"},
+    {file = "cffi-2.0.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7"},
+    {file = "cffi-2.0.0-cp39-cp39-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c"},
+    {file = "cffi-2.0.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165"},
+    {file = "cffi-2.0.0-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534"},
+    {file = "cffi-2.0.0-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f"},
+    {file = "cffi-2.0.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63"},
+    {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2"},
+    {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65"},
+    {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322"},
+    {file = "cffi-2.0.0-cp39-cp39-win32.whl", hash = "sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a"},
+    {file = "cffi-2.0.0-cp39-cp39-win_amd64.whl", hash = "sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9"},
+    {file = "cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529"},
 ]
 
 [package.dependencies]
-pycparser = "*"
+pycparser = {version = "*", markers = "implementation_name != \"PyPy\""}
 
 [[package]]
 name = "charset-normalizer"
-version = "3.1.0"
+version = "3.4.4"
 description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet."
 optional = false
-python-versions = ">=3.7.0"
+python-versions = ">=3.7"
 groups = ["main", "dev"]
 files = [
-    {file = "charset-normalizer-3.1.0.tar.gz", hash = "sha256:34e0a2f9c370eb95597aae63bf85eb5e96826d81e3dcf88b8886012906f509b5"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e0ac8959c929593fee38da1c2b64ee9778733cdf03c482c9ff1d508b6b593b2b"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:d7fc3fca01da18fbabe4625d64bb612b533533ed10045a2ac3dd194bfa656b60"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:04eefcee095f58eaabe6dc3cc2262f3bcd776d2c67005880894f447b3f2cb9c1"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:20064ead0717cf9a73a6d1e779b23d149b53daf971169289ed2ed43a71e8d3b0"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1435ae15108b1cb6fffbcea2af3d468683b7afed0169ad718451f8db5d1aff6f"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c84132a54c750fda57729d1e2599bb598f5fa0344085dbde5003ba429a4798c0"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:75f2568b4189dda1c567339b48cba4ac7384accb9c2a7ed655cd86b04055c795"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:11d3bcb7be35e7b1bba2c23beedac81ee893ac9871d0ba79effc7fc01167db6c"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:891cf9b48776b5c61c700b55a598621fdb7b1e301a550365571e9624f270c203"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:5f008525e02908b20e04707a4f704cd286d94718f48bb33edddc7d7b584dddc1"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_ppc64le.whl", hash = "sha256:b06f0d3bf045158d2fb8837c5785fe9ff9b8c93358be64461a1089f5da983137"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_s390x.whl", hash = "sha256:49919f8400b5e49e961f320c735388ee686a62327e773fa5b3ce6721f7e785ce"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:22908891a380d50738e1f978667536f6c6b526a2064156203d418f4856d6e86a"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-win32.whl", hash = "sha256:12d1a39aa6b8c6f6248bb54550efcc1c38ce0d8096a146638fd4738e42284448"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-win_amd64.whl", hash = "sha256:65ed923f84a6844de5fd29726b888e58c62820e0769b76565480e1fdc3d062f8"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9a3267620866c9d17b959a84dd0bd2d45719b817245e49371ead79ed4f710d19"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6734e606355834f13445b6adc38b53c0fd45f1a56a9ba06c2058f86893ae8017"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f8303414c7b03f794347ad062c0516cee0e15f7a612abd0ce1e25caf6ceb47df"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aaf53a6cebad0eae578f062c7d462155eada9c172bd8c4d250b8c1d8eb7f916a"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3dc5b6a8ecfdc5748a7e429782598e4f17ef378e3e272eeb1340ea57c9109f41"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e1b25e3ad6c909f398df8921780d6a3d120d8c09466720226fc621605b6f92b1"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0ca564606d2caafb0abe6d1b5311c2649e8071eb241b2d64e75a0d0065107e62"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b82fab78e0b1329e183a65260581de4375f619167478dddab510c6c6fb04d9b6"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:bd7163182133c0c7701b25e604cf1611c0d87712e56e88e7ee5d72deab3e76b5"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:11d117e6c63e8f495412d37e7dc2e2fff09c34b2d09dbe2bee3c6229577818be"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_ppc64le.whl", hash = "sha256:cf6511efa4801b9b38dc5546d7547d5b5c6ef4b081c60b23e4d941d0eba9cbeb"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_s390x.whl", hash = "sha256:abc1185d79f47c0a7aaf7e2412a0eb2c03b724581139193d2d82b3ad8cbb00ac"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:cb7b2ab0188829593b9de646545175547a70d9a6e2b63bf2cd87a0a391599324"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-win32.whl", hash = "sha256:c36bcbc0d5174a80d6cccf43a0ecaca44e81d25be4b7f90f0ed7bcfbb5a00909"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-win_amd64.whl", hash = "sha256:cca4def576f47a09a943666b8f829606bcb17e2bc2d5911a46c8f8da45f56755"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:0c95f12b74681e9ae127728f7e5409cbbef9cd914d5896ef238cc779b8152373"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:fca62a8301b605b954ad2e9c3666f9d97f63872aa4efcae5492baca2056b74ab"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ac0aa6cd53ab9a31d397f8303f92c42f534693528fafbdb997c82bae6e477ad9"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c3af8e0f07399d3176b179f2e2634c3ce9c1301379a6b8c9c9aeecd481da494f"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3a5fc78f9e3f501a1614a98f7c54d3969f3ad9bba8ba3d9b438c3bc5d047dd28"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:628c985afb2c7d27a4800bfb609e03985aaecb42f955049957814e0491d4006d"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:74db0052d985cf37fa111828d0dd230776ac99c740e1a758ad99094be4f1803d"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_i686.whl", hash = "sha256:1e8fcdd8f672a1c4fc8d0bd3a2b576b152d2a349782d1eb0f6b8e52e9954731d"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_ppc64le.whl", hash = "sha256:04afa6387e2b282cf78ff3dbce20f0cc071c12dc8f685bd40960cc68644cfea6"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_s390x.whl", hash = "sha256:dd5653e67b149503c68c4018bf07e42eeed6b4e956b24c00ccdf93ac79cdff84"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:d2686f91611f9e17f4548dbf050e75b079bbc2a82be565832bc8ea9047b61c8c"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-win32.whl", hash = "sha256:4155b51ae05ed47199dc5b2a4e62abccb274cee6b01da5b895099b61b1982974"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-win_amd64.whl", hash = "sha256:322102cdf1ab682ecc7d9b1c5eed4ec59657a65e1c146a0da342b78f4112db23"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:e633940f28c1e913615fd624fcdd72fdba807bf53ea6925d6a588e84e1151531"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:3a06f32c9634a8705f4ca9946d667609f52cf130d5548881401f1eb2c39b1e2c"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:7381c66e0561c5757ffe616af869b916c8b4e42b367ab29fedc98481d1e74e14"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3573d376454d956553c356df45bb824262c397c6e26ce43e8203c4c540ee0acb"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e89df2958e5159b811af9ff0f92614dabf4ff617c03a4c1c6ff53bf1c399e0e1"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:78cacd03e79d009d95635e7d6ff12c21eb89b894c354bd2b2ed0b4763373693b"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:de5695a6f1d8340b12a5d6d4484290ee74d61e467c39ff03b39e30df62cf83a0"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1c60b9c202d00052183c9be85e5eaf18a4ada0a47d188a83c8f5c5b23252f649"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:f645caaf0008bacf349875a974220f1f1da349c5dbe7c4ec93048cdc785a3326"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:ea9f9c6034ea2d93d9147818f17c2a0860d41b71c38b9ce4d55f21b6f9165a11"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_ppc64le.whl", hash = "sha256:80d1543d58bd3d6c271b66abf454d437a438dff01c3e62fdbcd68f2a11310d4b"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_s390x.whl", hash = "sha256:73dc03a6a7e30b7edc5b01b601e53e7fc924b04e1835e8e407c12c037e81adbd"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:6f5c2e7bc8a4bf7c426599765b1bd33217ec84023033672c1e9a8b35eaeaaaf8"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-win32.whl", hash = "sha256:12a2b561af122e3d94cdb97fe6fb2bb2b82cef0cdca131646fdb940a1eda04f0"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-win_amd64.whl", hash = "sha256:3160a0fd9754aab7d47f95a6b63ab355388d890163eb03b2d2b87ab0a30cfa59"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:38e812a197bf8e71a59fe55b757a84c1f946d0ac114acafaafaf21667a7e169e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:6baf0baf0d5d265fa7944feb9f7451cc316bfe30e8df1a61b1bb08577c554f31"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:8f25e17ab3039b05f762b0a55ae0b3632b2e073d9c8fc88e89aca31a6198e88f"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3747443b6a904001473370d7810aa19c3a180ccd52a7157aacc264a5ac79265e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b116502087ce8a6b7a5f1814568ccbd0e9f6cfd99948aa59b0e241dc57cf739f"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d16fd5252f883eb074ca55cb622bc0bee49b979ae4e8639fff6ca3ff44f9f854"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:21fa558996782fc226b529fdd2ed7866c2c6ec91cee82735c98a197fae39f706"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:6f6c7a8a57e9405cad7485f4c9d3172ae486cfef1344b5ddd8e5239582d7355e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:ac3775e3311661d4adace3697a52ac0bab17edd166087d493b52d4f4f553f9f0"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:10c93628d7497c81686e8e5e557aafa78f230cd9e77dd0c40032ef90c18f2230"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_ppc64le.whl", hash = "sha256:6f4f4668e1831850ebcc2fd0b1cd11721947b6dc7c00bf1c6bd3c929ae14f2c7"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_s390x.whl", hash = "sha256:0be65ccf618c1e7ac9b849c315cc2e8a8751d9cfdaa43027d4f6624bd587ab7e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:53d0a3fa5f8af98a1e261de6a3943ca631c526635eb5817a87a59d9a57ebf48f"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-win32.whl", hash = "sha256:a04f86f41a8916fe45ac5024ec477f41f886b3c435da2d4e3d2709b22ab02af1"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-win_amd64.whl", hash = "sha256:830d2948a5ec37c386d3170c483063798d7879037492540f10a475e3fd6f244b"},
-    {file = "charset_normalizer-3.1.0-py3-none-any.whl", hash = "sha256:3d9098b479e78c85080c98e1e35ff40b4a31d8953102bb0fd7d1b6f8a2111a3d"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e824f1492727fa856dd6eda4f7cee25f8518a12f3c4a56a74e8095695089cf6d"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4bd5d4137d500351a30687c2d3971758aac9a19208fc110ccb9d7188fbe709e8"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:027f6de494925c0ab2a55eab46ae5129951638a49a34d87f4c3eda90f696b4ad"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f820802628d2694cb7e56db99213f930856014862f3fd943d290ea8438d07ca8"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:798d75d81754988d2565bff1b97ba5a44411867c0cf32b77a7e8f8d84796b10d"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d1bb833febdff5c8927f922386db610b49db6e0d4f4ee29601d71e7c2694313"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:9cd98cdc06614a2f768d2b7286d66805f94c48cde050acdbbb7db2600ab3197e"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:077fbb858e903c73f6c9db43374fd213b0b6a778106bc7032446a8e8b5b38b93"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:244bfb999c71b35de57821b8ea746b24e863398194a4014e4c76adc2bbdfeff0"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:64b55f9dce520635f018f907ff1b0df1fdc31f2795a922fb49dd14fbcdf48c84"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:faa3a41b2b66b6e50f84ae4a68c64fcd0c44355741c6374813a800cd6695db9e"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:6515f3182dbe4ea06ced2d9e8666d97b46ef4c75e326b79bb624110f122551db"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:cc00f04ed596e9dc0da42ed17ac5e596c6ccba999ba6bd92b0e0aef2f170f2d6"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-win32.whl", hash = "sha256:f34be2938726fc13801220747472850852fe6b1ea75869a048d6f896838c896f"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-win_amd64.whl", hash = "sha256:a61900df84c667873b292c3de315a786dd8dac506704dea57bc957bd31e22c7d"},
+    {file = "charset_normalizer-3.4.4-cp310-cp310-win_arm64.whl", hash = "sha256:cead0978fc57397645f12578bfd2d5ea9138ea0fac82b2f63f7f7c6877986a69"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:6e1fcf0720908f200cd21aa4e6750a48ff6ce4afe7ff5a79a90d5ed8a08296f8"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f819d5fe9234f9f82d75bdfa9aef3a3d72c4d24a6e57aeaebba32a704553aa0"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a59cb51917aa591b1c4e6a43c132f0cdc3c76dbad6155df4e28ee626cc77a0a3"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8ef3c867360f88ac904fd3f5e1f902f13307af9052646963ee08ff4f131adafc"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d9e45d7faa48ee908174d8fe84854479ef838fc6a705c9315372eacbc2f02897"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:840c25fb618a231545cbab0564a799f101b63b9901f2569faecd6b222ac72381"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ca5862d5b3928c4940729dacc329aa9102900382fea192fc5e52eb69d6093815"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d9c7f57c3d666a53421049053eaacdd14bbd0a528e2186fcb2e672effd053bb0"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:277e970e750505ed74c832b4bf75dac7476262ee2a013f5574dd49075879e161"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:31fd66405eaf47bb62e8cd575dc621c56c668f27d46a61d975a249930dd5e2a4"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:0d3d8f15c07f86e9ff82319b3d9ef6f4bf907608f53fe9d92b28ea9ae3d1fd89"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:9f7fcd74d410a36883701fafa2482a6af2ff5ba96b9a620e9e0721e28ead5569"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ebf3e58c7ec8a8bed6d66a75d7fb37b55e5015b03ceae72a8e7c74495551e224"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-win32.whl", hash = "sha256:eecbc200c7fd5ddb9a7f16c7decb07b566c29fa2161a16cf67b8d068bd21690a"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-win_amd64.whl", hash = "sha256:5ae497466c7901d54b639cf42d5b8c1b6a4fead55215500d2f486d34db48d016"},
+    {file = "charset_normalizer-3.4.4-cp311-cp311-win_arm64.whl", hash = "sha256:65e2befcd84bc6f37095f5961e68a6f077bf44946771354a28ad434c2cce0ae1"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0a98e6759f854bd25a58a73fa88833fba3b7c491169f86ce1180c948ab3fd394"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b5b290ccc2a263e8d185130284f8501e3e36c5e02750fc6b6bdeb2e9e96f1e25"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:74bb723680f9f7a6234dcf67aea57e708ec1fbdf5699fb91dfd6f511b0a320ef"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f1e34719c6ed0b92f418c7c780480b26b5d9c50349e9a9af7d76bf757530350d"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2437418e20515acec67d86e12bf70056a33abdacb5cb1655042f6538d6b085a8"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:11d694519d7f29d6cd09f6ac70028dba10f92f6cdd059096db198c283794ac86"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ac1c4a689edcc530fc9d9aa11f5774b9e2f33f9a0c6a57864e90908f5208d30a"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:21d142cc6c0ec30d2efee5068ca36c128a30b0f2c53c1c07bd78cb6bc1d3be5f"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:5dbe56a36425d26d6cfb40ce79c314a2e4dd6211d51d6d2191c00bed34f354cc"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:5bfbb1b9acf3334612667b61bd3002196fe2a1eb4dd74d247e0f2a4d50ec9bbf"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:d055ec1e26e441f6187acf818b73564e6e6282709e9bcb5b63f5b23068356a15"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:af2d8c67d8e573d6de5bc30cdb27e9b95e49115cd9baad5ddbd1a6207aaa82a9"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:780236ac706e66881f3b7f2f32dfe90507a09e67d1d454c762cf642e6e1586e0"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-win32.whl", hash = "sha256:5833d2c39d8896e4e19b689ffc198f08ea58116bee26dea51e362ecc7cd3ed26"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-win_amd64.whl", hash = "sha256:a79cfe37875f822425b89a82333404539ae63dbdddf97f84dcbc3d339aae9525"},
+    {file = "charset_normalizer-3.4.4-cp312-cp312-win_arm64.whl", hash = "sha256:376bec83a63b8021bb5c8ea75e21c4ccb86e7e45ca4eb81146091b56599b80c3"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:e1f185f86a6f3403aa2420e815904c67b2f9ebc443f045edd0de921108345794"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b39f987ae8ccdf0d2642338faf2abb1862340facc796048b604ef14919e55ed"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3162d5d8ce1bb98dd51af660f2121c55d0fa541b46dff7bb9b9f86ea1d87de72"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:81d5eb2a312700f4ecaa977a8235b634ce853200e828fbadf3a9c50bab278328"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5bd2293095d766545ec1a8f612559f6b40abc0eb18bb2f5d1171872d34036ede"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a8a8b89589086a25749f471e6a900d3f662d1d3b6e2e59dcecf787b1cc3a1894"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc7637e2f80d8530ee4a78e878bce464f70087ce73cf7c1caf142416923b98f1"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f8bf04158c6b607d747e93949aa60618b61312fe647a6369f88ce2ff16043490"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:554af85e960429cf30784dd47447d5125aaa3b99a6f0683589dbd27e2f45da44"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:74018750915ee7ad843a774364e13a3db91682f26142baddf775342c3f5b1133"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:c0463276121fdee9c49b98908b3a89c39be45d86d1dbaa22957e38f6321d4ce3"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:362d61fd13843997c1c446760ef36f240cf81d3ebf74ac62652aebaf7838561e"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9a26f18905b8dd5d685d6d07b0cdf98a79f3c7a918906af7cc143ea2e164c8bc"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-win32.whl", hash = "sha256:9b35f4c90079ff2e2edc5b26c0c77925e5d2d255c42c74fdb70fb49b172726ac"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-win_amd64.whl", hash = "sha256:b435cba5f4f750aa6c0a0d92c541fb79f69a387c91e61f1795227e4ed9cece14"},
+    {file = "charset_normalizer-3.4.4-cp313-cp313-win_arm64.whl", hash = "sha256:542d2cee80be6f80247095cc36c418f7bddd14f4a6de45af91dfad36d817bba2"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:da3326d9e65ef63a817ecbcc0df6e94463713b754fe293eaa03da99befb9a5bd"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8af65f14dc14a79b924524b1e7fffe304517b2bff5a58bf64f30b98bbc5079eb"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:74664978bb272435107de04e36db5a9735e78232b85b77d45cfb38f758efd33e"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:752944c7ffbfdd10c074dc58ec2d5a8a4cd9493b314d367c14d24c17684ddd14"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d1f13550535ad8cff21b8d757a3257963e951d96e20ec82ab44bc64aeb62a191"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ecaae4149d99b1c9e7b88bb03e3221956f68fd6d50be2ef061b2381b61d20838"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cb6254dc36b47a990e59e1068afacdcd02958bdcce30bb50cc1700a8b9d624a6"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:c8ae8a0f02f57a6e61203a31428fa1d677cbe50c93622b4149d5c0f319c1d19e"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:47cc91b2f4dd2833fddaedd2893006b0106129d4b94fdb6af1f4ce5a9965577c"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:82004af6c302b5d3ab2cfc4cc5f29db16123b1a8417f2e25f9066f91d4411090"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2b7d8f6c26245217bd2ad053761201e9f9680f8ce52f0fcd8d0755aeae5b2152"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:799a7a5e4fb2d5898c60b640fd4981d6a25f1c11790935a44ce38c54e985f828"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:99ae2cffebb06e6c22bdc25801d7b30f503cc87dbd283479e7b606f70aff57ec"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-win32.whl", hash = "sha256:f9d332f8c2a2fcbffe1378594431458ddbef721c1769d78e2cbc06280d8155f9"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-win_amd64.whl", hash = "sha256:8a6562c3700cce886c5be75ade4a5db4214fda19fede41d9792d100288d8f94c"},
+    {file = "charset_normalizer-3.4.4-cp314-cp314-win_arm64.whl", hash = "sha256:de00632ca48df9daf77a2c65a484531649261ec9f25489917f09e455cb09ddb2"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:ce8a0633f41a967713a59c4139d29110c07e826d131a316b50ce11b1d79b4f84"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eaabd426fe94daf8fd157c32e571c85cb12e66692f15516a83a03264b08d06c3"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c4ef880e27901b6cc782f1b95f82da9313c0eb95c3af699103088fa0ac3ce9ac"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2aaba3b0819274cc41757a1da876f810a3e4d7b6eb25699253a4effef9e8e4af"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:778d2e08eda00f4256d7f672ca9fef386071c9202f5e4607920b86d7803387f2"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f155a433c2ec037d4e8df17d18922c3a0d9b3232a396690f17175d2946f0218d"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a8bf8d0f749c5757af2142fe7903a9df1d2e8aa3841559b2bad34b08d0e2bcf3"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:194f08cbb32dc406d6e1aea671a68be0823673db2832b38405deba2fb0d88f63"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-musllinux_1_2_armv7l.whl", hash = "sha256:6aee717dcfead04c6eb1ce3bd29ac1e22663cdea57f943c87d1eab9a025438d7"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-musllinux_1_2_ppc64le.whl", hash = "sha256:cd4b7ca9984e5e7985c12bc60a6f173f3c958eae74f3ef6624bb6b26e2abbae4"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-musllinux_1_2_riscv64.whl", hash = "sha256:b7cf1017d601aa35e6bb650b6ad28652c9cd78ee6caff19f3c28d03e1c80acbf"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-musllinux_1_2_s390x.whl", hash = "sha256:e912091979546adf63357d7e2ccff9b44f026c075aeaf25a52d0e95ad2281074"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:5cb4d72eea50c8868f5288b7f7f33ed276118325c1dfd3957089f6b519e1382a"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-win32.whl", hash = "sha256:837c2ce8c5a65a2035be9b3569c684358dfbf109fd3b6969630a87535495ceaa"},
+    {file = "charset_normalizer-3.4.4-cp38-cp38-win_amd64.whl", hash = "sha256:44c2a8734b333e0578090c4cd6b16f275e07aa6614ca8715e6c038e865e70576"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:a9768c477b9d7bd54bc0c86dbaebdec6f03306675526c9927c0e8a04e8f94af9"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1bee1e43c28aa63cb16e5c14e582580546b08e535299b8b6158a7c9c768a1f3d"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fd44c878ea55ba351104cb93cc85e74916eb8fa440ca7903e57575e97394f608"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0f04b14ffe5fdc8c4933862d8306109a2c51e0704acfa35d51598eb45a1e89fc"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:cd09d08005f958f370f539f186d10aec3377d55b9eeb0d796025d4886119d76e"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4fe7859a4e3e8457458e2ff592f15ccb02f3da787fcd31e0183879c3ad4692a1"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fa09f53c465e532f4d3db095e0c55b615f010ad81803d383195b6b5ca6cbf5f3"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:7fa17817dc5625de8a027cb8b26d9fefa3ea28c8253929b8d6649e705d2835b6"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:5947809c8a2417be3267efc979c47d76a079758166f7d43ef5ae8e9f92751f88"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:4902828217069c3c5c71094537a8e623f5d097858ac6ca8252f7b4d10b7560f1"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:7c308f7e26e4363d79df40ca5b2be1c6ba9f02bdbccfed5abddb7859a6ce72cf"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:2c9d3c380143a1fedbff95a312aa798578371eb29da42106a29019368a475318"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:cb01158d8b88ee68f15949894ccc6712278243d95f344770fa7593fa2d94410c"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-win32.whl", hash = "sha256:2677acec1a2f8ef614c6888b5b4ae4060cc184174a938ed4e8ef690e15d3e505"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-win_amd64.whl", hash = "sha256:f8e160feb2aed042cd657a72acc0b481212ed28b1b9a95c0cee1621b524e1966"},
+    {file = "charset_normalizer-3.4.4-cp39-cp39-win_arm64.whl", hash = "sha256:b5d84d37db046c5ca74ee7bb47dd6cbc13f80665fdde3e8040bdd3fb015ecb50"},
+    {file = "charset_normalizer-3.4.4-py3-none-any.whl", hash = "sha256:7a32c560861a02ff789ad905a2fe94e3f840803362c84fecf1851cb4cf3dc37f"},
+    {file = "charset_normalizer-3.4.4.tar.gz", hash = "sha256:94537985111c35f28720e43603b8e7b43a6ecfb2ce1d3058bbe955b73404e21a"},
 ]
 
 [[package]]
 name = "click"
-version = "8.1.8"
+version = "8.3.1"
 description = "Composable command line interface toolkit"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.10"
 groups = ["dev"]
 files = [
-    {file = "click-8.1.8-py3-none-any.whl", hash = "sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2"},
-    {file = "click-8.1.8.tar.gz", hash = "sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a"},
+    {file = "click-8.3.1-py3-none-any.whl", hash = "sha256:981153a64e25f12d547d3426c367a4857371575ee7ad18df2a6183ab0545b2a6"},
+    {file = "click-8.3.1.tar.gz", hash = "sha256:12ff4785d337a1bb490bb7e9c2b1ee5da3112e94a8622f26a6c77f5d2fc6842a"},
 ]
 
 [package.dependencies]
@@ -368,64 +441,87 @@ files = [
 
 [[package]]
 name = "constantly"
-version = "15.1.0"
+version = "23.10.4"
 description = "Symbolic constants in Python"
 optional = false
-python-versions = "*"
+python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "constantly-15.1.0-py2.py3-none-any.whl", hash = "sha256:dd2fa9d6b1a51a83f0d7dd76293d734046aa176e384bf6e33b7e44880eb37c5d"},
-    {file = "constantly-15.1.0.tar.gz", hash = "sha256:586372eb92059873e29eba4f9dec8381541b4d3834660707faf8ba59146dfc35"},
+    {file = "constantly-23.10.4-py3-none-any.whl", hash = "sha256:3fd9b4d1c3dc1ec9757f3c52aef7e53ad9323dbe39f51dfd4c43853b68dfa3f9"},
+    {file = "constantly-23.10.4.tar.gz", hash = "sha256:aa92b70a33e2ac0bb33cd745eb61776594dc48764b06c35e0efd050b7f1c7cbd"},
 ]
 
 [[package]]
 name = "cryptography"
-version = "43.0.3"
+version = "46.0.6"
 description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers."
 optional = false
-python-versions = ">=3.7"
+python-versions = "!=3.9.0,!=3.9.1,>=3.8"
 groups = ["main", "dev"]
 files = [
-    {file = "cryptography-43.0.3-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:bf7a1932ac4176486eab36a19ed4c0492da5d97123f1406cf15e41b05e787d2e"},
-    {file = "cryptography-43.0.3-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:63efa177ff54aec6e1c0aefaa1a241232dcd37413835a9b674b6e3f0ae2bfd3e"},
-    {file = "cryptography-43.0.3-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7e1ce50266f4f70bf41a2c6dc4358afadae90e2a1e5342d3c08883df1675374f"},
-    {file = "cryptography-43.0.3-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:443c4a81bb10daed9a8f334365fe52542771f25aedaf889fd323a853ce7377d6"},
-    {file = "cryptography-43.0.3-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:74f57f24754fe349223792466a709f8e0c093205ff0dca557af51072ff47ab18"},
-    {file = "cryptography-43.0.3-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9762ea51a8fc2a88b70cf2995e5675b38d93bf36bd67d91721c309df184f49bd"},
-    {file = "cryptography-43.0.3-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:81ef806b1fef6b06dcebad789f988d3b37ccaee225695cf3e07648eee0fc6b73"},
-    {file = "cryptography-43.0.3-cp37-abi3-win32.whl", hash = "sha256:cbeb489927bd7af4aa98d4b261af9a5bc025bd87f0e3547e11584be9e9427be2"},
-    {file = "cryptography-43.0.3-cp37-abi3-win_amd64.whl", hash = "sha256:f46304d6f0c6ab8e52770addfa2fc41e6629495548862279641972b6215451cd"},
-    {file = "cryptography-43.0.3-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:8ac43ae87929a5982f5948ceda07001ee5e83227fd69cf55b109144938d96984"},
-    {file = "cryptography-43.0.3-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:846da004a5804145a5f441b8530b4bf35afbf7da70f82409f151695b127213d5"},
-    {file = "cryptography-43.0.3-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0f996e7268af62598f2fc1204afa98a3b5712313a55c4c9d434aef49cadc91d4"},
-    {file = "cryptography-43.0.3-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:f7b178f11ed3664fd0e995a47ed2b5ff0a12d893e41dd0494f406d1cf555cab7"},
-    {file = "cryptography-43.0.3-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:c2e6fc39c4ab499049df3bdf567f768a723a5e8464816e8f009f121a5a9f4405"},
-    {file = "cryptography-43.0.3-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:e1be4655c7ef6e1bbe6b5d0403526601323420bcf414598955968c9ef3eb7d16"},
-    {file = "cryptography-43.0.3-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:df6b6c6d742395dd77a23ea3728ab62f98379eff8fb61be2744d4679ab678f73"},
-    {file = "cryptography-43.0.3-cp39-abi3-win32.whl", hash = "sha256:d56e96520b1020449bbace2b78b603442e7e378a9b3bd68de65c782db1507995"},
-    {file = "cryptography-43.0.3-cp39-abi3-win_amd64.whl", hash = "sha256:0c580952eef9bf68c4747774cde7ec1d85a6e61de97281f2dba83c7d2c806362"},
-    {file = "cryptography-43.0.3-pp310-pypy310_pp73-macosx_10_9_x86_64.whl", hash = "sha256:d03b5621a135bffecad2c73e9f4deb1a0f977b9a8ffe6f8e002bf6c9d07b918c"},
-    {file = "cryptography-43.0.3-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:a2a431ee15799d6db9fe80c82b055bae5a752bef645bba795e8e52687c69efe3"},
-    {file = "cryptography-43.0.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:281c945d0e28c92ca5e5930664c1cefd85efe80e5c0d2bc58dd63383fda29f83"},
-    {file = "cryptography-43.0.3-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:f18c716be16bc1fea8e95def49edf46b82fccaa88587a45f8dc0ff6ab5d8e0a7"},
-    {file = "cryptography-43.0.3-pp39-pypy39_pp73-macosx_10_9_x86_64.whl", hash = "sha256:4a02ded6cd4f0a5562a8887df8b3bd14e822a90f97ac5e544c162899bc467664"},
-    {file = "cryptography-43.0.3-pp39-pypy39_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:53a583b6637ab4c4e3591a15bc9db855b8d9dee9a669b550f311480acab6eb08"},
-    {file = "cryptography-43.0.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:1ec0bcf7e17c0c5669d881b1cd38c4972fade441b27bda1051665faaa89bdcaa"},
-    {file = "cryptography-43.0.3-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:2ce6fae5bdad59577b44e4dfed356944fbf1d925269114c28be377692643b4ff"},
-    {file = "cryptography-43.0.3.tar.gz", hash = "sha256:315b9001266a492a6ff443b61238f956b214dbec9910a081ba5b6646a055a805"},
+    {file = "cryptography-46.0.6-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:64235194bad039a10bb6d2d930ab3323baaec67e2ce36215fd0952fad0930ca8"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:26031f1e5ca62fcb9d1fcb34b2b60b390d1aacaa15dc8b895a9ed00968b97b30"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9a693028b9cbe51b5a1136232ee8f2bc242e4e19d456ded3fa7c86e43c713b4a"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:67177e8a9f421aa2d3a170c3e56eca4e0128883cf52a071a7cbf53297f18b175"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:d9528b535a6c4f8ff37847144b8986a9a143585f0540fbcb1a98115b543aa463"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:22259338084d6ae497a19bae5d4c66b7ca1387d3264d1c2c0e72d9e9b6a77b97"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:760997a4b950ff00d418398ad73fbc91aa2894b5c1db7ccb45b4f68b42a63b3c"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:3dfa6567f2e9e4c5dceb8ccb5a708158a2a871052fa75c8b78cb0977063f1507"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:cdcd3edcbc5d55757e5f5f3d330dd00007ae463a7e7aa5bf132d1f22a4b62b19"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:d4e4aadb7fc1f88687f47ca20bb7227981b03afaae69287029da08096853b738"},
+    {file = "cryptography-46.0.6-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2b417edbe8877cda9022dde3a008e2deb50be9c407eef034aeeb3a8b11d9db3c"},
+    {file = "cryptography-46.0.6-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:380343e0653b1c9d7e1f55b52aaa2dbb2fdf2730088d48c43ca1c7c0abb7cc2f"},
+    {file = "cryptography-46.0.6-cp311-abi3-win32.whl", hash = "sha256:bcb87663e1f7b075e48c3be3ecb5f0b46c8fc50b50a97cf264e7f60242dca3f2"},
+    {file = "cryptography-46.0.6-cp311-abi3-win_amd64.whl", hash = "sha256:6739d56300662c468fddb0e5e291f9b4d084bead381667b9e654c7dd81705124"},
+    {file = "cryptography-46.0.6-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:2ef9e69886cbb137c2aef9772c2e7138dc581fad4fcbcf13cc181eb5a3ab6275"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7f417f034f91dcec1cb6c5c35b07cdbb2ef262557f701b4ecd803ee8cefed4f4"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d24c13369e856b94892a89ddf70b332e0b70ad4a5c43cf3e9cb71d6d7ffa1f7b"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:aad75154a7ac9039936d50cf431719a2f8d4ed3d3c277ac03f3339ded1a5e707"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:3c21d92ed15e9cfc6eb64c1f5a0326db22ca9c2566ca46d845119b45b4400361"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:4668298aef7cddeaf5c6ecc244c2302a2b8e40f384255505c22875eebb47888b"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:8ce35b77aaf02f3b59c90b2c8a05c73bac12cea5b4e8f3fbece1f5fddea5f0ca"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:c89eb37fae9216985d8734c1afd172ba4927f5a05cfd9bf0e4863c6d5465b013"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:ed418c37d095aeddf5336898a132fba01091f0ac5844e3e8018506f014b6d2c4"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:69cf0056d6947edc6e6760e5f17afe4bea06b56a9ac8a06de9d2bd6b532d4f3a"},
+    {file = "cryptography-46.0.6-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8e7304c4f4e9490e11efe56af6713983460ee0780f16c63f219984dab3af9d2d"},
+    {file = "cryptography-46.0.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:b928a3ca837c77a10e81a814a693f2295200adb3352395fad024559b7be7a736"},
+    {file = "cryptography-46.0.6-cp314-cp314t-win32.whl", hash = "sha256:97c8115b27e19e592a05c45d0dd89c57f81f841cc9880e353e0d3bf25b2139ed"},
+    {file = "cryptography-46.0.6-cp314-cp314t-win_amd64.whl", hash = "sha256:c797e2517cb7880f8297e2c0f43bb910e91381339336f75d2c1c2cbf811b70b4"},
+    {file = "cryptography-46.0.6-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:12cae594e9473bca1a7aceb90536060643128bb274fcea0fc459ab90f7d1ae7a"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:639301950939d844a9e1c4464d7e07f902fe9a7f6b215bb0d4f28584729935d8"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ed3775295fb91f70b4027aeba878d79b3e55c0b3e97eaa4de71f8f23a9f2eb77"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:8927ccfbe967c7df312ade694f987e7e9e22b2425976ddbf28271d7e58845290"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:b12c6b1e1651e42ab5de8b1e00dc3b6354fdfd778e7fa60541ddacc27cd21410"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:063b67749f338ca9c5a0b7fe438a52c25f9526b851e24e6c9310e7195aad3b4d"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:02fad249cb0e090b574e30b276a3da6a149e04ee2f049725b1f69e7b8351ec70"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:7e6142674f2a9291463e5e150090b95a8519b2fb6e6aaec8917dd8d094ce750d"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:456b3215172aeefb9284550b162801d62f5f264a081049a3e94307fe20792cfa"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:341359d6c9e68834e204ceaf25936dffeafea3829ab80e9503860dcc4f4dac58"},
+    {file = "cryptography-46.0.6-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9a9c42a2723999a710445bc0d974e345c32adfd8d2fac6d8a251fa829ad31cfb"},
+    {file = "cryptography-46.0.6-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:6617f67b1606dfd9fe4dbfa354a9508d4a6d37afe30306fe6c101b7ce3274b72"},
+    {file = "cryptography-46.0.6-cp38-abi3-win32.whl", hash = "sha256:7f6690b6c55e9c5332c0b59b9c8a3fb232ebf059094c17f9019a51e9827df91c"},
+    {file = "cryptography-46.0.6-cp38-abi3-win_amd64.whl", hash = "sha256:79e865c642cfc5c0b3eb12af83c35c5aeff4fa5c672dc28c43721c2c9fdd2f0f"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:2ea0f37e9a9cf0df2952893ad145fd9627d326a59daec9b0802480fa3bcd2ead"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:a3e84d5ec9ba01f8fd03802b2147ba77f0c8f2617b2aff254cedd551844209c8"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:12f0fa16cc247b13c43d56d7b35287ff1569b5b1f4c5e87e92cc4fcc00cd10c0"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:50575a76e2951fe7dbd1f56d181f8c5ceeeb075e9ff88e7ad997d2f42af06e7b"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:90e5f0a7b3be5f40c3a0a0eafb32c681d8d2c181fc2a1bdabe9b3f611d9f6b1a"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:6728c49e3b2c180ef26f8e9f0a883a2c585638db64cf265b49c9ba10652d430e"},
+    {file = "cryptography-46.0.6.tar.gz", hash = "sha256:27550628a518c5c6c903d84f637fbecf287f6cb9ced3804838a1295dc1fd0759"},
 ]
 
 [package.dependencies]
-cffi = {version = ">=1.12", markers = "platform_python_implementation != \"PyPy\""}
+cffi = {version = ">=2.0.0", markers = "python_full_version >= \"3.9.0\" and platform_python_implementation != \"PyPy\""}
+typing-extensions = {version = ">=4.13.2", markers = "python_full_version < \"3.11.0\""}
 
 [package.extras]
-docs = ["sphinx (>=5.3.0)", "sphinx-rtd-theme (>=1.1.1)"]
-docstest = ["pyenchant (>=1.6.11)", "readme-renderer", "sphinxcontrib-spelling (>=4.0.1)"]
-nox = ["nox"]
-pep8test = ["check-sdist", "click", "mypy", "ruff"]
-sdist = ["build"]
+docs = ["sphinx (>=5.3.0)", "sphinx-inline-tabs", "sphinx-rtd-theme (>=3.0.0)"]
+docstest = ["pyenchant (>=3)", "readme-renderer (>=30.0)", "sphinxcontrib-spelling (>=7.3.1)"]
+nox = ["nox[uv] (>=2024.4.15)"]
+pep8test = ["check-sdist", "click (>=8.0.1)", "mypy (>=1.14)", "ruff (>=0.11.11)"]
+sdist = ["build (>=1.0.0)"]
 ssh = ["bcrypt (>=3.1.5)"]
-test = ["certifi", "cryptography-vectors (==43.0.3)", "pretend", "pytest (>=6.2.0)", "pytest-benchmark", "pytest-cov", "pytest-xdist"]
+test = ["certifi (>=2024)", "cryptography-vectors (==46.0.6)", "pretend (>=0.7)", "pytest (>=7.4.0)", "pytest-benchmark (>=4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"]
 test-randomorder = ["pytest-randomly"]
 
 [[package]]
@@ -443,42 +539,42 @@ files = [
 
 [[package]]
 name = "docutils"
-version = "0.19"
+version = "0.22.4"
 description = "Docutils -- Python Documentation Utilities"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "docutils-0.19-py3-none-any.whl", hash = "sha256:5e1de4d849fee02c63b040a4a3fd567f4ab104defd8a5511fbbc24a8a017efbc"},
-    {file = "docutils-0.19.tar.gz", hash = "sha256:33995a6753c30b7f577febfc2c50411fec6aac7f7ffeb7c4cfe5991072dcf9e6"},
+    {file = "docutils-0.22.4-py3-none-any.whl", hash = "sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de"},
+    {file = "docutils-0.22.4.tar.gz", hash = "sha256:4db53b1fde9abecbb74d91230d32ab626d94f6badfc575d6db9194a49df29968"},
 ]
 
 [[package]]
 name = "elementpath"
-version = "4.1.5"
+version = "4.8.0"
 description = "XPath 1.0/2.0/3.0/3.1 parsers and selectors for ElementTree and lxml"
 optional = true
-python-versions = ">=3.7"
+python-versions = ">=3.8"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"saml2\""
 files = [
-    {file = "elementpath-4.1.5-py3-none-any.whl", hash = "sha256:2ac1a2fb31eb22bbbf817f8cf6752f844513216263f0e3892c8e79782fe4bb55"},
-    {file = "elementpath-4.1.5.tar.gz", hash = "sha256:c2d6dc524b29ef751ecfc416b0627668119d8812441c555d7471da41d4bacb8d"},
+    {file = "elementpath-4.8.0-py3-none-any.whl", hash = "sha256:5393191f84969bcf8033b05ec4593ef940e58622ea13cefe60ecefbbf09d58d9"},
+    {file = "elementpath-4.8.0.tar.gz", hash = "sha256:5822a2560d99e2633d95f78694c7ff9646adaa187db520da200a8e9479dc46ae"},
 ]
 
 [package.extras]
-dev = ["Sphinx", "coverage", "flake8", "lxml", "lxml-stubs", "memory-profiler", "memray", "mypy", "tox", "xmlschema (>=2.0.0)"]
+dev = ["Sphinx", "coverage", "flake8", "lxml", "lxml-stubs", "memory-profiler", "memray", "mypy", "tox", "xmlschema (>=3.3.2)"]
 
 [[package]]
 name = "gitdb"
-version = "4.0.10"
+version = "4.0.12"
 description = "Git Object Database"
 optional = false
 python-versions = ">=3.7"
 groups = ["dev"]
 files = [
-    {file = "gitdb-4.0.10-py3-none-any.whl", hash = "sha256:c286cf298426064079ed96a9e4a9d39e7f3e9bf15ba60701e95f5492f28415c7"},
-    {file = "gitdb-4.0.10.tar.gz", hash = "sha256:6eb990b69df4e15bad899ea868dc46572c3f75339735663b81de79b06f17eb9a"},
+    {file = "gitdb-4.0.12-py3-none-any.whl", hash = "sha256:67073e15955400952c6565cc3e707c554a4eea2e428946f7a4c162fab9bd9bcf"},
+    {file = "gitdb-4.0.12.tar.gz", hash = "sha256:5ef71f855d191a3326fcfbc0d5da835f26b13fbcba60c32c21091c349ffdb571"},
 ]
 
 [package.dependencies]
@@ -486,142 +582,137 @@ smmap = ">=3.0.1,<6"
 
 [[package]]
 name = "gitpython"
-version = "3.1.45"
+version = "3.1.46"
 description = "GitPython is a Python library used to interact with Git repositories"
 optional = false
 python-versions = ">=3.7"
 groups = ["dev"]
 files = [
-    {file = "gitpython-3.1.45-py3-none-any.whl", hash = "sha256:8908cb2e02fb3b93b7eb0f2827125cb699869470432cc885f019b8fd0fccff77"},
-    {file = "gitpython-3.1.45.tar.gz", hash = "sha256:85b0ee964ceddf211c41b9f27a49086010a190fd8132a24e21f362a4b36a791c"},
+    {file = "gitpython-3.1.46-py3-none-any.whl", hash = "sha256:79812ed143d9d25b6d176a10bb511de0f9c67b1fa641d82097b0ab90398a2058"},
+    {file = "gitpython-3.1.46.tar.gz", hash = "sha256:400124c7d0ef4ea03f7310ac2fbf7151e09ff97f2a3288d64a440c584a29c37f"},
 ]
 
 [package.dependencies]
 gitdb = ">=4.0.1,<5"
-typing-extensions = {version = ">=3.10.0.2", markers = "python_version < \"3.10\""}
 
 [package.extras]
 doc = ["sphinx (>=7.1.2,<7.2)", "sphinx-autodoc-typehints", "sphinx_rtd_theme"]
-test = ["coverage[toml]", "ddt (>=1.1.1,!=1.4.3)", "mock ; python_version < \"3.8\"", "mypy", "pre-commit", "pytest (>=7.3.1)", "pytest-cov", "pytest-instafail", "pytest-mock", "pytest-sugar", "typing-extensions ; python_version < \"3.11\""]
+test = ["coverage[toml]", "ddt (>=1.1.1,!=1.4.3)", "mock ; python_version < \"3.8\"", "mypy (==1.18.2) ; python_version >= \"3.9\"", "pre-commit", "pytest (>=7.3.1)", "pytest-cov", "pytest-instafail", "pytest-mock", "pytest-sugar", "typing-extensions ; python_version < \"3.11\""]
 
 [[package]]
 name = "hiredis"
-version = "3.2.1"
+version = "3.3.0"
 description = "Python wrapper for hiredis"
 optional = true
 python-versions = ">=3.8"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"redis\""
 files = [
-    {file = "hiredis-3.2.1-cp310-cp310-macosx_10_15_universal2.whl", hash = "sha256:add17efcbae46c5a6a13b244ff0b4a8fa079602ceb62290095c941b42e9d5dec"},
-    {file = "hiredis-3.2.1-cp310-cp310-macosx_10_15_x86_64.whl", hash = "sha256:5fe955cc4f66c57df1ae8e5caf4de2925d43b5efab4e40859662311d1bcc5f54"},
-    {file = "hiredis-3.2.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f9ad63cd9065820a43fb1efb8ed5ae85bb78f03ef5eb53f6bde47914708f5718"},
-    {file = "hiredis-3.2.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d8e7f9e5fdba08841d78d4e1450cae03a4dbed2eda8a4084673cafa5615ce24a"},
-    {file = "hiredis-3.2.1-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1dce2508eca5d4e47ef38bc7c0724cb45abcdb0089f95a2ef49baf52882979a8"},
-    {file = "hiredis-3.2.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:186428bf353e4819abae15aa2ad64c3f40499d596ede280fe328abb9e98e72ce"},
-    {file = "hiredis-3.2.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:74f2500d90a0494843aba7abcdc3e77f859c502e0892112d708c02e1dcae8f90"},
-    {file = "hiredis-3.2.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:32822a94d2fdd1da96c05b22fdeef6d145d8fdbd865ba2f273f45eb949e4a805"},
-    {file = "hiredis-3.2.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:ead809fb08dd4fdb5b4b6e2999c834e78c3b0c450a07c3ed88983964432d0c64"},
-    {file = "hiredis-3.2.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:b90fada20301c3a257e868dd6a4694febc089b2b6d893fa96a3fc6c1f9ab4340"},
-    {file = "hiredis-3.2.1-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:6d8bff53f526da3d9db86c8668011e4f7ca2958ee3a46c648edab6fe2cd1e709"},
-    {file = "hiredis-3.2.1-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:043d929ae262d03e1db0f08616e14504a9119c1ff3de13d66f857d85cd45caff"},
-    {file = "hiredis-3.2.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8d470fef39d02dbe5c541ec345cc4ffd7d2baec7d6e59c92bd9d9545dc221829"},
-    {file = "hiredis-3.2.1-cp310-cp310-win32.whl", hash = "sha256:efa4c76c45cc8c42228c7989b279fa974580e053b5e6a4a834098b5324b9eafa"},
-    {file = "hiredis-3.2.1-cp310-cp310-win_amd64.whl", hash = "sha256:cbac5ec3a620b095c46ef3a8f1f06da9c86c1cdc411d44a5f538876c39a2b321"},
-    {file = "hiredis-3.2.1-cp311-cp311-macosx_10_15_universal2.whl", hash = "sha256:e4ae0be44cab5e74e6e4c4a93d04784629a45e781ff483b136cc9e1b9c23975c"},
-    {file = "hiredis-3.2.1-cp311-cp311-macosx_10_15_x86_64.whl", hash = "sha256:24647e84c9f552934eb60b7f3d2116f8b64a7020361da9369e558935ca45914d"},
-    {file = "hiredis-3.2.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:6fb3e92d1172da8decc5f836bf8b528c0fc9b6d449f1353e79ceeb9dc1801132"},
-    {file = "hiredis-3.2.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38ba7a32e51e518b6b3e470142e52ed2674558e04d7d73d86eb19ebcb37d7d40"},
-    {file = "hiredis-3.2.1-cp311-cp311-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4fc632be73174891d6bb71480247e57b2fd8f572059f0a1153e4d0339e919779"},
-    {file = "hiredis-3.2.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f03e6839ff21379ad3c195e0700fc9c209e7f344946dea0f8a6d7b5137a2a141"},
-    {file = "hiredis-3.2.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:99983873e37c71bb71deb544670ff4f9d6920dab272aaf52365606d87a4d6c73"},
-    {file = "hiredis-3.2.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ffd982c419f48e3a57f592678c72474429465bb4bfc96472ec805f5d836523f0"},
-    {file = "hiredis-3.2.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bc993f4aa4abc029347f309e722f122e05a3b8a0c279ae612849b5cc9dc69f2d"},
-    {file = "hiredis-3.2.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:dde790d420081f18b5949227649ccb3ed991459df33279419a25fcae7f97cd92"},
-    {file = "hiredis-3.2.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:b0c8cae7edbef860afcf3177b705aef43e10b5628f14d5baf0ec69668247d08d"},
-    {file = "hiredis-3.2.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:e8a90eaca7e1ce7f175584f07a2cdbbcab13f4863f9f355d7895c4d28805f65b"},
-    {file = "hiredis-3.2.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:476031958fa44e245e803827e0787d49740daa4de708fe514370293ce519893a"},
-    {file = "hiredis-3.2.1-cp311-cp311-win32.whl", hash = "sha256:eb3f5df2a9593b4b4b676dce3cea53b9c6969fc372875188589ddf2bafc7f624"},
-    {file = "hiredis-3.2.1-cp311-cp311-win_amd64.whl", hash = "sha256:1402e763d8a9fdfcc103bbf8b2913971c0a3f7b8a73deacbda3dfe5f3a9d1e0b"},
-    {file = "hiredis-3.2.1-cp312-cp312-macosx_10_15_universal2.whl", hash = "sha256:3742d8b17e73c198cabeab11da35f2e2a81999d406f52c6275234592256bf8e8"},
-    {file = "hiredis-3.2.1-cp312-cp312-macosx_10_15_x86_64.whl", hash = "sha256:9c2f3176fb617a79f6cccf22cb7d2715e590acb534af6a82b41f8196ad59375d"},
-    {file = "hiredis-3.2.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:a8bd46189c7fa46174e02670dc44dfecb60f5bd4b67ed88cb050d8f1fd842f09"},
-    {file = "hiredis-3.2.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f86ee4488c8575b58139cdfdddeae17f91e9a893ffee20260822add443592e2f"},
-    {file = "hiredis-3.2.1-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3717832f4a557b2fe7060b9d4a7900e5de287a15595e398c3f04df69019ca69d"},
-    {file = "hiredis-3.2.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e5cb12c21fb9e2403d28c4e6a38120164973342d34d08120f2d7009b66785644"},
-    {file = "hiredis-3.2.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:080fda1510bbd389af91f919c11a4f2aa4d92f0684afa4709236faa084a42cac"},
-    {file = "hiredis-3.2.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1252e10a1f3273d1c6bf2021e461652c2e11b05b83e0915d6eb540ec7539afe2"},
-    {file = "hiredis-3.2.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:d9e320e99ab7d2a30dc91ff6f745ba38d39b23f43d345cdee9881329d7b511d6"},
-    {file = "hiredis-3.2.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:641668f385f16550fdd6fdc109b0af6988b94ba2acc06770a5e06a16e88f320c"},
-    {file = "hiredis-3.2.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:1e1f44208c39d6c345ff451f82f21e9eeda6fe9af4ac65972cc3eeb58d41f7cb"},
-    {file = "hiredis-3.2.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:f882a0d6415fffe1ffcb09e6281d0ba8b1ece470e866612bbb24425bf76cf397"},
-    {file = "hiredis-3.2.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b4e78719a0730ebffe335528531d154bc8867a246418f74ecd88adbc4d938c49"},
-    {file = "hiredis-3.2.1-cp312-cp312-win32.whl", hash = "sha256:33c4604d9f79a13b84da79950a8255433fca7edaf292bbd3364fd620864ed7b2"},
-    {file = "hiredis-3.2.1-cp312-cp312-win_amd64.whl", hash = "sha256:7b9749375bf9d171aab8813694f379f2cff0330d7424000f5e92890ad4932dc9"},
-    {file = "hiredis-3.2.1-cp313-cp313-macosx_10_15_universal2.whl", hash = "sha256:7cabf7f1f06be221e1cbed1f34f00891a7bdfad05b23e4d315007dd42148f3d4"},
-    {file = "hiredis-3.2.1-cp313-cp313-macosx_10_15_x86_64.whl", hash = "sha256:db85cb86f8114c314d0ec6d8de25b060a2590b4713135240d568da4f7dea97ac"},
-    {file = "hiredis-3.2.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:c9a592a49b7b8497e4e62c3ff40700d0c7f1a42d145b71e3e23c385df573c964"},
-    {file = "hiredis-3.2.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0079ef1e03930b364556b78548e67236ab3def4e07e674f6adfc52944aa972dd"},
-    {file = "hiredis-3.2.1-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d6a290ed45d9c14f4c50b6bda07afb60f270c69b5cb626fd23a4c2fde9e3da1"},
-    {file = "hiredis-3.2.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:79dd5fe8c0892769f82949adeb021342ca46871af26e26945eb55d044fcdf0d0"},
-    {file = "hiredis-3.2.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:998a82281a159f4aebbfd4fb45cfe24eb111145206df2951d95bc75327983b58"},
-    {file = "hiredis-3.2.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:41fc3cd52368ffe7c8e489fb83af5e99f86008ed7f9d9ba33b35fec54f215c0a"},
-    {file = "hiredis-3.2.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:8d10df3575ce09b0fa54b8582f57039dcbdafde5de698923a33f601d2e2a246c"},
-    {file = "hiredis-3.2.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:1ab010d04be33735ad8e643a40af0d68a21d70a57b1d0bff9b6a66b28cca9dbf"},
-    {file = "hiredis-3.2.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:ec3b5f9ea34f70aaba3e061cbe1fa3556fea401d41f5af321b13e326792f3017"},
-    {file = "hiredis-3.2.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:158dfb505fff6bffd17f823a56effc0c2a7a8bc4fb659d79a52782f22eefc697"},
-    {file = "hiredis-3.2.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9d632cd0ddd7895081be76748e6fb9286f81d2a51c371b516541c6324f2fdac9"},
-    {file = "hiredis-3.2.1-cp313-cp313-win32.whl", hash = "sha256:e9726d03e7df068bf755f6d1ecc61f7fc35c6b20363c7b1b96f39a14083df940"},
-    {file = "hiredis-3.2.1-cp313-cp313-win_amd64.whl", hash = "sha256:b5b1653ad7263a001f2e907e81a957d6087625f9700fa404f1a2268c0a4f9059"},
-    {file = "hiredis-3.2.1-cp38-cp38-macosx_10_15_universal2.whl", hash = "sha256:ef27728a8ceaa038ef4b6efc0e4473b7643b5c873c2fff5475e2c8b9c8d2e0d5"},
-    {file = "hiredis-3.2.1-cp38-cp38-macosx_10_15_x86_64.whl", hash = "sha256:1039d8d2e1d2a1528ad9f9e289e8aa8eec9bf4b4759be4d453a2ab406a70a800"},
-    {file = "hiredis-3.2.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:83a8cd0eb6e535c93aad9c21e3e85bcb7dd26d3ff9b8ab095287be86e8af2f59"},
-    {file = "hiredis-3.2.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d6fc1e8f78bcdc7e25651b7d96d19b983b843b575904d96642f97ae157797ae4"},
-    {file = "hiredis-3.2.1-cp38-cp38-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0ddfa9a10fda3bea985a3b371a64553731141aaa0a20cbcc62a0e659f05e6c01"},
-    {file = "hiredis-3.2.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e789ee008752b9be82a7bed82e36b62053c7cc06a0179a5a403ba5b2acba5bd8"},
-    {file = "hiredis-3.2.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4bf271877947a0f3eb9dc331688404a2e4cc246bca61bc5a1e2d62da9a1caad8"},
-    {file = "hiredis-3.2.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c9ad404fd0fdbdfe74e55ebb0592ab4169eecfe70ccf0db80eedc1d9943dd6d7"},
-    {file = "hiredis-3.2.1-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:979572c602bdea0c3df255545c8c257f2163dd6c10d1f172268ffa7a6e1287d6"},
-    {file = "hiredis-3.2.1-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:f74e3d899be057fb00444ea5f7ae1d7389d393bddf0f3ed698997aa05563483b"},
-    {file = "hiredis-3.2.1-cp38-cp38-musllinux_1_2_ppc64le.whl", hash = "sha256:a015666d5fdc3ca704f68db9850d0272ddcfb27e9f26a593013383f565ed2ad7"},
-    {file = "hiredis-3.2.1-cp38-cp38-musllinux_1_2_s390x.whl", hash = "sha256:259a3389dfe3390e356c2796b6bc96a778695e9d7d40c82121096a6b8a2dd3c6"},
-    {file = "hiredis-3.2.1-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:39f469891d29f0522712265de76018ab83a64b85ac4b4f67e1f692cbd42a03f9"},
-    {file = "hiredis-3.2.1-cp38-cp38-win32.whl", hash = "sha256:73aa0508f26cd6cb4dfdbe189b28fb3162fd171532e526e90a802363b88027f8"},
-    {file = "hiredis-3.2.1-cp38-cp38-win_amd64.whl", hash = "sha256:2b910f12d7bcaf5ffc056087fc7b2d23e688f166462c31b73a0799d12891378d"},
-    {file = "hiredis-3.2.1-cp39-cp39-macosx_10_15_universal2.whl", hash = "sha256:523a241d9f268bc0c7306792f58f9c633185f939a19abc0356c55f078d3901c5"},
-    {file = "hiredis-3.2.1-cp39-cp39-macosx_10_15_x86_64.whl", hash = "sha256:fec453a038c262e18d7de4919220b2916e0b17d1eadd12e7a800f09f78f84f39"},
-    {file = "hiredis-3.2.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:e75a49c5927453c316665cfa39f4274081d00ce69b137b393823eb90c66a8371"},
-    {file = "hiredis-3.2.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cd974cbe8b3ae8d3e7f60675e6da10383da69f029147c2c93d1a7e44b36d1290"},
-    {file = "hiredis-3.2.1-cp39-cp39-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:12d3b8fff9905e44f357417159d64138a32500dbd0d5cffaddbb2600d3ce33b1"},
-    {file = "hiredis-3.2.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e21985804a40cb91e69e35ae321eb4e3610cd61a2cbc0328ab73a245f608fa1c"},
-    {file = "hiredis-3.2.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4e26e2b49a9569f44a2a2d743464ff0786b46fb1124ed33d2a1bd8b1c660c25b"},
-    {file = "hiredis-3.2.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4ef1ebf9ee8e0b4a895b86a02a8b7e184b964c43758393532966ecb8a256f37c"},
-    {file = "hiredis-3.2.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:c936b690dd31d7af74f707fc9003c500315b4c9ad70fa564aff73d1283b3b37a"},
-    {file = "hiredis-3.2.1-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:4909666bcb73270bb806aa00d0eee9e81f7a1aca388aafb4ba7dfcf5d344d23a"},
-    {file = "hiredis-3.2.1-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:d74a2ad25bc91ca9639e4485099852e6263b360b2c3650fdd3cc47762c5db3fa"},
-    {file = "hiredis-3.2.1-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:e99910088df446ee64d64b160835f592fb4d36189fcc948dd204e903d91fffa3"},
-    {file = "hiredis-3.2.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:54423bd7af93a773edc6f166341cfb0e5f35ef42ca07b93f568f672a6f445e40"},
-    {file = "hiredis-3.2.1-cp39-cp39-win32.whl", hash = "sha256:4a5365cb6d7be82d3c6d523b369bc0bc1a64987e88ed6ecfabadda2aa1cf4fa4"},
-    {file = "hiredis-3.2.1-cp39-cp39-win_amd64.whl", hash = "sha256:0a2eb02b6aaf4f1425a408e892c0378ba6cb6b45b1412c30dd258df1322d88c0"},
-    {file = "hiredis-3.2.1-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:73913d2fa379e722d17ba52f21ce12dd578140941a08efd73e73b6fab1dea4d8"},
-    {file = "hiredis-3.2.1-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:15a3dff3eca31ecbf3d7d6d104cf1b318dc2b013bad3f4bdb2839cb9ea2e1584"},
-    {file = "hiredis-3.2.1-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c78258032c2f9fc6f39fee7b07882ce26de281e09178266ce535992572132d95"},
-    {file = "hiredis-3.2.1-pp310-pypy310_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:578d6a881e64e46db065256355594e680202c3bacf3270be3140057171d2c23e"},
-    {file = "hiredis-3.2.1-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8b7f34b170093c077c972b8cc0ceb15d8ff88ad0079751a8ae9733e94d77e733"},
-    {file = "hiredis-3.2.1-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:291a18b228fc90f6720d178de2fac46522082c96330b4cc2d3dd8cb2c1cb2815"},
-    {file = "hiredis-3.2.1-pp38-pypy38_pp73-macosx_10_15_x86_64.whl", hash = "sha256:f53d2af5a7cd33a4b4d7ba632dce80c17823df6814ef5a8d328ed44c815a68e7"},
-    {file = "hiredis-3.2.1-pp38-pypy38_pp73-macosx_11_0_arm64.whl", hash = "sha256:20bdf6dbdf77eb43b98bc53950f7711983042472199245d4c36448e6b4cb460f"},
-    {file = "hiredis-3.2.1-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f43e5c50d76da15118c72b757216cf26c643d55bb1b3c86cad1ae49173971780"},
-    {file = "hiredis-3.2.1-pp38-pypy38_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1e5bb5fe9834851d56c8543e52dcd2ac5275fb6772ebc97876e18c2e05a3300b"},
-    {file = "hiredis-3.2.1-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:53e348438b6452e3d14dddb95d071fe8eaf6f264f641cba999c10bf6359cf1d2"},
-    {file = "hiredis-3.2.1-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:e305f6c63a2abcbde6ce28958de2bb4dd0fd34c6ab3bde5a4410befd5df8c6b2"},
-    {file = "hiredis-3.2.1-pp39-pypy39_pp73-macosx_10_15_x86_64.whl", hash = "sha256:33f24b1152f684b54d6b9d09135d849a6df64b6982675e8cf972f8adfa2de9aa"},
-    {file = "hiredis-3.2.1-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:01dd8ea88bf8363751857ca2eb8f13faad0c7d57a6369663d4d1160f225ab449"},
-    {file = "hiredis-3.2.1-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4b16946533535cbb5cc7d4b6fc009d32d22b0f9ac58e8eb6f144637b64f9a61d"},
-    {file = "hiredis-3.2.1-pp39-pypy39_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f9a03886cad1076e9f7e9e411c402826a8eac6f56ba426ee84b88e6515574b7b"},
-    {file = "hiredis-3.2.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8a4f6340f1c378bce17c195d46288a796fcf213dd3e2a008c2c942b33ab58993"},
-    {file = "hiredis-3.2.1-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:9d64ddf29016d34e7e3bc4b3d36ca9ac8a94f9b2c13ac4b9d8a486862d91b95c"},
-    {file = "hiredis-3.2.1.tar.gz", hash = "sha256:5a5f64479bf04dd829fe7029fad0ea043eac4023abc6e946668cbbec3493a78d"},
+    {file = "hiredis-3.3.0-cp310-cp310-macosx_10_15_universal2.whl", hash = "sha256:9937d9b69321b393fbace69f55423480f098120bc55a3316e1ca3508c4dbbd6f"},
+    {file = "hiredis-3.3.0-cp310-cp310-macosx_10_15_x86_64.whl", hash = "sha256:50351b77f89ba6a22aff430b993653847f36b71d444509036baa0f2d79d1ebf4"},
+    {file = "hiredis-3.3.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:1d00bce25c813eec45a2f524249f58daf51d38c9d3347f6f643ae53826fc735a"},
+    {file = "hiredis-3.3.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ef840d9f142556ed384180ed8cdf14ff875fcae55c980cbe5cec7adca2ef4d8"},
+    {file = "hiredis-3.3.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:88bc79d7e9b94d17ed1bd8b7f2815ed0eada376ed5f48751044e5e4d179aa2f2"},
+    {file = "hiredis-3.3.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:7165c7363e59b258e1875c51f35c0b2b9901e6c691037b487d8a0ace2c137ed2"},
+    {file = "hiredis-3.3.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8c3be446f0c38fbe6863a7cf4522c9a463df6e64bee87c4402e9f6d7d2e7f869"},
+    {file = "hiredis-3.3.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:96f9a27643279853b91a1fb94a88b559e55fdecec86f1fcd5f2561492be52e47"},
+    {file = "hiredis-3.3.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:0a5eebb170de1b415c78ae5ca3aee17cff8b885df93c2055d54320e789d838f4"},
+    {file = "hiredis-3.3.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:200678547ac3966bac3e38df188211fdc13d5f21509c23267e7def411710e112"},
+    {file = "hiredis-3.3.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:dd9d78c5363a858f9dc5e698e5e1e402b83c00226cba294f977a92c53092b549"},
+    {file = "hiredis-3.3.0-cp310-cp310-win32.whl", hash = "sha256:a0d31ff178b913137a7a08c7377e93805914755a15c3585e203d0d74496456c0"},
+    {file = "hiredis-3.3.0-cp310-cp310-win_amd64.whl", hash = "sha256:7b41833c8f0d4c7fbfaa867c8ed9a4e4aaa71d7c54e4806ed62da2d5cd27b40d"},
+    {file = "hiredis-3.3.0-cp311-cp311-macosx_10_15_universal2.whl", hash = "sha256:63ee6c1ae6a2462a2439eb93c38ab0315cd5f4b6d769c6a34903058ba538b5d6"},
+    {file = "hiredis-3.3.0-cp311-cp311-macosx_10_15_x86_64.whl", hash = "sha256:31eda3526e2065268a8f97fbe3d0e9a64ad26f1d89309e953c80885c511ea2ae"},
+    {file = "hiredis-3.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a26bae1b61b7bcafe3d0d0c7d012fb66ab3c95f2121dbea336df67e344e39089"},
+    {file = "hiredis-3.3.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b9546079f7fd5c50fbff9c791710049b32eebe7f9b94debec1e8b9f4c048cba2"},
+    {file = "hiredis-3.3.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ae327fc13b1157b694d53f92d50920c0051e30b0c245f980a7036e299d039ab4"},
+    {file = "hiredis-3.3.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:4016e50a8be5740a59c5af5252e5ad16c395021a999ad24c6604f0d9faf4d346"},
+    {file = "hiredis-3.3.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c17b473f273465a3d2168a57a5b43846165105ac217d5652a005e14068589ddc"},
+    {file = "hiredis-3.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:9ecd9b09b11bd0b8af87d29c3f5da628d2bdc2a6c23d2dd264d2da082bd4bf32"},
+    {file = "hiredis-3.3.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:00fb04eac208cd575d14f246e74a468561081ce235937ab17d77cde73aefc66c"},
+    {file = "hiredis-3.3.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:60814a7d0b718adf3bfe2c32c6878b0e00d6ae290ad8e47f60d7bba3941234a6"},
+    {file = "hiredis-3.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:fcbd1a15e935aa323b5b2534b38419511b7909b4b8ee548e42b59090a1b37bb1"},
+    {file = "hiredis-3.3.0-cp311-cp311-win32.whl", hash = "sha256:73679607c5a19f4bcfc9cf6eb54480bcd26617b68708ac8b1079da9721be5449"},
+    {file = "hiredis-3.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:30a4df3d48f32538de50648d44146231dde5ad7f84f8f08818820f426840ae97"},
+    {file = "hiredis-3.3.0-cp312-cp312-macosx_10_15_universal2.whl", hash = "sha256:5b8e1d6a2277ec5b82af5dce11534d3ed5dffeb131fd9b210bc1940643b39b5f"},
+    {file = "hiredis-3.3.0-cp312-cp312-macosx_10_15_x86_64.whl", hash = "sha256:c4981de4d335f996822419e8a8b3b87367fcef67dc5fb74d3bff4df9f6f17783"},
+    {file = "hiredis-3.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1706480a683e328ae9ba5d704629dee2298e75016aa0207e7067b9c40cecc271"},
+    {file = "hiredis-3.3.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0a95cef9989736ac313639f8f545b76b60b797e44e65834aabbb54e4fad8d6c8"},
+    {file = "hiredis-3.3.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ca2802934557ccc28a954414c245ba7ad904718e9712cb67c05152cf6b9dd0a3"},
+    {file = "hiredis-3.3.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:fe730716775f61e76d75810a38ee4c349d3af3896450f1525f5a4034cf8f2ed7"},
+    {file = "hiredis-3.3.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:749faa69b1ce1f741f5eaf743435ac261a9262e2d2d66089192477e7708a9abc"},
+    {file = "hiredis-3.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:95c9427f2ac3f1dd016a3da4e1161fa9d82f221346c8f3fdd6f3f77d4e28946c"},
+    {file = "hiredis-3.3.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c863ee44fe7bff25e41f3a5105c936a63938b76299b802d758f40994ab340071"},
+    {file = "hiredis-3.3.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:2213c7eb8ad5267434891f3241c7776e3bafd92b5933fc57d53d4456247dc542"},
+    {file = "hiredis-3.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:a172bae3e2837d74530cd60b06b141005075db1b814d966755977c69bd882ce8"},
+    {file = "hiredis-3.3.0-cp312-cp312-win32.whl", hash = "sha256:cb91363b9fd6d41c80df9795e12fffbaf5c399819e6ae8120f414dedce6de068"},
+    {file = "hiredis-3.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:04ec150e95eea3de9ff8bac754978aa17b8bf30a86d4ab2689862020945396b0"},
+    {file = "hiredis-3.3.0-cp313-cp313-macosx_10_15_universal2.whl", hash = "sha256:b7048b4ec0d5dddc8ddd03da603de0c4b43ef2540bf6e4c54f47d23e3480a4fa"},
+    {file = "hiredis-3.3.0-cp313-cp313-macosx_10_15_x86_64.whl", hash = "sha256:e5f86ce5a779319c15567b79e0be806e8e92c18bb2ea9153e136312fafa4b7d6"},
+    {file = "hiredis-3.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:fbdb97a942e66016fff034df48a7a184e2b7dc69f14c4acd20772e156f20d04b"},
+    {file = "hiredis-3.3.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b0fb4bea72fe45ff13e93ddd1352b43ff0749f9866263b5cca759a4c960c776f"},
+    {file = "hiredis-3.3.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:85b9baf98050e8f43c2826ab46aaf775090d608217baf7af7882596aef74e7f9"},
+    {file = "hiredis-3.3.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:69079fb0f0ebb61ba63340b9c4bce9388ad016092ca157e5772eb2818209d930"},
+    {file = "hiredis-3.3.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c17f77b79031ea4b0967d30255d2ae6e7df0603ee2426ad3274067f406938236"},
+    {file = "hiredis-3.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:45d14f745fc177bc05fc24bdf20e2b515e9a068d3d4cce90a0fb78d04c9c9d9a"},
+    {file = "hiredis-3.3.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:ba063fdf1eff6377a0c409609cbe890389aefddfec109c2d20fcc19cfdafe9da"},
+    {file = "hiredis-3.3.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:1799cc66353ad066bfdd410135c951959da9f16bcb757c845aab2f21fc4ef099"},
+    {file = "hiredis-3.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2cbf71a121996ffac82436b6153290815b746afb010cac19b3290a1644381b07"},
+    {file = "hiredis-3.3.0-cp313-cp313-win32.whl", hash = "sha256:a7cbbc6026bf03659f0b25e94bbf6e64f6c8c22f7b4bc52fe569d041de274194"},
+    {file = "hiredis-3.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:a8def89dd19d4e2e4482b7412d453dec4a5898954d9a210d7d05f60576cedef6"},
+    {file = "hiredis-3.3.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:c135bda87211f7af9e2fd4e046ab433c576cd17b69e639a0f5bb2eed5e0e71a9"},
+    {file = "hiredis-3.3.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2f855c678230aed6fc29b962ce1cc67e5858a785ef3a3fd6b15dece0487a2e60"},
+    {file = "hiredis-3.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:4059c78a930cbb33c391452ccce75b137d6f89e2eebf6273d75dafc5c2143c03"},
+    {file = "hiredis-3.3.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:334a3f1d14c253bb092e187736c3384203bd486b244e726319bbb3f7dffa4a20"},
+    {file = "hiredis-3.3.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:fd137b147235447b3d067ec952c5b9b95ca54b71837e1b38dbb2ec03b89f24fc"},
+    {file = "hiredis-3.3.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8f88f4f2aceb73329ece86a1cb0794fdbc8e6d614cb5ca2d1023c9b7eb432db8"},
+    {file = "hiredis-3.3.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:550f4d1538822fc75ebf8cf63adc396b23d4958bdbbad424521f2c0e3dfcb169"},
+    {file = "hiredis-3.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:54b14211fbd5930fc696f6fcd1f1f364c660970d61af065a80e48a1fa5464dd6"},
+    {file = "hiredis-3.3.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:c9e96f63dbc489fc86f69951e9f83dadb9582271f64f6822c47dcffa6fac7e4a"},
+    {file = "hiredis-3.3.0-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:106e99885d46684d62ab3ec1d6b01573cc0e0083ac295b11aaa56870b536c7ec"},
+    {file = "hiredis-3.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:087e2ef3206361281b1a658b5b4263572b6ba99465253e827796964208680459"},
+    {file = "hiredis-3.3.0-cp314-cp314-win32.whl", hash = "sha256:80638ebeab1cefda9420e9fedc7920e1ec7b4f0513a6b23d58c9d13c882f8065"},
+    {file = "hiredis-3.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:a68aaf9ba024f4e28cf23df9196ff4e897bd7085872f3a30644dca07fa787816"},
+    {file = "hiredis-3.3.0-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:f7f80442a32ce51ee5d89aeb5a84ee56189a0e0e875f1a57bbf8d462555ae48f"},
+    {file = "hiredis-3.3.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:a1a67530da714954ed50579f4fe1ab0ddbac9c43643b1721c2cb226a50dde263"},
+    {file = "hiredis-3.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:616868352e47ab355559adca30f4f3859f9db895b4e7bc71e2323409a2add751"},
+    {file = "hiredis-3.3.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e799b79f3150083e9702fc37e6243c0bd47a443d6eae3f3077b0b3f510d6a145"},
+    {file = "hiredis-3.3.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9ef1dfb0d2c92c3701655e2927e6bbe10c499aba632c7ea57b6392516df3864b"},
+    {file = "hiredis-3.3.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c290da6bc2a57e854c7da9956cd65013483ede935677e84560da3b848f253596"},
+    {file = "hiredis-3.3.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fd8c438d9e1728f0085bf9b3c9484d19ec31f41002311464e75b69550c32ffa8"},
+    {file = "hiredis-3.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:1bbc6b8a88bbe331e3ebf6685452cebca6dfe6d38a6d4efc5651d7e363ba28bd"},
+    {file = "hiredis-3.3.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:55d8c18fe9a05496c5c04e6eccc695169d89bf358dff964bcad95696958ec05f"},
+    {file = "hiredis-3.3.0-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:4ddc79afa76b805d364e202a754666cb3c4d9c85153cbfed522871ff55827838"},
+    {file = "hiredis-3.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:8e8a4b8540581dcd1b2b25827a54cfd538e0afeaa1a0e3ca87ad7126965981cc"},
+    {file = "hiredis-3.3.0-cp314-cp314t-win32.whl", hash = "sha256:298593bb08487753b3afe6dc38bac2532e9bac8dcee8d992ef9977d539cc6776"},
+    {file = "hiredis-3.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:b442b6ab038a6f3b5109874d2514c4edf389d8d8b553f10f12654548808683bc"},
+    {file = "hiredis-3.3.0-cp38-cp38-macosx_10_15_universal2.whl", hash = "sha256:114c0b9f1b5fad99edae38e747018aead358a4f4e9720cc1876495d78cdb8276"},
+    {file = "hiredis-3.3.0-cp38-cp38-macosx_10_15_x86_64.whl", hash = "sha256:c6d91a5e6904ed7eca21d74b041e03f2ad598dd08a6065b06a776974fe5d003c"},
+    {file = "hiredis-3.3.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:76374faa075e996c895cbe106ba923852a9f8146f2aa59eba22111c5e5ec6316"},
+    {file = "hiredis-3.3.0-cp38-cp38-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:50a54397bd104c2e2f5b7696bbdab8ba2973d3075e4deb932adb025b8863de91"},
+    {file = "hiredis-3.3.0-cp38-cp38-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:15edee02cc9cc06e07e2bcfae07e283e640cc1aeedd08b4c6934bf1a0113c607"},
+    {file = "hiredis-3.3.0-cp38-cp38-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:ff3179a57745d0f8d71fa8bf3ea3944d3f557dcfa4431304497987fecad381dd"},
+    {file = "hiredis-3.3.0-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bdb7cd9e1e73db78f145a09bb837732790d0912eb963dee5768631faf2ece162"},
+    {file = "hiredis-3.3.0-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:4d3b4e0d4445faf9041c52a98cb5d2b65c4fcaebb2aa02efa7c6517c4917f7e8"},
+    {file = "hiredis-3.3.0-cp38-cp38-musllinux_1_2_ppc64le.whl", hash = "sha256:ffea6c407cff532c7599d3ec9e8502c2c865753cebab044f3dfce9afbf71a8df"},
+    {file = "hiredis-3.3.0-cp38-cp38-musllinux_1_2_s390x.whl", hash = "sha256:bcd745a28e1b3216e42680d91e142a42569dfad68a6f40535080c47b0356c796"},
+    {file = "hiredis-3.3.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:4c18a97ea55d1a58f5c3adfe236b3e7cccedc6735cbd36ab1c786c52fd823667"},
+    {file = "hiredis-3.3.0-cp38-cp38-win32.whl", hash = "sha256:77eacd969e3c6ff50c2b078c27d2a773c652248a5d81af5765a8663478d0bc02"},
+    {file = "hiredis-3.3.0-cp38-cp38-win_amd64.whl", hash = "sha256:161a4a595a53475587aef8dc549d0527962879b0c5d62f7947b44ba7e5084b76"},
+    {file = "hiredis-3.3.0-cp39-cp39-macosx_10_15_universal2.whl", hash = "sha256:1203697a7ebadc7cf873acc189df9e44fcb377b636e6660471707ac8d5bcba68"},
+    {file = "hiredis-3.3.0-cp39-cp39-macosx_10_15_x86_64.whl", hash = "sha256:9a7ea2344d277317160da4911f885bcf7dfd8381b830d76b442f7775b41544b3"},
+    {file = "hiredis-3.3.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:9bd7c9a089cf4e4f4b5a61f412c76293449bac6b0bf92bb49a3892850bd5c899"},
+    {file = "hiredis-3.3.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:294de11e3995128c784534e327d1f9382b88dc5407356465df7934c710e8392d"},
+    {file = "hiredis-3.3.0-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4a3aab895358368f81f9546a7cd192b6fb427f785cb1a8853cf9db38df01e9ca"},
+    {file = "hiredis-3.3.0-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:eaf8418e33e23d6d7ef0128eff4c06ab3040d40b9bbc8a24d6265d751a472596"},
+    {file = "hiredis-3.3.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:41aea51949142bad4e40badb0396392d7f4394791e4097a0951ab75bcc58ff84"},
+    {file = "hiredis-3.3.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:1f9a5f84a8bd29ac5b9953b27e8ba5508396afeabf1d165611a1e31fbd90a0e1"},
+    {file = "hiredis-3.3.0-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:a5f9fde56550ebbe962f437a4c982b0856d03aea7fab09e30fa6c0f9be992b40"},
+    {file = "hiredis-3.3.0-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:c567aab02612d91f3e747fc492100ae894515194f85d6fb6bb68958c0e718721"},
+    {file = "hiredis-3.3.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:ca97c5e6f9e9b9f0aed61b70fed2d594ce2f7472905077d2d10b307c50a41008"},
+    {file = "hiredis-3.3.0-cp39-cp39-win32.whl", hash = "sha256:776dc5769d5eb05e969216de095377ff61c802414a74bd3c24a4ca8526c897ab"},
+    {file = "hiredis-3.3.0-cp39-cp39-win_amd64.whl", hash = "sha256:538a9f5fbb3a8a4ef0c3abd309cccb90cd2ba9976fcc2b44193af9507d005b48"},
+    {file = "hiredis-3.3.0.tar.gz", hash = "sha256:105596aad9249634361815c574351f1bd50455dc23b537c2940066c4a9dea685"},
 ]
 
 [[package]]
@@ -641,34 +732,34 @@ idna = ">=2.5"
 
 [[package]]
 name = "id"
-version = "1.5.0"
+version = "1.6.1"
 description = "A tool for generating OIDC identities"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "id-1.5.0-py3-none-any.whl", hash = "sha256:f1434e1cef91f2cbb8a4ec64663d5a23b9ed43ef44c4c957d02583d61714c658"},
-    {file = "id-1.5.0.tar.gz", hash = "sha256:292cb8a49eacbbdbce97244f47a97b4c62540169c976552e497fd57df0734c1d"},
+    {file = "id-1.6.1-py3-none-any.whl", hash = "sha256:f5ec41ed2629a508f5d0988eda142e190c9c6da971100612c4de9ad9f9b237ca"},
+    {file = "id-1.6.1.tar.gz", hash = "sha256:d0732d624fb46fd4e7bc4e5152f00214450953b9e772c182c1c22964def1a069"},
 ]
 
 [package.dependencies]
-requests = "*"
+urllib3 = ">=2,<3"
 
 [package.extras]
 dev = ["build", "bump (>=1.3.2)", "id[lint,test]"]
-lint = ["bandit", "interrogate", "mypy", "ruff (<0.8.2)", "types-requests"]
+lint = ["bandit", "interrogate", "mypy", "ruff (<0.14.15)"]
 test = ["coverage[toml]", "pretend", "pytest", "pytest-cov"]
 
 [[package]]
 name = "idna"
-version = "3.10"
+version = "3.11"
 description = "Internationalized Domain Names in Applications (IDNA)"
 optional = false
-python-versions = ">=3.6"
+python-versions = ">=3.8"
 groups = ["main", "dev"]
 files = [
-    {file = "idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3"},
-    {file = "idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9"},
+    {file = "idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea"},
+    {file = "idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902"},
 ]
 
 [package.extras]
@@ -676,171 +767,162 @@ all = ["flake8 (>=7.1.1)", "mypy (>=1.11.2)", "pytest (>=8.3.2)", "ruff (>=0.6.2
 
 [[package]]
 name = "ijson"
-version = "3.4.0"
+version = "3.5.0"
 description = "Iterative JSON parser with standard Python iterator interfaces"
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "ijson-3.4.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e27e50f6dcdee648f704abc5d31b976cd2f90b4642ed447cf03296d138433d09"},
-    {file = "ijson-3.4.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:2a753be681ac930740a4af9c93cfb4edc49a167faed48061ea650dc5b0f406f1"},
-    {file = "ijson-3.4.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:a07c47aed534e0ec198e6a2d4360b259d32ac654af59c015afc517ad7973b7fb"},
-    {file = "ijson-3.4.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9c55f48181e11c597cd7146fb31edc8058391201ead69f8f40d2ecbb0b3e4fc6"},
-    {file = "ijson-3.4.0-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:abd5669f96f79d8a2dd5ae81cbd06770a4d42c435fd4a75c74ef28d9913b697d"},
-    {file = "ijson-3.4.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3e3ddd46d16b8542c63b1b8af7006c758d4e21cc1b86122c15f8530fae773461"},
-    {file = "ijson-3.4.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:1504cec7fe04be2bb0cc33b50c9dd3f83f98c0540ad4991d4017373b7853cfe6"},
-    {file = "ijson-3.4.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:2f2ff456adeb216603e25d7915f10584c1b958b6eafa60038d76d08fc8a5fb06"},
-    {file = "ijson-3.4.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:0ab00d75d61613a125fbbb524551658b1ad6919a52271ca16563ca5bc2737bb1"},
-    {file = "ijson-3.4.0-cp310-cp310-win32.whl", hash = "sha256:ada421fd59fe2bfa4cfa64ba39aeba3f0753696cdcd4d50396a85f38b1d12b01"},
-    {file = "ijson-3.4.0-cp310-cp310-win_amd64.whl", hash = "sha256:8c75e82cec05d00ed3a4af5f4edf08f59d536ed1a86ac7e84044870872d82a33"},
-    {file = "ijson-3.4.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9e369bf5a173ca51846c243002ad8025d32032532523b06510881ecc8723ee54"},
-    {file = "ijson-3.4.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:26e7da0a3cd2a56a1fde1b34231867693f21c528b683856f6691e95f9f39caec"},
-    {file = "ijson-3.4.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1c28c7f604729be22aa453e604e9617b665fa0c24cd25f9f47a970e8130c571a"},
-    {file = "ijson-3.4.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0bed8bcb84d3468940f97869da323ba09ae3e6b950df11dea9b62e2b231ca1e3"},
-    {file = "ijson-3.4.0-cp311-cp311-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:296bc824f4088f2af814aaf973b0435bc887ce3d9f517b1577cc4e7d1afb1cb7"},
-    {file = "ijson-3.4.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8145f8f40617b6a8aa24e28559d0adc8b889e56a203725226a8a60fa3501073f"},
-    {file = "ijson-3.4.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:b674a97bd503ea21bc85103e06b6493b1b2a12da3372950f53e1c664566a33a4"},
-    {file = "ijson-3.4.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:8bc731cf1c3282b021d3407a601a5a327613da9ad3c4cecb1123232623ae1826"},
-    {file = "ijson-3.4.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:42ace5e940e0cf58c9de72f688d6829ddd815096d07927ee7e77df2648006365"},
-    {file = "ijson-3.4.0-cp311-cp311-win32.whl", hash = "sha256:5be39a0df4cd3f02b304382ea8885391900ac62e95888af47525a287c50005e9"},
-    {file = "ijson-3.4.0-cp311-cp311-win_amd64.whl", hash = "sha256:0b1be1781792291e70d2e177acf564ec672a7907ba74f313583bdf39fe81f9b7"},
-    {file = "ijson-3.4.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:956b148f88259a80a9027ffbe2d91705fae0c004fbfba3e5a24028fbe72311a9"},
-    {file = "ijson-3.4.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:06b89960f5c721106394c7fba5760b3f67c515b8eb7d80f612388f5eca2f4621"},
-    {file = "ijson-3.4.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:9a0bb591cf250dd7e9dfab69d634745a7f3272d31cfe879f9156e0a081fd97ee"},
-    {file = "ijson-3.4.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:72e92de999977f4c6b660ffcf2b8d59604ccd531edcbfde05b642baf283e0de8"},
-    {file = "ijson-3.4.0-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9e9602157a5b869d44b6896e64f502c712a312fcde044c2e586fccb85d3e316e"},
-    {file = "ijson-3.4.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b1e83660edb931a425b7ff662eb49db1f10d30ca6d4d350e5630edbed098bc01"},
-    {file = "ijson-3.4.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:49bf8eac1c7b7913073865a859c215488461f7591b4fa6a33c14b51cb73659d0"},
-    {file = "ijson-3.4.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:160b09273cb42019f1811469508b0a057d19f26434d44752bde6f281da6d3f32"},
-    {file = "ijson-3.4.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2019ff4e6f354aa00c76c8591bd450899111c61f2354ad55cc127e2ce2492c44"},
-    {file = "ijson-3.4.0-cp312-cp312-win32.whl", hash = "sha256:931c007bf6bb8330705429989b2deed6838c22b63358a330bf362b6e458ba0bf"},
-    {file = "ijson-3.4.0-cp312-cp312-win_amd64.whl", hash = "sha256:71523f2b64cb856a820223e94d23e88369f193017ecc789bb4de198cc9d349eb"},
-    {file = "ijson-3.4.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:e8d96f88d75196a61c9d9443de2b72c2d4a7ba9456ff117b57ae3bba23a54256"},
-    {file = "ijson-3.4.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:c45906ce2c1d3b62f15645476fc3a6ca279549127f01662a39ca5ed334a00cf9"},
-    {file = "ijson-3.4.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4ab4bc2119b35c4363ea49f29563612237cae9413d2fbe54b223be098b97bc9e"},
-    {file = "ijson-3.4.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:97b0a9b5a15e61dfb1f14921ea4e0dba39f3a650df6d8f444ddbc2b19b479ff1"},
-    {file = "ijson-3.4.0-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e3047bb994dabedf11de11076ed1147a307924b6e5e2df6784fb2599c4ad8c60"},
-    {file = "ijson-3.4.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:68c83161b052e9f5dc8191acbc862bb1e63f8a35344cb5cd0db1afd3afd487a6"},
-    {file = "ijson-3.4.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1eebd9b6c20eb1dffde0ae1f0fbb4aeacec2eb7b89adb5c7c0449fc9fd742760"},
-    {file = "ijson-3.4.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:13fb6d5c35192c541421f3ee81239d91fc15a8d8f26c869250f941f4b346a86c"},
-    {file = "ijson-3.4.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:28b7196ff7b37c4897c547a28fa4876919696739fc91c1f347651c9736877c69"},
-    {file = "ijson-3.4.0-cp313-cp313-win32.whl", hash = "sha256:3c2691d2da42629522140f77b99587d6f5010440d58d36616f33bc7bdc830cc3"},
-    {file = "ijson-3.4.0-cp313-cp313-win_amd64.whl", hash = "sha256:c4554718c275a044c47eb3874f78f2c939f300215d9031e785a6711cc51b83fc"},
-    {file = "ijson-3.4.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:915a65e3f3c0eee2ea937bc62aaedb6c14cc1e8f0bb9f3f4fb5a9e2bbfa4b480"},
-    {file = "ijson-3.4.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:afbe9748707684b6c5adc295c4fdcf27765b300aec4d484e14a13dca4e5c0afa"},
-    {file = "ijson-3.4.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:d823f8f321b4d8d5fa020d0a84f089fec5d52b7c0762430476d9f8bf95bbc1a9"},
-    {file = "ijson-3.4.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b8a0a2c54f3becf76881188beefd98b484b1d3bd005769a740d5b433b089fa23"},
-    {file = "ijson-3.4.0-cp313-cp313t-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ced19a83ab09afa16257a0b15bc1aa888dbc555cb754be09d375c7f8d41051f2"},
-    {file = "ijson-3.4.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8100f9885eff1f38d35cef80ef759a1bbf5fc946349afa681bd7d0e681b7f1a0"},
-    {file = "ijson-3.4.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:d7bcc3f7f21b0f703031ecd15209b1284ea51b2a329d66074b5261de3916c1eb"},
-    {file = "ijson-3.4.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:2dcb190227b09dd171bdcbfe4720fddd574933c66314818dfb3960c8a6246a77"},
-    {file = "ijson-3.4.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:eda4cfb1d49c6073a901735aaa62e39cb7ab47f3ad7bb184862562f776f1fa8a"},
-    {file = "ijson-3.4.0-cp313-cp313t-win32.whl", hash = "sha256:0772638efa1f3b72b51736833404f1cbd2f5beeb9c1a3d392e7d385b9160cba7"},
-    {file = "ijson-3.4.0-cp313-cp313t-win_amd64.whl", hash = "sha256:3d8a0d67f36e4fb97c61a724456ef0791504b16ce6f74917a31c2e92309bbeb9"},
-    {file = "ijson-3.4.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:8a990401dc7350c1739f42187823e68d2ef6964b55040c6e9f3a29461f9929e2"},
-    {file = "ijson-3.4.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:80f50e0f5da4cd6b65e2d8ff38cb61b26559608a05dd3a3f9cfa6f19848e6f22"},
-    {file = "ijson-3.4.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:2d9ca52f5650d820a2e7aa672dea1c560f609e165337e5b3ed7cf56d696bf309"},
-    {file = "ijson-3.4.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:940c8c5fd20fb89b56dde9194a4f1c7b779149f1ab26af6d8dc1da51a95d26dd"},
-    {file = "ijson-3.4.0-cp39-cp39-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:41dbb525666017ad856ac9b4f0f4b87d3e56b7dfde680d5f6d123556b22e2172"},
-    {file = "ijson-3.4.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a9f84f5e2eea5c2d271c97221c382db005534294d1175ddd046a12369617c41c"},
-    {file = "ijson-3.4.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:c0cd126c11835839bba8ac0baaba568f67d701fc4f717791cf37b10b74a2ebd7"},
-    {file = "ijson-3.4.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:f9a9d3bbc6d91c24a2524a189d2aca703cb5f7e8eb34ad0aff3c91702404a983"},
-    {file = "ijson-3.4.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:56679ee133470d0f1f598a8ad109d760fcfebeef4819531e29335aefb7e4cb1a"},
-    {file = "ijson-3.4.0-cp39-cp39-win32.whl", hash = "sha256:583c15ded42ba80104fa1d0fa0dfdd89bb47922f3bb893a931bb843aeb55a3f3"},
-    {file = "ijson-3.4.0-cp39-cp39-win_amd64.whl", hash = "sha256:4563e603e56f4451572d96b47311dffef5b933d825f3417881d4d3630c6edac2"},
-    {file = "ijson-3.4.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:54e989c35dba9cf163d532c14bcf0c260897d5f465643f0cd1fba9c908bed7ef"},
-    {file = "ijson-3.4.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:494eeb8e87afef22fbb969a4cb81ac2c535f30406f334fb6136e9117b0bb5380"},
-    {file = "ijson-3.4.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:81603de95de1688958af65cd2294881a4790edae7de540b70c65c8253c5dc44a"},
-    {file = "ijson-3.4.0-pp310-pypy310_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:8524be12c1773e1be466034cc49c1ecbe3d5b47bb86217bd2a57f73f970a6c19"},
-    {file = "ijson-3.4.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:17994696ec895d05e0cfa21b11c68c920c82634b4a3d8b8a1455d6fe9fdee8f7"},
-    {file = "ijson-3.4.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:0b67727aaee55d43b2e82b6a866c3cbcb2b66a5e9894212190cbd8773d0d9857"},
-    {file = "ijson-3.4.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:cdc8c5ca0eec789ed99db29c68012dda05027af0860bb360afd28d825238d69d"},
-    {file = "ijson-3.4.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:8e6b44b6ec45d5b1a0ee9d97e0e65ab7f62258727004cbbe202bf5f198bc21f7"},
-    {file = "ijson-3.4.0-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b51e239e4cb537929796e840d349fc731fdc0d58b1a0683ce5465ad725321e0f"},
-    {file = "ijson-3.4.0-pp311-pypy311_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ed05d43ec02be8ddb1ab59579761f6656b25d241a77fd74f4f0f7ec09074318a"},
-    {file = "ijson-3.4.0-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cfeca1aaa59d93fd0a3718cbe5f7ef0effff85cf837e0bceb71831a47f39cc14"},
-    {file = "ijson-3.4.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:7ca72ca12e9a1dd4252c97d952be34282907f263f7e28fcdff3a01b83981e837"},
-    {file = "ijson-3.4.0-pp39-pypy39_pp73-macosx_10_15_x86_64.whl", hash = "sha256:0f79b2cd52bd220fff83b3ee4ef89b54fd897f57cc8564a6d8ab7ac669de3930"},
-    {file = "ijson-3.4.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:d16eed737610ad5ad8989b5864fbe09c64133129734e840c29085bb0d497fb03"},
-    {file = "ijson-3.4.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6b3aac1d7a27e1e3bdec5bd0689afe55c34aa499baa06a80852eda31f1ffa6dc"},
-    {file = "ijson-3.4.0-pp39-pypy39_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:784ae654aa9851851e87f323e9429b20b58a5399f83e6a7e348e080f2892081f"},
-    {file = "ijson-3.4.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5d05bd8fa6a8adefb32bbf7b993d2a2f4507db08453dd1a444c281413a6d9685"},
-    {file = "ijson-3.4.0-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:b5a05fd935cc28786b88c16976313086cd96414c6a3eb0a3822c47ab48b1793e"},
-    {file = "ijson-3.4.0.tar.gz", hash = "sha256:5f74dcbad9d592c428d3ca3957f7115a42689ee7ee941458860900236ae9bb13"},
+    {file = "ijson-3.5.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:ea8dcac10d86adaeead454bc25c97b68d0bda573d5fd6f86f5e21cf8f7906f88"},
+    {file = "ijson-3.5.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:92b0495bbb2150bbf14fc5d98fb6d76bcd1c526605a172709e602e6fedc96495"},
+    {file = "ijson-3.5.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:7af0c4c8943be8b09a4e57bdc1da6001dae7b36526d4154fe5c8224738d0921f"},
+    {file = "ijson-3.5.0-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:45887d5e84ff0d2b138c926cebd9071830733968afe8d9d12080b3c178c7f918"},
+    {file = "ijson-3.5.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9a70b575be8e57a28c80e90ed349ad3a851c3478524c70e36e07d6092ecd12c9"},
+    {file = "ijson-3.5.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2adeecd45830bfd5580ca79a584154713aabef0b9607e16249133df5d2859813"},
+    {file = "ijson-3.5.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:d873e72889e7fc5962ab58909f1adff338d7c2f49e450e5b5fe844eff8155a14"},
+    {file = "ijson-3.5.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:9a88c559456a79708592234d697645d92b599718f4cbbeaa6515f83ac63ca0ae"},
+    {file = "ijson-3.5.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:cf83f58ad50dc0d39a2105cb26d4f359b38f42cef68b913170d4d47d97d97ba5"},
+    {file = "ijson-3.5.0-cp310-cp310-win32.whl", hash = "sha256:aec4580a7712a19b1f95cd41bed260fc6a31266d37ef941827772a4c199e8143"},
+    {file = "ijson-3.5.0-cp310-cp310-win_amd64.whl", hash = "sha256:9a9c4c70501e23e8eb1675330686d1598eebfa14b6f0dbc8f00c2e081cc628fa"},
+    {file = "ijson-3.5.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:5616311404b858d32740b7ad8b9a799c62165f5ecb85d0a8ed16c21665a90533"},
+    {file = "ijson-3.5.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:e9733f94029dd41702d573ef64752e2556e72aea14623d6dbb7a44ca1ccf30fd"},
+    {file = "ijson-3.5.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:db8398c6721b98412a4f618da8022550c8b9c5d9214040646071b5deb4d4a393"},
+    {file = "ijson-3.5.0-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:c061314845c08163b1784b6076ea5f075372461a32e6916f4e5f211fd4130b64"},
+    {file = "ijson-3.5.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1111a1c5ac79119c5d6e836f900c1a53844b50a18af38311baa6bb61e2645aca"},
+    {file = "ijson-3.5.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1e74aff8c681c24002b61b1822f9511d4c384f324f7dbc08c78538e01fdc9fcb"},
+    {file = "ijson-3.5.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:739a7229b1b0cc5f7e2785a6e7a5fc915e850d3fed9588d0e89a09f88a417253"},
+    {file = "ijson-3.5.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:ef88712160360cab3ca6471a4e5418243f8b267cf1fe1620879d1b5558babc71"},
+    {file = "ijson-3.5.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:6ca0d1b6b5f8166a6248f4309497585fb8553b04bc8179a0260fad636cfdb798"},
+    {file = "ijson-3.5.0-cp311-cp311-win32.whl", hash = "sha256:966039cf9047c7967febf7b9a52ec6f38f5464a4c7fbb5565e0224b7376fefff"},
+    {file = "ijson-3.5.0-cp311-cp311-win_amd64.whl", hash = "sha256:6bad6a1634cb7c9f3f4c7e52325283b35b565f5b6cc27d42660c6912ce883422"},
+    {file = "ijson-3.5.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:1ebefbe149a6106cc848a3eaf536af51a9b5ccc9082de801389f152dba6ab755"},
+    {file = "ijson-3.5.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:19e30d9f00f82e64de689c0b8651b9cfed879c184b139d7e1ea5030cec401c21"},
+    {file = "ijson-3.5.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:a04a33ee78a6f27b9b8528c1ca3c207b1df3b8b867a4cf2fcc4109986f35c227"},
+    {file = "ijson-3.5.0-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:7d48dc2984af02eb3c56edfb3f13b3f62f2f3e4fe36f058c8cfc75d93adf4fed"},
+    {file = "ijson-3.5.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f1e73a44844d9adbca9cf2c4132cd875933e83f3d4b23881fcaf82be83644c7d"},
+    {file = "ijson-3.5.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7389a56b8562a19948bdf1d7bae3a2edc8c7f86fb59834dcb1c4c722818e645a"},
+    {file = "ijson-3.5.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3176f23f8ebec83f374ed0c3b4e5a0c4db7ede54c005864efebbed46da123608"},
+    {file = "ijson-3.5.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:6babd88e508630c6ef86c9bebaaf13bb2fb8ec1d8f8868773a03c20253f599bc"},
+    {file = "ijson-3.5.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:dc1b3836b174b6db2fa8319f1926fb5445abd195dc963368092103f8579cb8ed"},
+    {file = "ijson-3.5.0-cp312-cp312-win32.whl", hash = "sha256:6673de9395fb9893c1c79a43becd8c8fbee0a250be6ea324bfd1487bb5e9ee4c"},
+    {file = "ijson-3.5.0-cp312-cp312-win_amd64.whl", hash = "sha256:f4f7fabd653459dcb004175235f310435959b1bb5dfa8878578391c6cc9ad944"},
+    {file = "ijson-3.5.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:e9cedc10e40dd6023c351ed8bfc7dcfce58204f15c321c3c1546b9c7b12562a4"},
+    {file = "ijson-3.5.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:3647649f782ee06c97490b43680371186651f3f69bebe64c6083ee7615d185e5"},
+    {file = "ijson-3.5.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:90e74be1dce05fce73451c62d1118671f78f47c9f6be3991c82b91063bf01fc9"},
+    {file = "ijson-3.5.0-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:78e9ad73e7be2dd80627504bd5cbf512348c55ce2c06e362ed7683b5220e8568"},
+    {file = "ijson-3.5.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9577449313cc94be89a4fe4b3e716c65f09cc19636d5a6b2861c4e80dddebd58"},
+    {file = "ijson-3.5.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3e4c1178fb50aff5f5701a30a5152ead82a14e189ce0f6102fa1b5f10b2f54ff"},
+    {file = "ijson-3.5.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0eb402ab026ffb37a918d75af2b7260fe6cfbce13232cc83728a714dd30bd81d"},
+    {file = "ijson-3.5.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:5b08ee08355f9f729612a8eb9bf69cc14f9310c3b2a487c6f1c3c65d85216ec4"},
+    {file = "ijson-3.5.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:bda62b6d48442903e7bf56152108afb7f0f1293c2b9bef2f2c369defea76ab18"},
+    {file = "ijson-3.5.0-cp313-cp313-win32.whl", hash = "sha256:8d073d9b13574cfa11083cc7267c238b7a6ed563c2661e79192da4a25f09c82c"},
+    {file = "ijson-3.5.0-cp313-cp313-win_amd64.whl", hash = "sha256:2419f9e32e0968a876b04d8f26aeac042abd16f582810b576936bbc4c6015069"},
+    {file = "ijson-3.5.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:4d4b0cd676b8c842f7648c1a783448fac5cd3b98289abd83711b3e275e143524"},
+    {file = "ijson-3.5.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:252dec3680a48bb82d475e36b4ae1b3a9d7eb690b951bb98a76c5fe519e30188"},
+    {file = "ijson-3.5.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:aa1b5dca97d323931fde2501172337384c958914d81a9dac7f00f0d4bfc76bc7"},
+    {file = "ijson-3.5.0-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:7a5ec7fd86d606094bba6f6f8f87494897102fa4584ef653f3005c51a784c320"},
+    {file = "ijson-3.5.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:009f41443e1521847701c6d87fa3923c0b1961be3c7e7de90947c8cb92ea7c44"},
+    {file = "ijson-3.5.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e4c3651d1f9fe2839a93fdf8fd1d5ca3a54975349894249f3b1b572bcc4bd577"},
+    {file = "ijson-3.5.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:945b7abcfcfeae2cde17d8d900870f03536494245dda7ad4f8d056faa303256c"},
+    {file = "ijson-3.5.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:0574b0a841ff97495c13e9d7260fbf3d85358b061f540c52a123db9dbbaa2ed6"},
+    {file = "ijson-3.5.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:f969ffb2b89c5cdf686652d7fb66252bc72126fa54d416317411497276056a18"},
+    {file = "ijson-3.5.0-cp313-cp313t-win32.whl", hash = "sha256:59d3f9f46deed1332ad669518b8099920512a78bda64c1f021fcd2aff2b36693"},
+    {file = "ijson-3.5.0-cp313-cp313t-win_amd64.whl", hash = "sha256:5c2839fa233746d8aad3b8cd2354e441613f5df66d721d59da4a09394bd1db2b"},
+    {file = "ijson-3.5.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:25a5a6b2045c90bb83061df27cfa43572afa43ba9408611d7bfe237c20a731a9"},
+    {file = "ijson-3.5.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:8976c54c0b864bc82b951bae06567566ac77ef63b90a773a69cd73aab47f4f4f"},
+    {file = "ijson-3.5.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:859eb2038f7f1b0664df4241957694cc35e6295992d71c98659b22c69b3cbc10"},
+    {file = "ijson-3.5.0-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:c911aa02991c7c0d3639b6619b93a93210ff1e7f58bf7225d613abea10adc78e"},
+    {file = "ijson-3.5.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:903cbdc350173605220edc19796fbea9b2203c8b3951fb7335abfa8ed37afda8"},
+    {file = "ijson-3.5.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a4549d96ded5b8efa71639b2160235415f6bdb8c83367615e2dbabcb72755c33"},
+    {file = "ijson-3.5.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:6b2dcf6349e6042d83f3f8c39ce84823cf7577eba25bac5aae5e39bbbbbe9c1c"},
+    {file = "ijson-3.5.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:e44af39e6f8a17e5627dcd89715d8279bf3474153ff99aae031a936e5c5572e5"},
+    {file = "ijson-3.5.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:9260332304b7e7828db56d43f08fc970a3ab741bf84ff10189361ea1b60c395b"},
+    {file = "ijson-3.5.0-cp314-cp314-win32.whl", hash = "sha256:63bc8121bb422f6969ced270173a3fa692c29d4ae30c860a2309941abd81012a"},
+    {file = "ijson-3.5.0-cp314-cp314-win_amd64.whl", hash = "sha256:01b6dad72b7b7df225ef970d334556dfad46c696a2c6767fb5d9ed8889728bca"},
+    {file = "ijson-3.5.0-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:2ea4b676ec98e374c1df400a47929859e4fa1239274339024df4716e802aa7e4"},
+    {file = "ijson-3.5.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:014586eec043e23c80be9a923c56c3a0920a0f1f7d17478ce7bc20ba443968ef"},
+    {file = "ijson-3.5.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:d5b8b886b0248652d437f66e7c5ac318bbdcb2c7137a7e5327a68ca00b286f5f"},
+    {file = "ijson-3.5.0-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:498fd46ae2349297e43acf97cdc421e711dbd7198418677259393d2acdc62d78"},
+    {file = "ijson-3.5.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:22a51b4f9b81f12793731cf226266d1de2112c3c04ba4a04117ad4e466897e05"},
+    {file = "ijson-3.5.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9636c710dc4ac4a281baa266a64f323b4cc165cec26836af702c44328b59a515"},
+    {file = "ijson-3.5.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:f7168a39e8211107666d71b25693fd1b2bac0b33735ef744114c403c6cac21e1"},
+    {file = "ijson-3.5.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:8696454245415bc617ab03b0dc3ae4c86987df5dc6a90bad378fe72c5409d89e"},
+    {file = "ijson-3.5.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:c21bfb61f71f191565885bf1bc29e0a186292d866b4880637b833848360bdc1b"},
+    {file = "ijson-3.5.0-cp314-cp314t-win32.whl", hash = "sha256:a2619460d6795b70d0155e5bf016200ac8a63ab5397aa33588bb02b6c21759e6"},
+    {file = "ijson-3.5.0-cp314-cp314t-win_amd64.whl", hash = "sha256:4f24b78d4ef028d17eb57ad1b16c0aed4a17bdd9badbf232dc5d9305b7e13854"},
+    {file = "ijson-3.5.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:0ec62d397447cbe4941818c53e22b054e03250ff9cdbaea75144b11bc6db44ed"},
+    {file = "ijson-3.5.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:75980237a16e5e36ad46fbdd33e3f3d817c187624974c48947df0a2bfa104b9e"},
+    {file = "ijson-3.5.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:a9c321e8e1cdeac8aac698d09a90d98a049c9be8e8330c89cf2fcc517c96d51d"},
+    {file = "ijson-3.5.0-cp39-cp39-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:92878b130d7ad71919c70b4f50ad23ec7fbf2d09a9c675f9179d49c4be869a63"},
+    {file = "ijson-3.5.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a1ab890d43656c1d12c4a8dafb7fac5a2278ed3e4408102e0971f48b6ed4583d"},
+    {file = "ijson-3.5.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a55185e8983fef0b21abc1a0bbaa11eeb2fabdc651e2167f23defa9fe4eb999b"},
+    {file = "ijson-3.5.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:5a3af031e30751164c3289294f249f942535fbe7e8f35eb3ecc374247449214e"},
+    {file = "ijson-3.5.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:f4c8f5ccf7230a9a94c1d836322783ed0c0ec2a151f3d53b2e0a67c89ad66970"},
+    {file = "ijson-3.5.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:6e249796d2090afc1c42d2458ab0dbf0072a30ffa246b5683e3f7b9dc9b1b7f9"},
+    {file = "ijson-3.5.0-cp39-cp39-win32.whl", hash = "sha256:1b2cf2c0c79313fbc607a0d90788ffb4f4614872983af4aa85c5b92533ec4da2"},
+    {file = "ijson-3.5.0-cp39-cp39-win_amd64.whl", hash = "sha256:d38cb03f6b7cc26d542ff710adfe98e5f6d53878461c45456c97d3668297ec0d"},
+    {file = "ijson-3.5.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:d64c624da0e9d692d6eb0ff63a79656b59d76bf80773a17c5b0f835e4e8ef627"},
+    {file = "ijson-3.5.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:876f7df73b7e0d6474f9caa729b9cdbfc8e76de9075a4887dfd689e29e85c4ca"},
+    {file = "ijson-3.5.0-pp311-pypy311_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:e7dbff2c8d9027809b0cde663df44f3210da10ea377121d42896fb6ee405dd31"},
+    {file = "ijson-3.5.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4217a1edc278660679e1197c83a1a2a2d367792bfbb2a3279577f4b59b93730d"},
+    {file = "ijson-3.5.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:04f0fc740311388ee745ba55a12292b722d6f52000b11acbb913982ba5fbdf87"},
+    {file = "ijson-3.5.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:fdeee6957f92e0c114f65c55cf8fe7eabb80cfacab64eea6864060913173f66d"},
+    {file = "ijson-3.5.0.tar.gz", hash = "sha256:94688760720e3f5212731b3cb8d30267f9a045fb38fb3870254e7b9504246f31"},
 ]
 
 [[package]]
 name = "immutabledict"
-version = "4.2.1"
+version = "4.3.1"
 description = "Immutable wrapper around dictionaries (a fork of frozendict)"
 optional = false
-python-versions = ">=3.8"
+python-versions = "<4.0,>=3.8"
 groups = ["main"]
 files = [
-    {file = "immutabledict-4.2.1-py3-none-any.whl", hash = "sha256:c56a26ced38c236f79e74af3ccce53772827cef5c3bce7cab33ff2060f756373"},
-    {file = "immutabledict-4.2.1.tar.gz", hash = "sha256:d91017248981c72eb66c8ff9834e99c2f53562346f23e7f51e7a5ebcf66a3bcc"},
+    {file = "immutabledict-4.3.1-py3-none-any.whl", hash = "sha256:c9facdc0ff30fdb8e35bd16532026cac472a549e182c94fa201b51b25e4bf7bf"},
+    {file = "immutabledict-4.3.1.tar.gz", hash = "sha256:f844a669106cfdc73f47b1a9da003782fb17dc955a54c80972e0d93d1c63c514"},
 ]
 
 [[package]]
 name = "importlib-metadata"
-version = "6.7.0"
+version = "8.7.1"
 description = "Read metadata from Python packages"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
-markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\" and python_version < \"3.12\" or python_version < \"3.10\""
+markers = "python_version < \"3.12\" and platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
 files = [
-    {file = "importlib_metadata-6.7.0-py3-none-any.whl", hash = "sha256:cb52082e659e97afc5dac71e79de97d8681de3aa07ff18578330904a9d18e5b5"},
-    {file = "importlib_metadata-6.7.0.tar.gz", hash = "sha256:1aaf550d4f73e5d6783e7acb77aec43d49da8017410afae93822cc9cca98c4d4"},
+    {file = "importlib_metadata-8.7.1-py3-none-any.whl", hash = "sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151"},
+    {file = "importlib_metadata-8.7.1.tar.gz", hash = "sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb"},
 ]
 
 [package.dependencies]
-zipp = ">=0.5"
+zipp = ">=3.20"
 
 [package.extras]
-docs = ["furo", "jaraco.packaging (>=9)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\""]
+cover = ["pytest-cov"]
+doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+enabler = ["pytest-enabler (>=3.4)"]
 perf = ["ipython"]
-testing = ["flufl.flake8", "importlib-resources (>=1.3) ; python_version < \"3.9\"", "packaging", "pyfakefs", "pytest (>=6)", "pytest-black (>=0.3.7) ; platform_python_implementation != \"PyPy\"", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=1.3)", "pytest-mypy (>=0.9.1) ; platform_python_implementation != \"PyPy\"", "pytest-perf (>=0.9.2)", "pytest-ruff"]
-
-[[package]]
-name = "importlib-resources"
-version = "5.12.0"
-description = "Read resources from Python packages"
-optional = false
-python-versions = ">=3.7"
-groups = ["dev"]
-markers = "python_version < \"3.10\""
-files = [
-    {file = "importlib_resources-5.12.0-py3-none-any.whl", hash = "sha256:7b1deeebbf351c7578e09bf2f63fa2ce8b5ffec296e0d349139d43cca061a81a"},
-    {file = "importlib_resources-5.12.0.tar.gz", hash = "sha256:4be82589bf5c1d7999aedf2a45159d10cb3ca4f19b2271f8792bc8e6da7b22f6"},
-]
-
-[package.dependencies]
-zipp = {version = ">=3.1.0", markers = "python_version < \"3.10\""}
-
-[package.extras]
-docs = ["furo", "jaraco.packaging (>=9)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
-testing = ["flake8 (<5)", "pytest (>=6)", "pytest-black (>=0.3.7) ; platform_python_implementation != \"PyPy\"", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=1.3)", "pytest-flake8 ; python_version < \"3.12\"", "pytest-mypy (>=0.9.1) ; platform_python_implementation != \"PyPy\""]
+test = ["flufl.flake8", "jaraco.test (>=5.4)", "packaging", "pyfakefs", "pytest (>=6,!=8.1.*)", "pytest-perf (>=0.9.2)"]
+type = ["mypy (<1.19) ; platform_python_implementation == \"PyPy\"", "pytest-mypy (>=1.0.1)"]
 
 [[package]]
 name = "incremental"
-version = "24.7.2"
-description = "A small library that versions your Python projects."
+version = "24.11.0"
+description = "A CalVer version manager that supports the future."
 optional = false
 python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "incremental-24.7.2-py3-none-any.whl", hash = "sha256:8cb2c3431530bec48ad70513931a760f446ad6c25e8333ca5d95e24b0ed7b8fe"},
-    {file = "incremental-24.7.2.tar.gz", hash = "sha256:fb4f1d47ee60efe87d4f6f0ebb5f70b9760db2b2574c59c8e8912be4ebd464c9"},
+    {file = "incremental-24.11.0-py3-none-any.whl", hash = "sha256:a34450716b1c4341fe6676a0598e88a39e04189f4dce5dc96f656e040baa10b3"},
+    {file = "incremental-24.11.0.tar.gz", hash = "sha256:87d3480dbb083c1d736222511a8cf380012a8176c2456d01ef483242abbbcf8c"},
 ]
 
 [package.dependencies]
-setuptools = ">=61.0"
+packaging = ">=17.0"
 tomli = {version = "*", markers = "python_version < \"3.11\""}
 
-[package.extras]
-scripts = ["click (>=6.0)"]
-
 [[package]]
 name = "jaeger-client"
 version = "4.8.0"
@@ -864,40 +946,88 @@ tests = ["codecov", "coverage", "flake8", "flake8-quotes", "flake8-typing-import
 
 [[package]]
 name = "jaraco-classes"
-version = "3.2.3"
+version = "3.4.0"
 description = "Utility functions for Python class constructs"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.8"
 groups = ["dev"]
 markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
 files = [
-    {file = "jaraco.classes-3.2.3-py3-none-any.whl", hash = "sha256:2353de3288bc6b82120752201c6b1c1a14b058267fa424ed5ce5984e3b922158"},
-    {file = "jaraco.classes-3.2.3.tar.gz", hash = "sha256:89559fa5c1d3c34eff6f631ad80bb21f378dbcbb35dd161fd2c6b93f5be2f98a"},
+    {file = "jaraco.classes-3.4.0-py3-none-any.whl", hash = "sha256:f662826b6bed8cace05e7ff873ce0f9283b5c924470fe664fff1c2f00f581790"},
+    {file = "jaraco.classes-3.4.0.tar.gz", hash = "sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd"},
 ]
 
 [package.dependencies]
 more-itertools = "*"
 
 [package.extras]
-docs = ["jaraco.packaging (>=9)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)"]
-testing = ["flake8 (<5)", "pytest (>=6)", "pytest-black (>=0.3.7) ; platform_python_implementation != \"PyPy\"", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=1.3)", "pytest-flake8", "pytest-mypy (>=0.9.1) ; platform_python_implementation != \"PyPy\""]
+docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["pytest (>=6)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-mypy", "pytest-ruff (>=0.2.1)"]
+
+[[package]]
+name = "jaraco-context"
+version = "6.1.0"
+description = "Useful decorators and context managers"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
+files = [
+    {file = "jaraco_context-6.1.0-py3-none-any.whl", hash = "sha256:a43b5ed85815223d0d3cfdb6d7ca0d2bc8946f28f30b6f3216bda070f68badda"},
+    {file = "jaraco_context-6.1.0.tar.gz", hash = "sha256:129a341b0a85a7db7879e22acd66902fda67882db771754574338898b2d5d86f"},
+]
+
+[package.dependencies]
+"backports.tarfile" = {version = "*", markers = "python_version < \"3.12\""}
+
+[package.extras]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\""]
+cover = ["pytest-cov"]
+doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+enabler = ["pytest-enabler (>=3.4)"]
+test = ["jaraco.test (>=5.6.0)", "portend", "pytest (>=6,!=8.1.*)"]
+type = ["mypy (<1.19) ; platform_python_implementation == \"PyPy\"", "pytest-mypy (>=1.0.1)"]
+
+[[package]]
+name = "jaraco-functools"
+version = "4.4.0"
+description = "Functools like those found in stdlib"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
+files = [
+    {file = "jaraco_functools-4.4.0-py3-none-any.whl", hash = "sha256:9eec1e36f45c818d9bf307c8948eb03b2b56cd44087b3cdc989abca1f20b9176"},
+    {file = "jaraco_functools-4.4.0.tar.gz", hash = "sha256:da21933b0417b89515562656547a77b4931f98176eb173644c0d35032a33d6bb"},
+]
+
+[package.dependencies]
+more_itertools = "*"
+
+[package.extras]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\""]
+cover = ["pytest-cov"]
+doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+enabler = ["pytest-enabler (>=3.4)"]
+test = ["jaraco.classes", "pytest (>=6,!=8.1.*)"]
+type = ["mypy (<1.19) ; platform_python_implementation == \"PyPy\"", "pytest-mypy (>=1.0.1)"]
 
 [[package]]
 name = "jeepney"
-version = "0.8.0"
+version = "0.9.0"
 description = "Low-level, pure Python DBus protocol wrapper."
 optional = false
 python-versions = ">=3.7"
 groups = ["dev"]
 markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\" and sys_platform == \"linux\""
 files = [
-    {file = "jeepney-0.8.0-py3-none-any.whl", hash = "sha256:c0a454ad016ca575060802ee4d590dd912e35c122fa04e70306de3d076cce755"},
-    {file = "jeepney-0.8.0.tar.gz", hash = "sha256:5efe48d255973902f6badc3ce55e2aa6c5c3b3bc642059ef3a91247bcfcc5806"},
+    {file = "jeepney-0.9.0-py3-none-any.whl", hash = "sha256:97e5714520c16fc0a45695e5365a2e11b81ea79bba796e26f9f1d178cb182683"},
+    {file = "jeepney-0.9.0.tar.gz", hash = "sha256:cf0e9e845622b81e4a28df94c40345400256ec608d0e55bb8a3feaa9163f5732"},
 ]
 
 [package.extras]
-test = ["async-timeout", "pytest", "pytest-asyncio (>=0.17)", "pytest-trio", "testpath", "trio"]
-trio = ["async_generator ; python_version == \"3.6\"", "trio"]
+test = ["async-timeout ; python_version < \"3.11\"", "pytest", "pytest-asyncio (>=0.17)", "pytest-trio", "testpath", "trio"]
+trio = ["trio"]
 
 [[package]]
 name = "jinja2"
@@ -919,21 +1049,21 @@ i18n = ["Babel (>=2.7)"]
 
 [[package]]
 name = "jsonschema"
-version = "4.25.0"
+version = "4.26.0"
 description = "An implementation of JSON Schema validation for Python"
 optional = false
-python-versions = ">=3.9"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "jsonschema-4.25.0-py3-none-any.whl", hash = "sha256:24c2e8da302de79c8b9382fee3e76b355e44d2a4364bb207159ce10b517bd716"},
-    {file = "jsonschema-4.25.0.tar.gz", hash = "sha256:e63acf5c11762c0e6672ffb61482bdf57f0876684d8d249c0fe2d730d48bc55f"},
+    {file = "jsonschema-4.26.0-py3-none-any.whl", hash = "sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce"},
+    {file = "jsonschema-4.26.0.tar.gz", hash = "sha256:0c26707e2efad8aa1bfc5b7ce170f3fccc2e4918ff85989ba9ffa9facb2be326"},
 ]
 
 [package.dependencies]
 attrs = ">=22.2.0"
 jsonschema-specifications = ">=2023.03.6"
 referencing = ">=0.28.4"
-rpds-py = ">=0.7.1"
+rpds-py = ">=0.25.0"
 
 [package.extras]
 format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
@@ -941,43 +1071,49 @@ format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-
 
 [[package]]
 name = "jsonschema-specifications"
-version = "2023.6.1"
+version = "2025.9.1"
 description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "jsonschema_specifications-2023.6.1-py3-none-any.whl", hash = "sha256:3d2b82663aff01815f744bb5c7887e2121a63399b49b104a3c96145474d091d7"},
-    {file = "jsonschema_specifications-2023.6.1.tar.gz", hash = "sha256:ca1c4dd059a9e7b34101cf5b3ab7ff1d18b139f35950d598d629837ef66e8f28"},
+    {file = "jsonschema_specifications-2025.9.1-py3-none-any.whl", hash = "sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe"},
+    {file = "jsonschema_specifications-2025.9.1.tar.gz", hash = "sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d"},
 ]
 
 [package.dependencies]
-referencing = ">=0.28.0"
+referencing = ">=0.31.0"
 
 [[package]]
 name = "keyring"
-version = "23.13.1"
+version = "25.7.0"
 description = "Store and access your passwords safely."
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
 markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
 files = [
-    {file = "keyring-23.13.1-py3-none-any.whl", hash = "sha256:771ed2a91909389ed6148631de678f82ddc73737d85a927f382a8a1b157898cd"},
-    {file = "keyring-23.13.1.tar.gz", hash = "sha256:ba2e15a9b35e21908d0aaf4e0a47acc52d6ae33444df0da2b49d41a46ef6d678"},
+    {file = "keyring-25.7.0-py3-none-any.whl", hash = "sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f"},
+    {file = "keyring-25.7.0.tar.gz", hash = "sha256:fe01bd85eb3f8fb3dd0405defdeac9a5b4f6f0439edbb3149577f244a2e8245b"},
 ]
 
 [package.dependencies]
-importlib-metadata = {version = ">=4.11.4", markers = "python_version < \"3.12\""}
+importlib_metadata = {version = ">=4.11.4", markers = "python_version < \"3.12\""}
 "jaraco.classes" = "*"
+"jaraco.context" = "*"
+"jaraco.functools" = "*"
 jeepney = {version = ">=0.4.2", markers = "sys_platform == \"linux\""}
 pywin32-ctypes = {version = ">=0.2.0", markers = "sys_platform == \"win32\""}
 SecretStorage = {version = ">=3.2", markers = "sys_platform == \"linux\""}
 
 [package.extras]
-completion = ["shtab"]
-docs = ["furo", "jaraco.packaging (>=9)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)"]
-testing = ["flake8 (<5)", "pytest (>=6)", "pytest-black (>=0.3.7) ; platform_python_implementation != \"PyPy\"", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=1.3)", "pytest-flake8 ; python_version < \"3.12\"", "pytest-mypy (>=0.9.1) ; platform_python_implementation != \"PyPy\""]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\""]
+completion = ["shtab (>=1.1.0)"]
+cover = ["pytest-cov"]
+doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+enabler = ["pytest-enabler (>=3.4)"]
+test = ["pyfakefs", "pytest (>=6,!=8.1.*)"]
+type = ["pygobject-stubs", "pytest-mypy (>=1.0.1)", "shtab", "types-pywin32"]
 
 [[package]]
 name = "ldap3"
@@ -995,109 +1131,256 @@ files = [
 [package.dependencies]
 pyasn1 = ">=0.4.6"
 
+[[package]]
+name = "librt"
+version = "0.8.1"
+description = "Mypyc runtime library"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+markers = "platform_python_implementation != \"PyPy\""
+files = [
+    {file = "librt-0.8.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:81fd938344fecb9373ba1b155968c8a329491d2ce38e7ddb76f30ffb938f12dc"},
+    {file = "librt-0.8.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:5db05697c82b3a2ec53f6e72b2ed373132b0c2e05135f0696784e97d7f5d48e7"},
+    {file = "librt-0.8.1-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:d56bc4011975f7460bea7b33e1ff425d2f1adf419935ff6707273c77f8a4ada6"},
+    {file = "librt-0.8.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5cdc0f588ff4b663ea96c26d2a230c525c6fc62b28314edaaaca8ed5af931ad0"},
+    {file = "librt-0.8.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:97c2b54ff6717a7a563b72627990bec60d8029df17df423f0ed37d56a17a176b"},
+    {file = "librt-0.8.1-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8f1125e6bbf2f1657d9a2f3ccc4a2c9b0c8b176965bb565dd4d86be67eddb4b6"},
+    {file = "librt-0.8.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:8f4bb453f408137d7581be309b2fbc6868a80e7ef60c88e689078ee3a296ae71"},
+    {file = "librt-0.8.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:c336d61d2fe74a3195edc1646d53ff1cddd3a9600b09fa6ab75e5514ba4862a7"},
+    {file = "librt-0.8.1-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:eb5656019db7c4deacf0c1a55a898c5bb8f989be904597fcb5232a2f4828fa05"},
+    {file = "librt-0.8.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:c25d9e338d5bed46c1632f851babf3d13c78f49a225462017cf5e11e845c5891"},
+    {file = "librt-0.8.1-cp310-cp310-win32.whl", hash = "sha256:aaab0e307e344cb28d800957ef3ec16605146ef0e59e059a60a176d19543d1b7"},
+    {file = "librt-0.8.1-cp310-cp310-win_amd64.whl", hash = "sha256:56e04c14b696300d47b3bc5f1d10a00e86ae978886d0cee14e5714fafb5df5d2"},
+    {file = "librt-0.8.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:681dc2451d6d846794a828c16c22dc452d924e9f700a485b7ecb887a30aad1fd"},
+    {file = "librt-0.8.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a3b4350b13cc0e6f5bec8fa7caf29a8fb8cdc051a3bae45cfbfd7ce64f009965"},
+    {file = "librt-0.8.1-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:ac1e7817fd0ed3d14fd7c5df91daed84c48e4c2a11ee99c0547f9f62fdae13da"},
+    {file = "librt-0.8.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:747328be0c5b7075cde86a0e09d7a9196029800ba75a1689332348e998fb85c0"},
+    {file = "librt-0.8.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f0af2bd2bc204fa27f3d6711d0f360e6b8c684a035206257a81673ab924aa11e"},
+    {file = "librt-0.8.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:d480de377f5b687b6b1bc0c0407426da556e2a757633cc7e4d2e1a057aa688f3"},
+    {file = "librt-0.8.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d0ee06b5b5291f609ddb37b9750985b27bc567791bc87c76a569b3feed8481ac"},
+    {file = "librt-0.8.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:9e2c6f77b9ad48ce5603b83b7da9ee3e36b3ab425353f695cba13200c5d96596"},
+    {file = "librt-0.8.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:439352ba9373f11cb8e1933da194dcc6206daf779ff8df0ed69c5e39113e6a99"},
+    {file = "librt-0.8.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:82210adabbc331dbb65d7868b105185464ef13f56f7f76688565ad79f648b0fe"},
+    {file = "librt-0.8.1-cp311-cp311-win32.whl", hash = "sha256:52c224e14614b750c0a6d97368e16804a98c684657c7518752c356834fff83bb"},
+    {file = "librt-0.8.1-cp311-cp311-win_amd64.whl", hash = "sha256:c00e5c884f528c9932d278d5c9cbbea38a6b81eb62c02e06ae53751a83a4d52b"},
+    {file = "librt-0.8.1-cp311-cp311-win_arm64.whl", hash = "sha256:f7cdf7f26c2286ffb02e46d7bac56c94655540b26347673bea15fa52a6af17e9"},
+    {file = "librt-0.8.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a28f2612ab566b17f3698b0da021ff9960610301607c9a5e8eaca62f5e1c350a"},
+    {file = "librt-0.8.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:60a78b694c9aee2a0f1aaeaa7d101cf713e92e8423a941d2897f4fa37908dab9"},
+    {file = "librt-0.8.1-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:758509ea3f1eba2a57558e7e98f4659d0ea7670bff49673b0dde18a3c7e6c0eb"},
+    {file = "librt-0.8.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:039b9f2c506bd0ab0f8725aa5ba339c6f0cd19d3b514b50d134789809c24285d"},
+    {file = "librt-0.8.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5bb54f1205a3a6ab41a6fd71dfcdcbd278670d3a90ca502a30d9da583105b6f7"},
+    {file = "librt-0.8.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:05bd41cdee35b0c59c259f870f6da532a2c5ca57db95b5f23689fcb5c9e42440"},
+    {file = "librt-0.8.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:adfab487facf03f0d0857b8710cf82d0704a309d8ffc33b03d9302b4c64e91a9"},
+    {file = "librt-0.8.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:153188fe98a72f206042be10a2c6026139852805215ed9539186312d50a8e972"},
+    {file = "librt-0.8.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:dd3c41254ee98604b08bd5b3af5bf0a89740d4ee0711de95b65166bf44091921"},
+    {file = "librt-0.8.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e0d138c7ae532908cbb342162b2611dbd4d90c941cd25ab82084aaf71d2c0bd0"},
+    {file = "librt-0.8.1-cp312-cp312-win32.whl", hash = "sha256:43353b943613c5d9c49a25aaffdba46f888ec354e71e3529a00cca3f04d66a7a"},
+    {file = "librt-0.8.1-cp312-cp312-win_amd64.whl", hash = "sha256:ff8baf1f8d3f4b6b7257fcb75a501f2a5499d0dda57645baa09d4d0d34b19444"},
+    {file = "librt-0.8.1-cp312-cp312-win_arm64.whl", hash = "sha256:0f2ae3725904f7377e11cc37722d5d401e8b3d5851fb9273d7f4fe04f6b3d37d"},
+    {file = "librt-0.8.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7e6bad1cd94f6764e1e21950542f818a09316645337fd5ab9a7acc45d99a8f35"},
+    {file = "librt-0.8.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:cf450f498c30af55551ba4f66b9123b7185362ec8b625a773b3d39aa1a717583"},
+    {file = "librt-0.8.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:eca45e982fa074090057132e30585a7e8674e9e885d402eae85633e9f449ce6c"},
+    {file = "librt-0.8.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0c3811485fccfda840861905b8c70bba5ec094e02825598bb9d4ca3936857a04"},
+    {file = "librt-0.8.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5e4af413908f77294605e28cfd98063f54b2c790561383971d2f52d113d9c363"},
+    {file = "librt-0.8.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5212a5bd7fae98dae95710032902edcd2ec4dc994e883294f75c857b83f9aba0"},
+    {file = "librt-0.8.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:e692aa2d1d604e6ca12d35e51fdc36f4cda6345e28e36374579f7ef3611b3012"},
+    {file = "librt-0.8.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:4be2a5c926b9770c9e08e717f05737a269b9d0ebc5d2f0060f0fe3fe9ce47acb"},
+    {file = "librt-0.8.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:fd1a720332ea335ceb544cf0a03f81df92abd4bb887679fd1e460976b0e6214b"},
+    {file = "librt-0.8.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:93c2af9e01e0ef80d95ae3c720be101227edae5f2fe7e3dc63d8857fadfc5a1d"},
+    {file = "librt-0.8.1-cp313-cp313-win32.whl", hash = "sha256:086a32dbb71336627e78cc1d6ee305a68d038ef7d4c39aaff41ae8c9aa46e91a"},
+    {file = "librt-0.8.1-cp313-cp313-win_amd64.whl", hash = "sha256:e11769a1dbda4da7b00a76cfffa67aa47cfa66921d2724539eee4b9ede780b79"},
+    {file = "librt-0.8.1-cp313-cp313-win_arm64.whl", hash = "sha256:924817ab3141aca17893386ee13261f1d100d1ef410d70afe4389f2359fea4f0"},
+    {file = "librt-0.8.1-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:6cfa7fe54fd4d1f47130017351a959fe5804bda7a0bc7e07a2cdbc3fdd28d34f"},
+    {file = "librt-0.8.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:228c2409c079f8c11fb2e5d7b277077f694cb93443eb760e00b3b83cb8b3176c"},
+    {file = "librt-0.8.1-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:7aae78ab5e3206181780e56912d1b9bb9f90a7249ce12f0e8bf531d0462dd0fc"},
+    {file = "librt-0.8.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:172d57ec04346b047ca6af181e1ea4858086c80bdf455f61994c4aa6fc3f866c"},
+    {file = "librt-0.8.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6b1977c4ea97ce5eb7755a78fae68d87e4102e4aaf54985e8b56806849cc06a3"},
+    {file = "librt-0.8.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:10c42e1f6fd06733ef65ae7bebce2872bcafd8d6e6b0a08fe0a05a23b044fb14"},
+    {file = "librt-0.8.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:4c8dfa264b9193c4ee19113c985c95f876fae5e51f731494fc4e0cf594990ba7"},
+    {file = "librt-0.8.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:01170b6729a438f0dedc4a26ed342e3dc4f02d1000b4b19f980e1877f0c297e6"},
+    {file = "librt-0.8.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:7b02679a0d783bdae30d443025b94465d8c3dc512f32f5b5031f93f57ac32071"},
+    {file = "librt-0.8.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:190b109bb69592a3401fe1ffdea41a2e73370ace2ffdc4a0e8e2b39cdea81b78"},
+    {file = "librt-0.8.1-cp314-cp314-win32.whl", hash = "sha256:e70a57ecf89a0f64c24e37f38d3fe217a58169d2fe6ed6d70554964042474023"},
+    {file = "librt-0.8.1-cp314-cp314-win_amd64.whl", hash = "sha256:7e2f3edca35664499fbb36e4770650c4bd4a08abc1f4458eab9df4ec56389730"},
+    {file = "librt-0.8.1-cp314-cp314-win_arm64.whl", hash = "sha256:0d2f82168e55ddefd27c01c654ce52379c0750ddc31ee86b4b266bcf4d65f2a3"},
+    {file = "librt-0.8.1-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:2c74a2da57a094bd48d03fa5d196da83d2815678385d2978657499063709abe1"},
+    {file = "librt-0.8.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:a355d99c4c0d8e5b770313b8b247411ed40949ca44e33e46a4789b9293a907ee"},
+    {file = "librt-0.8.1-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:2eb345e8b33fb748227409c9f1233d4df354d6e54091f0e8fc53acdb2ffedeb7"},
+    {file = "librt-0.8.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9be2f15e53ce4e83cc08adc29b26fb5978db62ef2a366fbdf716c8a6c8901040"},
+    {file = "librt-0.8.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:785ae29c1f5c6e7c2cde2c7c0e148147f4503da3abc5d44d482068da5322fd9e"},
+    {file = "librt-0.8.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1d3a7da44baf692f0c6aeb5b2a09c5e6fc7a703bca9ffa337ddd2e2da53f7732"},
+    {file = "librt-0.8.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5fc48998000cbc39ec0d5311312dda93ecf92b39aaf184c5e817d5d440b29624"},
+    {file = "librt-0.8.1-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:e96baa6820280077a78244b2e06e416480ed859bbd8e5d641cf5742919d8beb4"},
+    {file = "librt-0.8.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:31362dbfe297b23590530007062c32c6f6176f6099646bb2c95ab1b00a57c382"},
+    {file = "librt-0.8.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:cc3656283d11540ab0ea01978378e73e10002145117055e03722417aeab30994"},
+    {file = "librt-0.8.1-cp314-cp314t-win32.whl", hash = "sha256:738f08021b3142c2918c03692608baed43bc51144c29e35807682f8070ee2a3a"},
+    {file = "librt-0.8.1-cp314-cp314t-win_amd64.whl", hash = "sha256:89815a22daf9c51884fb5dbe4f1ef65ee6a146e0b6a8df05f753e2e4a9359bf4"},
+    {file = "librt-0.8.1-cp314-cp314t-win_arm64.whl", hash = "sha256:bf512a71a23504ed08103a13c941f763db13fb11177beb3d9244c98c29fb4a61"},
+    {file = "librt-0.8.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:3dff3d3ca8db20e783b1bc7de49c0a2ab0b8387f31236d6a026597d07fcd68ac"},
+    {file = "librt-0.8.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:08eec3a1fc435f0d09c87b6bf1ec798986a3544f446b864e4099633a56fcd9ed"},
+    {file = "librt-0.8.1-cp39-cp39-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:e3f0a41487fd5fad7e760b9e8a90e251e27c2816fbc2cff36a22a0e6bcbbd9dd"},
+    {file = "librt-0.8.1-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bacdb58d9939d95cc557b4dbaa86527c9db2ac1ed76a18bc8d26f6dc8647d851"},
+    {file = "librt-0.8.1-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b6d7ab1f01aa753188605b09a51faa44a3327400b00b8cce424c71910fc0a128"},
+    {file = "librt-0.8.1-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:4998009e7cb9e896569f4be7004f09d0ed70d386fa99d42b6d363f6d200501ac"},
+    {file = "librt-0.8.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:2cc68eeeef5e906839c7bb0815748b5b0a974ec27125beefc0f942715785b551"},
+    {file = "librt-0.8.1-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:0bf69d79a23f4f40b8673a947a234baeeb133b5078b483b7297c5916539cf5d5"},
+    {file = "librt-0.8.1-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:22b46eabd76c1986ee7d231b0765ad387d7673bbd996aa0d0d054b38ac65d8f6"},
+    {file = "librt-0.8.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:237796479f4d0637d6b9cbcb926ff424a97735e68ade6facf402df4ec93375ed"},
+    {file = "librt-0.8.1-cp39-cp39-win32.whl", hash = "sha256:4beb04b8c66c6ae62f8c1e0b2f097c1ebad9295c929a8d5286c05eae7c2fc7dc"},
+    {file = "librt-0.8.1-cp39-cp39-win_amd64.whl", hash = "sha256:64548cde61b692dc0dc379f4b5f59a2f582c2ebe7890d09c1ae3b9e66fa015b7"},
+    {file = "librt-0.8.1.tar.gz", hash = "sha256:be46a14693955b3bd96014ccbdb8339ee8c9346fbe11c1b78901b55125f14c73"},
+]
+
 [[package]]
 name = "lxml"
-version = "6.0.0"
+version = "6.0.2"
 description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
 optional = true
 python-versions = ">=3.8"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"url-preview\""
 files = [
-    {file = "lxml-6.0.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:35bc626eec405f745199200ccb5c6b36f202675d204aa29bb52e27ba2b71dea8"},
-    {file = "lxml-6.0.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:246b40f8a4aec341cbbf52617cad8ab7c888d944bfe12a6abd2b1f6cfb6f6082"},
-    {file = "lxml-6.0.0-cp310-cp310-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:2793a627e95d119e9f1e19720730472f5543a6d84c50ea33313ce328d870f2dd"},
-    {file = "lxml-6.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:46b9ed911f36bfeb6338e0b482e7fe7c27d362c52fde29f221fddbc9ee2227e7"},
-    {file = "lxml-6.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2b4790b558bee331a933e08883c423f65bbcd07e278f91b2272489e31ab1e2b4"},
-    {file = "lxml-6.0.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e2030956cf4886b10be9a0285c6802e078ec2391e1dd7ff3eb509c2c95a69b76"},
-    {file = "lxml-6.0.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4d23854ecf381ab1facc8f353dcd9adeddef3652268ee75297c1164c987c11dc"},
-    {file = "lxml-6.0.0-cp310-cp310-manylinux_2_31_armv7l.whl", hash = "sha256:43fe5af2d590bf4691531b1d9a2495d7aab2090547eaacd224a3afec95706d76"},
-    {file = "lxml-6.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:74e748012f8c19b47f7d6321ac929a9a94ee92ef12bc4298c47e8b7219b26541"},
-    {file = "lxml-6.0.0-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:43cfbb7db02b30ad3926e8fceaef260ba2fb7df787e38fa2df890c1ca7966c3b"},
-    {file = "lxml-6.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:34190a1ec4f1e84af256495436b2d196529c3f2094f0af80202947567fdbf2e7"},
-    {file = "lxml-6.0.0-cp310-cp310-win32.whl", hash = "sha256:5967fe415b1920a3877a4195e9a2b779249630ee49ece22021c690320ff07452"},
-    {file = "lxml-6.0.0-cp310-cp310-win_amd64.whl", hash = "sha256:f3389924581d9a770c6caa4df4e74b606180869043b9073e2cec324bad6e306e"},
-    {file = "lxml-6.0.0-cp310-cp310-win_arm64.whl", hash = "sha256:522fe7abb41309e9543b0d9b8b434f2b630c5fdaf6482bee642b34c8c70079c8"},
-    {file = "lxml-6.0.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:4ee56288d0df919e4aac43b539dd0e34bb55d6a12a6562038e8d6f3ed07f9e36"},
-    {file = "lxml-6.0.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:b8dd6dd0e9c1992613ccda2bcb74fc9d49159dbe0f0ca4753f37527749885c25"},
-    {file = "lxml-6.0.0-cp311-cp311-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:d7ae472f74afcc47320238b5dbfd363aba111a525943c8a34a1b657c6be934c3"},
-    {file = "lxml-6.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5592401cdf3dc682194727c1ddaa8aa0f3ddc57ca64fd03226a430b955eab6f6"},
-    {file = "lxml-6.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:58ffd35bd5425c3c3b9692d078bf7ab851441434531a7e517c4984d5634cd65b"},
-    {file = "lxml-6.0.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f720a14aa102a38907c6d5030e3d66b3b680c3e6f6bc95473931ea3c00c59967"},
-    {file = "lxml-6.0.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c2a5e8d207311a0170aca0eb6b160af91adc29ec121832e4ac151a57743a1e1e"},
-    {file = "lxml-6.0.0-cp311-cp311-manylinux_2_31_armv7l.whl", hash = "sha256:2dd1cc3ea7e60bfb31ff32cafe07e24839df573a5e7c2d33304082a5019bcd58"},
-    {file = "lxml-6.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:2cfcf84f1defed7e5798ef4f88aa25fcc52d279be731ce904789aa7ccfb7e8d2"},
-    {file = "lxml-6.0.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:a52a4704811e2623b0324a18d41ad4b9fabf43ce5ff99b14e40a520e2190c851"},
-    {file = "lxml-6.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:c16304bba98f48a28ae10e32a8e75c349dd742c45156f297e16eeb1ba9287a1f"},
-    {file = "lxml-6.0.0-cp311-cp311-win32.whl", hash = "sha256:f8d19565ae3eb956d84da3ef367aa7def14a2735d05bd275cd54c0301f0d0d6c"},
-    {file = "lxml-6.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:b2d71cdefda9424adff9a3607ba5bbfc60ee972d73c21c7e3c19e71037574816"},
-    {file = "lxml-6.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:8a2e76efbf8772add72d002d67a4c3d0958638696f541734304c7f28217a9cab"},
-    {file = "lxml-6.0.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:78718d8454a6e928470d511bf8ac93f469283a45c354995f7d19e77292f26108"},
-    {file = "lxml-6.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:84ef591495ffd3f9dcabffd6391db7bb70d7230b5c35ef5148354a134f56f2be"},
-    {file = "lxml-6.0.0-cp312-cp312-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:2930aa001a3776c3e2601cb8e0a15d21b8270528d89cc308be4843ade546b9ab"},
-    {file = "lxml-6.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:219e0431ea8006e15005767f0351e3f7f9143e793e58519dc97fe9e07fae5563"},
-    {file = "lxml-6.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:bd5913b4972681ffc9718bc2d4c53cde39ef81415e1671ff93e9aa30b46595e7"},
-    {file = "lxml-6.0.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:390240baeb9f415a82eefc2e13285016f9c8b5ad71ec80574ae8fa9605093cd7"},
-    {file = "lxml-6.0.0-cp312-cp312-manylinux_2_27_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d6e200909a119626744dd81bae409fc44134389e03fbf1d68ed2a55a2fb10991"},
-    {file = "lxml-6.0.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ca50bd612438258a91b5b3788c6621c1f05c8c478e7951899f492be42defc0da"},
-    {file = "lxml-6.0.0-cp312-cp312-manylinux_2_31_armv7l.whl", hash = "sha256:c24b8efd9c0f62bad0439283c2c795ef916c5a6b75f03c17799775c7ae3c0c9e"},
-    {file = "lxml-6.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:afd27d8629ae94c5d863e32ab0e1d5590371d296b87dae0a751fb22bf3685741"},
-    {file = "lxml-6.0.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:54c4855eabd9fc29707d30141be99e5cd1102e7d2258d2892314cf4c110726c3"},
-    {file = "lxml-6.0.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c907516d49f77f6cd8ead1322198bdfd902003c3c330c77a1c5f3cc32a0e4d16"},
-    {file = "lxml-6.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:36531f81c8214e293097cd2b7873f178997dae33d3667caaae8bdfb9666b76c0"},
-    {file = "lxml-6.0.0-cp312-cp312-win32.whl", hash = "sha256:690b20e3388a7ec98e899fd54c924e50ba6693874aa65ef9cb53de7f7de9d64a"},
-    {file = "lxml-6.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:310b719b695b3dd442cdfbbe64936b2f2e231bb91d998e99e6f0daf991a3eba3"},
-    {file = "lxml-6.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:8cb26f51c82d77483cdcd2b4a53cda55bbee29b3c2f3ddeb47182a2a9064e4eb"},
-    {file = "lxml-6.0.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:6da7cd4f405fd7db56e51e96bff0865b9853ae70df0e6720624049da76bde2da"},
-    {file = "lxml-6.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b34339898bb556a2351a1830f88f751679f343eabf9cf05841c95b165152c9e7"},
-    {file = "lxml-6.0.0-cp313-cp313-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:51a5e4c61a4541bd1cd3ba74766d0c9b6c12d6a1a4964ef60026832aac8e79b3"},
-    {file = "lxml-6.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d18a25b19ca7307045581b18b3ec9ead2b1db5ccd8719c291f0cd0a5cec6cb81"},
-    {file = "lxml-6.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d4f0c66df4386b75d2ab1e20a489f30dc7fd9a06a896d64980541506086be1f1"},
-    {file = "lxml-6.0.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9f4b481b6cc3a897adb4279216695150bbe7a44c03daba3c894f49d2037e0a24"},
-    {file = "lxml-6.0.0-cp313-cp313-manylinux_2_27_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8a78d6c9168f5bcb20971bf3329c2b83078611fbe1f807baadc64afc70523b3a"},
-    {file = "lxml-6.0.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2ae06fbab4f1bb7db4f7c8ca9897dc8db4447d1a2b9bee78474ad403437bcc29"},
-    {file = "lxml-6.0.0-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:1fa377b827ca2023244a06554c6e7dc6828a10aaf74ca41965c5d8a4925aebb4"},
-    {file = "lxml-6.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1676b56d48048a62ef77a250428d1f31f610763636e0784ba67a9740823988ca"},
-    {file = "lxml-6.0.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:0e32698462aacc5c1cf6bdfebc9c781821b7e74c79f13e5ffc8bfe27c42b1abf"},
-    {file = "lxml-6.0.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:4d6036c3a296707357efb375cfc24bb64cd955b9ec731abf11ebb1e40063949f"},
-    {file = "lxml-6.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:7488a43033c958637b1a08cddc9188eb06d3ad36582cebc7d4815980b47e27ef"},
-    {file = "lxml-6.0.0-cp313-cp313-win32.whl", hash = "sha256:5fcd7d3b1d8ecb91445bd71b9c88bdbeae528fefee4f379895becfc72298d181"},
-    {file = "lxml-6.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:2f34687222b78fff795feeb799a7d44eca2477c3d9d3a46ce17d51a4f383e32e"},
-    {file = "lxml-6.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:21db1ec5525780fd07251636eb5f7acb84003e9382c72c18c542a87c416ade03"},
-    {file = "lxml-6.0.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:4eb114a0754fd00075c12648d991ec7a4357f9cb873042cc9a77bf3a7e30c9db"},
-    {file = "lxml-6.0.0-cp38-cp38-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:7da298e1659e45d151b4028ad5c7974917e108afb48731f4ed785d02b6818994"},
-    {file = "lxml-6.0.0-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7bf61bc4345c1895221357af8f3e89f8c103d93156ef326532d35c707e2fb19d"},
-    {file = "lxml-6.0.0-cp38-cp38-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:63b634facdfbad421d4b61c90735688465d4ab3a8853ac22c76ccac2baf98d97"},
-    {file = "lxml-6.0.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:e380e85b93f148ad28ac15f8117e2fd8e5437aa7732d65e260134f83ce67911b"},
-    {file = "lxml-6.0.0-cp38-cp38-win32.whl", hash = "sha256:185efc2fed89cdd97552585c624d3c908f0464090f4b91f7d92f8ed2f3b18f54"},
-    {file = "lxml-6.0.0-cp38-cp38-win_amd64.whl", hash = "sha256:f97487996a39cb18278ca33f7be98198f278d0bc3c5d0fd4d7b3d63646ca3c8a"},
-    {file = "lxml-6.0.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:85b14a4689d5cff426c12eefe750738648706ea2753b20c2f973b2a000d3d261"},
-    {file = "lxml-6.0.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:f64ccf593916e93b8d36ed55401bb7fe9c7d5de3180ce2e10b08f82a8f397316"},
-    {file = "lxml-6.0.0-cp39-cp39-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:b372d10d17a701b0945f67be58fae4664fd056b85e0ff0fbc1e6c951cdbc0512"},
-    {file = "lxml-6.0.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:a674c0948789e9136d69065cc28009c1b1874c6ea340253db58be7622ce6398f"},
-    {file = "lxml-6.0.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:edf6e4c8fe14dfe316939711e3ece3f9a20760aabf686051b537a7562f4da91a"},
-    {file = "lxml-6.0.0-cp39-cp39-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:048a930eb4572829604982e39a0c7289ab5dc8abc7fc9f5aabd6fbc08c154e93"},
-    {file = "lxml-6.0.0-cp39-cp39-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c0b5fa5eda84057a4f1bbb4bb77a8c28ff20ae7ce211588d698ae453e13c6281"},
-    {file = "lxml-6.0.0-cp39-cp39-manylinux_2_31_armv7l.whl", hash = "sha256:c352fc8f36f7e9727db17adbf93f82499457b3d7e5511368569b4c5bd155a922"},
-    {file = "lxml-6.0.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:8db5dc617cb937ae17ff3403c3a70a7de9df4852a046f93e71edaec678f721d0"},
-    {file = "lxml-6.0.0-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:2181e4b1d07dde53986023482673c0f1fba5178ef800f9ab95ad791e8bdded6a"},
-    {file = "lxml-6.0.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:b3c98d5b24c6095e89e03d65d5c574705be3d49c0d8ca10c17a8a4b5201b72f5"},
-    {file = "lxml-6.0.0-cp39-cp39-win32.whl", hash = "sha256:04d67ceee6db4bcb92987ccb16e53bef6b42ced872509f333c04fb58a3315256"},
-    {file = "lxml-6.0.0-cp39-cp39-win_amd64.whl", hash = "sha256:e0b1520ef900e9ef62e392dd3d7ae4f5fa224d1dd62897a792cf353eb20b6cae"},
-    {file = "lxml-6.0.0-cp39-cp39-win_arm64.whl", hash = "sha256:e35e8aaaf3981489f42884b59726693de32dabfc438ac10ef4eb3409961fd402"},
-    {file = "lxml-6.0.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:dbdd7679a6f4f08152818043dbb39491d1af3332128b3752c3ec5cebc0011a72"},
-    {file = "lxml-6.0.0-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:40442e2a4456e9910875ac12951476d36c0870dcb38a68719f8c4686609897c4"},
-    {file = "lxml-6.0.0-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:db0efd6bae1c4730b9c863fc4f5f3c0fa3e8f05cae2c44ae141cb9dfc7d091dc"},
-    {file = "lxml-6.0.0-pp310-pypy310_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9ab542c91f5a47aaa58abdd8ea84b498e8e49fe4b883d67800017757a3eb78e8"},
-    {file = "lxml-6.0.0-pp310-pypy310_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:013090383863b72c62a702d07678b658fa2567aa58d373d963cca245b017e065"},
-    {file = "lxml-6.0.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:c86df1c9af35d903d2b52d22ea3e66db8058d21dc0f59842ca5deb0595921141"},
-    {file = "lxml-6.0.0-pp39-pypy39_pp73-macosx_10_15_x86_64.whl", hash = "sha256:4337e4aec93b7c011f7ee2e357b0d30562edd1955620fdd4aeab6aacd90d43c5"},
-    {file = "lxml-6.0.0-pp39-pypy39_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ae74f7c762270196d2dda56f8dd7309411f08a4084ff2dfcc0b095a218df2e06"},
-    {file = "lxml-6.0.0-pp39-pypy39_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:059c4cbf3973a621b62ea3132934ae737da2c132a788e6cfb9b08d63a0ef73f9"},
-    {file = "lxml-6.0.0-pp39-pypy39_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:17f090a9bc0ce8da51a5632092f98a7e7f84bca26f33d161a98b57f7fb0004ca"},
-    {file = "lxml-6.0.0-pp39-pypy39_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9da022c14baeec36edfcc8daf0e281e2f55b950249a455776f0d1adeeada4734"},
-    {file = "lxml-6.0.0-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:a55da151d0b0c6ab176b4e761670ac0e2667817a1e0dadd04a01d0561a219349"},
-    {file = "lxml-6.0.0.tar.gz", hash = "sha256:032e65120339d44cdc3efc326c9f660f5f7205f3a535c1fdbf898b29ea01fb72"},
+    {file = "lxml-6.0.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e77dd455b9a16bbd2a5036a63ddbd479c19572af81b624e79ef422f929eef388"},
+    {file = "lxml-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:5d444858b9f07cefff6455b983aea9a67f7462ba1f6cbe4a21e8bf6791bf2153"},
+    {file = "lxml-6.0.2-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f952dacaa552f3bb8834908dddd500ba7d508e6ea6eb8c52eb2d28f48ca06a31"},
+    {file = "lxml-6.0.2-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:71695772df6acea9f3c0e59e44ba8ac50c4f125217e84aab21074a1a55e7e5c9"},
+    {file = "lxml-6.0.2-cp310-cp310-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:17f68764f35fd78d7c4cc4ef209a184c38b65440378013d24b8aecd327c3e0c8"},
+    {file = "lxml-6.0.2-cp310-cp310-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:058027e261afed589eddcfe530fcc6f3402d7fd7e89bfd0532df82ebc1563dba"},
+    {file = "lxml-6.0.2-cp310-cp310-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a8ffaeec5dfea5881d4c9d8913a32d10cfe3923495386106e4a24d45300ef79c"},
+    {file = "lxml-6.0.2-cp310-cp310-manylinux_2_31_armv7l.whl", hash = "sha256:f2e3b1a6bb38de0bc713edd4d612969dd250ca8b724be8d460001a387507021c"},
+    {file = "lxml-6.0.2-cp310-cp310-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:d6690ec5ec1cce0385cb20896b16be35247ac8c2046e493d03232f1c2414d321"},
+    {file = "lxml-6.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:f2a50c3c1d11cad0ebebbac357a97b26aa79d2bcaf46f256551152aa85d3a4d1"},
+    {file = "lxml-6.0.2-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:3efe1b21c7801ffa29a1112fab3b0f643628c30472d507f39544fd48e9549e34"},
+    {file = "lxml-6.0.2-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:59c45e125140b2c4b33920d21d83681940ca29f0b83f8629ea1a2196dc8cfe6a"},
+    {file = "lxml-6.0.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:452b899faa64f1805943ec1c0c9ebeaece01a1af83e130b69cdefeda180bb42c"},
+    {file = "lxml-6.0.2-cp310-cp310-win32.whl", hash = "sha256:1e786a464c191ca43b133906c6903a7e4d56bef376b75d97ccbb8ec5cf1f0a4b"},
+    {file = "lxml-6.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:dacf3c64ef3f7440e3167aa4b49aa9e0fb99e0aa4f9ff03795640bf94531bcb0"},
+    {file = "lxml-6.0.2-cp310-cp310-win_arm64.whl", hash = "sha256:45f93e6f75123f88d7f0cfd90f2d05f441b808562bf0bc01070a00f53f5028b5"},
+    {file = "lxml-6.0.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:13e35cbc684aadf05d8711a5d1b5857c92e5e580efa9a0d2be197199c8def607"},
+    {file = "lxml-6.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:3b1675e096e17c6fe9c0e8c81434f5736c0739ff9ac6123c87c2d452f48fc938"},
+    {file = "lxml-6.0.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8ac6e5811ae2870953390452e3476694196f98d447573234592d30488147404d"},
+    {file = "lxml-6.0.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5aa0fc67ae19d7a64c3fe725dc9a1bb11f80e01f78289d05c6f62545affec438"},
+    {file = "lxml-6.0.2-cp311-cp311-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:de496365750cc472b4e7902a485d3f152ecf57bd3ba03ddd5578ed8ceb4c5964"},
+    {file = "lxml-6.0.2-cp311-cp311-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:200069a593c5e40b8f6fc0d84d86d970ba43138c3e68619ffa234bc9bb806a4d"},
+    {file = "lxml-6.0.2-cp311-cp311-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7d2de809c2ee3b888b59f995625385f74629707c9355e0ff856445cdcae682b7"},
+    {file = "lxml-6.0.2-cp311-cp311-manylinux_2_31_armv7l.whl", hash = "sha256:b2c3da8d93cf5db60e8858c17684c47d01fee6405e554fb55018dd85fc23b178"},
+    {file = "lxml-6.0.2-cp311-cp311-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:442de7530296ef5e188373a1ea5789a46ce90c4847e597856570439621d9c553"},
+    {file = "lxml-6.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:2593c77efde7bfea7f6389f1ab249b15ed4aa5bc5cb5131faa3b843c429fbedb"},
+    {file = "lxml-6.0.2-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:3e3cb08855967a20f553ff32d147e14329b3ae70ced6edc2f282b94afbc74b2a"},
+    {file = "lxml-6.0.2-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:2ed6c667fcbb8c19c6791bbf40b7268ef8ddf5a96940ba9404b9f9a304832f6c"},
+    {file = "lxml-6.0.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b8f18914faec94132e5b91e69d76a5c1d7b0c73e2489ea8929c4aaa10b76bbf7"},
+    {file = "lxml-6.0.2-cp311-cp311-win32.whl", hash = "sha256:6605c604e6daa9e0d7f0a2137bdc47a2e93b59c60a65466353e37f8272f47c46"},
+    {file = "lxml-6.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:e5867f2651016a3afd8dd2c8238baa66f1e2802f44bc17e236f547ace6647078"},
+    {file = "lxml-6.0.2-cp311-cp311-win_arm64.whl", hash = "sha256:4197fb2534ee05fd3e7afaab5d8bfd6c2e186f65ea7f9cd6a82809c887bd1285"},
+    {file = "lxml-6.0.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:a59f5448ba2ceccd06995c95ea59a7674a10de0810f2ce90c9006f3cbc044456"},
+    {file = "lxml-6.0.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:e8113639f3296706fbac34a30813929e29247718e88173ad849f57ca59754924"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:a8bef9b9825fa8bc816a6e641bb67219489229ebc648be422af695f6e7a4fa7f"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:65ea18d710fd14e0186c2f973dc60bb52039a275f82d3c44a0e42b43440ea534"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c371aa98126a0d4c739ca93ceffa0fd7a5d732e3ac66a46e74339acd4d334564"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:700efd30c0fa1a3581d80a748157397559396090a51d306ea59a70020223d16f"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c33e66d44fe60e72397b487ee92e01da0d09ba2d66df8eae42d77b6d06e5eba0"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:90a345bbeaf9d0587a3aaffb7006aa39ccb6ff0e96a57286c0cb2fd1520ea192"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux_2_31_armv7l.whl", hash = "sha256:064fdadaf7a21af3ed1dcaa106b854077fbeada827c18f72aec9346847cd65d0"},
+    {file = "lxml-6.0.2-cp312-cp312-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fbc74f42c3525ac4ffa4b89cbdd00057b6196bcefe8bce794abd42d33a018092"},
+    {file = "lxml-6.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:6ddff43f702905a4e32bc24f3f2e2edfe0f8fde3277d481bffb709a4cced7a1f"},
+    {file = "lxml-6.0.2-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:6da5185951d72e6f5352166e3da7b0dc27aa70bd1090b0eb3f7f7212b53f1bb8"},
+    {file = "lxml-6.0.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:57a86e1ebb4020a38d295c04fc79603c7899e0df71588043eb218722dabc087f"},
+    {file = "lxml-6.0.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:2047d8234fe735ab77802ce5f2297e410ff40f5238aec569ad7c8e163d7b19a6"},
+    {file = "lxml-6.0.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6f91fd2b2ea15a6800c8e24418c0775a1694eefc011392da73bc6cef2623b322"},
+    {file = "lxml-6.0.2-cp312-cp312-win32.whl", hash = "sha256:3ae2ce7d6fedfb3414a2b6c5e20b249c4c607f72cb8d2bb7cc9c6ec7c6f4e849"},
+    {file = "lxml-6.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:72c87e5ee4e58a8354fb9c7c84cbf95a1c8236c127a5d1b7683f04bed8361e1f"},
+    {file = "lxml-6.0.2-cp312-cp312-win_arm64.whl", hash = "sha256:61cb10eeb95570153e0c0e554f58df92ecf5109f75eacad4a95baa709e26c3d6"},
+    {file = "lxml-6.0.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:9b33d21594afab46f37ae58dfadd06636f154923c4e8a4d754b0127554eb2e77"},
+    {file = "lxml-6.0.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:6c8963287d7a4c5c9a432ff487c52e9c5618667179c18a204bdedb27310f022f"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1941354d92699fb5ffe6ed7b32f9649e43c2feb4b97205f75866f7d21aa91452"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:bb2f6ca0ae2d983ded09357b84af659c954722bbf04dea98030064996d156048"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eb2a12d704f180a902d7fa778c6d71f36ceb7b0d317f34cdc76a5d05aa1dd1df"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:6ec0e3f745021bfed19c456647f0298d60a24c9ff86d9d051f52b509663feeb1"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:846ae9a12d54e368933b9759052d6206a9e8b250291109c48e350c1f1f49d916"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ef9266d2aa545d7374938fb5c484531ef5a2ec7f2d573e62f8ce722c735685fd"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:4077b7c79f31755df33b795dc12119cb557a0106bfdab0d2c2d97bd3cf3dffa6"},
+    {file = "lxml-6.0.2-cp313-cp313-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a7c5d5e5f1081955358533be077166ee97ed2571d6a66bdba6ec2f609a715d1a"},
+    {file = "lxml-6.0.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:8f8d0cbd0674ee89863a523e6994ac25fd5be9c8486acfc3e5ccea679bad2679"},
+    {file = "lxml-6.0.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:2cbcbf6d6e924c28f04a43f3b6f6e272312a090f269eff68a2982e13e5d57659"},
+    {file = "lxml-6.0.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:dfb874cfa53340009af6bdd7e54ebc0d21012a60a4e65d927c2e477112e63484"},
+    {file = "lxml-6.0.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:fb8dae0b6b8b7f9e96c26fdd8121522ce5de9bb5538010870bd538683d30e9a2"},
+    {file = "lxml-6.0.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:358d9adae670b63e95bc59747c72f4dc97c9ec58881d4627fe0120da0f90d314"},
+    {file = "lxml-6.0.2-cp313-cp313-win32.whl", hash = "sha256:e8cd2415f372e7e5a789d743d133ae474290a90b9023197fd78f32e2dc6873e2"},
+    {file = "lxml-6.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:b30d46379644fbfc3ab81f8f82ae4de55179414651f110a1514f0b1f8f6cb2d7"},
+    {file = "lxml-6.0.2-cp313-cp313-win_arm64.whl", hash = "sha256:13dcecc9946dca97b11b7c40d29fba63b55ab4170d3c0cf8c0c164343b9bfdcf"},
+    {file = "lxml-6.0.2-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:b0c732aa23de8f8aec23f4b580d1e52905ef468afb4abeafd3fec77042abb6fe"},
+    {file = "lxml-6.0.2-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:4468e3b83e10e0317a89a33d28f7aeba1caa4d1a6fd457d115dd4ffe90c5931d"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:abd44571493973bad4598a3be7e1d807ed45aa2adaf7ab92ab7c62609569b17d"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:370cd78d5855cfbffd57c422851f7d3864e6ae72d0da615fca4dad8c45d375a5"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:901e3b4219fa04ef766885fb40fa516a71662a4c61b80c94d25336b4934b71c0"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:a4bf42d2e4cf52c28cc1812d62426b9503cdb0c87a6de81442626aa7d69707ba"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:b2c7fdaa4d7c3d886a42534adec7cfac73860b89b4e5298752f60aa5984641a0"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:98a5e1660dc7de2200b00d53fa00bcd3c35a3608c305d45a7bbcaf29fa16e83d"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux_2_31_armv7l.whl", hash = "sha256:dc051506c30b609238d79eda75ee9cab3e520570ec8219844a72a46020901e37"},
+    {file = "lxml-6.0.2-cp314-cp314-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8799481bbdd212470d17513a54d568f44416db01250f49449647b5ab5b5dccb9"},
+    {file = "lxml-6.0.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:9261bb77c2dab42f3ecd9103951aeca2c40277701eb7e912c545c1b16e0e4917"},
+    {file = "lxml-6.0.2-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:65ac4a01aba353cfa6d5725b95d7aed6356ddc0a3cd734de00124d285b04b64f"},
+    {file = "lxml-6.0.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:b22a07cbb82fea98f8a2fd814f3d1811ff9ed76d0fc6abc84eb21527596e7cc8"},
+    {file = "lxml-6.0.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:d759cdd7f3e055d6bc8d9bec3ad905227b2e4c785dc16c372eb5b5e83123f48a"},
+    {file = "lxml-6.0.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:945da35a48d193d27c188037a05fec5492937f66fb1958c24fc761fb9d40d43c"},
+    {file = "lxml-6.0.2-cp314-cp314-win32.whl", hash = "sha256:be3aaa60da67e6153eb15715cc2e19091af5dc75faef8b8a585aea372507384b"},
+    {file = "lxml-6.0.2-cp314-cp314-win_amd64.whl", hash = "sha256:fa25afbadead523f7001caf0c2382afd272c315a033a7b06336da2637d92d6ed"},
+    {file = "lxml-6.0.2-cp314-cp314-win_arm64.whl", hash = "sha256:063eccf89df5b24e361b123e257e437f9e9878f425ee9aae3144c77faf6da6d8"},
+    {file = "lxml-6.0.2-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:6162a86d86893d63084faaf4ff937b3daea233e3682fb4474db07395794fa80d"},
+    {file = "lxml-6.0.2-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:414aaa94e974e23a3e92e7ca5b97d10c0cf37b6481f50911032c69eeb3991bba"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48461bd21625458dd01e14e2c38dd0aea69addc3c4f960c30d9f59d7f93be601"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:25fcc59afc57d527cfc78a58f40ab4c9b8fd096a9a3f964d2781ffb6eb33f4ed"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5179c60288204e6ddde3f774a93350177e08876eaf3ab78aa3a3649d43eb7d37"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:967aab75434de148ec80597b75062d8123cadf2943fb4281f385141e18b21338"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d100fcc8930d697c6561156c6810ab4a508fb264c8b6779e6e61e2ed5e7558f9"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2ca59e7e13e5981175b8b3e4ab84d7da57993eeff53c07764dcebda0d0e64ecd"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:957448ac63a42e2e49531b9d6c0fa449a1970dbc32467aaad46f11545be9af1d"},
+    {file = "lxml-6.0.2-cp314-cp314t-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b7fc49c37f1786284b12af63152fe1d0990722497e2d5817acfe7a877522f9a9"},
+    {file = "lxml-6.0.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e19e0643cc936a22e837f79d01a550678da8377d7d801a14487c10c34ee49c7e"},
+    {file = "lxml-6.0.2-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:1db01e5cf14345628e0cbe71067204db658e2fb8e51e7f33631f5f4735fefd8d"},
+    {file = "lxml-6.0.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:875c6b5ab39ad5291588aed6925fac99d0097af0dd62f33c7b43736043d4a2ec"},
+    {file = "lxml-6.0.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:cdcbed9ad19da81c480dfd6dd161886db6096083c9938ead313d94b30aadf272"},
+    {file = "lxml-6.0.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:80dadc234ebc532e09be1975ff538d154a7fa61ea5031c03d25178855544728f"},
+    {file = "lxml-6.0.2-cp314-cp314t-win32.whl", hash = "sha256:da08e7bb297b04e893d91087df19638dc7a6bb858a954b0cc2b9f5053c922312"},
+    {file = "lxml-6.0.2-cp314-cp314t-win_amd64.whl", hash = "sha256:252a22982dca42f6155125ac76d3432e548a7625d56f5a273ee78a5057216eca"},
+    {file = "lxml-6.0.2-cp314-cp314t-win_arm64.whl", hash = "sha256:bb4c1847b303835d89d785a18801a883436cdfd5dc3d62947f9c49e24f0f5a2c"},
+    {file = "lxml-6.0.2-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:a656ca105115f6b766bba324f23a67914d9c728dafec57638e2b92a9dcd76c62"},
+    {file = "lxml-6.0.2-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c54d83a2188a10ebdba573f16bd97135d06c9ef60c3dc495315c7a28c80a263f"},
+    {file = "lxml-6.0.2-cp38-cp38-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:1ea99340b3c729beea786f78c38f60f4795622f36e305d9c9be402201efdc3b7"},
+    {file = "lxml-6.0.2-cp38-cp38-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:af85529ae8d2a453feee4c780d9406a5e3b17cee0dd75c18bd31adcd584debc3"},
+    {file = "lxml-6.0.2-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:fe659f6b5d10fb5a17f00a50eb903eb277a71ee35df4615db573c069bcf967ac"},
+    {file = "lxml-6.0.2-cp38-cp38-win32.whl", hash = "sha256:5921d924aa5468c939d95c9814fa9f9b5935a6ff4e679e26aaf2951f74043512"},
+    {file = "lxml-6.0.2-cp38-cp38-win_amd64.whl", hash = "sha256:0aa7070978f893954008ab73bb9e3c24a7c56c054e00566a21b553dc18105fca"},
+    {file = "lxml-6.0.2-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:2c8458c2cdd29589a8367c09c8f030f1d202be673f0ca224ec18590b3b9fb694"},
+    {file = "lxml-6.0.2-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:3fee0851639d06276e6b387f1c190eb9d7f06f7f53514e966b26bae46481ec90"},
+    {file = "lxml-6.0.2-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b2142a376b40b6736dfc214fd2902409e9e3857eff554fed2d3c60f097e62a62"},
+    {file = "lxml-6.0.2-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a6b5b39cc7e2998f968f05309e666103b53e2edd01df8dc51b90d734c0825444"},
+    {file = "lxml-6.0.2-cp39-cp39-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d4aec24d6b72ee457ec665344a29acb2d35937d5192faebe429ea02633151aad"},
+    {file = "lxml-6.0.2-cp39-cp39-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:b42f4d86b451c2f9d06ffb4f8bbc776e04df3ba070b9fe2657804b1b40277c48"},
+    {file = "lxml-6.0.2-cp39-cp39-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6cdaefac66e8b8f30e37a9b4768a391e1f8a16a7526d5bc77a7928408ef68e93"},
+    {file = "lxml-6.0.2-cp39-cp39-manylinux_2_31_armv7l.whl", hash = "sha256:b738f7e648735714bbb82bdfd030203360cfeab7f6e8a34772b3c8c8b820568c"},
+    {file = "lxml-6.0.2-cp39-cp39-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:daf42de090d59db025af61ce6bdb2521f0f102ea0e6ea310f13c17610a97da4c"},
+    {file = "lxml-6.0.2-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:66328dabea70b5ba7e53d94aa774b733cf66686535f3bc9250a7aab53a91caaf"},
+    {file = "lxml-6.0.2-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:e237b807d68a61fc3b1e845407e27e5eb8ef69bc93fe8505337c1acb4ee300b6"},
+    {file = "lxml-6.0.2-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:ac02dc29fd397608f8eb15ac1610ae2f2f0154b03f631e6d724d9e2ad4ee2c84"},
+    {file = "lxml-6.0.2-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:817ef43a0c0b4a77bd166dc9a09a555394105ff3374777ad41f453526e37f9cb"},
+    {file = "lxml-6.0.2-cp39-cp39-win32.whl", hash = "sha256:bc532422ff26b304cfb62b328826bd995c96154ffd2bac4544f37dbb95ecaa8f"},
+    {file = "lxml-6.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:995e783eb0374c120f528f807443ad5a83a656a8624c467ea73781fc5f8a8304"},
+    {file = "lxml-6.0.2-cp39-cp39-win_arm64.whl", hash = "sha256:08b9d5e803c2e4725ae9e8559ee880e5328ed61aa0935244e0515d7d9dbec0aa"},
+    {file = "lxml-6.0.2-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:e748d4cf8fef2526bb2a589a417eba0c8674e29ffcb570ce2ceca44f1e567bf6"},
+    {file = "lxml-6.0.2-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:4ddb1049fa0579d0cbd00503ad8c58b9ab34d1254c77bc6a5576d96ec7853dba"},
+    {file = "lxml-6.0.2-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cb233f9c95f83707dae461b12b720c1af9c28c2d19208e1be03387222151daf5"},
+    {file = "lxml-6.0.2-pp310-pypy310_pp73-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bc456d04db0515ce3320d714a1eac7a97774ff0849e7718b492d957da4631dd4"},
+    {file = "lxml-6.0.2-pp310-pypy310_pp73-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2613e67de13d619fd283d58bda40bff0ee07739f624ffee8b13b631abf33083d"},
+    {file = "lxml-6.0.2-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:24a8e756c982c001ca8d59e87c80c4d9dcd4d9b44a4cbeb8d9be4482c514d41d"},
+    {file = "lxml-6.0.2-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:1c06035eafa8404b5cf475bb37a9f6088b0aca288d4ccc9d69389750d5543700"},
+    {file = "lxml-6.0.2-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c7d13103045de1bdd6fe5d61802565f1a3537d70cd3abf596aa0af62761921ee"},
+    {file = "lxml-6.0.2-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0a3c150a95fbe5ac91de323aa756219ef9cf7fde5a3f00e2281e30f33fa5fa4f"},
+    {file = "lxml-6.0.2-pp311-pypy311_pp73-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:60fa43be34f78bebb27812ed90f1925ec99560b0fa1decdb7d12b84d857d31e9"},
+    {file = "lxml-6.0.2-pp311-pypy311_pp73-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:21c73b476d3cfe836be731225ec3421fa2f048d84f6df6a8e70433dff1376d5a"},
+    {file = "lxml-6.0.2-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:27220da5be049e936c3aca06f174e8827ca6445a4353a1995584311487fc4e3e"},
+    {file = "lxml-6.0.2.tar.gz", hash = "sha256:cd79f3367bd74b317dda655dc8fcfa304d9eb6e4fb06b7168c5cf27f96e0cd62"},
 ]
 
 [package.extras]
@@ -1123,14 +1406,14 @@ test = ["coverage[toml] (>=7.2.5)", "mypy (>=1.2.0)", "pytest (>=7.3.0)", "pytes
 
 [[package]]
 name = "markdown-it-py"
-version = "3.0.0"
+version = "4.0.0"
 description = "Python port of markdown-it. Markdown parsing, done right!"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["dev"]
 files = [
-    {file = "markdown-it-py-3.0.0.tar.gz", hash = "sha256:e3f60a94fa066dc52ec76661e37c851cb232d92f9886b15cb560aaada2df8feb"},
-    {file = "markdown_it_py-3.0.0-py3-none-any.whl", hash = "sha256:355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1"},
+    {file = "markdown_it_py-4.0.0-py3-none-any.whl", hash = "sha256:87327c59b172c5011896038353a81343b6754500a08cd7a4973bb48c6d578147"},
+    {file = "markdown_it_py-4.0.0.tar.gz", hash = "sha256:cb0a2b4aa34f932c007117b194e945bd74e0ec24133ceb5bac59009cda1cb9f3"},
 ]
 
 [package.dependencies]
@@ -1138,83 +1421,110 @@ mdurl = ">=0.1,<1.0"
 
 [package.extras]
 benchmarking = ["psutil", "pytest", "pytest-benchmark"]
-code-style = ["pre-commit (>=3.0,<4.0)"]
-compare = ["commonmark (>=0.9,<1.0)", "markdown (>=3.4,<4.0)", "mistletoe (>=1.0,<2.0)", "mistune (>=2.0,<3.0)", "panflute (>=2.3,<3.0)"]
+compare = ["commonmark (>=0.9,<1.0)", "markdown (>=3.4,<4.0)", "markdown-it-pyrs", "mistletoe (>=1.0,<2.0)", "mistune (>=3.0,<4.0)", "panflute (>=2.3,<3.0)"]
 linkify = ["linkify-it-py (>=1,<3)"]
-plugins = ["mdit-py-plugins"]
+plugins = ["mdit-py-plugins (>=0.5.0)"]
 profiling = ["gprof2dot"]
-rtd = ["jupyter_sphinx", "mdit-py-plugins", "myst-parser", "pyyaml", "sphinx", "sphinx-copybutton", "sphinx-design", "sphinx_book_theme"]
-testing = ["coverage", "pytest", "pytest-cov", "pytest-regressions"]
+rtd = ["ipykernel", "jupyter_sphinx", "mdit-py-plugins (>=0.5.0)", "myst-parser", "pyyaml", "sphinx", "sphinx-book-theme (>=1.0,<2.0)", "sphinx-copybutton", "sphinx-design"]
+testing = ["coverage", "pytest", "pytest-cov", "pytest-regressions", "requests"]
 
 [[package]]
 name = "markupsafe"
-version = "3.0.2"
+version = "3.0.3"
 description = "Safely add untrusted strings to HTML/XML markup."
 optional = false
 python-versions = ">=3.9"
 groups = ["main", "dev"]
 files = [
-    {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-win32.whl", hash = "sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50"},
-    {file = "MarkupSafe-3.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-win32.whl", hash = "sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d"},
-    {file = "MarkupSafe-3.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-win32.whl", hash = "sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30"},
-    {file = "MarkupSafe-3.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-win32.whl", hash = "sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-win32.whl", hash = "sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6"},
-    {file = "MarkupSafe-3.0.2-cp313-cp313t-win_amd64.whl", hash = "sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-win32.whl", hash = "sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f"},
-    {file = "MarkupSafe-3.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a"},
-    {file = "markupsafe-3.0.2.tar.gz", hash = "sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0"},
+    {file = "markupsafe-3.0.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:2f981d352f04553a7171b8e44369f2af4055f888dfb147d55e42d29e29e74559"},
+    {file = "markupsafe-3.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:e1c1493fb6e50ab01d20a22826e57520f1284df32f2d8601fdd90b6304601419"},
+    {file = "markupsafe-3.0.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1ba88449deb3de88bd40044603fafffb7bc2b055d626a330323a9ed736661695"},
+    {file = "markupsafe-3.0.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f42d0984e947b8adf7dd6dde396e720934d12c506ce84eea8476409563607591"},
+    {file = "markupsafe-3.0.3-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c0c0b3ade1c0b13b936d7970b1d37a57acde9199dc2aecc4c336773e1d86049c"},
+    {file = "markupsafe-3.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f"},
+    {file = "markupsafe-3.0.3-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:d2ee202e79d8ed691ceebae8e0486bd9a2cd4794cec4824e1c99b6f5009502f6"},
+    {file = "markupsafe-3.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:177b5253b2834fe3678cb4a5f0059808258584c559193998be2601324fdeafb1"},
+    {file = "markupsafe-3.0.3-cp310-cp310-win32.whl", hash = "sha256:2a15a08b17dd94c53a1da0438822d70ebcd13f8c3a95abe3a9ef9f11a94830aa"},
+    {file = "markupsafe-3.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:c4ffb7ebf07cfe8931028e3e4c85f0357459a3f9f9490886198848f4fa002ec8"},
+    {file = "markupsafe-3.0.3-cp310-cp310-win_arm64.whl", hash = "sha256:e2103a929dfa2fcaf9bb4e7c091983a49c9ac3b19c9061b6d5427dd7d14d81a1"},
+    {file = "markupsafe-3.0.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1cc7ea17a6824959616c525620e387f6dd30fec8cb44f649e31712db02123dad"},
+    {file = "markupsafe-3.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a"},
+    {file = "markupsafe-3.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50"},
+    {file = "markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf"},
+    {file = "markupsafe-3.0.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f"},
+    {file = "markupsafe-3.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a"},
+    {file = "markupsafe-3.0.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115"},
+    {file = "markupsafe-3.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a"},
+    {file = "markupsafe-3.0.3-cp311-cp311-win32.whl", hash = "sha256:0db14f5dafddbb6d9208827849fad01f1a2609380add406671a26386cdf15a19"},
+    {file = "markupsafe-3.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:de8a88e63464af587c950061a5e6a67d3632e36df62b986892331d4620a35c01"},
+    {file = "markupsafe-3.0.3-cp311-cp311-win_arm64.whl", hash = "sha256:3b562dd9e9ea93f13d53989d23a7e775fdfd1066c33494ff43f5418bc8c58a5c"},
+    {file = "markupsafe-3.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d53197da72cc091b024dd97249dfc7794d6a56530370992a5e1a08983ad9230e"},
+    {file = "markupsafe-3.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce"},
+    {file = "markupsafe-3.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d"},
+    {file = "markupsafe-3.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d"},
+    {file = "markupsafe-3.0.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a"},
+    {file = "markupsafe-3.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b"},
+    {file = "markupsafe-3.0.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f"},
+    {file = "markupsafe-3.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b"},
+    {file = "markupsafe-3.0.3-cp312-cp312-win32.whl", hash = "sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d"},
+    {file = "markupsafe-3.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c"},
+    {file = "markupsafe-3.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f"},
+    {file = "markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795"},
+    {file = "markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219"},
+    {file = "markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6"},
+    {file = "markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676"},
+    {file = "markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9"},
+    {file = "markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1"},
+    {file = "markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc"},
+    {file = "markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12"},
+    {file = "markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed"},
+    {file = "markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5"},
+    {file = "markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218"},
+    {file = "markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287"},
+    {file = "markupsafe-3.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe"},
+    {file = "markupsafe-3.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026"},
+    {file = "markupsafe-3.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737"},
+    {file = "markupsafe-3.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97"},
+    {file = "markupsafe-3.0.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d"},
+    {file = "markupsafe-3.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda"},
+    {file = "markupsafe-3.0.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf"},
+    {file = "markupsafe-3.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe"},
+    {file = "markupsafe-3.0.3-cp314-cp314-win32.whl", hash = "sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9"},
+    {file = "markupsafe-3.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581"},
+    {file = "markupsafe-3.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-win32.whl", hash = "sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9"},
+    {file = "markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa"},
+    {file = "markupsafe-3.0.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:15d939a21d546304880945ca1ecb8a039db6b4dc49b2c5a400387cdae6a62e26"},
+    {file = "markupsafe-3.0.3-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:f71a396b3bf33ecaa1626c255855702aca4d3d9fea5e051b41ac59a9c1c41edc"},
+    {file = "markupsafe-3.0.3-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0f4b68347f8c5eab4a13419215bdfd7f8c9b19f2b25520968adfad23eb0ce60c"},
+    {file = "markupsafe-3.0.3-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e8fc20152abba6b83724d7ff268c249fa196d8259ff481f3b1476383f8f24e42"},
+    {file = "markupsafe-3.0.3-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:949b8d66bc381ee8b007cd945914c721d9aba8e27f71959d750a46f7c282b20b"},
+    {file = "markupsafe-3.0.3-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:3537e01efc9d4dccdf77221fb1cb3b8e1a38d5428920e0657ce299b20324d758"},
+    {file = "markupsafe-3.0.3-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:591ae9f2a647529ca990bc681daebdd52c8791ff06c2bfa05b65163e28102ef2"},
+    {file = "markupsafe-3.0.3-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:a320721ab5a1aba0a233739394eb907f8c8da5c98c9181d1161e77a0c8e36f2d"},
+    {file = "markupsafe-3.0.3-cp39-cp39-win32.whl", hash = "sha256:df2449253ef108a379b8b5d6b43f4b1a8e81a061d6537becd5582fba5f9196d7"},
+    {file = "markupsafe-3.0.3-cp39-cp39-win_amd64.whl", hash = "sha256:7c3fb7d25180895632e5d3148dbdc29ea38ccb7fd210aa27acbd1201a1902c6e"},
+    {file = "markupsafe-3.0.3-cp39-cp39-win_arm64.whl", hash = "sha256:38664109c14ffc9e7437e86b4dceb442b0096dfe3541d7864d9cbe1da4cf36c8"},
+    {file = "markupsafe-3.0.3.tar.gz", hash = "sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698"},
 ]
 
 [[package]]
@@ -1238,24 +1548,25 @@ test = ["aiounittest", "tox", "twisted"]
 
 [[package]]
 name = "matrix-synapse-ldap3"
-version = "0.3.0"
+version = "0.4.0"
 description = "An LDAP3 auth provider for Synapse"
 optional = true
-python-versions = ">=3.7"
+python-versions = ">=3.10"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"matrix-synapse-ldap3\""
 files = [
-    {file = "matrix-synapse-ldap3-0.3.0.tar.gz", hash = "sha256:8bb6517173164d4b9cc44f49de411d8cebdb2e705d5dd1ea1f38733c4a009e1d"},
-    {file = "matrix_synapse_ldap3-0.3.0-py3-none-any.whl", hash = "sha256:8b4d701f8702551e98cc1d8c20dbed532de5613584c08d0df22de376ba99159d"},
+    {file = "matrix_synapse_ldap3-0.4.0-py3-none-any.whl", hash = "sha256:bf080037230d2af5fd3639cb87266de65c1cad7a68ea206278c5b4bf9c1a17f3"},
+    {file = "matrix_synapse_ldap3-0.4.0.tar.gz", hash = "sha256:cff52ba780170de5e6e8af42863d2648ee23f3bf0a9fea6db52372f9fc00be2b"},
 ]
 
 [package.dependencies]
 ldap3 = ">=2.8"
-service-identity = "*"
+packaging = ">=14.1"
+service_identity = "*"
 Twisted = ">=15.1.0"
 
 [package.extras]
-dev = ["black (==22.3.0)", "flake8 (==4.0.1)", "isort (==5.9.3)", "ldaptor", "matrix-synapse", "mypy (==0.910)", "tox", "types-setuptools"]
+dev = ["black (==24.2.0)", "flake8 (==7.0.0)", "isort (==5.9.3)", "ldaptor", "matrix-synapse", "mypy (==1.9.0)", "tox", "types-setuptools"]
 
 [[package]]
 name = "mdurl"
@@ -1271,151 +1582,155 @@ files = [
 
 [[package]]
 name = "more-itertools"
-version = "9.1.0"
+version = "10.8.0"
 description = "More routines for operating on iterables, beyond itertools"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
 markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
 files = [
-    {file = "more-itertools-9.1.0.tar.gz", hash = "sha256:cabaa341ad0389ea83c17a94566a53ae4c9d07349861ecb14dc6d0345cf9ac5d"},
-    {file = "more_itertools-9.1.0-py3-none-any.whl", hash = "sha256:d2bc7f02446e86a68911e58ded76d6561eea00cddfb2a91e7019bbb586c799f3"},
+    {file = "more_itertools-10.8.0-py3-none-any.whl", hash = "sha256:52d4362373dcf7c52546bc4af9a86ee7c4579df9a8dc268be0a2f949d376cc9b"},
+    {file = "more_itertools-10.8.0.tar.gz", hash = "sha256:f638ddf8a1a0d134181275fb5d58b086ead7c6a72429ad725c67503f13ba30bd"},
 ]
 
 [[package]]
 name = "msgpack"
-version = "1.1.1"
+version = "1.1.2"
 description = "MessagePack serializer"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "msgpack-1.1.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:353b6fc0c36fde68b661a12949d7d49f8f51ff5fa019c1e47c87c4ff34b080ed"},
-    {file = "msgpack-1.1.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:79c408fcf76a958491b4e3b103d1c417044544b68e96d06432a189b43d1215c8"},
-    {file = "msgpack-1.1.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:78426096939c2c7482bf31ef15ca219a9e24460289c00dd0b94411040bb73ad2"},
-    {file = "msgpack-1.1.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8b17ba27727a36cb73aabacaa44b13090feb88a01d012c0f4be70c00f75048b4"},
-    {file = "msgpack-1.1.1-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7a17ac1ea6ec3c7687d70201cfda3b1e8061466f28f686c24f627cae4ea8efd0"},
-    {file = "msgpack-1.1.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:88d1e966c9235c1d4e2afac21ca83933ba59537e2e2727a999bf3f515ca2af26"},
-    {file = "msgpack-1.1.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:f6d58656842e1b2ddbe07f43f56b10a60f2ba5826164910968f5933e5178af75"},
-    {file = "msgpack-1.1.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:96decdfc4adcbc087f5ea7ebdcfd3dee9a13358cae6e81d54be962efc38f6338"},
-    {file = "msgpack-1.1.1-cp310-cp310-win32.whl", hash = "sha256:6640fd979ca9a212e4bcdf6eb74051ade2c690b862b679bfcb60ae46e6dc4bfd"},
-    {file = "msgpack-1.1.1-cp310-cp310-win_amd64.whl", hash = "sha256:8b65b53204fe1bd037c40c4148d00ef918eb2108d24c9aaa20bc31f9810ce0a8"},
-    {file = "msgpack-1.1.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:71ef05c1726884e44f8b1d1773604ab5d4d17729d8491403a705e649116c9558"},
-    {file = "msgpack-1.1.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:36043272c6aede309d29d56851f8841ba907a1a3d04435e43e8a19928e243c1d"},
-    {file = "msgpack-1.1.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a32747b1b39c3ac27d0670122b57e6e57f28eefb725e0b625618d1b59bf9d1e0"},
-    {file = "msgpack-1.1.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8a8b10fdb84a43e50d38057b06901ec9da52baac6983d3f709d8507f3889d43f"},
-    {file = "msgpack-1.1.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ba0c325c3f485dc54ec298d8b024e134acf07c10d494ffa24373bea729acf704"},
-    {file = "msgpack-1.1.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:88daaf7d146e48ec71212ce21109b66e06a98e5e44dca47d853cbfe171d6c8d2"},
-    {file = "msgpack-1.1.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d8b55ea20dc59b181d3f47103f113e6f28a5e1c89fd5b67b9140edb442ab67f2"},
-    {file = "msgpack-1.1.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:4a28e8072ae9779f20427af07f53bbb8b4aa81151054e882aee333b158da8752"},
-    {file = "msgpack-1.1.1-cp311-cp311-win32.whl", hash = "sha256:7da8831f9a0fdb526621ba09a281fadc58ea12701bc709e7b8cbc362feabc295"},
-    {file = "msgpack-1.1.1-cp311-cp311-win_amd64.whl", hash = "sha256:5fd1b58e1431008a57247d6e7cc4faa41c3607e8e7d4aaf81f7c29ea013cb458"},
-    {file = "msgpack-1.1.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ae497b11f4c21558d95de9f64fff7053544f4d1a17731c866143ed6bb4591238"},
-    {file = "msgpack-1.1.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:33be9ab121df9b6b461ff91baac6f2731f83d9b27ed948c5b9d1978ae28bf157"},
-    {file = "msgpack-1.1.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6f64ae8fe7ffba251fecb8408540c34ee9df1c26674c50c4544d72dbf792e5ce"},
-    {file = "msgpack-1.1.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a494554874691720ba5891c9b0b39474ba43ffb1aaf32a5dac874effb1619e1a"},
-    {file = "msgpack-1.1.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cb643284ab0ed26f6957d969fe0dd8bb17beb567beb8998140b5e38a90974f6c"},
-    {file = "msgpack-1.1.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:d275a9e3c81b1093c060c3837e580c37f47c51eca031f7b5fb76f7b8470f5f9b"},
-    {file = "msgpack-1.1.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:4fd6b577e4541676e0cc9ddc1709d25014d3ad9a66caa19962c4f5de30fc09ef"},
-    {file = "msgpack-1.1.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:bb29aaa613c0a1c40d1af111abf025f1732cab333f96f285d6a93b934738a68a"},
-    {file = "msgpack-1.1.1-cp312-cp312-win32.whl", hash = "sha256:870b9a626280c86cff9c576ec0d9cbcc54a1e5ebda9cd26dab12baf41fee218c"},
-    {file = "msgpack-1.1.1-cp312-cp312-win_amd64.whl", hash = "sha256:5692095123007180dca3e788bb4c399cc26626da51629a31d40207cb262e67f4"},
-    {file = "msgpack-1.1.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:3765afa6bd4832fc11c3749be4ba4b69a0e8d7b728f78e68120a157a4c5d41f0"},
-    {file = "msgpack-1.1.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:8ddb2bcfd1a8b9e431c8d6f4f7db0773084e107730ecf3472f1dfe9ad583f3d9"},
-    {file = "msgpack-1.1.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:196a736f0526a03653d829d7d4c5500a97eea3648aebfd4b6743875f28aa2af8"},
-    {file = "msgpack-1.1.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9d592d06e3cc2f537ceeeb23d38799c6ad83255289bb84c2e5792e5a8dea268a"},
-    {file = "msgpack-1.1.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4df2311b0ce24f06ba253fda361f938dfecd7b961576f9be3f3fbd60e87130ac"},
-    {file = "msgpack-1.1.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:e4141c5a32b5e37905b5940aacbc59739f036930367d7acce7a64e4dec1f5e0b"},
-    {file = "msgpack-1.1.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:b1ce7f41670c5a69e1389420436f41385b1aa2504c3b0c30620764b15dded2e7"},
-    {file = "msgpack-1.1.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4147151acabb9caed4e474c3344181e91ff7a388b888f1e19ea04f7e73dc7ad5"},
-    {file = "msgpack-1.1.1-cp313-cp313-win32.whl", hash = "sha256:500e85823a27d6d9bba1d057c871b4210c1dd6fb01fbb764e37e4e8847376323"},
-    {file = "msgpack-1.1.1-cp313-cp313-win_amd64.whl", hash = "sha256:6d489fba546295983abd142812bda76b57e33d0b9f5d5b71c09a583285506f69"},
-    {file = "msgpack-1.1.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bba1be28247e68994355e028dcd668316db30c1f758d3241a7b903ac78dcd285"},
-    {file = "msgpack-1.1.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b8f93dcddb243159c9e4109c9750ba5b335ab8d48d9522c5308cd05d7e3ce600"},
-    {file = "msgpack-1.1.1-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2fbbc0b906a24038c9958a1ba7ae0918ad35b06cb449d398b76a7d08470b0ed9"},
-    {file = "msgpack-1.1.1-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:61e35a55a546a1690d9d09effaa436c25ae6130573b6ee9829c37ef0f18d5e78"},
-    {file = "msgpack-1.1.1-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:1abfc6e949b352dadf4bce0eb78023212ec5ac42f6abfd469ce91d783c149c2a"},
-    {file = "msgpack-1.1.1-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:996f2609ddf0142daba4cefd767d6db26958aac8439ee41db9cc0db9f4c4c3a6"},
-    {file = "msgpack-1.1.1-cp38-cp38-win32.whl", hash = "sha256:4d3237b224b930d58e9d83c81c0dba7aacc20fcc2f89c1e5423aa0529a4cd142"},
-    {file = "msgpack-1.1.1-cp38-cp38-win_amd64.whl", hash = "sha256:da8f41e602574ece93dbbda1fab24650d6bf2a24089f9e9dbb4f5730ec1e58ad"},
-    {file = "msgpack-1.1.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:f5be6b6bc52fad84d010cb45433720327ce886009d862f46b26d4d154001994b"},
-    {file = "msgpack-1.1.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:3a89cd8c087ea67e64844287ea52888239cbd2940884eafd2dcd25754fb72232"},
-    {file = "msgpack-1.1.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1d75f3807a9900a7d575d8d6674a3a47e9f227e8716256f35bc6f03fc597ffbf"},
-    {file = "msgpack-1.1.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d182dac0221eb8faef2e6f44701812b467c02674a322c739355c39e94730cdbf"},
-    {file = "msgpack-1.1.1-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1b13fe0fb4aac1aa5320cd693b297fe6fdef0e7bea5518cbc2dd5299f873ae90"},
-    {file = "msgpack-1.1.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:435807eeb1bc791ceb3247d13c79868deb22184e1fc4224808750f0d7d1affc1"},
-    {file = "msgpack-1.1.1-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:4835d17af722609a45e16037bb1d4d78b7bdf19d6c0128116d178956618c4e88"},
-    {file = "msgpack-1.1.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:a8ef6e342c137888ebbfb233e02b8fbd689bb5b5fcc59b34711ac47ebd504478"},
-    {file = "msgpack-1.1.1-cp39-cp39-win32.whl", hash = "sha256:61abccf9de335d9efd149e2fff97ed5974f2481b3353772e8e2dd3402ba2bd57"},
-    {file = "msgpack-1.1.1-cp39-cp39-win_amd64.whl", hash = "sha256:40eae974c873b2992fd36424a5d9407f93e97656d999f43fca9d29f820899084"},
-    {file = "msgpack-1.1.1.tar.gz", hash = "sha256:77b79ce34a2bdab2594f490c8e80dd62a02d650b91a75159a63ec413b8d104cd"},
+    {file = "msgpack-1.1.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0051fffef5a37ca2cd16978ae4f0aef92f164df86823871b5162812bebecd8e2"},
+    {file = "msgpack-1.1.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:a605409040f2da88676e9c9e5853b3449ba8011973616189ea5ee55ddbc5bc87"},
+    {file = "msgpack-1.1.2-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8b696e83c9f1532b4af884045ba7f3aa741a63b2bc22617293a2c6a7c645f251"},
+    {file = "msgpack-1.1.2-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:365c0bbe981a27d8932da71af63ef86acc59ed5c01ad929e09a0b88c6294e28a"},
+    {file = "msgpack-1.1.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:41d1a5d875680166d3ac5c38573896453bbbea7092936d2e107214daf43b1d4f"},
+    {file = "msgpack-1.1.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:354e81bcdebaab427c3df4281187edc765d5d76bfb3a7c125af9da7a27e8458f"},
+    {file = "msgpack-1.1.2-cp310-cp310-win32.whl", hash = "sha256:e64c8d2f5e5d5fda7b842f55dec6133260ea8f53c4257d64494c534f306bf7a9"},
+    {file = "msgpack-1.1.2-cp310-cp310-win_amd64.whl", hash = "sha256:db6192777d943bdaaafb6ba66d44bf65aa0e9c5616fa1d2da9bb08828c6b39aa"},
+    {file = "msgpack-1.1.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:2e86a607e558d22985d856948c12a3fa7b42efad264dca8a3ebbcfa2735d786c"},
+    {file = "msgpack-1.1.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:283ae72fc89da59aa004ba147e8fc2f766647b1251500182fac0350d8af299c0"},
+    {file = "msgpack-1.1.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:61c8aa3bd513d87c72ed0b37b53dd5c5a0f58f2ff9f26e1555d3bd7948fb7296"},
+    {file = "msgpack-1.1.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:454e29e186285d2ebe65be34629fa0e8605202c60fbc7c4c650ccd41870896ef"},
+    {file = "msgpack-1.1.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7bc8813f88417599564fafa59fd6f95be417179f76b40325b500b3c98409757c"},
+    {file = "msgpack-1.1.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:bafca952dc13907bdfdedfc6a5f579bf4f292bdd506fadb38389afa3ac5b208e"},
+    {file = "msgpack-1.1.2-cp311-cp311-win32.whl", hash = "sha256:602b6740e95ffc55bfb078172d279de3773d7b7db1f703b2f1323566b878b90e"},
+    {file = "msgpack-1.1.2-cp311-cp311-win_amd64.whl", hash = "sha256:d198d275222dc54244bf3327eb8cbe00307d220241d9cec4d306d49a44e85f68"},
+    {file = "msgpack-1.1.2-cp311-cp311-win_arm64.whl", hash = "sha256:86f8136dfa5c116365a8a651a7d7484b65b13339731dd6faebb9a0242151c406"},
+    {file = "msgpack-1.1.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:70a0dff9d1f8da25179ffcf880e10cf1aad55fdb63cd59c9a49a1b82290062aa"},
+    {file = "msgpack-1.1.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:446abdd8b94b55c800ac34b102dffd2f6aa0ce643c55dfc017ad89347db3dbdb"},
+    {file = "msgpack-1.1.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c63eea553c69ab05b6747901b97d620bb2a690633c77f23feb0c6a947a8a7b8f"},
+    {file = "msgpack-1.1.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:372839311ccf6bdaf39b00b61288e0557916c3729529b301c52c2d88842add42"},
+    {file = "msgpack-1.1.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2929af52106ca73fcb28576218476ffbb531a036c2adbcf54a3664de124303e9"},
+    {file = "msgpack-1.1.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:be52a8fc79e45b0364210eef5234a7cf8d330836d0a64dfbb878efa903d84620"},
+    {file = "msgpack-1.1.2-cp312-cp312-win32.whl", hash = "sha256:1fff3d825d7859ac888b0fbda39a42d59193543920eda9d9bea44d958a878029"},
+    {file = "msgpack-1.1.2-cp312-cp312-win_amd64.whl", hash = "sha256:1de460f0403172cff81169a30b9a92b260cb809c4cb7e2fc79ae8d0510c78b6b"},
+    {file = "msgpack-1.1.2-cp312-cp312-win_arm64.whl", hash = "sha256:be5980f3ee0e6bd44f3a9e9dea01054f175b50c3e6cdb692bc9424c0bbb8bf69"},
+    {file = "msgpack-1.1.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4efd7b5979ccb539c221a4c4e16aac1a533efc97f3b759bb5a5ac9f6d10383bf"},
+    {file = "msgpack-1.1.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:42eefe2c3e2af97ed470eec850facbe1b5ad1d6eacdbadc42ec98e7dcf68b4b7"},
+    {file = "msgpack-1.1.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1fdf7d83102bf09e7ce3357de96c59b627395352a4024f6e2458501f158bf999"},
+    {file = "msgpack-1.1.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fac4be746328f90caa3cd4bc67e6fe36ca2bf61d5c6eb6d895b6527e3f05071e"},
+    {file = "msgpack-1.1.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:fffee09044073e69f2bad787071aeec727183e7580443dfeb8556cbf1978d162"},
+    {file = "msgpack-1.1.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:5928604de9b032bc17f5099496417f113c45bc6bc21b5c6920caf34b3c428794"},
+    {file = "msgpack-1.1.2-cp313-cp313-win32.whl", hash = "sha256:a7787d353595c7c7e145e2331abf8b7ff1e6673a6b974ded96e6d4ec09f00c8c"},
+    {file = "msgpack-1.1.2-cp313-cp313-win_amd64.whl", hash = "sha256:a465f0dceb8e13a487e54c07d04ae3ba131c7c5b95e2612596eafde1dccf64a9"},
+    {file = "msgpack-1.1.2-cp313-cp313-win_arm64.whl", hash = "sha256:e69b39f8c0aa5ec24b57737ebee40be647035158f14ed4b40e6f150077e21a84"},
+    {file = "msgpack-1.1.2-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:e23ce8d5f7aa6ea6d2a2b326b4ba46c985dbb204523759984430db7114f8aa00"},
+    {file = "msgpack-1.1.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:6c15b7d74c939ebe620dd8e559384be806204d73b4f9356320632d783d1f7939"},
+    {file = "msgpack-1.1.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:99e2cb7b9031568a2a5c73aa077180f93dd2e95b4f8d3b8e14a73ae94a9e667e"},
+    {file = "msgpack-1.1.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:180759d89a057eab503cf62eeec0aa61c4ea1200dee709f3a8e9397dbb3b6931"},
+    {file = "msgpack-1.1.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:04fb995247a6e83830b62f0b07bf36540c213f6eac8e851166d8d86d83cbd014"},
+    {file = "msgpack-1.1.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:8e22ab046fa7ede9e36eeb4cfad44d46450f37bb05d5ec482b02868f451c95e2"},
+    {file = "msgpack-1.1.2-cp314-cp314-win32.whl", hash = "sha256:80a0ff7d4abf5fecb995fcf235d4064b9a9a8a40a3ab80999e6ac1e30b702717"},
+    {file = "msgpack-1.1.2-cp314-cp314-win_amd64.whl", hash = "sha256:9ade919fac6a3e7260b7f64cea89df6bec59104987cbea34d34a2fa15d74310b"},
+    {file = "msgpack-1.1.2-cp314-cp314-win_arm64.whl", hash = "sha256:59415c6076b1e30e563eb732e23b994a61c159cec44deaf584e5cc1dd662f2af"},
+    {file = "msgpack-1.1.2-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:897c478140877e5307760b0ea66e0932738879e7aa68144d9b78ea4c8302a84a"},
+    {file = "msgpack-1.1.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:a668204fa43e6d02f89dbe79a30b0d67238d9ec4c5bd8a940fc3a004a47b721b"},
+    {file = "msgpack-1.1.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5559d03930d3aa0f3aacb4c42c776af1a2ace2611871c84a75afe436695e6245"},
+    {file = "msgpack-1.1.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:70c5a7a9fea7f036b716191c29047374c10721c389c21e9ffafad04df8c52c90"},
+    {file = "msgpack-1.1.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:f2cb069d8b981abc72b41aea1c580ce92d57c673ec61af4c500153a626cb9e20"},
+    {file = "msgpack-1.1.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d62ce1f483f355f61adb5433ebfd8868c5f078d1a52d042b0a998682b4fa8c27"},
+    {file = "msgpack-1.1.2-cp314-cp314t-win32.whl", hash = "sha256:1d1418482b1ee984625d88aa9585db570180c286d942da463533b238b98b812b"},
+    {file = "msgpack-1.1.2-cp314-cp314t-win_amd64.whl", hash = "sha256:5a46bf7e831d09470ad92dff02b8b1ac92175ca36b087f904a0519857c6be3ff"},
+    {file = "msgpack-1.1.2-cp314-cp314t-win_arm64.whl", hash = "sha256:d99ef64f349d5ec3293688e91486c5fdb925ed03807f64d98d205d2713c60b46"},
+    {file = "msgpack-1.1.2-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:ea5405c46e690122a76531ab97a079e184c0daf491e588592d6a23d3e32af99e"},
+    {file = "msgpack-1.1.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:9fba231af7a933400238cb357ecccf8ab5d51535ea95d94fc35b7806218ff844"},
+    {file = "msgpack-1.1.2-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a8f6e7d30253714751aa0b0c84ae28948e852ee7fb0524082e6716769124bc23"},
+    {file = "msgpack-1.1.2-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:94fd7dc7d8cb0a54432f296f2246bc39474e017204ca6f4ff345941d4ed285a7"},
+    {file = "msgpack-1.1.2-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:350ad5353a467d9e3b126d8d1b90fe05ad081e2e1cef5753f8c345217c37e7b8"},
+    {file = "msgpack-1.1.2-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:6bde749afe671dc44893f8d08e83bf475a1a14570d67c4bb5cec5573463c8833"},
+    {file = "msgpack-1.1.2-cp39-cp39-win32.whl", hash = "sha256:ad09b984828d6b7bb52d1d1d0c9be68ad781fa004ca39216c8a1e63c0f34ba3c"},
+    {file = "msgpack-1.1.2-cp39-cp39-win_amd64.whl", hash = "sha256:67016ae8c8965124fdede9d3769528ad8284f14d635337ffa6a713a580f6c030"},
+    {file = "msgpack-1.1.2.tar.gz", hash = "sha256:3b60763c1373dd60f398488069bcdc703cd08a711477b5d480eecc9f9626f47e"},
 ]
 
 [[package]]
 name = "multipart"
-version = "1.2.1"
+version = "1.3.1"
 description = "Parser for multipart/form-data"
 optional = false
 python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "multipart-1.2.1-py3-none-any.whl", hash = "sha256:c03dc203bc2e67f6b46a599467ae0d87cf71d7530504b2c1ff4a9ea21d8b8c8c"},
-    {file = "multipart-1.2.1.tar.gz", hash = "sha256:829b909b67bc1ad1c6d4488fcdc6391c2847842b08323addf5200db88dbe9480"},
+    {file = "multipart-1.3.1-py3-none-any.whl", hash = "sha256:a82b59e1befe74d3d30b3d3f70efd5a2eba4d938f845dcff9faace968888ff29"},
+    {file = "multipart-1.3.1.tar.gz", hash = "sha256:211d7cfc1a7a43e75c4d24ee0e8e0f4f61d522f1a21575303ae85333dea687bf"},
 ]
 
 [package.extras]
-dev = ["build", "pytest", "pytest-cov", "twine"]
+dev = ["build", "pytest", "pytest-cov", "tox", "tox-uv", "twine"]
 docs = ["sphinx (>=8,<9)", "sphinx-autobuild"]
 
 [[package]]
 name = "mypy"
-version = "1.17.1"
+version = "1.19.1"
 description = "Optional static typing for Python"
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "mypy-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:3fbe6d5555bf608c47203baa3e72dbc6ec9965b3d7c318aa9a4ca76f465bd972"},
-    {file = "mypy-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:80ef5c058b7bce08c83cac668158cb7edea692e458d21098c7d3bce35a5d43e7"},
-    {file = "mypy-1.17.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c4a580f8a70c69e4a75587bd925d298434057fe2a428faaf927ffe6e4b9a98df"},
-    {file = "mypy-1.17.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:dd86bb649299f09d987a2eebb4d52d10603224500792e1bee18303bbcc1ce390"},
-    {file = "mypy-1.17.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:a76906f26bd8d51ea9504966a9c25419f2e668f012e0bdf3da4ea1526c534d94"},
-    {file = "mypy-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:e79311f2d904ccb59787477b7bd5d26f3347789c06fcd7656fa500875290264b"},
-    {file = "mypy-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:ad37544be07c5d7fba814eb370e006df58fed8ad1ef33ed1649cb1889ba6ff58"},
-    {file = "mypy-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:064e2ff508e5464b4bd807a7c1625bc5047c5022b85c70f030680e18f37273a5"},
-    {file = "mypy-1.17.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:70401bbabd2fa1aa7c43bb358f54037baf0586f41e83b0ae67dd0534fc64edfd"},
-    {file = "mypy-1.17.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e92bdc656b7757c438660f775f872a669b8ff374edc4d18277d86b63edba6b8b"},
-    {file = "mypy-1.17.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:c1fdf4abb29ed1cb091cf432979e162c208a5ac676ce35010373ff29247bcad5"},
-    {file = "mypy-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:ff2933428516ab63f961644bc49bc4cbe42bbffb2cd3b71cc7277c07d16b1a8b"},
-    {file = "mypy-1.17.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:69e83ea6553a3ba79c08c6e15dbd9bfa912ec1e493bf75489ef93beb65209aeb"},
-    {file = "mypy-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1b16708a66d38abb1e6b5702f5c2c87e133289da36f6a1d15f6a5221085c6403"},
-    {file = "mypy-1.17.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:89e972c0035e9e05823907ad5398c5a73b9f47a002b22359b177d40bdaee7056"},
-    {file = "mypy-1.17.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:03b6d0ed2b188e35ee6d5c36b5580cffd6da23319991c49ab5556c023ccf1341"},
-    {file = "mypy-1.17.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c837b896b37cd103570d776bda106eabb8737aa6dd4f248451aecf53030cdbeb"},
-    {file = "mypy-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:665afab0963a4b39dff7c1fa563cc8b11ecff7910206db4b2e64dd1ba25aed19"},
-    {file = "mypy-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:93378d3203a5c0800c6b6d850ad2f19f7a3cdf1a3701d3416dbf128805c6a6a7"},
-    {file = "mypy-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:15d54056f7fe7a826d897789f53dd6377ec2ea8ba6f776dc83c2902b899fee81"},
-    {file = "mypy-1.17.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:209a58fed9987eccc20f2ca94afe7257a8f46eb5df1fb69958650973230f91e6"},
-    {file = "mypy-1.17.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:099b9a5da47de9e2cb5165e581f158e854d9e19d2e96b6698c0d64de911dd849"},
-    {file = "mypy-1.17.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:fa6ffadfbe6994d724c5a1bb6123a7d27dd68fc9c059561cd33b664a79578e14"},
-    {file = "mypy-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:9a2b7d9180aed171f033c9f2fc6c204c1245cf60b0cb61cf2e7acc24eea78e0a"},
-    {file = "mypy-1.17.1-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:15a83369400454c41ed3a118e0cc58bd8123921a602f385cb6d6ea5df050c733"},
-    {file = "mypy-1.17.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:55b918670f692fc9fba55c3298d8a3beae295c5cded0a55dccdc5bbead814acd"},
-    {file = "mypy-1.17.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:62761474061feef6f720149d7ba876122007ddc64adff5ba6f374fda35a018a0"},
-    {file = "mypy-1.17.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c49562d3d908fd49ed0938e5423daed8d407774a479b595b143a3d7f87cdae6a"},
-    {file = "mypy-1.17.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:397fba5d7616a5bc60b45c7ed204717eaddc38f826e3645402c426057ead9a91"},
-    {file = "mypy-1.17.1-cp314-cp314-win_amd64.whl", hash = "sha256:9d6b20b97d373f41617bd0708fd46aa656059af57f2ef72aa8c7d6a2b73b74ed"},
-    {file = "mypy-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:5d1092694f166a7e56c805caaf794e0585cabdbf1df36911c414e4e9abb62ae9"},
-    {file = "mypy-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:79d44f9bfb004941ebb0abe8eff6504223a9c1ac51ef967d1263c6572bbebc99"},
-    {file = "mypy-1.17.1-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b01586eed696ec905e61bd2568f48740f7ac4a45b3a468e6423a03d3788a51a8"},
-    {file = "mypy-1.17.1-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:43808d9476c36b927fbcd0b0255ce75efe1b68a080154a38ae68a7e62de8f0f8"},
-    {file = "mypy-1.17.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:feb8cc32d319edd5859da2cc084493b3e2ce5e49a946377663cc90f6c15fb259"},
-    {file = "mypy-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d7598cf74c3e16539d4e2f0b8d8c318e00041553d83d4861f87c7a72e95ac24d"},
-    {file = "mypy-1.17.1-py3-none-any.whl", hash = "sha256:a9f52c0351c21fe24c21d8c0eb1f62967b262d6729393397b6f443c3b773c3b9"},
-    {file = "mypy-1.17.1.tar.gz", hash = "sha256:25e01ec741ab5bb3eec8ba9cdb0f769230368a22c959c4937360efb89b7e9f01"},
+    {file = "mypy-1.19.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:5f05aa3d375b385734388e844bc01733bd33c644ab48e9684faa54e5389775ec"},
+    {file = "mypy-1.19.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:022ea7279374af1a5d78dfcab853fe6a536eebfda4b59deab53cd21f6cd9f00b"},
+    {file = "mypy-1.19.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee4c11e460685c3e0c64a4c5de82ae143622410950d6be863303a1c4ba0e36d6"},
+    {file = "mypy-1.19.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:de759aafbae8763283b2ee5869c7255391fbc4de3ff171f8f030b5ec48381b74"},
+    {file = "mypy-1.19.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:ab43590f9cd5108f41aacf9fca31841142c786827a74ab7cc8a2eacb634e09a1"},
+    {file = "mypy-1.19.1-cp310-cp310-win_amd64.whl", hash = "sha256:2899753e2f61e571b3971747e302d5f420c3fd09650e1951e99f823bc3089dac"},
+    {file = "mypy-1.19.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:d8dfc6ab58ca7dda47d9237349157500468e404b17213d44fc1cb77bce532288"},
+    {file = "mypy-1.19.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e3f276d8493c3c97930e354b2595a44a21348b320d859fb4a2b9f66da9ed27ab"},
+    {file = "mypy-1.19.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2abb24cf3f17864770d18d673c85235ba52456b36a06b6afc1e07c1fdcd3d0e6"},
+    {file = "mypy-1.19.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a009ffa5a621762d0c926a078c2d639104becab69e79538a494bcccb62cc0331"},
+    {file = "mypy-1.19.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f7cee03c9a2e2ee26ec07479f38ea9c884e301d42c6d43a19d20fb014e3ba925"},
+    {file = "mypy-1.19.1-cp311-cp311-win_amd64.whl", hash = "sha256:4b84a7a18f41e167f7995200a1d07a4a6810e89d29859df936f1c3923d263042"},
+    {file = "mypy-1.19.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a8174a03289288c1f6c46d55cef02379b478bfbc8e358e02047487cad44c6ca1"},
+    {file = "mypy-1.19.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffcebe56eb09ff0c0885e750036a095e23793ba6c2e894e7e63f6d89ad51f22e"},
+    {file = "mypy-1.19.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b64d987153888790bcdb03a6473d321820597ab8dd9243b27a92153c4fa50fd2"},
+    {file = "mypy-1.19.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c35d298c2c4bba75feb2195655dfea8124d855dfd7343bf8b8c055421eaf0cf8"},
+    {file = "mypy-1.19.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:34c81968774648ab5ac09c29a375fdede03ba253f8f8287847bd480782f73a6a"},
+    {file = "mypy-1.19.1-cp312-cp312-win_amd64.whl", hash = "sha256:b10e7c2cd7870ba4ad9b2d8a6102eb5ffc1f16ca35e3de6bfa390c1113029d13"},
+    {file = "mypy-1.19.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e3157c7594ff2ef1634ee058aafc56a82db665c9438fd41b390f3bde1ab12250"},
+    {file = "mypy-1.19.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:bdb12f69bcc02700c2b47e070238f42cb87f18c0bc1fc4cdb4fb2bc5fd7a3b8b"},
+    {file = "mypy-1.19.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f859fb09d9583a985be9a493d5cfc5515b56b08f7447759a0c5deaf68d80506e"},
+    {file = "mypy-1.19.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c9a6538e0415310aad77cb94004ca6482330fece18036b5f360b62c45814c4ef"},
+    {file = "mypy-1.19.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:da4869fc5e7f62a88f3fe0b5c919d1d9f7ea3cef92d3689de2823fd27e40aa75"},
+    {file = "mypy-1.19.1-cp313-cp313-win_amd64.whl", hash = "sha256:016f2246209095e8eda7538944daa1d60e1e8134d98983b9fc1e92c1fc0cb8dd"},
+    {file = "mypy-1.19.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:06e6170bd5836770e8104c8fdd58e5e725cfeb309f0a6c681a811f557e97eac1"},
+    {file = "mypy-1.19.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:804bd67b8054a85447c8954215a906d6eff9cabeabe493fb6334b24f4bfff718"},
+    {file = "mypy-1.19.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:21761006a7f497cb0d4de3d8ef4ca70532256688b0523eee02baf9eec895e27b"},
+    {file = "mypy-1.19.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:28902ee51f12e0f19e1e16fbe2f8f06b6637f482c459dd393efddd0ec7f82045"},
+    {file = "mypy-1.19.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:481daf36a4c443332e2ae9c137dfee878fcea781a2e3f895d54bd3002a900957"},
+    {file = "mypy-1.19.1-cp314-cp314-win_amd64.whl", hash = "sha256:8bb5c6f6d043655e055be9b542aa5f3bdd30e4f3589163e85f93f3640060509f"},
+    {file = "mypy-1.19.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:7bcfc336a03a1aaa26dfce9fff3e287a3ba99872a157561cbfcebe67c13308e3"},
+    {file = "mypy-1.19.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:b7951a701c07ea584c4fe327834b92a30825514c868b1f69c30445093fdd9d5a"},
+    {file = "mypy-1.19.1-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b13cfdd6c87fc3efb69ea4ec18ef79c74c3f98b4e5498ca9b85ab3b2c2329a67"},
+    {file = "mypy-1.19.1-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4f28f99c824ecebcdaa2e55d82953e38ff60ee5ec938476796636b86afa3956e"},
+    {file = "mypy-1.19.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:c608937067d2fc5a4dd1a5ce92fd9e1398691b8c5d012d66e1ddd430e9244376"},
+    {file = "mypy-1.19.1-cp39-cp39-win_amd64.whl", hash = "sha256:409088884802d511ee52ca067707b90c883426bd95514e8cfda8281dc2effe24"},
+    {file = "mypy-1.19.1-py3-none-any.whl", hash = "sha256:f1235f5ea01b7db5468d53ece6aaddf1ad0b88d9e7462b86ef96fe04995d7247"},
+    {file = "mypy-1.19.1.tar.gz", hash = "sha256:19d88bb05303fe63f71dd2c6270daca27cb9401c4ca8255fe50d1d920e0eb9ba"},
 ]
 
 [package.dependencies]
+librt = {version = ">=0.6.2", markers = "platform_python_implementation != \"PyPy\""}
 mypy_extensions = ">=1.0.0"
 pathspec = ">=0.9.0"
 tomli = {version = ">=1.1.0", markers = "python_version < \"3.11\""}
@@ -1430,30 +1745,30 @@ reports = ["lxml"]
 
 [[package]]
 name = "mypy-extensions"
-version = "1.0.0"
+version = "1.1.0"
 description = "Type system extensions for programs checked with the mypy type checker."
 optional = false
-python-versions = ">=3.5"
+python-versions = ">=3.8"
 groups = ["dev"]
 files = [
-    {file = "mypy_extensions-1.0.0-py3-none-any.whl", hash = "sha256:4392f6c0eb8a5668a69e23d168ffa70f0be9ccfd32b5cc2d26a34ae5b844552d"},
-    {file = "mypy_extensions-1.0.0.tar.gz", hash = "sha256:75dbf8955dc00442a438fc4d0666508a9a97b6bd41aa2f0ffe9d2f2725af0782"},
+    {file = "mypy_extensions-1.1.0-py3-none-any.whl", hash = "sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505"},
+    {file = "mypy_extensions-1.1.0.tar.gz", hash = "sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558"},
 ]
 
 [[package]]
 name = "mypy-zope"
-version = "1.0.13"
+version = "1.0.14"
 description = "Plugin for mypy to support zope interfaces"
 optional = false
 python-versions = "*"
 groups = ["dev"]
 files = [
-    {file = "mypy_zope-1.0.13-py3-none-any.whl", hash = "sha256:13740c4cbc910cca2c143c6709e1c483c991abeeeb7b629ad6f73d8ac1edad15"},
-    {file = "mypy_zope-1.0.13.tar.gz", hash = "sha256:63fb4d035ea874baf280dc69e714dcde4bd2a4a4837a0fd8d90ce91bea510f99"},
+    {file = "mypy_zope-1.0.14-py3-none-any.whl", hash = "sha256:8842ade93630421dbec0c9906d6515f6e65c6407ef8b9b2eb7f4f73ae1e8a42a"},
+    {file = "mypy_zope-1.0.14.tar.gz", hash = "sha256:42555ad4703f2e50c912de3ebe0c7197619c3f71864817fabc5385ecea0f8449"},
 ]
 
 [package.dependencies]
-mypy = ">=1.0.0,<1.18.0"
+mypy = ">=1.0.0,<1.20.0"
 "zope.interface" = "*"
 "zope.schema" = "*"
 
@@ -1475,6 +1790,43 @@ files = [
 [package.extras]
 nicer-shell = ["ipython"]
 
+[[package]]
+name = "nh3"
+version = "0.3.3"
+description = "Python binding to Ammonia HTML sanitizer Rust crate"
+optional = false
+python-versions = ">=3.8"
+groups = ["dev"]
+files = [
+    {file = "nh3-0.3.3-cp314-cp314t-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:21b058cd20d9f0919421a820a2843fdb5e1749c0bf57a6247ab8f4ba6723c9fc"},
+    {file = "nh3-0.3.3-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f4400a73c2a62859e769f9d36d1b5a7a5c65c4179d1dddd2f6f3095b2db0cbfc"},
+    {file = "nh3-0.3.3-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:1ef87f8e916321a88b45f2d597f29bd56e560ed4568a50f0f1305afab86b7189"},
+    {file = "nh3-0.3.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:a446eae598987f49ee97ac2f18eafcce4e62e7574bd1eb23782e4702e54e217d"},
+    {file = "nh3-0.3.3-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:0d5eb734a78ac364af1797fef718340a373f626a9ff6b4fb0b4badf7927e7b81"},
+    {file = "nh3-0.3.3-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:92a958e6f6d0100e025a5686aafd67e3c98eac67495728f8bb64fbeb3e474493"},
+    {file = "nh3-0.3.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:9ed40cf8449a59a03aa465114fedce1ff7ac52561688811d047917cc878b19ca"},
+    {file = "nh3-0.3.3-cp314-cp314t-win32.whl", hash = "sha256:b50c3770299fb2a7c1113751501e8878d525d15160a4c05194d7fe62b758aad8"},
+    {file = "nh3-0.3.3-cp314-cp314t-win_amd64.whl", hash = "sha256:21a63ccb18ddad3f784bb775955839b8b80e347e597726f01e43ca1abcc5c808"},
+    {file = "nh3-0.3.3-cp314-cp314t-win_arm64.whl", hash = "sha256:f508ddd4e2433fdcb78c790fc2d24e3a349ba775e5fa904af89891321d4844a3"},
+    {file = "nh3-0.3.3-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:e8ee96156f7dfc6e30ecda650e480c5ae0a7d38f0c6fafc3c1c655e2500421d9"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45fe0d6a607264910daec30360c8a3b5b1500fd832d21b2da608256287bcb92d"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:5bc1d4b30ba1ba896669d944b6003630592665974bd11a3dc2f661bde92798a7"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:f433a2dd66545aad4a720ad1b2150edcdca75bfff6f4e6f378ade1ec138d5e77"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:52e973cb742e95b9ae1b35822ce23992428750f4b46b619fe86eba4205255b30"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4c730617bdc15d7092dcc0469dc2826b914c8f874996d105b4bc3842a41c1cd9"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e98fa3dbfd54e25487e36ba500bc29bca3a4cab4ffba18cfb1a35a2d02624297"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_31_riscv64.whl", hash = "sha256:3a62b8ae7c235481715055222e54c682422d0495a5c73326807d4e44c5d14691"},
+    {file = "nh3-0.3.3-cp38-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:fc305a2264868ec8fa16548296f803d8fd9c1fa66cd28b88b605b1bd06667c0b"},
+    {file = "nh3-0.3.3-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:90126a834c18af03bfd6ff9a027bfa6bbf0e238527bc780a24de6bd7cc1041e2"},
+    {file = "nh3-0.3.3-cp38-abi3-musllinux_1_2_armv7l.whl", hash = "sha256:24769a428e9e971e4ccfb24628f83aaa7dc3c8b41b130c8ddc1835fa1c924489"},
+    {file = "nh3-0.3.3-cp38-abi3-musllinux_1_2_i686.whl", hash = "sha256:b7a18ee057761e455d58b9d31445c3e4b2594cff4ddb84d2e331c011ef46f462"},
+    {file = "nh3-0.3.3-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5a4b2c1f3e6f3cbe7048e17f4fefad3f8d3e14cc0fd08fb8599e0d5653f6b181"},
+    {file = "nh3-0.3.3-cp38-abi3-win32.whl", hash = "sha256:e974850b131fdffa75e7ad8e0d9c7a855b96227b093417fdf1bd61656e530f37"},
+    {file = "nh3-0.3.3-cp38-abi3-win_amd64.whl", hash = "sha256:2efd17c0355d04d39e6d79122b42662277ac10a17ea48831d90b46e5ef7e4fc0"},
+    {file = "nh3-0.3.3-cp38-abi3-win_arm64.whl", hash = "sha256:b838e619f483531483d26d889438e53a880510e832d2aafe73f93b7b1ac2bce2"},
+    {file = "nh3-0.3.3.tar.gz", hash = "sha256:185ed41b88c910b9ca8edc89ca3b4be688a12cb9de129d84befa2f74a0039fee"},
+]
+
 [[package]]
 name = "opentracing"
 version = "2.4.0"
@@ -1492,14 +1844,14 @@ tests = ["Sphinx", "doubles", "flake8", "flake8-quotes", "gevent", "mock", "pyte
 
 [[package]]
 name = "packaging"
-version = "25.0"
+version = "26.0"
 description = "Core utilities for Python packages"
 optional = false
 python-versions = ">=3.8"
 groups = ["main", "dev"]
 files = [
-    {file = "packaging-25.0-py3-none-any.whl", hash = "sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484"},
-    {file = "packaging-25.0.tar.gz", hash = "sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f"},
+    {file = "packaging-26.0-py3-none-any.whl", hash = "sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529"},
+    {file = "packaging-26.0.tar.gz", hash = "sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4"},
 ]
 
 [[package]]
@@ -1519,187 +1871,176 @@ dev = ["jinja2"]
 
 [[package]]
 name = "pathspec"
-version = "0.12.1"
+version = "1.0.4"
 description = "Utility library for gitignore style pattern matching of file paths."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "pathspec-0.12.1-py3-none-any.whl", hash = "sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08"},
-    {file = "pathspec-0.12.1.tar.gz", hash = "sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712"},
+    {file = "pathspec-1.0.4-py3-none-any.whl", hash = "sha256:fb6ae2fd4e7c921a165808a552060e722767cfa526f99ca5156ed2ce45a5c723"},
+    {file = "pathspec-1.0.4.tar.gz", hash = "sha256:0210e2ae8a21a9137c0d470578cb0e595af87edaa6ebf12ff176f14a02e0e645"},
 ]
 
+[package.extras]
+hyperscan = ["hyperscan (>=0.7)"]
+optional = ["typing-extensions (>=4)"]
+re2 = ["google-re2 (>=1.1)"]
+tests = ["pytest (>=9)", "typing-extensions (>=4.15)"]
+
 [[package]]
 name = "phonenumbers"
-version = "9.0.12"
+version = "9.0.26"
 description = "Python version of Google's common library for parsing, formatting, storing and validating international phone numbers."
 optional = false
-python-versions = "*"
+python-versions = ">=2.5"
 groups = ["main"]
 files = [
-    {file = "phonenumbers-9.0.12-py2.py3-none-any.whl", hash = "sha256:900633afc3e12191458d710262df5efc117838bd1e2e613b64fa254a86bb20a1"},
-    {file = "phonenumbers-9.0.12.tar.gz", hash = "sha256:ccadff6b949494bd606836d8c9678bee5b55cb1cbad1e98bf7adae108e6fd0be"},
+    {file = "phonenumbers-9.0.26-py2.py3-none-any.whl", hash = "sha256:ff473da5712965b6c7f7a31cbff8255864df694eb48243771133ecb761e807c1"},
+    {file = "phonenumbers-9.0.26.tar.gz", hash = "sha256:9e582c827f0f5503cddeebef80099475a52ffa761551d8384099c7ec71298cbf"},
 ]
 
 [[package]]
 name = "pillow"
-version = "11.3.0"
-description = "Python Imaging Library (Fork)"
+version = "12.1.1"
+description = "Python Imaging Library (fork)"
 optional = false
-python-versions = ">=3.9"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "pillow-11.3.0-cp310-cp310-macosx_10_10_x86_64.whl", hash = "sha256:1b9c17fd4ace828b3003dfd1e30bff24863e0eb59b535e8f80194d9cc7ecf860"},
-    {file = "pillow-11.3.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:65dc69160114cdd0ca0f35cb434633c75e8e7fad4cf855177a05bf38678f73ad"},
-    {file = "pillow-11.3.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7107195ddc914f656c7fc8e4a5e1c25f32e9236ea3ea860f257b0436011fddd0"},
-    {file = "pillow-11.3.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cc3e831b563b3114baac7ec2ee86819eb03caa1a2cef0b481a5675b59c4fe23b"},
-    {file = "pillow-11.3.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f1f182ebd2303acf8c380a54f615ec883322593320a9b00438eb842c1f37ae50"},
-    {file = "pillow-11.3.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4445fa62e15936a028672fd48c4c11a66d641d2c05726c7ec1f8ba6a572036ae"},
-    {file = "pillow-11.3.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:71f511f6b3b91dd543282477be45a033e4845a40278fa8dcdbfdb07109bf18f9"},
-    {file = "pillow-11.3.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:040a5b691b0713e1f6cbe222e0f4f74cd233421e105850ae3b3c0ceda520f42e"},
-    {file = "pillow-11.3.0-cp310-cp310-win32.whl", hash = "sha256:89bd777bc6624fe4115e9fac3352c79ed60f3bb18651420635f26e643e3dd1f6"},
-    {file = "pillow-11.3.0-cp310-cp310-win_amd64.whl", hash = "sha256:19d2ff547c75b8e3ff46f4d9ef969a06c30ab2d4263a9e287733aa8b2429ce8f"},
-    {file = "pillow-11.3.0-cp310-cp310-win_arm64.whl", hash = "sha256:819931d25e57b513242859ce1876c58c59dc31587847bf74cfe06b2e0cb22d2f"},
-    {file = "pillow-11.3.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:1cd110edf822773368b396281a2293aeb91c90a2db00d78ea43e7e861631b722"},
-    {file = "pillow-11.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9c412fddd1b77a75aa904615ebaa6001f169b26fd467b4be93aded278266b288"},
-    {file = "pillow-11.3.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7d1aa4de119a0ecac0a34a9c8bde33f34022e2e8f99104e47a3ca392fd60e37d"},
-    {file = "pillow-11.3.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:91da1d88226663594e3f6b4b8c3c8d85bd504117d043740a8e0ec449087cc494"},
-    {file = "pillow-11.3.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:643f189248837533073c405ec2f0bb250ba54598cf80e8c1e043381a60632f58"},
-    {file = "pillow-11.3.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:106064daa23a745510dabce1d84f29137a37224831d88eb4ce94bb187b1d7e5f"},
-    {file = "pillow-11.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:cd8ff254faf15591e724dc7c4ddb6bf4793efcbe13802a4ae3e863cd300b493e"},
-    {file = "pillow-11.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:932c754c2d51ad2b2271fd01c3d121daaa35e27efae2a616f77bf164bc0b3e94"},
-    {file = "pillow-11.3.0-cp311-cp311-win32.whl", hash = "sha256:b4b8f3efc8d530a1544e5962bd6b403d5f7fe8b9e08227c6b255f98ad82b4ba0"},
-    {file = "pillow-11.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:1a992e86b0dd7aeb1f053cd506508c0999d710a8f07b4c791c63843fc6a807ac"},
-    {file = "pillow-11.3.0-cp311-cp311-win_arm64.whl", hash = "sha256:30807c931ff7c095620fe04448e2c2fc673fcbb1ffe2a7da3fb39613489b1ddd"},
-    {file = "pillow-11.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:fdae223722da47b024b867c1ea0be64e0df702c5e0a60e27daad39bf960dd1e4"},
-    {file = "pillow-11.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:921bd305b10e82b4d1f5e802b6850677f965d8394203d182f078873851dada69"},
-    {file = "pillow-11.3.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:eb76541cba2f958032d79d143b98a3a6b3ea87f0959bbe256c0b5e416599fd5d"},
-    {file = "pillow-11.3.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:67172f2944ebba3d4a7b54f2e95c786a3a50c21b88456329314caaa28cda70f6"},
-    {file = "pillow-11.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:97f07ed9f56a3b9b5f49d3661dc9607484e85c67e27f3e8be2c7d28ca032fec7"},
-    {file = "pillow-11.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:676b2815362456b5b3216b4fd5bd89d362100dc6f4945154ff172e206a22c024"},
-    {file = "pillow-11.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3e184b2f26ff146363dd07bde8b711833d7b0202e27d13540bfe2e35a323a809"},
-    {file = "pillow-11.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6be31e3fc9a621e071bc17bb7de63b85cbe0bfae91bb0363c893cbe67247780d"},
-    {file = "pillow-11.3.0-cp312-cp312-win32.whl", hash = "sha256:7b161756381f0918e05e7cb8a371fff367e807770f8fe92ecb20d905d0e1c149"},
-    {file = "pillow-11.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a6444696fce635783440b7f7a9fc24b3ad10a9ea3f0ab66c5905be1c19ccf17d"},
-    {file = "pillow-11.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:2aceea54f957dd4448264f9bf40875da0415c83eb85f55069d89c0ed436e3542"},
-    {file = "pillow-11.3.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:1c627742b539bba4309df89171356fcb3cc5a9178355b2727d1b74a6cf155fbd"},
-    {file = "pillow-11.3.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:30b7c02f3899d10f13d7a48163c8969e4e653f8b43416d23d13d1bbfdc93b9f8"},
-    {file = "pillow-11.3.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:7859a4cc7c9295f5838015d8cc0a9c215b77e43d07a25e460f35cf516df8626f"},
-    {file = "pillow-11.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ec1ee50470b0d050984394423d96325b744d55c701a439d2bd66089bff963d3c"},
-    {file = "pillow-11.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:7db51d222548ccfd274e4572fdbf3e810a5e66b00608862f947b163e613b67dd"},
-    {file = "pillow-11.3.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:2d6fcc902a24ac74495df63faad1884282239265c6839a0a6416d33faedfae7e"},
-    {file = "pillow-11.3.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0f5d8f4a08090c6d6d578351a2b91acf519a54986c055af27e7a93feae6d3f1"},
-    {file = "pillow-11.3.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c37d8ba9411d6003bba9e518db0db0c58a680ab9fe5179f040b0463644bc9805"},
-    {file = "pillow-11.3.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:13f87d581e71d9189ab21fe0efb5a23e9f28552d5be6979e84001d3b8505abe8"},
-    {file = "pillow-11.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:023f6d2d11784a465f09fd09a34b150ea4672e85fb3d05931d89f373ab14abb2"},
-    {file = "pillow-11.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:45dfc51ac5975b938e9809451c51734124e73b04d0f0ac621649821a63852e7b"},
-    {file = "pillow-11.3.0-cp313-cp313-win32.whl", hash = "sha256:a4d336baed65d50d37b88ca5b60c0fa9d81e3a87d4a7930d3880d1624d5b31f3"},
-    {file = "pillow-11.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:0bce5c4fd0921f99d2e858dc4d4d64193407e1b99478bc5cacecba2311abde51"},
-    {file = "pillow-11.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:1904e1264881f682f02b7f8167935cce37bc97db457f8e7849dc3a6a52b99580"},
-    {file = "pillow-11.3.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:4c834a3921375c48ee6b9624061076bc0a32a60b5532b322cc0ea64e639dd50e"},
-    {file = "pillow-11.3.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:5e05688ccef30ea69b9317a9ead994b93975104a677a36a8ed8106be9260aa6d"},
-    {file = "pillow-11.3.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1019b04af07fc0163e2810167918cb5add8d74674b6267616021ab558dc98ced"},
-    {file = "pillow-11.3.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f944255db153ebb2b19c51fe85dd99ef0ce494123f21b9db4877ffdfc5590c7c"},
-    {file = "pillow-11.3.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1f85acb69adf2aaee8b7da124efebbdb959a104db34d3a2cb0f3793dbae422a8"},
-    {file = "pillow-11.3.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:05f6ecbeff5005399bb48d198f098a9b4b6bdf27b8487c7f38ca16eeb070cd59"},
-    {file = "pillow-11.3.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:a7bc6e6fd0395bc052f16b1a8670859964dbd7003bd0af2ff08342eb6e442cfe"},
-    {file = "pillow-11.3.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:83e1b0161c9d148125083a35c1c5a89db5b7054834fd4387499e06552035236c"},
-    {file = "pillow-11.3.0-cp313-cp313t-win32.whl", hash = "sha256:2a3117c06b8fb646639dce83694f2f9eac405472713fcb1ae887469c0d4f6788"},
-    {file = "pillow-11.3.0-cp313-cp313t-win_amd64.whl", hash = "sha256:857844335c95bea93fb39e0fa2726b4d9d758850b34075a7e3ff4f4fa3aa3b31"},
-    {file = "pillow-11.3.0-cp313-cp313t-win_arm64.whl", hash = "sha256:8797edc41f3e8536ae4b10897ee2f637235c94f27404cac7297f7b607dd0716e"},
-    {file = "pillow-11.3.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:d9da3df5f9ea2a89b81bb6087177fb1f4d1c7146d583a3fe5c672c0d94e55e12"},
-    {file = "pillow-11.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:0b275ff9b04df7b640c59ec5a3cb113eefd3795a8df80bac69646ef699c6981a"},
-    {file = "pillow-11.3.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0743841cabd3dba6a83f38a92672cccbd69af56e3e91777b0ee7f4dba4385632"},
-    {file = "pillow-11.3.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2465a69cf967b8b49ee1b96d76718cd98c4e925414ead59fdf75cf0fd07df673"},
-    {file = "pillow-11.3.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:41742638139424703b4d01665b807c6468e23e699e8e90cffefe291c5832b027"},
-    {file = "pillow-11.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:93efb0b4de7e340d99057415c749175e24c8864302369e05914682ba642e5d77"},
-    {file = "pillow-11.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7966e38dcd0fa11ca390aed7c6f20454443581d758242023cf36fcb319b1a874"},
-    {file = "pillow-11.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:98a9afa7b9007c67ed84c57c9e0ad86a6000da96eaa638e4f8abe5b65ff83f0a"},
-    {file = "pillow-11.3.0-cp314-cp314-win32.whl", hash = "sha256:02a723e6bf909e7cea0dac1b0e0310be9d7650cd66222a5f1c571455c0a45214"},
-    {file = "pillow-11.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:a418486160228f64dd9e9efcd132679b7a02a5f22c982c78b6fc7dab3fefb635"},
-    {file = "pillow-11.3.0-cp314-cp314-win_arm64.whl", hash = "sha256:155658efb5e044669c08896c0c44231c5e9abcaadbc5cd3648df2f7c0b96b9a6"},
-    {file = "pillow-11.3.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:59a03cdf019efbfeeed910bf79c7c93255c3d54bc45898ac2a4140071b02b4ae"},
-    {file = "pillow-11.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f8a5827f84d973d8636e9dc5764af4f0cf2318d26744b3d902931701b0d46653"},
-    {file = "pillow-11.3.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ee92f2fd10f4adc4b43d07ec5e779932b4eb3dbfbc34790ada5a6669bc095aa6"},
-    {file = "pillow-11.3.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c96d333dcf42d01f47b37e0979b6bd73ec91eae18614864622d9b87bbd5bbf36"},
-    {file = "pillow-11.3.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4c96f993ab8c98460cd0c001447bff6194403e8b1d7e149ade5f00594918128b"},
-    {file = "pillow-11.3.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:41342b64afeba938edb034d122b2dda5db2139b9a4af999729ba8818e0056477"},
-    {file = "pillow-11.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:068d9c39a2d1b358eb9f245ce7ab1b5c3246c7c8c7d9ba58cfa5b43146c06e50"},
-    {file = "pillow-11.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a1bc6ba083b145187f648b667e05a2534ecc4b9f2784c2cbe3089e44868f2b9b"},
-    {file = "pillow-11.3.0-cp314-cp314t-win32.whl", hash = "sha256:118ca10c0d60b06d006be10a501fd6bbdfef559251ed31b794668ed569c87e12"},
-    {file = "pillow-11.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:8924748b688aa210d79883357d102cd64690e56b923a186f35a82cbc10f997db"},
-    {file = "pillow-11.3.0-cp314-cp314t-win_arm64.whl", hash = "sha256:79ea0d14d3ebad43ec77ad5272e6ff9bba5b679ef73375ea760261207fa8e0aa"},
-    {file = "pillow-11.3.0-cp39-cp39-macosx_10_10_x86_64.whl", hash = "sha256:48d254f8a4c776de343051023eb61ffe818299eeac478da55227d96e241de53f"},
-    {file = "pillow-11.3.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:7aee118e30a4cf54fdd873bd3a29de51e29105ab11f9aad8c32123f58c8f8081"},
-    {file = "pillow-11.3.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:23cff760a9049c502721bdb743a7cb3e03365fafcdfc2ef9784610714166e5a4"},
-    {file = "pillow-11.3.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:6359a3bc43f57d5b375d1ad54a0074318a0844d11b76abccf478c37c986d3cfc"},
-    {file = "pillow-11.3.0-cp39-cp39-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:092c80c76635f5ecb10f3f83d76716165c96f5229addbd1ec2bdbbda7d496e06"},
-    {file = "pillow-11.3.0-cp39-cp39-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cadc9e0ea0a2431124cde7e1697106471fc4c1da01530e679b2391c37d3fbb3a"},
-    {file = "pillow-11.3.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:6a418691000f2a418c9135a7cf0d797c1bb7d9a485e61fe8e7722845b95ef978"},
-    {file = "pillow-11.3.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:97afb3a00b65cc0804d1c7abddbf090a81eaac02768af58cbdcaaa0a931e0b6d"},
-    {file = "pillow-11.3.0-cp39-cp39-win32.whl", hash = "sha256:ea944117a7974ae78059fcc1800e5d3295172bb97035c0c1d9345fca1419da71"},
-    {file = "pillow-11.3.0-cp39-cp39-win_amd64.whl", hash = "sha256:e5c5858ad8ec655450a7c7df532e9842cf8df7cc349df7225c60d5d348c8aada"},
-    {file = "pillow-11.3.0-cp39-cp39-win_arm64.whl", hash = "sha256:6abdbfd3aea42be05702a8dd98832329c167ee84400a1d1f61ab11437f1717eb"},
-    {file = "pillow-11.3.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:3cee80663f29e3843b68199b9d6f4f54bd1d4a6b59bdd91bceefc51238bcb967"},
-    {file = "pillow-11.3.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:b5f56c3f344f2ccaf0dd875d3e180f631dc60a51b314295a3e681fe8cf851fbe"},
-    {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e67d793d180c9df62f1f40aee3accca4829d3794c95098887edc18af4b8b780c"},
-    {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d000f46e2917c705e9fb93a3606ee4a819d1e3aa7a9b442f6444f07e77cf5e25"},
-    {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:527b37216b6ac3a12d7838dc3bd75208ec57c1c6d11ef01902266a5a0c14fc27"},
-    {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:be5463ac478b623b9dd3937afd7fb7ab3d79dd290a28e2b6df292dc75063eb8a"},
-    {file = "pillow-11.3.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:8dc70ca24c110503e16918a658b869019126ecfe03109b754c402daff12b3d9f"},
-    {file = "pillow-11.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:7c8ec7a017ad1bd562f93dbd8505763e688d388cde6e4a010ae1486916e713e6"},
-    {file = "pillow-11.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:9ab6ae226de48019caa8074894544af5b53a117ccb9d3b3dcb2871464c829438"},
-    {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fe27fb049cdcca11f11a7bfda64043c37b30e6b91f10cb5bab275806c32f6ab3"},
-    {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:465b9e8844e3c3519a983d58b80be3f668e2a7a5db97f2784e7079fbc9f9822c"},
-    {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5418b53c0d59b3824d05e029669efa023bbef0f3e92e75ec8428f3799487f361"},
-    {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:504b6f59505f08ae014f724b6207ff6222662aab5cc9542577fb084ed0676ac7"},
-    {file = "pillow-11.3.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:c84d689db21a1c397d001aa08241044aa2069e7587b398c8cc63020390b1c1b8"},
-    {file = "pillow-11.3.0.tar.gz", hash = "sha256:3828ee7586cd0b2091b6209e5ad53e20d0649bbe87164a459d0676e035e8f523"},
+    {file = "pillow-12.1.1-cp310-cp310-macosx_10_10_x86_64.whl", hash = "sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0"},
+    {file = "pillow-12.1.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713"},
+    {file = "pillow-12.1.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b"},
+    {file = "pillow-12.1.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b"},
+    {file = "pillow-12.1.1-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4"},
+    {file = "pillow-12.1.1-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4"},
+    {file = "pillow-12.1.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e"},
+    {file = "pillow-12.1.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff"},
+    {file = "pillow-12.1.1-cp310-cp310-win32.whl", hash = "sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40"},
+    {file = "pillow-12.1.1-cp310-cp310-win_amd64.whl", hash = "sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23"},
+    {file = "pillow-12.1.1-cp310-cp310-win_arm64.whl", hash = "sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9"},
+    {file = "pillow-12.1.1-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32"},
+    {file = "pillow-12.1.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38"},
+    {file = "pillow-12.1.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5"},
+    {file = "pillow-12.1.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090"},
+    {file = "pillow-12.1.1-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af"},
+    {file = "pillow-12.1.1-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b"},
+    {file = "pillow-12.1.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5"},
+    {file = "pillow-12.1.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d"},
+    {file = "pillow-12.1.1-cp311-cp311-win32.whl", hash = "sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c"},
+    {file = "pillow-12.1.1-cp311-cp311-win_amd64.whl", hash = "sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563"},
+    {file = "pillow-12.1.1-cp311-cp311-win_arm64.whl", hash = "sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80"},
+    {file = "pillow-12.1.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052"},
+    {file = "pillow-12.1.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984"},
+    {file = "pillow-12.1.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79"},
+    {file = "pillow-12.1.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293"},
+    {file = "pillow-12.1.1-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397"},
+    {file = "pillow-12.1.1-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0"},
+    {file = "pillow-12.1.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3"},
+    {file = "pillow-12.1.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35"},
+    {file = "pillow-12.1.1-cp312-cp312-win32.whl", hash = "sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a"},
+    {file = "pillow-12.1.1-cp312-cp312-win_amd64.whl", hash = "sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6"},
+    {file = "pillow-12.1.1-cp312-cp312-win_arm64.whl", hash = "sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523"},
+    {file = "pillow-12.1.1-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e"},
+    {file = "pillow-12.1.1-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9"},
+    {file = "pillow-12.1.1-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6"},
+    {file = "pillow-12.1.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60"},
+    {file = "pillow-12.1.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2"},
+    {file = "pillow-12.1.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850"},
+    {file = "pillow-12.1.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289"},
+    {file = "pillow-12.1.1-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e"},
+    {file = "pillow-12.1.1-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717"},
+    {file = "pillow-12.1.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a"},
+    {file = "pillow-12.1.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029"},
+    {file = "pillow-12.1.1-cp313-cp313-win32.whl", hash = "sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b"},
+    {file = "pillow-12.1.1-cp313-cp313-win_amd64.whl", hash = "sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1"},
+    {file = "pillow-12.1.1-cp313-cp313-win_arm64.whl", hash = "sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a"},
+    {file = "pillow-12.1.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da"},
+    {file = "pillow-12.1.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc"},
+    {file = "pillow-12.1.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c"},
+    {file = "pillow-12.1.1-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8"},
+    {file = "pillow-12.1.1-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20"},
+    {file = "pillow-12.1.1-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13"},
+    {file = "pillow-12.1.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf"},
+    {file = "pillow-12.1.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524"},
+    {file = "pillow-12.1.1-cp313-cp313t-win32.whl", hash = "sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986"},
+    {file = "pillow-12.1.1-cp313-cp313t-win_amd64.whl", hash = "sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c"},
+    {file = "pillow-12.1.1-cp313-cp313t-win_arm64.whl", hash = "sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3"},
+    {file = "pillow-12.1.1-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af"},
+    {file = "pillow-12.1.1-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f"},
+    {file = "pillow-12.1.1-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642"},
+    {file = "pillow-12.1.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd"},
+    {file = "pillow-12.1.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202"},
+    {file = "pillow-12.1.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f"},
+    {file = "pillow-12.1.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f"},
+    {file = "pillow-12.1.1-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f"},
+    {file = "pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e"},
+    {file = "pillow-12.1.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0"},
+    {file = "pillow-12.1.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb"},
+    {file = "pillow-12.1.1-cp314-cp314-win32.whl", hash = "sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f"},
+    {file = "pillow-12.1.1-cp314-cp314-win_amd64.whl", hash = "sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15"},
+    {file = "pillow-12.1.1-cp314-cp314-win_arm64.whl", hash = "sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f"},
+    {file = "pillow-12.1.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8"},
+    {file = "pillow-12.1.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9"},
+    {file = "pillow-12.1.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60"},
+    {file = "pillow-12.1.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7"},
+    {file = "pillow-12.1.1-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f"},
+    {file = "pillow-12.1.1-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586"},
+    {file = "pillow-12.1.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce"},
+    {file = "pillow-12.1.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8"},
+    {file = "pillow-12.1.1-cp314-cp314t-win32.whl", hash = "sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36"},
+    {file = "pillow-12.1.1-cp314-cp314t-win_amd64.whl", hash = "sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b"},
+    {file = "pillow-12.1.1-cp314-cp314t-win_arm64.whl", hash = "sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334"},
+    {file = "pillow-12.1.1-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f"},
+    {file = "pillow-12.1.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9"},
+    {file = "pillow-12.1.1-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e"},
+    {file = "pillow-12.1.1-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9"},
+    {file = "pillow-12.1.1-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3"},
+    {file = "pillow-12.1.1-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735"},
+    {file = "pillow-12.1.1-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e"},
+    {file = "pillow-12.1.1.tar.gz", hash = "sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4"},
 ]
 
 [package.extras]
 docs = ["furo", "olefile", "sphinx (>=8.2)", "sphinx-autobuild", "sphinx-copybutton", "sphinx-inline-tabs", "sphinxext-opengraph"]
 fpx = ["olefile"]
 mic = ["olefile"]
-test-arrow = ["pyarrow"]
-tests = ["check-manifest", "coverage (>=7.4.2)", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout", "pytest-xdist", "trove-classifiers (>=2024.10.12)"]
-typing = ["typing-extensions ; python_version < \"3.10\""]
+test-arrow = ["arro3-compute", "arro3-core", "nanoarrow", "pyarrow"]
+tests = ["check-manifest", "coverage (>=7.4.2)", "defusedxml", "markdown2", "olefile", "packaging", "pyroma (>=5)", "pytest", "pytest-cov", "pytest-timeout", "pytest-xdist", "trove-classifiers (>=2024.10.12)"]
 xmp = ["defusedxml"]
 
 [[package]]
 name = "prometheus-client"
-version = "0.22.1"
+version = "0.24.1"
 description = "Python client for the Prometheus monitoring system."
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "prometheus_client-0.22.1-py3-none-any.whl", hash = "sha256:cca895342e308174341b2cbf99a56bef291fbc0ef7b9e5412a0f26d653ba7094"},
-    {file = "prometheus_client-0.22.1.tar.gz", hash = "sha256:190f1331e783cf21eb60bca559354e0a4d4378facecf78f5428c39b675d20d28"},
+    {file = "prometheus_client-0.24.1-py3-none-any.whl", hash = "sha256:150db128af71a5c2482b36e588fc8a6b95e498750da4b17065947c16070f4055"},
+    {file = "prometheus_client-0.24.1.tar.gz", hash = "sha256:7e0ced7fbbd40f7b84962d5d2ab6f17ef88a72504dcf7c0b40737b43b2a461f9"},
 ]
 
 [package.extras]
+aiohttp = ["aiohttp"]
+django = ["django"]
 twisted = ["twisted"]
 
 [[package]]
 name = "psycopg2"
-version = "2.9.10"
+version = "2.9.11"
 description = "psycopg2 - Python-PostgreSQL Database Adapter"
 optional = true
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"postgres\""
 files = [
-    {file = "psycopg2-2.9.10-cp310-cp310-win32.whl", hash = "sha256:5df2b672140f95adb453af93a7d669d7a7bf0a56bcd26f1502329166f4a61716"},
-    {file = "psycopg2-2.9.10-cp310-cp310-win_amd64.whl", hash = "sha256:c6f7b8561225f9e711a9c47087388a97fdc948211c10a4bccbf0ba68ab7b3b5a"},
-    {file = "psycopg2-2.9.10-cp311-cp311-win32.whl", hash = "sha256:47c4f9875125344f4c2b870e41b6aad585901318068acd01de93f3677a6522c2"},
-    {file = "psycopg2-2.9.10-cp311-cp311-win_amd64.whl", hash = "sha256:0435034157049f6846e95103bd8f5a668788dd913a7c30162ca9503fdf542cb4"},
-    {file = "psycopg2-2.9.10-cp312-cp312-win32.whl", hash = "sha256:65a63d7ab0e067e2cdb3cf266de39663203d38d6a8ed97f5ca0cb315c73fe067"},
-    {file = "psycopg2-2.9.10-cp312-cp312-win_amd64.whl", hash = "sha256:4a579d6243da40a7b3182e0430493dbd55950c493d8c68f4eec0b302f6bbf20e"},
-    {file = "psycopg2-2.9.10-cp313-cp313-win_amd64.whl", hash = "sha256:91fd603a2155da8d0cfcdbf8ab24a2d54bca72795b90d2a3ed2b6da8d979dee2"},
-    {file = "psycopg2-2.9.10-cp39-cp39-win32.whl", hash = "sha256:9d5b3b94b79a844a986d029eee38998232451119ad653aea42bb9220a8c5066b"},
-    {file = "psycopg2-2.9.10-cp39-cp39-win_amd64.whl", hash = "sha256:88138c8dedcbfa96408023ea2b0c369eda40fe5d75002c0964c78f46f11fa442"},
-    {file = "psycopg2-2.9.10.tar.gz", hash = "sha256:12ec0b40b0273f95296233e8750441339298e6a572f7039da5b260e3c8b60e11"},
+    {file = "psycopg2-2.9.11-cp310-cp310-win_amd64.whl", hash = "sha256:103e857f46bb76908768ead4e2d0ba1d1a130e7b8ed77d3ae91e8b33481813e8"},
+    {file = "psycopg2-2.9.11-cp311-cp311-win_amd64.whl", hash = "sha256:210daed32e18f35e3140a1ebe059ac29209dd96468f2f7559aa59f75ee82a5cb"},
+    {file = "psycopg2-2.9.11-cp312-cp312-win_amd64.whl", hash = "sha256:e03e4a6dbe87ff81540b434f2e5dc2bddad10296db5eea7bdc995bf5f4162938"},
+    {file = "psycopg2-2.9.11-cp313-cp313-win_amd64.whl", hash = "sha256:8dc379166b5b7d5ea66dcebf433011dfc51a7bb8a5fc12367fa05668e5fc53c8"},
+    {file = "psycopg2-2.9.11-cp314-cp314-win_amd64.whl", hash = "sha256:f10a48acba5fe6e312b891f290b4d2ca595fc9a06850fe53320beac353575578"},
+    {file = "psycopg2-2.9.11-cp39-cp39-win_amd64.whl", hash = "sha256:6ecddcf573777536bddfefaea8079ce959287798c8f5804bee6933635d538924"},
+    {file = "psycopg2-2.9.11.tar.gz", hash = "sha256:964d31caf728e217c697ff77ea69c2ba0865fa41ec20bb00f0977e62fdcc52e3"},
 ]
 
 [[package]]
@@ -1735,14 +2076,14 @@ psycopg2 = "*"
 
 [[package]]
 name = "pyasn1"
-version = "0.6.1"
+version = "0.6.3"
 description = "Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)"
 optional = false
 python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "pyasn1-0.6.1-py3-none-any.whl", hash = "sha256:0d632f46f2ba09143da3a8afe9e33fb6f92fa2320ab7e886e2d0f7672af84629"},
-    {file = "pyasn1-0.6.1.tar.gz", hash = "sha256:6f580d2bdd84365380830acf45550f2511469f673cb4a5ae3857a3170128b034"},
+    {file = "pyasn1-0.6.3-py3-none-any.whl", hash = "sha256:a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde"},
+    {file = "pyasn1-0.6.3.tar.gz", hash = "sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf"},
 ]
 
 [[package]]
@@ -1762,33 +2103,34 @@ pyasn1 = ">=0.6.1,<0.7.0"
 
 [[package]]
 name = "pycparser"
-version = "2.21"
+version = "3.0"
 description = "C parser in Python"
 optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
+python-versions = ">=3.10"
 groups = ["main", "dev"]
+markers = "implementation_name != \"PyPy\""
 files = [
-    {file = "pycparser-2.21-py2.py3-none-any.whl", hash = "sha256:8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9"},
-    {file = "pycparser-2.21.tar.gz", hash = "sha256:e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206"},
+    {file = "pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992"},
+    {file = "pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29"},
 ]
 
 [[package]]
 name = "pydantic"
-version = "2.11.7"
+version = "2.12.5"
 description = "Data validation using Python type hints"
 optional = false
 python-versions = ">=3.9"
-groups = ["main", "dev"]
+groups = ["main"]
 files = [
-    {file = "pydantic-2.11.7-py3-none-any.whl", hash = "sha256:dde5df002701f6de26248661f6835bbe296a47bf73990135c7d07ce741b9623b"},
-    {file = "pydantic-2.11.7.tar.gz", hash = "sha256:d989c3c6cb79469287b1569f7447a17848c998458d49ebe294e975b9baf0f0db"},
+    {file = "pydantic-2.12.5-py3-none-any.whl", hash = "sha256:e561593fccf61e8a20fc46dfc2dfe075b8be7d0188df33f221ad1f0139180f9d"},
+    {file = "pydantic-2.12.5.tar.gz", hash = "sha256:4d351024c75c0f085a9febbb665ce8c0c6ec5d30e903bdb6394b7ede26aebb49"},
 ]
 
 [package.dependencies]
 annotated-types = ">=0.6.0"
-pydantic-core = "2.33.2"
-typing-extensions = ">=4.12.2"
-typing-inspection = ">=0.4.0"
+pydantic-core = "2.41.5"
+typing-extensions = ">=4.14.1"
+typing-inspection = ">=0.4.2"
 
 [package.extras]
 email = ["email-validator (>=2.0.0)"]
@@ -1796,126 +2138,148 @@ timezone = ["tzdata ; python_version >= \"3.9\" and platform_system == \"Windows
 
 [[package]]
 name = "pydantic-core"
-version = "2.33.2"
+version = "2.41.5"
 description = "Core functionality for Pydantic validation and serialization"
 optional = false
 python-versions = ">=3.9"
-groups = ["main", "dev"]
+groups = ["main"]
 files = [
-    {file = "pydantic_core-2.33.2-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:2b3d326aaef0c0399d9afffeb6367d5e26ddc24d351dbc9c636840ac355dc5d8"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:0e5b2671f05ba48b94cb90ce55d8bdcaaedb8ba00cc5359f6810fc918713983d"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0069c9acc3f3981b9ff4cdfaf088e98d83440a4c7ea1bc07460af3d4dc22e72d"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d53b22f2032c42eaaf025f7c40c2e3b94568ae077a606f006d206a463bc69572"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0405262705a123b7ce9f0b92f123334d67b70fd1f20a9372b907ce1080c7ba02"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4b25d91e288e2c4e0662b8038a28c6a07eaac3e196cfc4ff69de4ea3db992a1b"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6bdfe4b3789761f3bcb4b1ddf33355a71079858958e3a552f16d5af19768fef2"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:efec8db3266b76ef9607c2c4c419bdb06bf335ae433b80816089ea7585816f6a"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:031c57d67ca86902726e0fae2214ce6770bbe2f710dc33063187a68744a5ecac"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_armv7l.whl", hash = "sha256:f8de619080e944347f5f20de29a975c2d815d9ddd8be9b9b7268e2e3ef68605a"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:73662edf539e72a9440129f231ed3757faab89630d291b784ca99237fb94db2b"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-win32.whl", hash = "sha256:0a39979dcbb70998b0e505fb1556a1d550a0781463ce84ebf915ba293ccb7e22"},
-    {file = "pydantic_core-2.33.2-cp310-cp310-win_amd64.whl", hash = "sha256:b0379a2b24882fef529ec3b4987cb5d003b9cda32256024e6fe1586ac45fc640"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:4c5b0a576fb381edd6d27f0a85915c6daf2f8138dc5c267a57c08a62900758c7"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e799c050df38a639db758c617ec771fd8fb7a5f8eaaa4b27b101f266b216a246"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dc46a01bf8d62f227d5ecee74178ffc448ff4e5197c756331f71efcc66dc980f"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a144d4f717285c6d9234a66778059f33a89096dfb9b39117663fd8413d582dcc"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:73cf6373c21bc80b2e0dc88444f41ae60b2f070ed02095754eb5a01df12256de"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3dc625f4aa79713512d1976fe9f0bc99f706a9dee21dfd1810b4bbbf228d0e8a"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:881b21b5549499972441da4758d662aeea93f1923f953e9cbaff14b8b9565aef"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:bdc25f3681f7b78572699569514036afe3c243bc3059d3942624e936ec93450e"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:fe5b32187cbc0c862ee201ad66c30cf218e5ed468ec8dc1cf49dec66e160cc4d"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_armv7l.whl", hash = "sha256:bc7aee6f634a6f4a95676fcb5d6559a2c2a390330098dba5e5a5f28a2e4ada30"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:235f45e5dbcccf6bd99f9f472858849f73d11120d76ea8707115415f8e5ebebf"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-win32.whl", hash = "sha256:6368900c2d3ef09b69cb0b913f9f8263b03786e5b2a387706c5afb66800efd51"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-win_amd64.whl", hash = "sha256:1e063337ef9e9820c77acc768546325ebe04ee38b08703244c1309cccc4f1bab"},
-    {file = "pydantic_core-2.33.2-cp311-cp311-win_arm64.whl", hash = "sha256:6b99022f1d19bc32a4c2a0d544fc9a76e3be90f0b3f4af413f87d38749300e65"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:a7ec89dc587667f22b6a0b6579c249fca9026ce7c333fc142ba42411fa243cdc"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3c6db6e52c6d70aa0d00d45cdb9b40f0433b96380071ea80b09277dba021ddf7"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e61206137cbc65e6d5256e1166f88331d3b6238e082d9f74613b9b765fb9025"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:eb8c529b2819c37140eb51b914153063d27ed88e3bdc31b71198a198e921e011"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c52b02ad8b4e2cf14ca7b3d918f3eb0ee91e63b3167c32591e57c4317e134f8f"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:96081f1605125ba0855dfda83f6f3df5ec90c61195421ba72223de35ccfb2f88"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8f57a69461af2a5fa6e6bbd7a5f60d3b7e6cebb687f55106933188e79ad155c1"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:572c7e6c8bb4774d2ac88929e3d1f12bc45714ae5ee6d9a788a9fb35e60bb04b"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:db4b41f9bd95fbe5acd76d89920336ba96f03e149097365afe1cb092fceb89a1"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_armv7l.whl", hash = "sha256:fa854f5cf7e33842a892e5c73f45327760bc7bc516339fda888c75ae60edaeb6"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:5f483cfb75ff703095c59e365360cb73e00185e01aaea067cd19acffd2ab20ea"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-win32.whl", hash = "sha256:9cb1da0f5a471435a7bc7e439b8a728e8b61e59784b2af70d7c169f8dd8ae290"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-win_amd64.whl", hash = "sha256:f941635f2a3d96b2973e867144fde513665c87f13fe0e193c158ac51bfaaa7b2"},
-    {file = "pydantic_core-2.33.2-cp312-cp312-win_arm64.whl", hash = "sha256:cca3868ddfaccfbc4bfb1d608e2ccaaebe0ae628e1416aeb9c4d88c001bb45ab"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:1082dd3e2d7109ad8b7da48e1d4710c8d06c253cbc4a27c1cff4fbcaa97a9e3f"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f517ca031dfc037a9c07e748cefd8d96235088b83b4f4ba8939105d20fa1dcd6"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0a9f2c9dd19656823cb8250b0724ee9c60a82f3cdf68a080979d13092a3b0fef"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2b0a451c263b01acebe51895bfb0e1cc842a5c666efe06cdf13846c7418caa9a"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1ea40a64d23faa25e62a70ad163571c0b342b8bf66d5fa612ac0dec4f069d916"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0fb2d542b4d66f9470e8065c5469ec676978d625a8b7a363f07d9a501a9cb36a"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9fdac5d6ffa1b5a83bca06ffe7583f5576555e6c8b3a91fbd25ea7780f825f7d"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:04a1a413977ab517154eebb2d326da71638271477d6ad87a769102f7c2488c56"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:c8e7af2f4e0194c22b5b37205bfb293d166a7344a5b0d0eaccebc376546d77d5"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:5c92edd15cd58b3c2d34873597a1e20f13094f59cf88068adb18947df5455b4e"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:65132b7b4a1c0beded5e057324b7e16e10910c106d43675d9bd87d4f38dde162"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-win32.whl", hash = "sha256:52fb90784e0a242bb96ec53f42196a17278855b0f31ac7c3cc6f5c1ec4811849"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-win_amd64.whl", hash = "sha256:c083a3bdd5a93dfe480f1125926afcdbf2917ae714bdb80b36d34318b2bec5d9"},
-    {file = "pydantic_core-2.33.2-cp313-cp313-win_arm64.whl", hash = "sha256:e80b087132752f6b3d714f041ccf74403799d3b23a72722ea2e6ba2e892555b9"},
-    {file = "pydantic_core-2.33.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:61c18fba8e5e9db3ab908620af374db0ac1baa69f0f32df4f61ae23f15e586ac"},
-    {file = "pydantic_core-2.33.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:95237e53bb015f67b63c91af7518a62a8660376a6a0db19b89acc77a4d6199f5"},
-    {file = "pydantic_core-2.33.2-cp313-cp313t-win_amd64.whl", hash = "sha256:c2fc0a768ef76c15ab9238afa6da7f69895bb5d1ee83aeea2e3509af4472d0b9"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-macosx_10_12_x86_64.whl", hash = "sha256:a2b911a5b90e0374d03813674bf0a5fbbb7741570dcd4b4e85a2e48d17def29d"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:6fa6dfc3e4d1f734a34710f391ae822e0a8eb8559a85c6979e14e65ee6ba2954"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c54c939ee22dc8e2d545da79fc5381f1c020d6d3141d3bd747eab59164dc89fb"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:53a57d2ed685940a504248187d5685e49eb5eef0f696853647bf37c418c538f7"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:09fb9dd6571aacd023fe6aaca316bd01cf60ab27240d7eb39ebd66a3a15293b4"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0e6116757f7959a712db11f3e9c0a99ade00a5bbedae83cb801985aa154f071b"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8d55ab81c57b8ff8548c3e4947f119551253f4e3787a7bbc0b6b3ca47498a9d3"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c20c462aa4434b33a2661701b861604913f912254e441ab8d78d30485736115a"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:44857c3227d3fb5e753d5fe4a3420d6376fa594b07b621e220cd93703fe21782"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-musllinux_1_1_armv7l.whl", hash = "sha256:eb9b459ca4df0e5c87deb59d37377461a538852765293f9e6ee834f0435a93b9"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:9fcd347d2cc5c23b06de6d3b7b8275be558a0c90549495c699e379a80bf8379e"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-win32.whl", hash = "sha256:83aa99b1285bc8f038941ddf598501a86f1536789740991d7d8756e34f1e74d9"},
-    {file = "pydantic_core-2.33.2-cp39-cp39-win_amd64.whl", hash = "sha256:f481959862f57f29601ccced557cc2e817bce7533ab8e01a797a48b49c9692b3"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:5c4aa4e82353f65e548c476b37e64189783aa5384903bfea4f41580f255fddfa"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:d946c8bf0d5c24bf4fe333af284c59a19358aa3ec18cb3dc4370080da1e8ad29"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:87b31b6846e361ef83fedb187bb5b4372d0da3f7e28d85415efa92d6125d6e6d"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aa9d91b338f2df0508606f7009fde642391425189bba6d8c653afd80fd6bb64e"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:2058a32994f1fde4ca0480ab9d1e75a0e8c87c22b53a3ae66554f9af78f2fe8c"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:0e03262ab796d986f978f79c943fc5f620381be7287148b8010b4097f79a39ec"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:1a8695a8d00c73e50bff9dfda4d540b7dee29ff9b8053e38380426a85ef10052"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:fa754d1850735a0b0e03bcffd9d4b4343eb417e47196e4485d9cca326073a42c"},
-    {file = "pydantic_core-2.33.2-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:a11c8d26a50bfab49002947d3d237abe4d9e4b5bdc8846a63537b6488e197808"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:dd14041875d09cc0f9308e37a6f8b65f5585cf2598a53aa0123df8b129d481f8"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:d87c561733f66531dced0da6e864f44ebf89a8fba55f31407b00c2f7f9449593"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2f82865531efd18d6e07a04a17331af02cb7a651583c418df8266f17a63c6612"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bfb5112df54209d820d7bf9317c7a6c9025ea52e49f46b6a2060104bba37de7"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:64632ff9d614e5eecfb495796ad51b0ed98c453e447a76bcbeeb69615079fc7e"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:f889f7a40498cc077332c7ab6b4608d296d852182211787d4f3ee377aaae66e8"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:de4b83bb311557e439b9e186f733f6c645b9417c84e2eb8203f3f820a4b988bf"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:82f68293f055f51b51ea42fafc74b6aad03e70e191799430b90c13d643059ebb"},
-    {file = "pydantic_core-2.33.2-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:329467cecfb529c925cf2bbd4d60d2c509bc2fb52a20c1045bf09bb70971a9c1"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-macosx_10_12_x86_64.whl", hash = "sha256:87acbfcf8e90ca885206e98359d7dca4bcbb35abdc0ff66672a293e1d7a19101"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:7f92c15cd1e97d4b12acd1cc9004fa092578acfa57b67ad5e43a197175d01a64"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d3f26877a748dc4251cfcfda9dfb5f13fcb034f5308388066bcfe9031b63ae7d"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dac89aea9af8cd672fa7b510e7b8c33b0bba9a43186680550ccf23020f32d535"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:970919794d126ba8645f3837ab6046fb4e72bbc057b3709144066204c19a455d"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:3eb3fe62804e8f859c49ed20a8451342de53ed764150cb14ca71357c765dc2a6"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:3abcd9392a36025e3bd55f9bd38d908bd17962cc49bc6da8e7e96285336e2bca"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:3a1c81334778f9e3af2f8aeb7a960736e5cab1dfebfb26aabca09afd2906c039"},
-    {file = "pydantic_core-2.33.2-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:2807668ba86cb38c6817ad9bc66215ab8584d1d304030ce4f0887336f28a5e27"},
-    {file = "pydantic_core-2.33.2.tar.gz", hash = "sha256:7cb8bc3605c29176e1b105350d2e6474142d7c1bd1d9327c4a9bdb46bf827acc"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:77b63866ca88d804225eaa4af3e664c5faf3568cea95360d21f4725ab6e07146"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:dfa8a0c812ac681395907e71e1274819dec685fec28273a28905df579ef137e2"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5921a4d3ca3aee735d9fd163808f5e8dd6c6972101e4adbda9a4667908849b97"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:e25c479382d26a2a41b7ebea1043564a937db462816ea07afa8a44c0866d52f9"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f547144f2966e1e16ae626d8ce72b4cfa0caedc7fa28052001c94fb2fcaa1c52"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f52298fbd394f9ed112d56f3d11aabd0d5bd27beb3084cc3d8ad069483b8941"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:100baa204bb412b74fe285fb0f3a385256dad1d1879f0a5cb1499ed2e83d132a"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:05a2c8852530ad2812cb7914dc61a1125dc4e06252ee98e5638a12da6cc6fb6c"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:29452c56df2ed968d18d7e21f4ab0ac55e71dc59524872f6fc57dcf4a3249ed2"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-musllinux_1_1_armv7l.whl", hash = "sha256:d5160812ea7a8a2ffbe233d8da666880cad0cbaf5d4de74ae15c313213d62556"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:df3959765b553b9440adfd3c795617c352154e497a4eaf3752555cfb5da8fc49"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-win32.whl", hash = "sha256:1f8d33a7f4d5a7889e60dc39856d76d09333d8a6ed0f5f1190635cbec70ec4ba"},
+    {file = "pydantic_core-2.41.5-cp310-cp310-win_amd64.whl", hash = "sha256:62de39db01b8d593e45871af2af9e497295db8d73b085f6bfd0b18c83c70a8f9"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:a3a52f6156e73e7ccb0f8cced536adccb7042be67cb45f9562e12b319c119da6"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:7f3bf998340c6d4b0c9a2f02d6a400e51f123b59565d74dc60d252ce888c260b"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:378bec5c66998815d224c9ca994f1e14c0c21cb95d2f52b6021cc0b2a58f2a5a"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:e7b576130c69225432866fe2f4a469a85a54ade141d96fd396dffcf607b558f8"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:6cb58b9c66f7e4179a2d5e0f849c48eff5c1fca560994d6eb6543abf955a149e"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:88942d3a3dff3afc8288c21e565e476fc278902ae4d6d134f1eeda118cc830b1"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f31d95a179f8d64d90f6831d71fa93290893a33148d890ba15de25642c5d075b"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c1df3d34aced70add6f867a8cf413e299177e0c22660cc767218373d0779487b"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:4009935984bd36bd2c774e13f9a09563ce8de4abaa7226f5108262fa3e637284"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-musllinux_1_1_armv7l.whl", hash = "sha256:34a64bc3441dc1213096a20fe27e8e128bd3ff89921706e83c0b1ac971276594"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:c9e19dd6e28fdcaa5a1de679aec4141f691023916427ef9bae8584f9c2fb3b0e"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-win32.whl", hash = "sha256:2c010c6ded393148374c0f6f0bf89d206bf3217f201faa0635dcd56bd1520f6b"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-win_amd64.whl", hash = "sha256:76ee27c6e9c7f16f47db7a94157112a2f3a00e958bc626e2f4ee8bec5c328fbe"},
+    {file = "pydantic_core-2.41.5-cp311-cp311-win_arm64.whl", hash = "sha256:4bc36bbc0b7584de96561184ad7f012478987882ebf9f9c389b23f432ea3d90f"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:f41a7489d32336dbf2199c8c0a215390a751c5b014c2c1c5366e817202e9cdf7"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:070259a8818988b9a84a449a2a7337c7f430a22acc0859c6b110aa7212a6d9c0"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e96cea19e34778f8d59fe40775a7a574d95816eb150850a85a7a4c8f4b94ac69"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:ed2e99c456e3fadd05c991f8f437ef902e00eedf34320ba2b0842bd1c3ca3a75"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:65840751b72fbfd82c3c640cff9284545342a4f1eb1586ad0636955b261b0b05"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e536c98a7626a98feb2d3eaf75944ef6f3dbee447e1f841eae16f2f0a72d8ddc"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:eceb81a8d74f9267ef4081e246ffd6d129da5d87e37a77c9bde550cb04870c1c"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d38548150c39b74aeeb0ce8ee1d8e82696f4a4e16ddc6de7b1d8823f7de4b9b5"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:c23e27686783f60290e36827f9c626e63154b82b116d7fe9adba1fda36da706c"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-musllinux_1_1_armv7l.whl", hash = "sha256:482c982f814460eabe1d3bb0adfdc583387bd4691ef00b90575ca0d2b6fe2294"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:bfea2a5f0b4d8d43adf9d7b8bf019fb46fdd10a2e5cde477fbcb9d1fa08c68e1"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-win32.whl", hash = "sha256:b74557b16e390ec12dca509bce9264c3bbd128f8a2c376eaa68003d7f327276d"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-win_amd64.whl", hash = "sha256:1962293292865bca8e54702b08a4f26da73adc83dd1fcf26fbc875b35d81c815"},
+    {file = "pydantic_core-2.41.5-cp312-cp312-win_arm64.whl", hash = "sha256:1746d4a3d9a794cacae06a5eaaccb4b8643a131d45fbc9af23e353dc0a5ba5c3"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:941103c9be18ac8daf7b7adca8228f8ed6bb7a1849020f643b3a14d15b1924d9"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:112e305c3314f40c93998e567879e887a3160bb8689ef3d2c04b6cc62c33ac34"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0cbaad15cb0c90aa221d43c00e77bb33c93e8d36e0bf74760cd00e732d10a6a0"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:03ca43e12fab6023fc79d28ca6b39b05f794ad08ec2feccc59a339b02f2b3d33"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:dc799088c08fa04e43144b164feb0c13f9a0bc40503f8df3e9fde58a3c0c101e"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:97aeba56665b4c3235a0e52b2c2f5ae9cd071b8a8310ad27bddb3f7fb30e9aa2"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:406bf18d345822d6c21366031003612b9c77b3e29ffdb0f612367352aab7d586"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b93590ae81f7010dbe380cdeab6f515902ebcbefe0b9327cc4804d74e93ae69d"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:01a3d0ab748ee531f4ea6c3e48ad9dac84ddba4b0d82291f87248f2f9de8d740"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:6561e94ba9dacc9c61bce40e2d6bdc3bfaa0259d3ff36ace3b1e6901936d2e3e"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:915c3d10f81bec3a74fbd4faebe8391013ba61e5a1a8d48c4455b923bdda7858"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-win32.whl", hash = "sha256:650ae77860b45cfa6e2cdafc42618ceafab3a2d9a3811fcfbd3bbf8ac3c40d36"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-win_amd64.whl", hash = "sha256:79ec52ec461e99e13791ec6508c722742ad745571f234ea6255bed38c6480f11"},
+    {file = "pydantic_core-2.41.5-cp313-cp313-win_arm64.whl", hash = "sha256:3f84d5c1b4ab906093bdc1ff10484838aca54ef08de4afa9de0f5f14d69639cd"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:3f37a19d7ebcdd20b96485056ba9e8b304e27d9904d233d7b1015db320e51f0a"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1d1d9764366c73f996edd17abb6d9d7649a7eb690006ab6adbda117717099b14"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:25e1c2af0fce638d5f1988b686f3b3ea8cd7de5f244ca147c777769e798a9cd1"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:506d766a8727beef16b7adaeb8ee6217c64fc813646b424d0804d67c16eddb66"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4819fa52133c9aa3c387b3328f25c1facc356491e6135b459f1de698ff64d869"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2b761d210c9ea91feda40d25b4efe82a1707da2ef62901466a42492c028553a2"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:22f0fb8c1c583a3b6f24df2470833b40207e907b90c928cc8d3594b76f874375"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:2782c870e99878c634505236d81e5443092fba820f0373997ff75f90f68cd553"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:0177272f88ab8312479336e1d777f6b124537d47f2123f89cb37e0accea97f90"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-musllinux_1_1_armv7l.whl", hash = "sha256:63510af5e38f8955b8ee5687740d6ebf7c2a0886d15a6d65c32814613681bc07"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:e56ba91f47764cc14f1daacd723e3e82d1a89d783f0f5afe9c364b8bb491ccdb"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-win32.whl", hash = "sha256:aec5cf2fd867b4ff45b9959f8b20ea3993fc93e63c7363fe6851424c8a7e7c23"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-win_amd64.whl", hash = "sha256:8e7c86f27c585ef37c35e56a96363ab8de4e549a95512445b85c96d3e2f7c1bf"},
+    {file = "pydantic_core-2.41.5-cp314-cp314-win_arm64.whl", hash = "sha256:e672ba74fbc2dc8eea59fb6d4aed6845e6905fc2a8afe93175d94a83ba2a01a0"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:8566def80554c3faa0e65ac30ab0932b9e3a5cd7f8323764303d468e5c37595a"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:b80aa5095cd3109962a298ce14110ae16b8c1aece8b72f9dafe81cf597ad80b3"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3006c3dd9ba34b0c094c544c6006cc79e87d8612999f1a5d43b769b89181f23c"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:72f6c8b11857a856bcfa48c86f5368439f74453563f951e473514579d44aa612"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5cb1b2f9742240e4bb26b652a5aeb840aa4b417c7748b6f8387927bc6e45e40d"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:bd3d54f38609ff308209bd43acea66061494157703364ae40c951f83ba99a1a9"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2ff4321e56e879ee8d2a879501c8e469414d948f4aba74a2d4593184eb326660"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d0d2568a8c11bf8225044aa94409e21da0cb09dcdafe9ecd10250b2baad531a9"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-musllinux_1_1_aarch64.whl", hash = "sha256:a39455728aabd58ceabb03c90e12f71fd30fa69615760a075b9fec596456ccc3"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-musllinux_1_1_armv7l.whl", hash = "sha256:239edca560d05757817c13dc17c50766136d21f7cd0fac50295499ae24f90fdf"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-musllinux_1_1_x86_64.whl", hash = "sha256:2a5e06546e19f24c6a96a129142a75cee553cc018ffee48a460059b1185f4470"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-win32.whl", hash = "sha256:b4ececa40ac28afa90871c2cc2b9ffd2ff0bf749380fbdf57d165fd23da353aa"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-win_amd64.whl", hash = "sha256:80aa89cad80b32a912a65332f64a4450ed00966111b6615ca6816153d3585a8c"},
+    {file = "pydantic_core-2.41.5-cp314-cp314t-win_arm64.whl", hash = "sha256:35b44f37a3199f771c3eaa53051bc8a70cd7b54f333531c59e29fd4db5d15008"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-macosx_10_12_x86_64.whl", hash = "sha256:8bfeaf8735be79f225f3fefab7f941c712aaca36f1128c9d7e2352ee1aa87bdf"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:346285d28e4c8017da95144c7f3acd42740d637ff41946af5ce6e5e420502dd5"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a75dafbf87d6276ddc5b2bf6fae5254e3d0876b626eb24969a574fff9149ee5d"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7b93a4d08587e2b7e7882de461e82b6ed76d9026ce91ca7915e740ecc7855f60"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e8465ab91a4bd96d36dde3263f06caa6a8a6019e4113f24dc753d79a8b3a3f82"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:299e0a22e7ae2b85c1a57f104538b2656e8ab1873511fd718a1c1c6f149b77b5"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:707625ef0983fcfb461acfaf14de2067c5942c6bb0f3b4c99158bed6fedd3cf3"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f41eb9797986d6ebac5e8edff36d5cef9de40def462311b3eb3eeded1431e425"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:0384e2e1021894b1ff5a786dbf94771e2986ebe2869533874d7e43bc79c6f504"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-musllinux_1_1_armv7l.whl", hash = "sha256:f0cd744688278965817fd0839c4a4116add48d23890d468bc436f78beb28abf5"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:753e230374206729bf0a807954bcc6c150d3743928a73faffee51ac6557a03c3"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-win32.whl", hash = "sha256:873e0d5b4fb9b89ef7c2d2a963ea7d02879d9da0da8d9d4933dee8ee86a8b460"},
+    {file = "pydantic_core-2.41.5-cp39-cp39-win_amd64.whl", hash = "sha256:e4f4a984405e91527a0d62649ee21138f8e3d0ef103be488c1dc11a80d7f184b"},
+    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_10_12_x86_64.whl", hash = "sha256:b96d5f26b05d03cc60f11a7761a5ded1741da411e7fe0909e27a5e6a0cb7b034"},
+    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_11_0_arm64.whl", hash = "sha256:634e8609e89ceecea15e2d61bc9ac3718caaaa71963717bf3c8f38bfde64242c"},
+    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:93e8740d7503eb008aa2df04d3b9735f845d43ae845e6dcd2be0b55a2da43cd2"},
+    {file = "pydantic_core-2.41.5-graalpy311-graalpy242_311_native-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f15489ba13d61f670dcc96772e733aad1a6f9c429cc27574c6cdaed82d0146ad"},
+    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-macosx_10_12_x86_64.whl", hash = "sha256:7da7087d756b19037bc2c06edc6c170eeef3c3bafcb8f532ff17d64dc427adfd"},
+    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-macosx_11_0_arm64.whl", hash = "sha256:aabf5777b5c8ca26f7824cb4a120a740c9588ed58df9b2d196ce92fba42ff8dc"},
+    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c007fe8a43d43b3969e8469004e9845944f1a80e6acd47c150856bb87f230c56"},
+    {file = "pydantic_core-2.41.5-graalpy312-graalpy250_312_native-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:76d0819de158cd855d1cbb8fcafdf6f5cf1eb8e470abe056d5d161106e38062b"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:b5819cd790dbf0c5eb9f82c73c16b39a65dd6dd4d1439dcdea7816ec9adddab8"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:5a4e67afbc95fa5c34cf27d9089bca7fcab4e51e57278d710320a70b956d1b9a"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ece5c59f0ce7d001e017643d8d24da587ea1f74f6993467d85ae8a5ef9d4f42b"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:16f80f7abe3351f8ea6858914ddc8c77e02578544a0ebc15b4c2e1a0e813b0b2"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:33cb885e759a705b426baada1fe68cbb0a2e68e34c5d0d0289a364cf01709093"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:c8d8b4eb992936023be7dee581270af5c6e0697a8559895f527f5b7105ecd36a"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:242a206cd0318f95cd21bdacff3fcc3aab23e79bba5cac3db5a841c9ef9c6963"},
+    {file = "pydantic_core-2.41.5-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:d3a978c4f57a597908b7e697229d996d77a6d3c94901e9edee593adada95ce1a"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:b2379fa7ed44ddecb5bfe4e48577d752db9fc10be00a6b7446e9663ba143de26"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:266fb4cbf5e3cbd0b53669a6d1b039c45e3ce651fd5442eff4d07c2cc8d66808"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:58133647260ea01e4d0500089a8c4f07bd7aa6ce109682b1426394988d8aaacc"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:287dad91cfb551c363dc62899a80e9e14da1f0e2b6ebde82c806612ca2a13ef1"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:03b77d184b9eb40240ae9fd676ca364ce1085f203e1b1256f8ab9984dca80a84"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:a668ce24de96165bb239160b3d854943128f4334822900534f2fe947930e5770"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:f14f8f046c14563f8eb3f45f499cc658ab8d10072961e07225e507adb700e93f"},
+    {file = "pydantic_core-2.41.5-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:56121965f7a4dc965bff783d70b907ddf3d57f6eba29b6d2e5dabfaf07799c51"},
+    {file = "pydantic_core-2.41.5.tar.gz", hash = "sha256:08daa51ea16ad373ffd5e7606252cc32f07bc72b28284b6bc9c6df804816476e"},
 ]
 
 [package.dependencies]
-typing-extensions = ">=4.6.0,<4.7.0 || >4.7.0"
+typing-extensions = ">=4.14.1"
 
 [[package]]
 name = "pygithub"
-version = "2.7.0"
+version = "2.8.1"
 description = "Use the full Github API v3"
 optional = false
 python-versions = ">=3.8"
 groups = ["dev"]
 files = [
-    {file = "pygithub-2.7.0-py3-none-any.whl", hash = "sha256:40ecbfe26dc55cc34ab4b0ffa1d455e6f816ef9a2bc8d6f5ad18ce572f163700"},
-    {file = "pygithub-2.7.0.tar.gz", hash = "sha256:7cd6eafabb09b5369afba3586d86b1f1ad6f1326d2ff01bc47bb26615dce4cbb"},
+    {file = "pygithub-2.8.1-py3-none-any.whl", hash = "sha256:23a0a5bca93baef082e03411bf0ce27204c32be8bfa7abc92fe4a3e132936df0"},
+    {file = "pygithub-2.8.1.tar.gz", hash = "sha256:341b7c78521cb07324ff670afd1baa2bf5c286f8d9fd302c1798ba594a5400c9"},
 ]
 
 [package.dependencies]
@@ -1927,29 +2291,29 @@ urllib3 = ">=1.26.0"
 
 [[package]]
 name = "pygments"
-version = "2.15.1"
+version = "2.20.0"
 description = "Pygments is a syntax highlighting package written in Python."
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "Pygments-2.15.1-py3-none-any.whl", hash = "sha256:db2db3deb4b4179f399a09054b023b6a586b76499d36965813c71aa8ed7b5fd1"},
-    {file = "Pygments-2.15.1.tar.gz", hash = "sha256:8ace4d3c1dd481894b2005f560ead0f9f19ee64fe983366be1a21e171d12775c"},
+    {file = "pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176"},
+    {file = "pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f"},
 ]
 
 [package.extras]
-plugins = ["importlib-metadata ; python_version < \"3.8\""]
+windows-terminal = ["colorama (>=0.4.6)"]
 
 [[package]]
 name = "pyjwt"
-version = "2.6.0"
+version = "2.12.0"
 description = "JSON Web Token implementation in Python"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "PyJWT-2.6.0-py3-none-any.whl", hash = "sha256:d83c3d892a77bbb74d3e1a2cfa90afaadb60945205d1095d9221f04466f64c14"},
-    {file = "PyJWT-2.6.0.tar.gz", hash = "sha256:69285c7e31fc44f68a1feb309e948e0df53259d579295e6cfe2b1792329f05fd"},
+    {file = "pyjwt-2.12.0-py3-none-any.whl", hash = "sha256:9bb459d1bdd0387967d287f5656bf7ec2b9a26645d1961628cda1764e087fd6e"},
+    {file = "pyjwt-2.12.0.tar.gz", hash = "sha256:2f62390b667cd8257de560b850bb5a883102a388829274147f1d724453f8fb02"},
 ]
 
 [package.dependencies]
@@ -1957,9 +2321,9 @@ cryptography = {version = ">=3.4.0", optional = true, markers = "extra == \"cryp
 
 [package.extras]
 crypto = ["cryptography (>=3.4.0)"]
-dev = ["coverage[toml] (==5.0.4)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=6.0.0,<7.0.0)", "sphinx (>=4.5.0,<5.0.0)", "sphinx-rtd-theme", "zope.interface"]
-docs = ["sphinx (>=4.5.0,<5.0.0)", "sphinx-rtd-theme", "zope.interface"]
-tests = ["coverage[toml] (==5.0.4)", "pytest (>=6.0.0,<7.0.0)"]
+dev = ["coverage[toml] (==7.10.7)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=8.4.2,<9.0.0)", "sphinx", "sphinx-rtd-theme", "zope.interface"]
+docs = ["sphinx", "sphinx-rtd-theme", "zope.interface"]
+tests = ["coverage[toml] (==7.10.7)", "pytest (>=8.4.2,<9.0.0)"]
 
 [[package]]
 name = "pymacaroons"
@@ -1992,51 +2356,123 @@ files = [
 
 [[package]]
 name = "pynacl"
-version = "1.5.0"
+version = "1.6.2"
 description = "Python binding to the Networking and Cryptography (NaCl) library"
 optional = false
-python-versions = ">=3.6"
+python-versions = ">=3.8"
 groups = ["main", "dev"]
 files = [
-    {file = "PyNaCl-1.5.0-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-win32.whl", hash = "sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-win_amd64.whl", hash = "sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93"},
-    {file = "PyNaCl-1.5.0.tar.gz", hash = "sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba"},
+    {file = "pynacl-1.6.2-cp314-cp314t-macosx_10_10_universal2.whl", hash = "sha256:622d7b07cc5c02c666795792931b50c91f3ce3c2649762efb1ef0d5684c81594"},
+    {file = "pynacl-1.6.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d071c6a9a4c94d79eb665db4ce5cedc537faf74f2355e4d502591d850d3913c0"},
+    {file = "pynacl-1.6.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe9847ca47d287af41e82be1dd5e23023d3c31a951da134121ab02e42ac218c9"},
+    {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:04316d1fc625d860b6c162fff704eb8426b1a8bcd3abacea11142cbd99a6b574"},
+    {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:44081faff368d6c5553ccf55322ef2819abb40e25afaec7e740f159f74813634"},
+    {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:a9f9932d8d2811ce1a8ffa79dcbdf3970e7355b5c8eb0c1a881a57e7f7d96e88"},
+    {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:bc4a36b28dd72fb4845e5d8f9760610588a96d5a51f01d84d8c6ff9849968c14"},
+    {file = "pynacl-1.6.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:3bffb6d0f6becacb6526f8f42adfb5efb26337056ee0831fb9a7044d1a964444"},
+    {file = "pynacl-1.6.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:2fef529ef3ee487ad8113d287a593fa26f48ee3620d92ecc6f1d09ea38e0709b"},
+    {file = "pynacl-1.6.2-cp314-cp314t-win32.whl", hash = "sha256:a84bf1c20339d06dc0c85d9aea9637a24f718f375d861b2668b2f9f96fa51145"},
+    {file = "pynacl-1.6.2-cp314-cp314t-win_amd64.whl", hash = "sha256:320ef68a41c87547c91a8b58903c9caa641ab01e8512ce291085b5fe2fcb7590"},
+    {file = "pynacl-1.6.2-cp314-cp314t-win_arm64.whl", hash = "sha256:d29bfe37e20e015a7d8b23cfc8bd6aa7909c92a1b8f41ee416bbb3e79ef182b2"},
+    {file = "pynacl-1.6.2-cp38-abi3-macosx_10_10_universal2.whl", hash = "sha256:c949ea47e4206af7c8f604b8278093b674f7c79ed0d4719cc836902bf4517465"},
+    {file = "pynacl-1.6.2-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8845c0631c0be43abdd865511c41eab235e0be69c81dc66a50911594198679b0"},
+    {file = "pynacl-1.6.2-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:22de65bb9010a725b0dac248f353bb072969c94fa8d6b1f34b87d7953cf7bbe4"},
+    {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:46065496ab748469cdd999246d17e301b2c24ae2fdf739132e580a0e94c94a87"},
+    {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8a66d6fb6ae7661c58995f9c6435bda2b1e68b54b598a6a10247bfcdadac996c"},
+    {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:26bfcd00dcf2cf160f122186af731ae30ab120c18e8375684ec2670dccd28130"},
+    {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:c8a231e36ec2cab018c4ad4358c386e36eede0319a0c41fed24f840b1dac59f6"},
+    {file = "pynacl-1.6.2-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:68be3a09455743ff9505491220b64440ced8973fe930f270c8e07ccfa25b1f9e"},
+    {file = "pynacl-1.6.2-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:8b097553b380236d51ed11356c953bf8ce36a29a3e596e934ecabe76c985a577"},
+    {file = "pynacl-1.6.2-cp38-abi3-win32.whl", hash = "sha256:5811c72b473b2f38f7e2a3dc4f8642e3a3e9b5e7317266e4ced1fba85cae41aa"},
+    {file = "pynacl-1.6.2-cp38-abi3-win_amd64.whl", hash = "sha256:62985f233210dee6548c223301b6c25440852e13d59a8b81490203c3227c5ba0"},
+    {file = "pynacl-1.6.2-cp38-abi3-win_arm64.whl", hash = "sha256:834a43af110f743a754448463e8fd61259cd4ab5bbedcf70f9dabad1d28a394c"},
+    {file = "pynacl-1.6.2.tar.gz", hash = "sha256:018494d6d696ae03c7e656e5e74cdfd8ea1326962cc401bcf018f1ed8436811c"},
 ]
 
 [package.dependencies]
-cffi = ">=1.4.1"
+cffi = {version = ">=2.0.0", markers = "platform_python_implementation != \"PyPy\" and python_version >= \"3.9\""}
 
 [package.extras]
-docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"]
-tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"]
+docs = ["sphinx (<7)", "sphinx_rtd_theme"]
+tests = ["hypothesis (>=3.27.0)", "pytest (>=7.4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"]
 
 [[package]]
 name = "pyopenssl"
-version = "25.1.0"
+version = "26.0.0"
 description = "Python wrapper module around the OpenSSL library"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "pyopenssl-25.1.0-py3-none-any.whl", hash = "sha256:2b11f239acc47ac2e5aca04fd7fa829800aeee22a2eb30d744572a157bd8a1ab"},
-    {file = "pyopenssl-25.1.0.tar.gz", hash = "sha256:8d031884482e0c67ee92bf9a4d8cceb08d92aba7136432ffb0703c5280fc205b"},
+    {file = "pyopenssl-26.0.0-py3-none-any.whl", hash = "sha256:df94d28498848b98cc1c0ffb8ef1e71e40210d3b0a8064c9d29571ed2904bf81"},
+    {file = "pyopenssl-26.0.0.tar.gz", hash = "sha256:f293934e52936f2e3413b89c6ce36df66a0b34ae1ea3a053b8c5020ff2f513fc"},
 ]
 
 [package.dependencies]
-cryptography = ">=41.0.5,<46"
+cryptography = ">=46.0.0,<47"
 typing-extensions = {version = ">=4.9", markers = "python_version < \"3.13\" and python_version >= \"3.8\""}
 
 [package.extras]
 docs = ["sphinx (!=5.2.0,!=5.2.0.post0,!=7.2.5)", "sphinx_rtd_theme"]
 test = ["pretend", "pytest (>=3.0.1)", "pytest-rerunfailures"]
 
+[[package]]
+name = "pyparsing"
+version = "3.3.2"
+description = "pyparsing - Classes and methods to define and execute parsing grammars"
+optional = false
+python-versions = ">=3.9"
+groups = ["main"]
+files = [
+    {file = "pyparsing-3.3.2-py3-none-any.whl", hash = "sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d"},
+    {file = "pyparsing-3.3.2.tar.gz", hash = "sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc"},
+]
+
+[package.extras]
+diagrams = ["jinja2", "railroad-diagrams"]
+
+[[package]]
+name = "pyrsistent"
+version = "0.20.0"
+description = "Persistent/Functional/Immutable data structures"
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+files = [
+    {file = "pyrsistent-0.20.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:8c3aba3e01235221e5b229a6c05f585f344734bd1ad42a8ac51493d74722bbce"},
+    {file = "pyrsistent-0.20.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c1beb78af5423b879edaf23c5591ff292cf7c33979734c99aa66d5914ead880f"},
+    {file = "pyrsistent-0.20.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:21cc459636983764e692b9eba7144cdd54fdec23ccdb1e8ba392a63666c60c34"},
+    {file = "pyrsistent-0.20.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f5ac696f02b3fc01a710427585c855f65cd9c640e14f52abe52020722bb4906b"},
+    {file = "pyrsistent-0.20.0-cp310-cp310-win32.whl", hash = "sha256:0724c506cd8b63c69c7f883cc233aac948c1ea946ea95996ad8b1380c25e1d3f"},
+    {file = "pyrsistent-0.20.0-cp310-cp310-win_amd64.whl", hash = "sha256:8441cf9616d642c475684d6cf2520dd24812e996ba9af15e606df5f6fd9d04a7"},
+    {file = "pyrsistent-0.20.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:0f3b1bcaa1f0629c978b355a7c37acd58907390149b7311b5db1b37648eb6958"},
+    {file = "pyrsistent-0.20.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5cdd7ef1ea7a491ae70d826b6cc64868de09a1d5ff9ef8d574250d0940e275b8"},
+    {file = "pyrsistent-0.20.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cae40a9e3ce178415040a0383f00e8d68b569e97f31928a3a8ad37e3fde6df6a"},
+    {file = "pyrsistent-0.20.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:6288b3fa6622ad8a91e6eb759cfc48ff3089e7c17fb1d4c59a919769314af224"},
+    {file = "pyrsistent-0.20.0-cp311-cp311-win32.whl", hash = "sha256:7d29c23bdf6e5438c755b941cef867ec2a4a172ceb9f50553b6ed70d50dfd656"},
+    {file = "pyrsistent-0.20.0-cp311-cp311-win_amd64.whl", hash = "sha256:59a89bccd615551391f3237e00006a26bcf98a4d18623a19909a2c48b8e986ee"},
+    {file = "pyrsistent-0.20.0-cp312-cp312-macosx_10_9_universal2.whl", hash = "sha256:09848306523a3aba463c4b49493a760e7a6ca52e4826aa100ee99d8d39b7ad1e"},
+    {file = "pyrsistent-0.20.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a14798c3005ec892bbada26485c2eea3b54109cb2533713e355c806891f63c5e"},
+    {file = "pyrsistent-0.20.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b14decb628fac50db5e02ee5a35a9c0772d20277824cfe845c8a8b717c15daa3"},
+    {file = "pyrsistent-0.20.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2e2c116cc804d9b09ce9814d17df5edf1df0c624aba3b43bc1ad90411487036d"},
+    {file = "pyrsistent-0.20.0-cp312-cp312-win32.whl", hash = "sha256:e78d0c7c1e99a4a45c99143900ea0546025e41bb59ebc10182e947cf1ece9174"},
+    {file = "pyrsistent-0.20.0-cp312-cp312-win_amd64.whl", hash = "sha256:4021a7f963d88ccd15b523787d18ed5e5269ce57aa4037146a2377ff607ae87d"},
+    {file = "pyrsistent-0.20.0-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:79ed12ba79935adaac1664fd7e0e585a22caa539dfc9b7c7c6d5ebf91fb89054"},
+    {file = "pyrsistent-0.20.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f920385a11207dc372a028b3f1e1038bb244b3ec38d448e6d8e43c6b3ba20e98"},
+    {file = "pyrsistent-0.20.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4f5c2d012671b7391803263419e31b5c7c21e7c95c8760d7fc35602353dee714"},
+    {file = "pyrsistent-0.20.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ef3992833fbd686ee783590639f4b8343a57f1f75de8633749d984dc0eb16c86"},
+    {file = "pyrsistent-0.20.0-cp38-cp38-win32.whl", hash = "sha256:881bbea27bbd32d37eb24dd320a5e745a2a5b092a17f6debc1349252fac85423"},
+    {file = "pyrsistent-0.20.0-cp38-cp38-win_amd64.whl", hash = "sha256:6d270ec9dd33cdb13f4d62c95c1a5a50e6b7cdd86302b494217137f760495b9d"},
+    {file = "pyrsistent-0.20.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:ca52d1ceae015859d16aded12584c59eb3825f7b50c6cfd621d4231a6cc624ce"},
+    {file = "pyrsistent-0.20.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b318ca24db0f0518630e8b6f3831e9cba78f099ed5c1d65ffe3e023003043ba0"},
+    {file = "pyrsistent-0.20.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fed2c3216a605dc9a6ea50c7e84c82906e3684c4e80d2908208f662a6cbf9022"},
+    {file = "pyrsistent-0.20.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2e14c95c16211d166f59c6611533d0dacce2e25de0f76e4c140fde250997b3ca"},
+    {file = "pyrsistent-0.20.0-cp39-cp39-win32.whl", hash = "sha256:f058a615031eea4ef94ead6456f5ec2026c19fb5bd6bfe86e9665c4158cf802f"},
+    {file = "pyrsistent-0.20.0-cp39-cp39-win_amd64.whl", hash = "sha256:58b8f6366e152092194ae68fefe18b9f0b4f89227dfd86a07770c3d86097aebf"},
+    {file = "pyrsistent-0.20.0-py3-none-any.whl", hash = "sha256:c55acc4733aad6560a7f5f818466631f07efc001fd023f34a6c203f8b6df0f0b"},
+    {file = "pyrsistent-0.20.0.tar.gz", hash = "sha256:4c48f78f62ab596c679086084d0dd13254ae4f3d6c72a83ffdf5ebdef8f265a4"},
+]
+
 [[package]]
 name = "pysaml2"
 version = "7.5.0"
@@ -2064,15 +2500,15 @@ s2repoze = ["paste", "repoze.who", "zope.interface"]
 
 [[package]]
 name = "python-dateutil"
-version = "2.8.2"
+version = "2.9.0.post0"
 description = "Extensions to the standard Python datetime module"
 optional = true
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"saml2\""
 files = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+    {file = "python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3"},
+    {file = "python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427"},
 ]
 
 [package.dependencies]
@@ -2080,120 +2516,140 @@ six = ">=1.5"
 
 [[package]]
 name = "python-multipart"
-version = "0.0.20"
+version = "0.0.22"
 description = "A streaming multipart parser for Python"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "python_multipart-0.0.20-py3-none-any.whl", hash = "sha256:8a62d3a8335e06589fe01f2a3e178cdcc632f3fbe0d492ad9ee0ec35aab1f104"},
-    {file = "python_multipart-0.0.20.tar.gz", hash = "sha256:8dd0cab45b8e23064ae09147625994d090fa46f5b0d1e13af944c331a7fa9d13"},
+    {file = "python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155"},
+    {file = "python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58"},
 ]
 
 [[package]]
 name = "pytz"
-version = "2022.7.1"
+version = "2026.1.post1"
 description = "World timezone definitions, modern and historical"
 optional = true
 python-versions = "*"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"saml2\""
 files = [
-    {file = "pytz-2022.7.1-py2.py3-none-any.whl", hash = "sha256:78f4f37d8198e0627c5f1143240bb0206b8691d8d7ac6d78fee88b78733f8c4a"},
-    {file = "pytz-2022.7.1.tar.gz", hash = "sha256:01a0681c4b9684a28304615eba55d1ab31ae00bf68ec157ec3708a8182dbbcd0"},
+    {file = "pytz-2026.1.post1-py2.py3-none-any.whl", hash = "sha256:f2fd16142fda348286a75e1a524be810bb05d444e5a081f37f7affc635035f7a"},
+    {file = "pytz-2026.1.post1.tar.gz", hash = "sha256:3378dde6a0c3d26719182142c56e60c7f9af7e968076f31aae569d72a0358ee1"},
 ]
 
 [[package]]
 name = "pywin32-ctypes"
-version = "0.2.0"
-description = ""
+version = "0.2.3"
+description = "A (partial) reimplementation of pywin32 using ctypes/cffi"
 optional = false
-python-versions = "*"
+python-versions = ">=3.6"
 groups = ["dev"]
 markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\" and sys_platform == \"win32\""
 files = [
-    {file = "pywin32-ctypes-0.2.0.tar.gz", hash = "sha256:24ffc3b341d457d48e8922352130cf2644024a4ff09762a2261fd34c36ee5942"},
-    {file = "pywin32_ctypes-0.2.0-py2.py3-none-any.whl", hash = "sha256:9dc2d991b3479cc2df15930958b674a48a227d5361d413827a4cfd0b5876fc98"},
+    {file = "pywin32-ctypes-0.2.3.tar.gz", hash = "sha256:d162dc04946d704503b2edc4d55f3dba5c1d539ead017afa00142c38b9885755"},
+    {file = "pywin32_ctypes-0.2.3-py3-none-any.whl", hash = "sha256:8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8"},
 ]
 
 [[package]]
 name = "pyyaml"
-version = "6.0.2"
+version = "6.0.3"
 description = "YAML parser and emitter for Python"
 optional = false
 python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "PyYAML-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086"},
-    {file = "PyYAML-6.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf"},
-    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237"},
-    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b"},
-    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed"},
-    {file = "PyYAML-6.0.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180"},
-    {file = "PyYAML-6.0.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68"},
-    {file = "PyYAML-6.0.2-cp310-cp310-win32.whl", hash = "sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99"},
-    {file = "PyYAML-6.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e"},
-    {file = "PyYAML-6.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774"},
-    {file = "PyYAML-6.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee"},
-    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c"},
-    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317"},
-    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85"},
-    {file = "PyYAML-6.0.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4"},
-    {file = "PyYAML-6.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e"},
-    {file = "PyYAML-6.0.2-cp311-cp311-win32.whl", hash = "sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5"},
-    {file = "PyYAML-6.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44"},
-    {file = "PyYAML-6.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab"},
-    {file = "PyYAML-6.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725"},
-    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5"},
-    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425"},
-    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476"},
-    {file = "PyYAML-6.0.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48"},
-    {file = "PyYAML-6.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b"},
-    {file = "PyYAML-6.0.2-cp312-cp312-win32.whl", hash = "sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4"},
-    {file = "PyYAML-6.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8"},
-    {file = "PyYAML-6.0.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba"},
-    {file = "PyYAML-6.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1"},
-    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133"},
-    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484"},
-    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5"},
-    {file = "PyYAML-6.0.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc"},
-    {file = "PyYAML-6.0.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652"},
-    {file = "PyYAML-6.0.2-cp313-cp313-win32.whl", hash = "sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183"},
-    {file = "PyYAML-6.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563"},
-    {file = "PyYAML-6.0.2-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a"},
-    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5"},
-    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d"},
-    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083"},
-    {file = "PyYAML-6.0.2-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706"},
-    {file = "PyYAML-6.0.2-cp38-cp38-win32.whl", hash = "sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a"},
-    {file = "PyYAML-6.0.2-cp38-cp38-win_amd64.whl", hash = "sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff"},
-    {file = "PyYAML-6.0.2-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d"},
-    {file = "PyYAML-6.0.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f"},
-    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290"},
-    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12"},
-    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19"},
-    {file = "PyYAML-6.0.2-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e"},
-    {file = "PyYAML-6.0.2-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725"},
-    {file = "PyYAML-6.0.2-cp39-cp39-win32.whl", hash = "sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631"},
-    {file = "PyYAML-6.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8"},
-    {file = "pyyaml-6.0.2.tar.gz", hash = "sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e"},
+    {file = "PyYAML-6.0.3-cp38-cp38-macosx_10_13_x86_64.whl", hash = "sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f"},
+    {file = "PyYAML-6.0.3-cp38-cp38-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4"},
+    {file = "PyYAML-6.0.3-cp38-cp38-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3"},
+    {file = "PyYAML-6.0.3-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6"},
+    {file = "PyYAML-6.0.3-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369"},
+    {file = "PyYAML-6.0.3-cp38-cp38-win32.whl", hash = "sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295"},
+    {file = "PyYAML-6.0.3-cp38-cp38-win_amd64.whl", hash = "sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b"},
+    {file = "pyyaml-6.0.3-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b"},
+    {file = "pyyaml-6.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956"},
+    {file = "pyyaml-6.0.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8"},
+    {file = "pyyaml-6.0.3-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198"},
+    {file = "pyyaml-6.0.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b"},
+    {file = "pyyaml-6.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0"},
+    {file = "pyyaml-6.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69"},
+    {file = "pyyaml-6.0.3-cp310-cp310-win32.whl", hash = "sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e"},
+    {file = "pyyaml-6.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c"},
+    {file = "pyyaml-6.0.3-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e"},
+    {file = "pyyaml-6.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824"},
+    {file = "pyyaml-6.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c"},
+    {file = "pyyaml-6.0.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00"},
+    {file = "pyyaml-6.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d"},
+    {file = "pyyaml-6.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a"},
+    {file = "pyyaml-6.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4"},
+    {file = "pyyaml-6.0.3-cp311-cp311-win32.whl", hash = "sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b"},
+    {file = "pyyaml-6.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf"},
+    {file = "pyyaml-6.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196"},
+    {file = "pyyaml-6.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0"},
+    {file = "pyyaml-6.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28"},
+    {file = "pyyaml-6.0.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c"},
+    {file = "pyyaml-6.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc"},
+    {file = "pyyaml-6.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e"},
+    {file = "pyyaml-6.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea"},
+    {file = "pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5"},
+    {file = "pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b"},
+    {file = "pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd"},
+    {file = "pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8"},
+    {file = "pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1"},
+    {file = "pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c"},
+    {file = "pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5"},
+    {file = "pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6"},
+    {file = "pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6"},
+    {file = "pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be"},
+    {file = "pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26"},
+    {file = "pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c"},
+    {file = "pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb"},
+    {file = "pyyaml-6.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac"},
+    {file = "pyyaml-6.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310"},
+    {file = "pyyaml-6.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7"},
+    {file = "pyyaml-6.0.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788"},
+    {file = "pyyaml-6.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5"},
+    {file = "pyyaml-6.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764"},
+    {file = "pyyaml-6.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35"},
+    {file = "pyyaml-6.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac"},
+    {file = "pyyaml-6.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9"},
+    {file = "pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b"},
+    {file = "pyyaml-6.0.3-cp39-cp39-macosx_10_13_x86_64.whl", hash = "sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da"},
+    {file = "pyyaml-6.0.3-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917"},
+    {file = "pyyaml-6.0.3-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9"},
+    {file = "pyyaml-6.0.3-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5"},
+    {file = "pyyaml-6.0.3-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a"},
+    {file = "pyyaml-6.0.3-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926"},
+    {file = "pyyaml-6.0.3-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7"},
+    {file = "pyyaml-6.0.3-cp39-cp39-win32.whl", hash = "sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0"},
+    {file = "pyyaml-6.0.3-cp39-cp39-win_amd64.whl", hash = "sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007"},
+    {file = "pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f"},
 ]
 
 [[package]]
 name = "readme-renderer"
-version = "37.3"
-description = "readme_renderer is a library for rendering \"readme\" descriptions for Warehouse"
+version = "44.0"
+description = "readme_renderer is a library for rendering readme descriptions for Warehouse"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "readme_renderer-37.3-py3-none-any.whl", hash = "sha256:f67a16caedfa71eef48a31b39708637a6f4664c4394801a7b0d6432d13907343"},
-    {file = "readme_renderer-37.3.tar.gz", hash = "sha256:cd653186dfc73055656f090f227f5cb22a046d7f71a841dfa305f55c9a513273"},
+    {file = "readme_renderer-44.0-py3-none-any.whl", hash = "sha256:2fbca89b81a08526aadf1357a8c2ae889ec05fb03f5da67f9769c9a592166151"},
+    {file = "readme_renderer-44.0.tar.gz", hash = "sha256:8712034eabbfa6805cacf1402b4eeb2a73028f72d1166d6f5cb7f9c047c5d1e1"},
 ]
 
 [package.dependencies]
-bleach = ">=2.1.0"
-docutils = ">=0.13.1"
+docutils = ">=0.21.2"
+nh3 = ">=0.2.14"
 Pygments = ">=2.5.1"
 
 [package.extras]
@@ -2201,41 +2657,43 @@ md = ["cmarkgfm (>=0.8.0)"]
 
 [[package]]
 name = "referencing"
-version = "0.29.1"
+version = "0.37.0"
 description = "JSON Referencing + Python"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main", "dev"]
 files = [
-    {file = "referencing-0.29.1-py3-none-any.whl", hash = "sha256:d3c8f323ee1480095da44d55917cfb8278d73d6b4d5f677e3e40eb21314ac67f"},
-    {file = "referencing-0.29.1.tar.gz", hash = "sha256:90cb53782d550ba28d2166ef3f55731f38397def8832baac5d45235f1995e35e"},
+    {file = "referencing-0.37.0-py3-none-any.whl", hash = "sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231"},
+    {file = "referencing-0.37.0.tar.gz", hash = "sha256:44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8"},
 ]
 
 [package.dependencies]
 attrs = ">=22.2.0"
 rpds-py = ">=0.7.0"
+typing-extensions = {version = ">=4.4.0", markers = "python_version < \"3.13\""}
 
 [[package]]
 name = "requests"
-version = "2.32.4"
+version = "2.33.0"
 description = "Python HTTP for Humans."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main", "dev"]
 files = [
-    {file = "requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c"},
-    {file = "requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"},
+    {file = "requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b"},
+    {file = "requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652"},
 ]
 
 [package.dependencies]
-certifi = ">=2017.4.17"
+certifi = ">=2023.5.7"
 charset_normalizer = ">=2,<4"
 idna = ">=2.5,<4"
-urllib3 = ">=1.21.1,<3"
+urllib3 = ">=1.26,<3"
 
 [package.extras]
 socks = ["PySocks (>=1.5.6,!=1.5.7)"]
-use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"]
+test = ["PySocks (>=1.5.6,!=1.5.7)", "pytest (>=3)", "pytest-cov", "pytest-httpbin (==2.1.0)", "pytest-mock", "pytest-xdist"]
+use-chardet-on-py3 = ["chardet (>=3.0.2,<8)"]
 
 [[package]]
 name = "requests-toolbelt"
@@ -2269,171 +2727,188 @@ idna2008 = ["idna"]
 
 [[package]]
 name = "rich"
-version = "14.0.0"
+version = "14.3.3"
 description = "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal"
 optional = false
 python-versions = ">=3.8.0"
 groups = ["dev"]
 files = [
-    {file = "rich-14.0.0-py3-none-any.whl", hash = "sha256:1c9491e1951aac09caffd42f448ee3d04e58923ffe14993f6e83068dc395d7e0"},
-    {file = "rich-14.0.0.tar.gz", hash = "sha256:82f1bc23a6a21ebca4ae0c45af9bdbc492ed20231dcb63f297d6d1021a9d5725"},
+    {file = "rich-14.3.3-py3-none-any.whl", hash = "sha256:793431c1f8619afa7d3b52b2cdec859562b950ea0d4b6b505397612db8d5362d"},
+    {file = "rich-14.3.3.tar.gz", hash = "sha256:b8daa0b9e4eef54dd8cf7c86c03713f53241884e814f4e2f5fb342fe520f639b"},
 ]
 
 [package.dependencies]
 markdown-it-py = ">=2.2.0"
 pygments = ">=2.13.0,<3.0.0"
-typing-extensions = {version = ">=4.0.0,<5.0", markers = "python_version < \"3.11\""}
 
 [package.extras]
 jupyter = ["ipywidgets (>=7.5.1,<9)"]
 
 [[package]]
 name = "rpds-py"
-version = "0.8.10"
+version = "0.30.0"
 description = "Python bindings to Rust's persistent data structures (rpds)"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main", "dev"]
 files = [
-    {file = "rpds_py-0.8.10-cp310-cp310-macosx_10_7_x86_64.whl", hash = "sha256:93d06cccae15b3836247319eee7b6f1fdcd6c10dabb4e6d350d27bd0bdca2711"},
-    {file = "rpds_py-0.8.10-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:3816a890a6a9e9f1de250afa12ca71c9a7a62f2b715a29af6aaee3aea112c181"},
-    {file = "rpds_py-0.8.10-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a7c6304b894546b5a6bdc0fe15761fa53fe87d28527a7142dae8de3c663853e1"},
-    {file = "rpds_py-0.8.10-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:ad3bfb44c8840fb4be719dc58e229f435e227fbfbe133dc33f34981ff622a8f8"},
-    {file = "rpds_py-0.8.10-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:14f1c356712f66653b777ecd8819804781b23dbbac4eade4366b94944c9e78ad"},
-    {file = "rpds_py-0.8.10-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:82bb361cae4d0a627006dadd69dc2f36b7ad5dc1367af9d02e296ec565248b5b"},
-    {file = "rpds_py-0.8.10-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b2e3c4f2a8e3da47f850d7ea0d7d56720f0f091d66add889056098c4b2fd576c"},
-    {file = "rpds_py-0.8.10-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:15a90d0ac11b4499171067ae40a220d1ca3cb685ec0acc356d8f3800e07e4cb8"},
-    {file = "rpds_py-0.8.10-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:70bb9c8004b97b4ef7ae56a2aa56dfaa74734a0987c78e7e85f00004ab9bf2d0"},
-    {file = "rpds_py-0.8.10-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:d64f9f88d5203274a002b54442cafc9c7a1abff2a238f3e767b70aadf919b451"},
-    {file = "rpds_py-0.8.10-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:ccbbd276642788c4376fbe8d4e6c50f0fb4972ce09ecb051509062915891cbf0"},
-    {file = "rpds_py-0.8.10-cp310-none-win32.whl", hash = "sha256:fafc0049add8043ad07ab5382ee80d80ed7e3699847f26c9a5cf4d3714d96a84"},
-    {file = "rpds_py-0.8.10-cp310-none-win_amd64.whl", hash = "sha256:915031002c86a5add7c6fd4beb601b2415e8a1c956590a5f91d825858e92fe6e"},
-    {file = "rpds_py-0.8.10-cp311-cp311-macosx_10_7_x86_64.whl", hash = "sha256:84eb541a44f7a18f07a6bfc48b95240739e93defe1fdfb4f2a295f37837945d7"},
-    {file = "rpds_py-0.8.10-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f59996d0550894affaad8743e97b9b9c98f638b221fac12909210ec3d9294786"},
-    {file = "rpds_py-0.8.10-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f9adb5664b78fcfcd830000416c8cc69853ef43cb084d645b3f1f0296edd9bae"},
-    {file = "rpds_py-0.8.10-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f96f3f98fbff7af29e9edf9a6584f3c1382e7788783d07ba3721790625caa43e"},
-    {file = "rpds_py-0.8.10-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:376b8de737401050bd12810003d207e824380be58810c031f10ec563ff6aef3d"},
-    {file = "rpds_py-0.8.10-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5d1c2bc319428d50b3e0fa6b673ab8cc7fa2755a92898db3a594cbc4eeb6d1f7"},
-    {file = "rpds_py-0.8.10-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:73a1e48430f418f0ac3dfd87860e4cc0d33ad6c0f589099a298cb53724db1169"},
-    {file = "rpds_py-0.8.10-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:134ec8f14ca7dbc6d9ae34dac632cdd60939fe3734b5d287a69683c037c51acb"},
-    {file = "rpds_py-0.8.10-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:4b519bac7c09444dd85280fd60f28c6dde4389c88dddf4279ba9b630aca3bbbe"},
-    {file = "rpds_py-0.8.10-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:9cd57981d9fab04fc74438d82460f057a2419974d69a96b06a440822d693b3c0"},
-    {file = "rpds_py-0.8.10-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:69d089c026f6a8b9d64a06ff67dc3be196707b699d7f6ca930c25f00cf5e30d8"},
-    {file = "rpds_py-0.8.10-cp311-none-win32.whl", hash = "sha256:220bdcad2d2936f674650d304e20ac480a3ce88a40fe56cd084b5780f1d104d9"},
-    {file = "rpds_py-0.8.10-cp311-none-win_amd64.whl", hash = "sha256:6c6a0225b8501d881b32ebf3f5807a08ad3685b5eb5f0a6bfffd3a6e039b2055"},
-    {file = "rpds_py-0.8.10-cp312-cp312-macosx_10_7_x86_64.whl", hash = "sha256:e3d0cd3dff0e7638a7b5390f3a53057c4e347f4ef122ee84ed93fc2fb7ea4aa2"},
-    {file = "rpds_py-0.8.10-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d77dff3a5aa5eedcc3da0ebd10ff8e4969bc9541aa3333a8d41715b429e99f47"},
-    {file = "rpds_py-0.8.10-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:41c89a366eae49ad9e65ed443a8f94aee762931a1e3723749d72aeac80f5ef2f"},
-    {file = "rpds_py-0.8.10-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3793c21494bad1373da517001d0849eea322e9a049a0e4789e50d8d1329df8e7"},
-    {file = "rpds_py-0.8.10-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:805a5f3f05d186c5d50de2e26f765ba7896d0cc1ac5b14ffc36fae36df5d2f10"},
-    {file = "rpds_py-0.8.10-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b01b39ad5411563031ea3977bbbc7324d82b088e802339e6296f082f78f6115c"},
-    {file = "rpds_py-0.8.10-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f3f1e860be21f3e83011116a65e7310486300e08d9a3028e73e8d13bb6c77292"},
-    {file = "rpds_py-0.8.10-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:a13c8e56c46474cd5958d525ce6a9996727a83d9335684e41f5192c83deb6c58"},
-    {file = "rpds_py-0.8.10-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:93d99f957a300d7a4ced41615c45aeb0343bb8f067c42b770b505de67a132346"},
-    {file = "rpds_py-0.8.10-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:148b0b38d719c0760e31ce9285a9872972bdd7774969a4154f40c980e5beaca7"},
-    {file = "rpds_py-0.8.10-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:3cc5e5b5514796f45f03a568981971b12a3570f3de2e76114f7dc18d4b60a3c4"},
-    {file = "rpds_py-0.8.10-cp38-cp38-macosx_10_7_x86_64.whl", hash = "sha256:e8e24b210a4deb5a7744971f8f77393005bae7f873568e37dfd9effe808be7f7"},
-    {file = "rpds_py-0.8.10-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:b41941583adce4242af003d2a8337b066ba6148ca435f295f31ac6d9e4ea2722"},
-    {file = "rpds_py-0.8.10-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3c490204e16bca4f835dba8467869fe7295cdeaa096e4c5a7af97f3454a97991"},
-    {file = "rpds_py-0.8.10-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:1ee45cd1d84beed6cbebc839fd85c2e70a3a1325c8cfd16b62c96e2ffb565eca"},
-    {file = "rpds_py-0.8.10-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4a8ca409f1252e1220bf09c57290b76cae2f14723746215a1e0506472ebd7bdf"},
-    {file = "rpds_py-0.8.10-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:96b293c0498c70162effb13100624c5863797d99df75f2f647438bd10cbf73e4"},
-    {file = "rpds_py-0.8.10-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b4627520a02fccbd324b33c7a83e5d7906ec746e1083a9ac93c41ac7d15548c7"},
-    {file = "rpds_py-0.8.10-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e39d7ab0c18ac99955b36cd19f43926450baba21e3250f053e0704d6ffd76873"},
-    {file = "rpds_py-0.8.10-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:ba9f1d1ebe4b63801977cec7401f2d41e888128ae40b5441270d43140efcad52"},
-    {file = "rpds_py-0.8.10-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:802f42200d8caf7f25bbb2a6464cbd83e69d600151b7e3b49f49a47fa56b0a38"},
-    {file = "rpds_py-0.8.10-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:d19db6ba816e7f59fc806c690918da80a7d186f00247048cd833acdab9b4847b"},
-    {file = "rpds_py-0.8.10-cp38-none-win32.whl", hash = "sha256:7947e6e2c2ad68b1c12ee797d15e5f8d0db36331200b0346871492784083b0c6"},
-    {file = "rpds_py-0.8.10-cp38-none-win_amd64.whl", hash = "sha256:fa326b3505d5784436d9433b7980171ab2375535d93dd63fbcd20af2b5ca1bb6"},
-    {file = "rpds_py-0.8.10-cp39-cp39-macosx_10_7_x86_64.whl", hash = "sha256:7b38a9ac96eeb6613e7f312cd0014de64c3f07000e8bf0004ad6ec153bac46f8"},
-    {file = "rpds_py-0.8.10-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:c4d42e83ddbf3445e6514f0aff96dca511421ed0392d9977d3990d9f1ba6753c"},
-    {file = "rpds_py-0.8.10-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1b21575031478609db6dbd1f0465e739fe0e7f424a8e7e87610a6c7f68b4eb16"},
-    {file = "rpds_py-0.8.10-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:574868858a7ff6011192c023a5289158ed20e3f3b94b54f97210a773f2f22921"},
-    {file = "rpds_py-0.8.10-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ae40f4a70a1f40939d66ecbaf8e7edc144fded190c4a45898a8cfe19d8fc85ea"},
-    {file = "rpds_py-0.8.10-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:37f7ee4dc86db7af3bac6d2a2cedbecb8e57ce4ed081f6464510e537589f8b1e"},
-    {file = "rpds_py-0.8.10-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:695f642a3a5dbd4ad2ffbbacf784716ecd87f1b7a460843b9ddf965ccaeafff4"},
-    {file = "rpds_py-0.8.10-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f43ab4cb04bde6109eb2555528a64dfd8a265cc6a9920a67dcbde13ef53a46c8"},
-    {file = "rpds_py-0.8.10-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:a11ab0d97be374efd04f640c04fe5c2d3dabc6dfb998954ea946ee3aec97056d"},
-    {file = "rpds_py-0.8.10-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:92cf5b3ee60eef41f41e1a2cabca466846fb22f37fc580ffbcb934d1bcab225a"},
-    {file = "rpds_py-0.8.10-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:ceaac0c603bf5ac2f505a78b2dcab78d3e6b706be6596c8364b64cc613d208d2"},
-    {file = "rpds_py-0.8.10-cp39-none-win32.whl", hash = "sha256:dd4f16e57c12c0ae17606c53d1b57d8d1c8792efe3f065a37cb3341340599d49"},
-    {file = "rpds_py-0.8.10-cp39-none-win_amd64.whl", hash = "sha256:c03a435d26c3999c2a8642cecad5d1c4d10c961817536af52035f6f4ee2f5dd0"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0da53292edafecba5e1d8c1218f99babf2ed0bf1c791d83c0ab5c29b57223068"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:7d20a8ed227683401cc508e7be58cba90cc97f784ea8b039c8cd01111e6043e0"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:97cab733d303252f7c2f7052bf021a3469d764fc2b65e6dbef5af3cbf89d4892"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8c398fda6df361a30935ab4c4bccb7f7a3daef2964ca237f607c90e9f3fdf66f"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2eb4b08c45f8f8d8254cdbfacd3fc5d6b415d64487fb30d7380b0d0569837bf1"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e7dfb1cbb895810fa2b892b68153c17716c6abaa22c7dc2b2f6dcf3364932a1c"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:89c92b74e8bf6f53a6f4995fd52f4bd510c12f103ee62c99e22bc9e05d45583c"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e9c0683cb35a9b5881b41bc01d5568ffc667910d9dbc632a1fba4e7d59e98773"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:0eeb2731708207d0fe2619afe6c4dc8cb9798f7de052da891de5f19c0006c315"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-musllinux_1_2_i686.whl", hash = "sha256:7495010b658ec5b52835f21d8c8b1a7e52e194c50f095d4223c0b96c3da704b1"},
-    {file = "rpds_py-0.8.10-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:c72ebc22e70e04126158c46ba56b85372bc4d54d00d296be060b0db1671638a4"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-macosx_10_7_x86_64.whl", hash = "sha256:2cd3045e7f6375dda64ed7db1c5136826facb0159ea982f77d9cf6125025bd34"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-macosx_11_0_arm64.whl", hash = "sha256:2418cf17d653d24ffb8b75e81f9f60b7ba1b009a23298a433a4720b2a0a17017"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1a2edf8173ac0c7a19da21bc68818be1321998528b5e3f748d6ee90c0ba2a1fd"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7f29b8c55fd3a2bc48e485e37c4e2df3317f43b5cc6c4b6631c33726f52ffbb3"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9a7d20c1cf8d7b3960c5072c265ec47b3f72a0c608a9a6ee0103189b4f28d531"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:521fc8861a86ae54359edf53a15a05fabc10593cea7b3357574132f8427a5e5a"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d5c191713e98e7c28800233f039a32a42c1a4f9a001a8a0f2448b07391881036"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:083df0fafe199371206111583c686c985dddaf95ab3ee8e7b24f1fda54515d09"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:ed41f3f49507936a6fe7003985ea2574daccfef999775525d79eb67344e23767"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-musllinux_1_2_i686.whl", hash = "sha256:2614c2732bf45de5c7f9e9e54e18bc78693fa2f635ae58d2895b7965e470378c"},
-    {file = "rpds_py-0.8.10-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:c60528671d9d467009a6ec284582179f6b88651e83367d0ab54cb739021cd7de"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-macosx_10_7_x86_64.whl", hash = "sha256:ee744fca8d1ea822480a2a4e7c5f2e1950745477143668f0b523769426060f29"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:a38b9f526d0d6cbdaa37808c400e3d9f9473ac4ff64d33d9163fd05d243dbd9b"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:60e0e86e870350e03b3e25f9b1dd2c6cc72d2b5f24e070249418320a6f9097b7"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f53f55a8852f0e49b0fc76f2412045d6ad9d5772251dea8f55ea45021616e7d5"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c493365d3fad241d52f096e4995475a60a80f4eba4d3ff89b713bc65c2ca9615"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:300eb606e6b94a7a26f11c8cc8ee59e295c6649bd927f91e1dbd37a4c89430b6"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5a665f6f1a87614d1c3039baf44109094926dedf785e346d8b0a728e9cabd27a"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:927d784648211447201d4c6f1babddb7971abad922b32257ab74de2f2750fad0"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:c200b30dd573afa83847bed7e3041aa36a8145221bf0cfdfaa62d974d720805c"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-musllinux_1_2_i686.whl", hash = "sha256:08166467258fd0240a1256fce272f689f2360227ee41c72aeea103e9e4f63d2b"},
-    {file = "rpds_py-0.8.10-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:996cc95830de9bc22b183661d95559ec6b3cd900ad7bc9154c4cbf5be0c9b734"},
-    {file = "rpds_py-0.8.10.tar.gz", hash = "sha256:13e643ce8ad502a0263397362fb887594b49cf84bf518d6038c16f235f2bcea4"},
+    {file = "rpds_py-0.30.0-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:679ae98e00c0e8d68a7fda324e16b90fd5260945b45d3b824c892cec9eea3288"},
+    {file = "rpds_py-0.30.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:4cc2206b76b4f576934f0ed374b10d7ca5f457858b157ca52064bdfc26b9fc00"},
+    {file = "rpds_py-0.30.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:389a2d49eded1896c3d48b0136ead37c48e221b391c052fba3f4055c367f60a6"},
+    {file = "rpds_py-0.30.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:32c8528634e1bf7121f3de08fa85b138f4e0dc47657866630611b03967f041d7"},
+    {file = "rpds_py-0.30.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f207f69853edd6f6700b86efb84999651baf3789e78a466431df1331608e5324"},
+    {file = "rpds_py-0.30.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:67b02ec25ba7a9e8fa74c63b6ca44cf5707f2fbfadae3ee8e7494297d56aa9df"},
+    {file = "rpds_py-0.30.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0c0e95f6819a19965ff420f65578bacb0b00f251fefe2c8b23347c37174271f3"},
+    {file = "rpds_py-0.30.0-cp310-cp310-manylinux_2_31_riscv64.whl", hash = "sha256:a452763cc5198f2f98898eb98f7569649fe5da666c2dc6b5ddb10fde5a574221"},
+    {file = "rpds_py-0.30.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e0b65193a413ccc930671c55153a03ee57cecb49e6227204b04fae512eb657a7"},
+    {file = "rpds_py-0.30.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:858738e9c32147f78b3ac24dc0edb6610000e56dc0f700fd5f651d0a0f0eb9ff"},
+    {file = "rpds_py-0.30.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:da279aa314f00acbb803da1e76fa18666778e8a8f83484fba94526da5de2cba7"},
+    {file = "rpds_py-0.30.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:7c64d38fb49b6cdeda16ab49e35fe0da2e1e9b34bc38bd78386530f218b37139"},
+    {file = "rpds_py-0.30.0-cp310-cp310-win32.whl", hash = "sha256:6de2a32a1665b93233cde140ff8b3467bdb9e2af2b91079f0333a0974d12d464"},
+    {file = "rpds_py-0.30.0-cp310-cp310-win_amd64.whl", hash = "sha256:1726859cd0de969f88dc8673bdd954185b9104e05806be64bcd87badbe313169"},
+    {file = "rpds_py-0.30.0-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:a2bffea6a4ca9f01b3f8e548302470306689684e61602aa3d141e34da06cf425"},
+    {file = "rpds_py-0.30.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:dc4f992dfe1e2bc3ebc7444f6c7051b4bc13cd8e33e43511e8ffd13bf407010d"},
+    {file = "rpds_py-0.30.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:422c3cb9856d80b09d30d2eb255d0754b23e090034e1deb4083f8004bd0761e4"},
+    {file = "rpds_py-0.30.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:07ae8a593e1c3c6b82ca3292efbe73c30b61332fd612e05abee07c79359f292f"},
+    {file = "rpds_py-0.30.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:12f90dd7557b6bd57f40abe7747e81e0c0b119bef015ea7726e69fe550e394a4"},
+    {file = "rpds_py-0.30.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:99b47d6ad9a6da00bec6aabe5a6279ecd3c06a329d4aa4771034a21e335c3a97"},
+    {file = "rpds_py-0.30.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:33f559f3104504506a44bb666b93a33f5d33133765b0c216a5bf2f1e1503af89"},
+    {file = "rpds_py-0.30.0-cp311-cp311-manylinux_2_31_riscv64.whl", hash = "sha256:946fe926af6e44f3697abbc305ea168c2c31d3e3ef1058cf68f379bf0335a78d"},
+    {file = "rpds_py-0.30.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:495aeca4b93d465efde585977365187149e75383ad2684f81519f504f5c13038"},
+    {file = "rpds_py-0.30.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d9a0ca5da0386dee0655b4ccdf46119df60e0f10da268d04fe7cc87886872ba7"},
+    {file = "rpds_py-0.30.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:8d6d1cc13664ec13c1b84241204ff3b12f9bb82464b8ad6e7a5d3486975c2eed"},
+    {file = "rpds_py-0.30.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:3896fa1be39912cf0757753826bc8bdc8ca331a28a7c4ae46b7a21280b06bb85"},
+    {file = "rpds_py-0.30.0-cp311-cp311-win32.whl", hash = "sha256:55f66022632205940f1827effeff17c4fa7ae1953d2b74a8581baaefb7d16f8c"},
+    {file = "rpds_py-0.30.0-cp311-cp311-win_amd64.whl", hash = "sha256:a51033ff701fca756439d641c0ad09a41d9242fa69121c7d8769604a0a629825"},
+    {file = "rpds_py-0.30.0-cp311-cp311-win_arm64.whl", hash = "sha256:47b0ef6231c58f506ef0b74d44e330405caa8428e770fec25329ed2cb971a229"},
+    {file = "rpds_py-0.30.0-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:a161f20d9a43006833cd7068375a94d035714d73a172b681d8881820600abfad"},
+    {file = "rpds_py-0.30.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:6abc8880d9d036ecaafe709079969f56e876fcf107f7a8e9920ba6d5a3878d05"},
+    {file = "rpds_py-0.30.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca28829ae5f5d569bb62a79512c842a03a12576375d5ece7d2cadf8abe96ec28"},
+    {file = "rpds_py-0.30.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a1010ed9524c73b94d15919ca4d41d8780980e1765babf85f9a2f90d247153dd"},
+    {file = "rpds_py-0.30.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f8d1736cfb49381ba528cd5baa46f82fdc65c06e843dab24dd70b63d09121b3f"},
+    {file = "rpds_py-0.30.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d948b135c4693daff7bc2dcfc4ec57237a29bd37e60c2fabf5aff2bbacf3e2f1"},
+    {file = "rpds_py-0.30.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:47f236970bccb2233267d89173d3ad2703cd36a0e2a6e92d0560d333871a3d23"},
+    {file = "rpds_py-0.30.0-cp312-cp312-manylinux_2_31_riscv64.whl", hash = "sha256:2e6ecb5a5bcacf59c3f912155044479af1d0b6681280048b338b28e364aca1f6"},
+    {file = "rpds_py-0.30.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:a8fa71a2e078c527c3e9dc9fc5a98c9db40bcc8a92b4e8858e36d329f8684b51"},
+    {file = "rpds_py-0.30.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:73c67f2db7bc334e518d097c6d1e6fed021bbc9b7d678d6cc433478365d1d5f5"},
+    {file = "rpds_py-0.30.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:5ba103fb455be00f3b1c2076c9d4264bfcb037c976167a6047ed82f23153f02e"},
+    {file = "rpds_py-0.30.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7cee9c752c0364588353e627da8a7e808a66873672bcb5f52890c33fd965b394"},
+    {file = "rpds_py-0.30.0-cp312-cp312-win32.whl", hash = "sha256:1ab5b83dbcf55acc8b08fc62b796ef672c457b17dbd7820a11d6c52c06839bdf"},
+    {file = "rpds_py-0.30.0-cp312-cp312-win_amd64.whl", hash = "sha256:a090322ca841abd453d43456ac34db46e8b05fd9b3b4ac0c78bcde8b089f959b"},
+    {file = "rpds_py-0.30.0-cp312-cp312-win_arm64.whl", hash = "sha256:669b1805bd639dd2989b281be2cfd951c6121b65e729d9b843e9639ef1fd555e"},
+    {file = "rpds_py-0.30.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:f83424d738204d9770830d35290ff3273fbb02b41f919870479fab14b9d303b2"},
+    {file = "rpds_py-0.30.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e7536cd91353c5273434b4e003cbda89034d67e7710eab8761fd918ec6c69cf8"},
+    {file = "rpds_py-0.30.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2771c6c15973347f50fece41fc447c054b7ac2ae0502388ce3b6738cd366e3d4"},
+    {file = "rpds_py-0.30.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:0a59119fc6e3f460315fe9d08149f8102aa322299deaa5cab5b40092345c2136"},
+    {file = "rpds_py-0.30.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:76fec018282b4ead0364022e3c54b60bf368b9d926877957a8624b58419169b7"},
+    {file = "rpds_py-0.30.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:692bef75a5525db97318e8cd061542b5a79812d711ea03dbc1f6f8dbb0c5f0d2"},
+    {file = "rpds_py-0.30.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9027da1ce107104c50c81383cae773ef5c24d296dd11c99e2629dbd7967a20c6"},
+    {file = "rpds_py-0.30.0-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:9cf69cdda1f5968a30a359aba2f7f9aa648a9ce4b580d6826437f2b291cfc86e"},
+    {file = "rpds_py-0.30.0-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:a4796a717bf12b9da9d3ad002519a86063dcac8988b030e405704ef7d74d2d9d"},
+    {file = "rpds_py-0.30.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:5d4c2aa7c50ad4728a094ebd5eb46c452e9cb7edbfdb18f9e1221f597a73e1e7"},
+    {file = "rpds_py-0.30.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ba81a9203d07805435eb06f536d95a266c21e5b2dfbf6517748ca40c98d19e31"},
+    {file = "rpds_py-0.30.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:945dccface01af02675628334f7cf49c2af4c1c904748efc5cf7bbdf0b579f95"},
+    {file = "rpds_py-0.30.0-cp313-cp313-win32.whl", hash = "sha256:b40fb160a2db369a194cb27943582b38f79fc4887291417685f3ad693c5a1d5d"},
+    {file = "rpds_py-0.30.0-cp313-cp313-win_amd64.whl", hash = "sha256:806f36b1b605e2d6a72716f321f20036b9489d29c51c91f4dd29a3e3afb73b15"},
+    {file = "rpds_py-0.30.0-cp313-cp313-win_arm64.whl", hash = "sha256:d96c2086587c7c30d44f31f42eae4eac89b60dabbac18c7669be3700f13c3ce1"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:eb0b93f2e5c2189ee831ee43f156ed34e2a89a78a66b98cadad955972548be5a"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:922e10f31f303c7c920da8981051ff6d8c1a56207dbdf330d9047f6d30b70e5e"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cdc62c8286ba9bf7f47befdcea13ea0e26bf294bda99758fd90535cbaf408000"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:47f9a91efc418b54fb8190a6b4aa7813a23fb79c51f4bb84e418f5476c38b8db"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1f3587eb9b17f3789ad50824084fa6f81921bbf9a795826570bda82cb3ed91f2"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:39c02563fc592411c2c61d26b6c5fe1e51eaa44a75aa2c8735ca88b0d9599daa"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:51a1234d8febafdfd33a42d97da7a43f5dcb120c1060e352a3fbc0c6d36e2083"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-manylinux_2_31_riscv64.whl", hash = "sha256:eb2c4071ab598733724c08221091e8d80e89064cd472819285a9ab0f24bcedb9"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:6bdfdb946967d816e6adf9a3d8201bfad269c67efe6cefd7093ef959683c8de0"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:c77afbd5f5250bf27bf516c7c4a016813eb2d3e116139aed0096940c5982da94"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:61046904275472a76c8c90c9ccee9013d70a6d0f73eecefd38c1ae7c39045a08"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:4c5f36a861bc4b7da6516dbdf302c55313afa09b81931e8280361a4f6c9a2d27"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-win32.whl", hash = "sha256:3d4a69de7a3e50ffc214ae16d79d8fbb0922972da0356dcf4d0fdca2878559c6"},
+    {file = "rpds_py-0.30.0-cp313-cp313t-win_amd64.whl", hash = "sha256:f14fc5df50a716f7ece6a80b6c78bb35ea2ca47c499e422aa4463455dd96d56d"},
+    {file = "rpds_py-0.30.0-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:68f19c879420aa08f61203801423f6cd5ac5f0ac4ac82a2368a9fcd6a9a075e0"},
+    {file = "rpds_py-0.30.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:ec7c4490c672c1a0389d319b3a9cfcd098dcdc4783991553c332a15acf7249be"},
+    {file = "rpds_py-0.30.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f251c812357a3fed308d684a5079ddfb9d933860fc6de89f2b7ab00da481e65f"},
+    {file = "rpds_py-0.30.0-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:ac98b175585ecf4c0348fd7b29c3864bda53b805c773cbf7bfdaffc8070c976f"},
+    {file = "rpds_py-0.30.0-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3e62880792319dbeb7eb866547f2e35973289e7d5696c6e295476448f5b63c87"},
+    {file = "rpds_py-0.30.0-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4e7fc54e0900ab35d041b0601431b0a0eb495f0851a0639b6ef90f7741b39a18"},
+    {file = "rpds_py-0.30.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:47e77dc9822d3ad616c3d5759ea5631a75e5809d5a28707744ef79d7a1bcfcad"},
+    {file = "rpds_py-0.30.0-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:b4dc1a6ff022ff85ecafef7979a2c6eb423430e05f1165d6688234e62ba99a07"},
+    {file = "rpds_py-0.30.0-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:4559c972db3a360808309e06a74628b95eaccbf961c335c8fe0d590cf587456f"},
+    {file = "rpds_py-0.30.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:0ed177ed9bded28f8deb6ab40c183cd1192aa0de40c12f38be4d59cd33cb5c65"},
+    {file = "rpds_py-0.30.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:ad1fa8db769b76ea911cb4e10f049d80bf518c104f15b3edb2371cc65375c46f"},
+    {file = "rpds_py-0.30.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:46e83c697b1f1c72b50e5ee5adb4353eef7406fb3f2043d64c33f20ad1c2fc53"},
+    {file = "rpds_py-0.30.0-cp314-cp314-win32.whl", hash = "sha256:ee454b2a007d57363c2dfd5b6ca4a5d7e2c518938f8ed3b706e37e5d470801ed"},
+    {file = "rpds_py-0.30.0-cp314-cp314-win_amd64.whl", hash = "sha256:95f0802447ac2d10bcc69f6dc28fe95fdf17940367b21d34e34c737870758950"},
+    {file = "rpds_py-0.30.0-cp314-cp314-win_arm64.whl", hash = "sha256:613aa4771c99f03346e54c3f038e4cc574ac09a3ddfb0e8878487335e96dead6"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:7e6ecfcb62edfd632e56983964e6884851786443739dbfe3582947e87274f7cb"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:a1d0bc22a7cdc173fedebb73ef81e07faef93692b8c1ad3733b67e31e1b6e1b8"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0d08f00679177226c4cb8c5265012eea897c8ca3b93f429e546600c971bcbae7"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:5965af57d5848192c13534f90f9dd16464f3c37aaf166cc1da1cae1fd5a34898"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9a4e86e34e9ab6b667c27f3211ca48f73dba7cd3d90f8d5b11be56e5dbc3fb4e"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e5d3e6b26f2c785d65cc25ef1e5267ccbe1b069c5c21b8cc724efee290554419"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:626a7433c34566535b6e56a1b39a7b17ba961e97ce3b80ec62e6f1312c025551"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:acd7eb3f4471577b9b5a41baf02a978e8bdeb08b4b355273994f8b87032000a8"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:fe5fa731a1fa8a0a56b0977413f8cacac1768dad38d16b3a296712709476fbd5"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:74a3243a411126362712ee1524dfc90c650a503502f135d54d1b352bd01f2404"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:3e8eeb0544f2eb0d2581774be4c3410356eba189529a6b3e36bbbf9696175856"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:dbd936cde57abfee19ab3213cf9c26be06d60750e60a8e4dd85d1ab12c8b1f40"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-win32.whl", hash = "sha256:dc824125c72246d924f7f796b4f63c1e9dc810c7d9e2355864b3c3a73d59ade0"},
+    {file = "rpds_py-0.30.0-cp314-cp314t-win_amd64.whl", hash = "sha256:27f4b0e92de5bfbc6f86e43959e6edd1425c33b5e69aab0984a72047f2bcf1e3"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:c2262bdba0ad4fc6fb5545660673925c2d2a5d9e2e0fb603aad545427be0fc58"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3adbb8179ce342d235c31ab8ec511e66c73faa27a47e076ccc92421add53e2bb"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:250fa00e9543ac9b97ac258bd37367ff5256666122c2d0f2bc97577c60a1818c"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9854cf4f488b3d57b9aaeb105f06d78e5529d3145b1e4a41750167e8c213c6d3"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:993914b8e560023bc0a8bf742c5f303551992dcb85e247b1e5c7f4a7d145bda5"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:58edca431fb9b29950807e301826586e5bbf24163677732429770a697ffe6738"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_31_riscv64.whl", hash = "sha256:dea5b552272a944763b34394d04577cf0f9bd013207bc32323b5a89a53cf9c2f"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:ba3af48635eb83d03f6c9735dfb21785303e73d22ad03d489e88adae6eab8877"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:dff13836529b921e22f15cb099751209a60009731a68519630a24d61f0b1b30a"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-musllinux_1_2_i686.whl", hash = "sha256:1b151685b23929ab7beec71080a8889d4d6d9fa9a983d213f07121205d48e2c4"},
+    {file = "rpds_py-0.30.0-pp311-pypy311_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:ac37f9f516c51e5753f27dfdef11a88330f04de2d564be3991384b2f3535d02e"},
+    {file = "rpds_py-0.30.0.tar.gz", hash = "sha256:dd8ff7cf90014af0c0f787eea34794ebf6415242ee1d6fa91eaba725cc441e84"},
 ]
 
 [[package]]
 name = "ruff"
-version = "0.12.10"
+version = "0.14.6"
 description = "An extremely fast Python linter and code formatter, written in Rust."
 optional = false
 python-versions = ">=3.7"
 groups = ["dev"]
 files = [
-    {file = "ruff-0.12.10-py3-none-linux_armv6l.whl", hash = "sha256:8b593cb0fb55cc8692dac7b06deb29afda78c721c7ccfed22db941201b7b8f7b"},
-    {file = "ruff-0.12.10-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:ebb7333a45d56efc7c110a46a69a1b32365d5c5161e7244aaf3aa20ce62399c1"},
-    {file = "ruff-0.12.10-py3-none-macosx_11_0_arm64.whl", hash = "sha256:d59e58586829f8e4a9920788f6efba97a13d1fa320b047814e8afede381c6839"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:822d9677b560f1fdeab69b89d1f444bf5459da4aa04e06e766cf0121771ab844"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:37b4a64f4062a50c75019c61c7017ff598cb444984b638511f48539d3a1c98db"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2c6f4064c69d2542029b2a61d39920c85240c39837599d7f2e32e80d36401d6e"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:059e863ea3a9ade41407ad71c1de2badfbe01539117f38f763ba42a1206f7559"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1bef6161e297c68908b7218fa6e0e93e99a286e5ed9653d4be71e687dff101cf"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4f1345fbf8fb0531cd722285b5f15af49b2932742fc96b633e883da8d841896b"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1f68433c4fbc63efbfa3ba5db31727db229fa4e61000f452c540474b03de52a9"},
-    {file = "ruff-0.12.10-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:141ce3d88803c625257b8a6debf4a0473eb6eed9643a6189b68838b43e78165a"},
-    {file = "ruff-0.12.10-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:f3fc21178cd44c98142ae7590f42ddcb587b8e09a3b849cbc84edb62ee95de60"},
-    {file = "ruff-0.12.10-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:7d1a4e0bdfafcd2e3e235ecf50bf0176f74dd37902f241588ae1f6c827a36c56"},
-    {file = "ruff-0.12.10-py3-none-musllinux_1_2_i686.whl", hash = "sha256:e67d96827854f50b9e3e8327b031647e7bcc090dbe7bb11101a81a3a2cbf1cc9"},
-    {file = "ruff-0.12.10-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:ae479e1a18b439c59138f066ae79cc0f3ee250712a873d00dbafadaad9481e5b"},
-    {file = "ruff-0.12.10-py3-none-win32.whl", hash = "sha256:9de785e95dc2f09846c5e6e1d3a3d32ecd0b283a979898ad427a9be7be22b266"},
-    {file = "ruff-0.12.10-py3-none-win_amd64.whl", hash = "sha256:7837eca8787f076f67aba2ca559cefd9c5cbc3a9852fd66186f4201b87c1563e"},
-    {file = "ruff-0.12.10-py3-none-win_arm64.whl", hash = "sha256:cc138cc06ed9d4bfa9d667a65af7172b47840e1a98b02ce7011c391e54635ffc"},
-    {file = "ruff-0.12.10.tar.gz", hash = "sha256:189ab65149d11ea69a2d775343adf5f49bb2426fc4780f65ee33b423ad2e47f9"},
+    {file = "ruff-0.14.6-py3-none-linux_armv6l.whl", hash = "sha256:d724ac2f1c240dbd01a2ae98db5d1d9a5e1d9e96eba999d1c48e30062df578a3"},
+    {file = "ruff-0.14.6-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:9f7539ea257aa4d07b7ce87aed580e485c40143f2473ff2f2b75aee003186004"},
+    {file = "ruff-0.14.6-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7f6007e55b90a2a7e93083ba48a9f23c3158c433591c33ee2e99a49b889c6332"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0a8e7b9d73d8728b68f632aa8e824ef041d068d231d8dbc7808532d3629a6bef"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d50d45d4553a3ebcbd33e7c5e0fe6ca4aafd9a9122492de357205c2c48f00775"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:118548dd121f8a21bfa8ab2c5b80e5b4aed67ead4b7567790962554f38e598ce"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:57256efafbfefcb8748df9d1d766062f62b20150691021f8ab79e2d919f7c11f"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ff18134841e5c68f8e5df1999a64429a02d5549036b394fafbe410f886e1989d"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:29c4b7ec1e66a105d5c27bd57fa93203637d66a26d10ca9809dc7fc18ec58440"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:167843a6f78680746d7e226f255d920aeed5e4ad9c03258094a2d49d3028b105"},
+    {file = "ruff-0.14.6-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:16a33af621c9c523b1ae006b1b99b159bf5ac7e4b1f20b85b2572455018e0821"},
+    {file = "ruff-0.14.6-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:1432ab6e1ae2dc565a7eea707d3b03a0c234ef401482a6f1621bc1f427c2ff55"},
+    {file = "ruff-0.14.6-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:4c55cfbbe7abb61eb914bfd20683d14cdfb38a6d56c6c66efa55ec6570ee4e71"},
+    {file = "ruff-0.14.6-py3-none-musllinux_1_2_i686.whl", hash = "sha256:efea3c0f21901a685fff4befda6d61a1bf4cb43de16da87e8226a281d614350b"},
+    {file = "ruff-0.14.6-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:344d97172576d75dc6afc0e9243376dbe1668559c72de1864439c4fc95f78185"},
+    {file = "ruff-0.14.6-py3-none-win32.whl", hash = "sha256:00169c0c8b85396516fdd9ce3446c7ca20c2a8f90a77aa945ba6b8f2bfe99e85"},
+    {file = "ruff-0.14.6-py3-none-win_amd64.whl", hash = "sha256:390e6480c5e3659f8a4c8d6a0373027820419ac14fa0d2713bd8e6c3e125b8b9"},
+    {file = "ruff-0.14.6-py3-none-win_arm64.whl", hash = "sha256:d43c81fbeae52cfa8728d8766bbf46ee4298c888072105815b392da70ca836b2"},
+    {file = "ruff-0.14.6.tar.gz", hash = "sha256:6f0c742ca6a7783a736b867a263b9a7a80a45ce9bee391eeda296895f1b4e1cc"},
 ]
 
 [[package]]
 name = "secretstorage"
-version = "3.3.3"
+version = "3.5.0"
 description = "Python bindings to FreeDesktop.org Secret Service API"
 optional = false
-python-versions = ">=3.6"
+python-versions = ">=3.10"
 groups = ["dev"]
 markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\" and sys_platform == \"linux\""
 files = [
-    {file = "SecretStorage-3.3.3-py3-none-any.whl", hash = "sha256:f356e6628222568e3af06f2eba8df495efa13b3b63081dafd4f7d9a7b7bc9f99"},
-    {file = "SecretStorage-3.3.3.tar.gz", hash = "sha256:2403533ef369eca6d2ba81718576c5e0f564d5cca1b58f73a8b23e7d4eeebd77"},
+    {file = "secretstorage-3.5.0-py3-none-any.whl", hash = "sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137"},
+    {file = "secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be"},
 ]
 
 [package.dependencies]
@@ -2458,15 +2933,15 @@ doc = ["Sphinx", "sphinx-rtd-theme"]
 
 [[package]]
 name = "sentry-sdk"
-version = "2.34.1"
+version = "2.54.0"
 description = "Python client for Sentry (https://sentry.io)"
 optional = true
 python-versions = ">=3.6"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"sentry\""
 files = [
-    {file = "sentry_sdk-2.34.1-py2.py3-none-any.whl", hash = "sha256:b7a072e1cdc5abc48101d5146e1ae680fa81fe886d8d95aaa25a0b450c818d32"},
-    {file = "sentry_sdk-2.34.1.tar.gz", hash = "sha256:69274eb8c5c38562a544c3e9f68b5be0a43be4b697f5fd385bf98e4fbe672687"},
+    {file = "sentry_sdk-2.54.0-py2.py3-none-any.whl", hash = "sha256:fd74e0e281dcda63afff095d23ebcd6e97006102cdc8e78a29f19ecdf796a0de"},
+    {file = "sentry_sdk-2.54.0.tar.gz", hash = "sha256:2620c2575128d009b11b20f7feb81e4e4e8ae08ec1d36cbc845705060b45cc1b"},
 ]
 
 [package.dependencies]
@@ -2488,20 +2963,26 @@ django = ["django (>=1.8)"]
 falcon = ["falcon (>=1.4)"]
 fastapi = ["fastapi (>=0.79.0)"]
 flask = ["blinker (>=1.1)", "flask (>=0.11)", "markupsafe"]
+google-genai = ["google-genai (>=1.29.0)"]
 grpcio = ["grpcio (>=1.21.1)", "protobuf (>=3.8.0)"]
 http2 = ["httpcore[http2] (==1.*)"]
 httpx = ["httpx (>=0.16.0)"]
 huey = ["huey (>=2)"]
 huggingface-hub = ["huggingface_hub (>=0.22)"]
 langchain = ["langchain (>=0.0.210)"]
+langgraph = ["langgraph (>=0.6.6)"]
 launchdarkly = ["launchdarkly-server-sdk (>=9.8.0)"]
+litellm = ["litellm (>=1.77.5)"]
 litestar = ["litestar (>=2.0.0)"]
 loguru = ["loguru (>=0.5)"]
+mcp = ["mcp (>=1.15.0)"]
 openai = ["openai (>=1.0.0)", "tiktoken (>=0.3.0)"]
 openfeature = ["openfeature-sdk (>=0.7.1)"]
 opentelemetry = ["opentelemetry-distro (>=0.35b0)"]
 opentelemetry-experimental = ["opentelemetry-distro"]
+opentelemetry-otlp = ["opentelemetry-distro[otlp] (>=0.35b0)"]
 pure-eval = ["asttokens", "executing", "pure_eval"]
+pydantic-ai = ["pydantic-ai (>=1.0.0)"]
 pymongo = ["pymongo (>=3.1)"]
 pyspark = ["pyspark (>=2.4.4)"]
 quart = ["blinker (>=1.1)", "quart (>=0.16.1)"]
@@ -2541,35 +3022,35 @@ tests = ["coverage[toml] (>=5.0.2)", "pytest"]
 
 [[package]]
 name = "setuptools"
-version = "78.1.1"
+version = "82.0.0"
 description = "Easily download, build, install, upgrade, and uninstall Python packages"
 optional = false
 python-versions = ">=3.9"
-groups = ["main", "dev"]
+groups = ["main"]
 files = [
-    {file = "setuptools-78.1.1-py3-none-any.whl", hash = "sha256:c3a9c4211ff4c309edb8b8c4f1cbfa7ae324c4ba9f91ff254e3d305b9fd54561"},
-    {file = "setuptools-78.1.1.tar.gz", hash = "sha256:fcc17fd9cd898242f6b4adfaca46137a9edef687f43e6f78469692a5e70d851d"},
+    {file = "setuptools-82.0.0-py3-none-any.whl", hash = "sha256:70b18734b607bd1da571d097d236cfcfacaf01de45717d59e6e04b96877532e0"},
+    {file = "setuptools-82.0.0.tar.gz", hash = "sha256:22e0a2d69474c6ae4feb01951cb69d515ed23728cf96d05513d36e42b62b37cb"},
 ]
 
 [package.extras]
-check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\"", "ruff (>=0.8.0) ; sys_platform != \"cygwin\""]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\"", "ruff (>=0.13.0) ; sys_platform != \"cygwin\""]
 core = ["importlib_metadata (>=6) ; python_version < \"3.10\"", "jaraco.functools (>=4)", "jaraco.text (>=3.7)", "more_itertools", "more_itertools (>=8.8)", "packaging (>=24.2)", "platformdirs (>=4.2.2)", "tomli (>=2.0.1) ; python_version < \"3.11\"", "wheel (>=0.43.0)"]
 cover = ["pytest-cov"]
 doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "pyproject-hooks (!=1.1)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (>=1,<2)", "sphinx-reredirects", "sphinxcontrib-towncrier", "towncrier (<24.7)"]
 enabler = ["pytest-enabler (>=2.2)"]
 test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "jaraco.envs (>=2.2)", "jaraco.path (>=3.7.2)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf ; sys_platform != \"cygwin\"", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"]
-type = ["importlib_metadata (>=7.0.2) ; python_version < \"3.10\"", "jaraco.develop (>=7.21) ; sys_platform != \"cygwin\"", "mypy (==1.14.*)", "pytest-mypy"]
+type = ["importlib_metadata (>=7.0.2) ; python_version < \"3.10\"", "jaraco.develop (>=7.21) ; sys_platform != \"cygwin\"", "mypy (==1.18.*)", "pytest-mypy"]
 
 [[package]]
 name = "setuptools-rust"
-version = "1.11.1"
+version = "1.12.0"
 description = "Setuptools Rust extension plugin"
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "setuptools_rust-1.11.1-py3-none-any.whl", hash = "sha256:5eaaddaed268dc24a527ffa659ce56b22d3cf17b781247b779efd611031fe8ea"},
-    {file = "setuptools_rust-1.11.1.tar.gz", hash = "sha256:7dabc4392252ced314b8050d63276e05fdc5d32398fc7d3cce1f6a6ac35b76c0"},
+    {file = "setuptools_rust-1.12.0-py3-none-any.whl", hash = "sha256:7e7db90547f224a835b45f5ad90c983340828a345554a9a660bdb2de8605dcdd"},
+    {file = "setuptools_rust-1.12.0.tar.gz", hash = "sha256:d94a93f0c97751c17014565f07bdc324bee45d396cd1bba83d8e7af92b945f0c"},
 ]
 
 [package.dependencies]
@@ -2598,26 +3079,26 @@ dev = ["typing-extensions (>=3.5)"]
 
 [[package]]
 name = "six"
-version = "1.16.0"
+version = "1.17.0"
 description = "Python 2 and 3 compatibility utilities"
 optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
 groups = ["main"]
 files = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+    {file = "six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274"},
+    {file = "six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81"},
 ]
 
 [[package]]
 name = "smmap"
-version = "5.0.0"
+version = "5.0.2"
 description = "A pure Python implementation of a sliding window memory map manager"
 optional = false
-python-versions = ">=3.6"
+python-versions = ">=3.7"
 groups = ["dev"]
 files = [
-    {file = "smmap-5.0.0-py3-none-any.whl", hash = "sha256:2aba19d6a040e78d8b09de5c57e96207b09ed71d8e55ce0959eeee6c8e190d94"},
-    {file = "smmap-5.0.0.tar.gz", hash = "sha256:c840e62059cd3be204b0c9c9f74be2c09d5648eddd4580d9314c3ecde0b30936"},
+    {file = "smmap-5.0.2-py3-none-any.whl", hash = "sha256:b30115f0def7d7531d22a0fb6502488d879e75b260a9db4d0819cfb25403af5e"},
+    {file = "smmap-5.0.2.tar.gz", hash = "sha256:26ea65a03958fa0c8a1c7e8c7a58fdc77221b8910f6be2131affade476898ad5"},
 ]
 
 [[package]]
@@ -2633,17 +3114,22 @@ files = [
 ]
 
 [[package]]
-name = "systemd-python"
-version = "235"
-description = "Python interface for libsystemd"
-optional = true
-python-versions = "*"
-groups = ["main"]
-markers = "extra == \"systemd\""
+name = "sqlglot"
+version = "29.0.1"
+description = "An easily customizable SQL parser and transpiler"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
 files = [
-    {file = "systemd-python-235.tar.gz", hash = "sha256:4e57f39797fd5d9e2d22b8806a252d7c0106c936039d1e71c8c6b8008e695c0a"},
+    {file = "sqlglot-29.0.1-py3-none-any.whl", hash = "sha256:06a473ea6c2b3632ac67bd38e687a6860265bf4156e66b54adeda15d07f00c65"},
+    {file = "sqlglot-29.0.1.tar.gz", hash = "sha256:0010b4f77fb996c8d25dd4b16f3654e6da163ff1866ceabc70b24e791c203048"},
 ]
 
+[package.extras]
+c = ["sqlglotc"]
+dev = ["duckdb (>=0.6)", "mypy", "pandas", "pandas-stubs", "pdoc", "pre-commit", "pyperf", "python-dateutil", "pytz", "ruff (==0.7.2)", "types-python-dateutil", "types-pytz", "typing_extensions"]
+rs = ["sqlglotrs (==0.13.0)"]
+
 [[package]]
 name = "threadloop"
 version = "1.0.2"
@@ -2662,19 +3148,16 @@ tornado = "*"
 
 [[package]]
 name = "thrift"
-version = "0.16.0"
+version = "0.22.0"
 description = "Python bindings for the Apache Thrift RPC system"
 optional = true
 python-versions = "*"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"opentracing\""
 files = [
-    {file = "thrift-0.16.0.tar.gz", hash = "sha256:2b5b6488fcded21f9d312aa23c9ff6a0195d0f6ae26ddbd5ad9e3e25dfc14408"},
+    {file = "thrift-0.22.0.tar.gz", hash = "sha256:42e8276afbd5f54fe1d364858b6877bc5e5a4a5ed69f6a005b94ca4918fe1466"},
 ]
 
-[package.dependencies]
-six = ">=1.7.2"
-
 [package.extras]
 all = ["tornado (>=4.0)", "twisted"]
 tornado = ["tornado (>=4.0)"]
@@ -2682,85 +3165,97 @@ twisted = ["twisted"]
 
 [[package]]
 name = "tomli"
-version = "2.2.1"
+version = "2.4.0"
 description = "A lil' TOML parser"
 optional = false
 python-versions = ">=3.8"
 groups = ["main", "dev"]
 files = [
-    {file = "tomli-2.2.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:678e4fa69e4575eb77d103de3df8a895e1591b48e740211bd1067378c69e8249"},
-    {file = "tomli-2.2.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:023aa114dd824ade0100497eb2318602af309e5a55595f76b626d6d9f3b7b0a6"},
-    {file = "tomli-2.2.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a"},
-    {file = "tomli-2.2.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6972ca9c9cc9f0acaa56a8ca1ff51e7af152a9f87fb64623e31d5c83700080ee"},
-    {file = "tomli-2.2.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c954d2250168d28797dd4e3ac5cf812a406cd5a92674ee4c8f123c889786aa8e"},
-    {file = "tomli-2.2.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:8dd28b3e155b80f4d54beb40a441d366adcfe740969820caf156c019fb5c7ec4"},
-    {file = "tomli-2.2.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:e59e304978767a54663af13c07b3d1af22ddee3bb2fb0618ca1593e4f593a106"},
-    {file = "tomli-2.2.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:33580bccab0338d00994d7f16f4c4ec25b776af3ffaac1ed74e0b3fc95e885a8"},
-    {file = "tomli-2.2.1-cp311-cp311-win32.whl", hash = "sha256:465af0e0875402f1d226519c9904f37254b3045fc5084697cefb9bdde1ff99ff"},
-    {file = "tomli-2.2.1-cp311-cp311-win_amd64.whl", hash = "sha256:2d0f2fdd22b02c6d81637a3c95f8cd77f995846af7414c5c4b8d0545afa1bc4b"},
-    {file = "tomli-2.2.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:4a8f6e44de52d5e6c657c9fe83b562f5f4256d8ebbfe4ff922c495620a7f6cea"},
-    {file = "tomli-2.2.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8d57ca8095a641b8237d5b079147646153d22552f1c637fd3ba7f4b0b29167a8"},
-    {file = "tomli-2.2.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e340144ad7ae1533cb897d406382b4b6fede8890a03738ff1683af800d54192"},
-    {file = "tomli-2.2.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:db2b95f9de79181805df90bedc5a5ab4c165e6ec3fe99f970d0e302f384ad222"},
-    {file = "tomli-2.2.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:40741994320b232529c802f8bc86da4e1aa9f413db394617b9a256ae0f9a7f77"},
-    {file = "tomli-2.2.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:400e720fe168c0f8521520190686ef8ef033fb19fc493da09779e592861b78c6"},
-    {file = "tomli-2.2.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:02abe224de6ae62c19f090f68da4e27b10af2b93213d36cf44e6e1c5abd19fdd"},
-    {file = "tomli-2.2.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b82ebccc8c8a36f2094e969560a1b836758481f3dc360ce9a3277c65f374285e"},
-    {file = "tomli-2.2.1-cp312-cp312-win32.whl", hash = "sha256:889f80ef92701b9dbb224e49ec87c645ce5df3fa2cc548664eb8a25e03127a98"},
-    {file = "tomli-2.2.1-cp312-cp312-win_amd64.whl", hash = "sha256:7fc04e92e1d624a4a63c76474610238576942d6b8950a2d7f908a340494e67e4"},
-    {file = "tomli-2.2.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7"},
-    {file = "tomli-2.2.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:286f0ca2ffeeb5b9bd4fcc8d6c330534323ec51b2f52da063b11c502da16f30c"},
-    {file = "tomli-2.2.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a92ef1a44547e894e2a17d24e7557a5e85a9e1d0048b0b5e7541f76c5032cb13"},
-    {file = "tomli-2.2.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9316dc65bed1684c9a98ee68759ceaed29d229e985297003e494aa825ebb0281"},
-    {file = "tomli-2.2.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e85e99945e688e32d5a35c1ff38ed0b3f41f43fad8df0bdf79f72b2ba7bc5272"},
-    {file = "tomli-2.2.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ac065718db92ca818f8d6141b5f66369833d4a80a9d74435a268c52bdfa73140"},
-    {file = "tomli-2.2.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:d920f33822747519673ee656a4b6ac33e382eca9d331c87770faa3eef562aeb2"},
-    {file = "tomli-2.2.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:a198f10c4d1b1375d7687bc25294306e551bf1abfa4eace6650070a5c1ae2744"},
-    {file = "tomli-2.2.1-cp313-cp313-win32.whl", hash = "sha256:d3f5614314d758649ab2ab3a62d4f2004c825922f9e370b29416484086b264ec"},
-    {file = "tomli-2.2.1-cp313-cp313-win_amd64.whl", hash = "sha256:a38aa0308e754b0e3c67e344754dff64999ff9b513e691d0e786265c93583c69"},
-    {file = "tomli-2.2.1-py3-none-any.whl", hash = "sha256:cb55c73c5f4408779d0cf3eef9f762b9c9f147a77de7b258bef0a5628adc85cc"},
-    {file = "tomli-2.2.1.tar.gz", hash = "sha256:cd45e1dc79c835ce60f7404ec8119f2eb06d38b1deba146f07ced3bbc44505ff"},
+    {file = "tomli-2.4.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:b5ef256a3fd497d4973c11bf142e9ed78b150d36f5773f1ca6088c230ffc5867"},
+    {file = "tomli-2.4.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:5572e41282d5268eb09a697c89a7bee84fae66511f87533a6f88bd2f7b652da9"},
+    {file = "tomli-2.4.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:551e321c6ba03b55676970b47cb1b73f14a0a4dce6a3e1a9458fd6d921d72e95"},
+    {file = "tomli-2.4.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5e3f639a7a8f10069d0e15408c0b96a2a828cfdec6fca05296ebcdcc28ca7c76"},
+    {file = "tomli-2.4.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1b168f2731796b045128c45982d3a4874057626da0e2ef1fdd722848b741361d"},
+    {file = "tomli-2.4.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:133e93646ec4300d651839d382d63edff11d8978be23da4cc106f5a18b7d0576"},
+    {file = "tomli-2.4.0-cp311-cp311-win32.whl", hash = "sha256:b6c78bdf37764092d369722d9946cb65b8767bfa4110f902a1b2542d8d173c8a"},
+    {file = "tomli-2.4.0-cp311-cp311-win_amd64.whl", hash = "sha256:d3d1654e11d724760cdb37a3d7691f0be9db5fbdaef59c9f532aabf87006dbaa"},
+    {file = "tomli-2.4.0-cp311-cp311-win_arm64.whl", hash = "sha256:cae9c19ed12d4e8f3ebf46d1a75090e4c0dc16271c5bce1c833ac168f08fb614"},
+    {file = "tomli-2.4.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:920b1de295e72887bafa3ad9f7a792f811847d57ea6b1215154030cf131f16b1"},
+    {file = "tomli-2.4.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7d6d9a4aee98fac3eab4952ad1d73aee87359452d1c086b5ceb43ed02ddb16b8"},
+    {file = "tomli-2.4.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:36b9d05b51e65b254ea6c2585b59d2c4cb91c8a3d91d0ed0f17591a29aaea54a"},
+    {file = "tomli-2.4.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1c8a885b370751837c029ef9bc014f27d80840e48bac415f3412e6593bbc18c1"},
+    {file = "tomli-2.4.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8768715ffc41f0008abe25d808c20c3d990f42b6e2e58305d5da280ae7d1fa3b"},
+    {file = "tomli-2.4.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7b438885858efd5be02a9a133caf5812b8776ee0c969fea02c45e8e3f296ba51"},
+    {file = "tomli-2.4.0-cp312-cp312-win32.whl", hash = "sha256:0408e3de5ec77cc7f81960c362543cbbd91ef883e3138e81b729fc3eea5b9729"},
+    {file = "tomli-2.4.0-cp312-cp312-win_amd64.whl", hash = "sha256:685306e2cc7da35be4ee914fd34ab801a6acacb061b6a7abca922aaf9ad368da"},
+    {file = "tomli-2.4.0-cp312-cp312-win_arm64.whl", hash = "sha256:5aa48d7c2356055feef06a43611fc401a07337d5b006be13a30f6c58f869e3c3"},
+    {file = "tomli-2.4.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:84d081fbc252d1b6a982e1870660e7330fb8f90f676f6e78b052ad4e64714bf0"},
+    {file = "tomli-2.4.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:9a08144fa4cba33db5255f9b74f0b89888622109bd2776148f2597447f92a94e"},
+    {file = "tomli-2.4.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c73add4bb52a206fd0c0723432db123c0c75c280cbd67174dd9d2db228ebb1b4"},
+    {file = "tomli-2.4.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1fb2945cbe303b1419e2706e711b7113da57b7db31ee378d08712d678a34e51e"},
+    {file = "tomli-2.4.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:bbb1b10aa643d973366dc2cb1ad94f99c1726a02343d43cbc011edbfac579e7c"},
+    {file = "tomli-2.4.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4cbcb367d44a1f0c2be408758b43e1ffb5308abe0ea222897d6bfc8e8281ef2f"},
+    {file = "tomli-2.4.0-cp313-cp313-win32.whl", hash = "sha256:7d49c66a7d5e56ac959cb6fc583aff0651094ec071ba9ad43df785abc2320d86"},
+    {file = "tomli-2.4.0-cp313-cp313-win_amd64.whl", hash = "sha256:3cf226acb51d8f1c394c1b310e0e0e61fecdd7adcb78d01e294ac297dd2e7f87"},
+    {file = "tomli-2.4.0-cp313-cp313-win_arm64.whl", hash = "sha256:d20b797a5c1ad80c516e41bc1fb0443ddb5006e9aaa7bda2d71978346aeb9132"},
+    {file = "tomli-2.4.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:26ab906a1eb794cd4e103691daa23d95c6919cc2fa9160000ac02370cc9dd3f6"},
+    {file = "tomli-2.4.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:20cedb4ee43278bc4f2fee6cb50daec836959aadaf948db5172e776dd3d993fc"},
+    {file = "tomli-2.4.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:39b0b5d1b6dd03684b3fb276407ebed7090bbec989fa55838c98560c01113b66"},
+    {file = "tomli-2.4.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a26d7ff68dfdb9f87a016ecfd1e1c2bacbe3108f4e0f8bcd2228ef9a766c787d"},
+    {file = "tomli-2.4.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:20ffd184fb1df76a66e34bd1b36b4a4641bd2b82954befa32fe8163e79f1a702"},
+    {file = "tomli-2.4.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:75c2f8bbddf170e8effc98f5e9084a8751f8174ea6ccf4fca5398436e0320bc8"},
+    {file = "tomli-2.4.0-cp314-cp314-win32.whl", hash = "sha256:31d556d079d72db7c584c0627ff3a24c5d3fb4f730221d3444f3efb1b2514776"},
+    {file = "tomli-2.4.0-cp314-cp314-win_amd64.whl", hash = "sha256:43e685b9b2341681907759cf3a04e14d7104b3580f808cfde1dfdb60ada85475"},
+    {file = "tomli-2.4.0-cp314-cp314-win_arm64.whl", hash = "sha256:3d895d56bd3f82ddd6faaff993c275efc2ff38e52322ea264122d72729dca2b2"},
+    {file = "tomli-2.4.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:5b5807f3999fb66776dbce568cc9a828544244a8eb84b84b9bafc080c99597b9"},
+    {file = "tomli-2.4.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c084ad935abe686bd9c898e62a02a19abfc9760b5a79bc29644463eaf2840cb0"},
+    {file = "tomli-2.4.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0f2e3955efea4d1cfbcb87bc321e00dc08d2bcb737fd1d5e398af111d86db5df"},
+    {file = "tomli-2.4.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0e0fe8a0b8312acf3a88077a0802565cb09ee34107813bba1c7cd591fa6cfc8d"},
+    {file = "tomli-2.4.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:413540dce94673591859c4c6f794dfeaa845e98bf35d72ed59636f869ef9f86f"},
+    {file = "tomli-2.4.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:0dc56fef0e2c1c470aeac5b6ca8cc7b640bb93e92d9803ddaf9ea03e198f5b0b"},
+    {file = "tomli-2.4.0-cp314-cp314t-win32.whl", hash = "sha256:d878f2a6707cc9d53a1be1414bbb419e629c3d6e67f69230217bb663e76b5087"},
+    {file = "tomli-2.4.0-cp314-cp314t-win_amd64.whl", hash = "sha256:2add28aacc7425117ff6364fe9e06a183bb0251b03f986df0e78e974047571fd"},
+    {file = "tomli-2.4.0-cp314-cp314t-win_arm64.whl", hash = "sha256:2b1e3b80e1d5e52e40e9b924ec43d81570f0e7d09d11081b797bc4692765a3d4"},
+    {file = "tomli-2.4.0-py3-none-any.whl", hash = "sha256:1f776e7d669ebceb01dee46484485f43a4048746235e683bcdffacdf1fb4785a"},
+    {file = "tomli-2.4.0.tar.gz", hash = "sha256:aa89c3f6c277dd275d8e243ad24f3b5e701491a860d5121f2cdd399fbb31fc9c"},
 ]
+markers = {main = "python_version < \"3.14\""}
 
 [[package]]
 name = "tornado"
-version = "6.5"
+version = "6.5.5"
 description = "Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed."
 optional = true
 python-versions = ">=3.9"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"opentracing\""
 files = [
-    {file = "tornado-6.5-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:f81067dad2e4443b015368b24e802d0083fecada4f0a4572fdb72fc06e54a9a6"},
-    {file = "tornado-6.5-cp39-abi3-macosx_10_9_x86_64.whl", hash = "sha256:9ac1cbe1db860b3cbb251e795c701c41d343f06a96049d6274e7c77559117e41"},
-    {file = "tornado-6.5-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7c625b9d03f1fb4d64149c47d0135227f0434ebb803e2008040eb92906b0105a"},
-    {file = "tornado-6.5-cp39-abi3-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9a0d8d2309faf015903080fb5bdd969ecf9aa5ff893290845cf3fd5b2dd101bc"},
-    {file = "tornado-6.5-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:03576ab51e9b1677e4cdaae620d6700d9823568b7939277e4690fe4085886c55"},
-    {file = "tornado-6.5-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ab75fe43d0e1b3a5e3ceddb2a611cb40090dd116a84fc216a07a298d9e000471"},
-    {file = "tornado-6.5-cp39-abi3-musllinux_1_2_i686.whl", hash = "sha256:119c03f440a832128820e87add8a175d211b7f36e7ee161c631780877c28f4fb"},
-    {file = "tornado-6.5-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:231f2193bb4c28db2bdee9e57bc6ca0cd491f345cd307c57d79613b058e807e0"},
-    {file = "tornado-6.5-cp39-abi3-win32.whl", hash = "sha256:fd20c816e31be1bbff1f7681f970bbbd0bb241c364220140228ba24242bcdc59"},
-    {file = "tornado-6.5-cp39-abi3-win_amd64.whl", hash = "sha256:007f036f7b661e899bd9ef3fa5f87eb2cb4d1b2e7d67368e778e140a2f101a7a"},
-    {file = "tornado-6.5-cp39-abi3-win_arm64.whl", hash = "sha256:542e380658dcec911215c4820654662810c06ad872eefe10def6a5e9b20e9633"},
-    {file = "tornado-6.5.tar.gz", hash = "sha256:c70c0a26d5b2d85440e4debd14a8d0b463a0cf35d92d3af05f5f1ffa8675c826"},
+    {file = "tornado-6.5.5-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:487dc9cc380e29f58c7ab88f9e27cdeef04b2140862e5076a66fb6bb68bb1bfa"},
+    {file = "tornado-6.5.5-cp39-abi3-macosx_10_9_x86_64.whl", hash = "sha256:65a7f1d46d4bb41df1ac99f5fcb685fb25c7e61613742d5108b010975a9a6521"},
+    {file = "tornado-6.5.5-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:e74c92e8e65086b338fd56333fb9a68b9f6f2fe7ad532645a290a464bcf46be5"},
+    {file = "tornado-6.5.5-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:435319e9e340276428bbdb4e7fa732c2d399386d1de5686cb331ec8eee754f07"},
+    {file = "tornado-6.5.5-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:3f54aa540bdbfee7b9eb268ead60e7d199de5021facd276819c193c0fb28ea4e"},
+    {file = "tornado-6.5.5-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:36abed1754faeb80fbd6e64db2758091e1320f6bba74a4cf8c09cd18ccce8aca"},
+    {file = "tornado-6.5.5-cp39-abi3-win32.whl", hash = "sha256:dd3eafaaeec1c7f2f8fdcd5f964e8907ad788fe8a5a32c4426fbbdda621223b7"},
+    {file = "tornado-6.5.5-cp39-abi3-win_amd64.whl", hash = "sha256:6443a794ba961a9f619b1ae926a2e900ac20c34483eea67be4ed8f1e58d3ef7b"},
+    {file = "tornado-6.5.5-cp39-abi3-win_arm64.whl", hash = "sha256:2c9a876e094109333f888539ddb2de4361743e5d21eece20688e3e351e4990a6"},
+    {file = "tornado-6.5.5.tar.gz", hash = "sha256:192b8f3ea91bd7f1f50c06955416ed76c6b72f96779b962f07f911b91e8d30e9"},
 ]
 
 [[package]]
 name = "towncrier"
-version = "24.8.0"
+version = "25.8.0"
 description = "Building newsfiles for your project."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "towncrier-24.8.0-py3-none-any.whl", hash = "sha256:9343209592b839209cdf28c339ba45792fbfe9775b5f9c177462fd693e127d8d"},
-    {file = "towncrier-24.8.0.tar.gz", hash = "sha256:013423ee7eed102b2f393c287d22d95f66f1a3ea10a4baa82d298001a7f18af3"},
+    {file = "towncrier-25.8.0-py3-none-any.whl", hash = "sha256:b953d133d98f9aeae9084b56a3563fd2519dfc6ec33f61c9cd2c61ff243fb513"},
+    {file = "towncrier-25.8.0.tar.gz", hash = "sha256:eef16d29f831ad57abb3ae32a0565739866219f1ebfbdd297d32894eb9940eb1"},
 ]
 
 [package.dependencies]
 click = "*"
-importlib-metadata = {version = ">=4.6", markers = "python_version < \"3.10\""}
-importlib-resources = {version = ">=5", markers = "python_version < \"3.10\""}
 jinja2 = "*"
 tomli = {version = "*", markers = "python_version < \"3.11\""}
 
@@ -2794,20 +3289,19 @@ docs = ["sphinx", "sphinx-rtd-theme"]
 
 [[package]]
 name = "twine"
-version = "6.1.0"
+version = "6.2.0"
 description = "Collection of utilities for publishing packages on PyPI"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "twine-6.1.0-py3-none-any.whl", hash = "sha256:a47f973caf122930bf0fbbf17f80b83bc1602c9ce393c7845f289a3001dc5384"},
-    {file = "twine-6.1.0.tar.gz", hash = "sha256:be324f6272eff91d07ee93f251edf232fc647935dd585ac003539b42404a8dbd"},
+    {file = "twine-6.2.0-py3-none-any.whl", hash = "sha256:418ebf08ccda9a8caaebe414433b0ba5e25eb5e4a927667122fbe8f829f985d8"},
+    {file = "twine-6.2.0.tar.gz", hash = "sha256:e5ed0d2fd70c9959770dce51c8f39c8945c574e18173a7b81802dab51b4b75cf"},
 ]
 
 [package.dependencies]
 id = "*"
-importlib-metadata = {version = ">=3.6", markers = "python_version < \"3.10\""}
-keyring = {version = ">=15.1", markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\""}
+keyring = {version = ">=21.2.0", markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\""}
 packaging = ">=24.0"
 readme-renderer = ">=35.0"
 requests = ">=2.20"
@@ -2817,7 +3311,7 @@ rich = ">=12.0.0"
 urllib3 = ">=1.26.0"
 
 [package.extras]
-keyring = ["keyring (>=15.1)"]
+keyring = ["keyring (>=21.2.0)"]
 
 [[package]]
 name = "twisted"
@@ -2878,14 +3372,14 @@ twisted = "*"
 
 [[package]]
 name = "types-bleach"
-version = "6.2.0.20250809"
+version = "6.3.0.20251115"
 description = "Typing stubs for bleach"
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types_bleach-6.2.0.20250809-py3-none-any.whl", hash = "sha256:0b372a75117947d9ac8a31ae733fd0f8d92ec75c4772e7b37093ba3fa5b48fb9"},
-    {file = "types_bleach-6.2.0.20250809.tar.gz", hash = "sha256:188d7a1119f6c953140b513ed57ba4213755695815472c19d0c22ac09c79b90b"},
+    {file = "types_bleach-6.3.0.20251115-py3-none-any.whl", hash = "sha256:f81e7cf4ebac3f3d60b66b3fd5236c324e65037d1b28d22c94d5b457f0b98f42"},
+    {file = "types_bleach-6.3.0.20251115.tar.gz", hash = "sha256:96911b20f169a18524d03b61fa7e98a08c411292f7cdb5dc191057f55dad9ae3"},
 ]
 
 [package.dependencies]
@@ -2893,14 +3387,14 @@ types-html5lib = "*"
 
 [[package]]
 name = "types-cffi"
-version = "1.16.0.20240331"
+version = "1.17.0.20250915"
 description = "Typing stubs for cffi"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types-cffi-1.16.0.20240331.tar.gz", hash = "sha256:b8b20d23a2b89cfed5f8c5bc53b0cb8677c3aac6d970dbc771e28b9c698f5dee"},
-    {file = "types_cffi-1.16.0.20240331-py3-none-any.whl", hash = "sha256:a363e5ea54a4eb6a4a105d800685fde596bc318089b025b27dee09849fe41ff0"},
+    {file = "types_cffi-1.17.0.20250915-py3-none-any.whl", hash = "sha256:cef4af1116c83359c11bb4269283c50f0688e9fc1d7f0eeb390f3661546da52c"},
+    {file = "types_cffi-1.17.0.20250915.tar.gz", hash = "sha256:4362e20368f78dabd5c56bca8004752cc890e07a71605d9e0d9e069dbaac8c06"},
 ]
 
 [package.dependencies]
@@ -2908,26 +3402,29 @@ types-setuptools = "*"
 
 [[package]]
 name = "types-html5lib"
-version = "1.1.11.20240228"
+version = "1.1.11.20251117"
 description = "Typing stubs for html5lib"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types-html5lib-1.1.11.20240228.tar.gz", hash = "sha256:22736b7299e605ec4ba539d48691e905fd0c61c3ea610acc59922232dc84cede"},
-    {file = "types_html5lib-1.1.11.20240228-py3-none-any.whl", hash = "sha256:af5de0125cb0fe5667543b158db83849b22e25c0e36c9149836b095548bf1020"},
+    {file = "types_html5lib-1.1.11.20251117-py3-none-any.whl", hash = "sha256:2a3fc935de788a4d2659f4535002a421e05bea5e172b649d33232e99d4272d08"},
+    {file = "types_html5lib-1.1.11.20251117.tar.gz", hash = "sha256:1a6a3ac5394aa12bf547fae5d5eff91dceec46b6d07c4367d9b39a37f42f201a"},
 ]
 
+[package.dependencies]
+types-webencodings = "*"
+
 [[package]]
 name = "types-jsonschema"
-version = "4.25.1.20250822"
+version = "4.26.0.20260202"
 description = "Typing stubs for jsonschema"
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types_jsonschema-4.25.1.20250822-py3-none-any.whl", hash = "sha256:f82c2d7fa1ce1c0b84ba1de4ed6798469768188884db04e66421913a4e181294"},
-    {file = "types_jsonschema-4.25.1.20250822.tar.gz", hash = "sha256:aac69ed4b23f49aaceb7fcb834141d61b9e4e6a7f6008cb2f0d3b831dfa8464a"},
+    {file = "types_jsonschema-4.26.0.20260202-py3-none-any.whl", hash = "sha256:41c95343abc4de9264e333a55e95dfb4d401e463856d0164eec9cb182e8746da"},
+    {file = "types_jsonschema-4.26.0.20260202.tar.gz", hash = "sha256:29831baa4308865a9aec547a61797a06fc152b0dac8dddd531e002f32265cb07"},
 ]
 
 [package.dependencies]
@@ -2935,14 +3432,14 @@ referencing = "*"
 
 [[package]]
 name = "types-netaddr"
-version = "1.3.0.20240530"
+version = "1.3.0.20260130"
 description = "Typing stubs for netaddr"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types-netaddr-1.3.0.20240530.tar.gz", hash = "sha256:742c2ec1f202b666f544223e2616b34f1f13df80c91e5aeaaa93a72e4d0774ea"},
-    {file = "types_netaddr-1.3.0.20240530-py3-none-any.whl", hash = "sha256:354998d018e326da4f1d9b005fc91137b7c2c473aaf03c4ef64bf83c6861b440"},
+    {file = "types_netaddr-1.3.0.20260130-py3-none-any.whl", hash = "sha256:ec1b2de102bda98d063f97d87de5370778d0d955ae2928a9e3465554f90c9a92"},
+    {file = "types_netaddr-1.3.0.20260130.tar.gz", hash = "sha256:13d9805c8d5eeb27406938de9c2d9c447c032358c8538c11f796ab382d17d54d"},
 ]
 
 [[package]]
@@ -2971,14 +3468,14 @@ files = [
 
 [[package]]
 name = "types-psycopg2"
-version = "2.9.21.20250809"
+version = "2.9.21.20260223"
 description = "Typing stubs for psycopg2"
 optional = false
-python-versions = ">=3.9"
+python-versions = ">=3.10"
 groups = ["dev"]
 files = [
-    {file = "types_psycopg2-2.9.21.20250809-py3-none-any.whl", hash = "sha256:59b7b0ed56dcae9efae62b8373497274fc1a0484bdc5135cdacbe5a8f44e1d7b"},
-    {file = "types_psycopg2-2.9.21.20250809.tar.gz", hash = "sha256:b7c2cbdcf7c0bd16240f59ba694347329b0463e43398de69784ea4dee45f3c6d"},
+    {file = "types_psycopg2-2.9.21.20260223-py3-none-any.whl", hash = "sha256:c6228ade72d813b0624f4c03feeb89471950ac27cd0506b5debed6f053086bc8"},
+    {file = "types_psycopg2-2.9.21.20260223.tar.gz", hash = "sha256:78ed70de2e56bc6b5c26c8c1da8e9af54e49fdc3c94d1504609f3519e2b84f02"},
 ]
 
 [[package]]
@@ -2999,26 +3496,26 @@ types-cffi = "*"
 
 [[package]]
 name = "types-pyyaml"
-version = "6.0.12.20250809"
+version = "6.0.12.20250915"
 description = "Typing stubs for PyYAML"
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types_pyyaml-6.0.12.20250809-py3-none-any.whl", hash = "sha256:032b6003b798e7de1a1ddfeefee32fac6486bdfe4845e0ae0e7fb3ee4512b52f"},
-    {file = "types_pyyaml-6.0.12.20250809.tar.gz", hash = "sha256:af4a1aca028f18e75297da2ee0da465f799627370d74073e96fee876524f61b5"},
+    {file = "types_pyyaml-6.0.12.20250915-py3-none-any.whl", hash = "sha256:e7d4d9e064e89a3b3cae120b4990cd370874d2bf12fa5f46c97018dd5d3c9ab6"},
+    {file = "types_pyyaml-6.0.12.20250915.tar.gz", hash = "sha256:0f8b54a528c303f0e6f7165687dd33fafa81c807fcac23f632b63aa624ced1d3"},
 ]
 
 [[package]]
 name = "types-requests"
-version = "2.32.4.20250611"
+version = "2.32.4.20260107"
 description = "Typing stubs for requests"
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types_requests-2.32.4.20250611-py3-none-any.whl", hash = "sha256:ad2fe5d3b0cb3c2c902c8815a70e7fb2302c4b8c1f77bdcd738192cdb3878072"},
-    {file = "types_requests-2.32.4.20250611.tar.gz", hash = "sha256:741c8777ed6425830bf51e54d6abe245f79b4dcb9019f1622b773463946bf826"},
+    {file = "types_requests-2.32.4.20260107-py3-none-any.whl", hash = "sha256:b703fe72f8ce5b31ef031264fe9395cac8f46a04661a79f7ed31a80fb308730d"},
+    {file = "types_requests-2.32.4.20260107.tar.gz", hash = "sha256:018a11ac158f801bfa84857ddec1650750e393df8a004a8a9ae2a9bec6fcb24f"},
 ]
 
 [package.dependencies]
@@ -3026,38 +3523,50 @@ urllib3 = ">=2"
 
 [[package]]
 name = "types-setuptools"
-version = "80.9.0.20250809"
+version = "82.0.0.20260210"
 description = "Typing stubs for setuptools"
 optional = false
+python-versions = ">=3.10"
+groups = ["dev"]
+files = [
+    {file = "types_setuptools-82.0.0.20260210-py3-none-any.whl", hash = "sha256:5124a7daf67f195c6054e0f00f1d97c69caad12fdcf9113eba33eff0bce8cd2b"},
+    {file = "types_setuptools-82.0.0.20260210.tar.gz", hash = "sha256:d9719fbbeb185254480ade1f25327c4654f8c00efda3fec36823379cebcdee58"},
+]
+
+[[package]]
+name = "types-webencodings"
+version = "0.5.0.20251108"
+description = "Typing stubs for webencodings"
+optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "types_setuptools-80.9.0.20250809-py3-none-any.whl", hash = "sha256:7c6539b4c7ac7b4ab4db2be66d8a58fb1e28affa3ee3834be48acafd94f5976a"},
-    {file = "types_setuptools-80.9.0.20250809.tar.gz", hash = "sha256:e986ba37ffde364073d76189e1d79d9928fb6f5278c7d07589cde353d0218864"},
+    {file = "types_webencodings-0.5.0.20251108-py3-none-any.whl", hash = "sha256:e21f81ff750795faffddaffd70a3d8bfff77d006f22c27e393eb7812586249d8"},
+    {file = "types_webencodings-0.5.0.20251108.tar.gz", hash = "sha256:2378e2ceccced3d41bb5e21387586e7b5305e11519fc6b0659c629f23b2e5de4"},
 ]
 
 [[package]]
 name = "typing-extensions"
-version = "4.14.1"
+version = "4.15.0"
 description = "Backported and Experimental Type Hints for Python 3.9+"
 optional = false
 python-versions = ">=3.9"
 groups = ["main", "dev"]
 files = [
-    {file = "typing_extensions-4.14.1-py3-none-any.whl", hash = "sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76"},
-    {file = "typing_extensions-4.14.1.tar.gz", hash = "sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36"},
+    {file = "typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548"},
+    {file = "typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466"},
 ]
 
 [[package]]
 name = "typing-inspection"
-version = "0.4.0"
+version = "0.4.2"
 description = "Runtime typing introspection tools"
 optional = false
 python-versions = ">=3.9"
-groups = ["main", "dev"]
+groups = ["main"]
 files = [
-    {file = "typing_inspection-0.4.0-py3-none-any.whl", hash = "sha256:50e72559fcd2a6367a19f7a7e610e6afcb9fac940c650290eed893d61386832f"},
-    {file = "typing_inspection-0.4.0.tar.gz", hash = "sha256:9765c87de36671694a67904bf2c96e395be9c6439bb6c87b5142569dcdd65122"},
+    {file = "typing_inspection-0.4.2-py3-none-any.whl", hash = "sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7"},
+    {file = "typing_inspection-0.4.2.tar.gz", hash = "sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464"},
 ]
 
 [package.dependencies]
@@ -3077,21 +3586,21 @@ files = [
 
 [[package]]
 name = "urllib3"
-version = "2.5.0"
+version = "2.6.3"
 description = "HTTP library with thread-safe connection pooling, file post, and more."
 optional = false
 python-versions = ">=3.9"
 groups = ["main", "dev"]
 files = [
-    {file = "urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc"},
-    {file = "urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760"},
+    {file = "urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4"},
+    {file = "urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"},
 ]
 
 [package.extras]
-brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""]
+brotli = ["brotli (>=1.2.0) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=1.2.0.0) ; platform_python_implementation != \"CPython\""]
 h2 = ["h2 (>=4,<5)"]
 socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"]
-zstd = ["zstandard (>=0.18.0)"]
+zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""]
 
 [[package]]
 name = "webencodings"
@@ -3099,7 +3608,7 @@ version = "0.5.1"
 description = "Character encoding aliases for legacy web content"
 optional = false
 python-versions = "*"
-groups = ["main", "dev"]
+groups = ["main"]
 files = [
     {file = "webencodings-0.5.1-py2.py3-none-any.whl", hash = "sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78"},
     {file = "webencodings-0.5.1.tar.gz", hash = "sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923"},
@@ -3107,15 +3616,15 @@ files = [
 
 [[package]]
 name = "xmlschema"
-version = "2.4.0"
+version = "2.5.1"
 description = "An XML Schema validator and decoder"
 optional = true
 python-versions = ">=3.7"
 groups = ["main"]
 markers = "extra == \"all\" or extra == \"saml2\""
 files = [
-    {file = "xmlschema-2.4.0-py3-none-any.whl", hash = "sha256:dc87be0caaa61f42649899189aab2fd8e0d567f2cf548433ba7b79278d231a4a"},
-    {file = "xmlschema-2.4.0.tar.gz", hash = "sha256:d74cd0c10866ac609e1ef94a5a69b018ad16e39077bc6393408b40c6babee793"},
+    {file = "xmlschema-2.5.1-py3-none-any.whl", hash = "sha256:ec2b2a15c8896c1fcd14dcee34ca30032b99456c3c43ce793fdb9dca2fb4b869"},
+    {file = "xmlschema-2.5.1.tar.gz", hash = "sha256:4f7497de6c8b6dc2c28ad7b9ed6e21d186f4afe248a5bea4f54eedab4da44083"},
 ]
 
 [package.dependencies]
@@ -3128,90 +3637,82 @@ docs = ["Sphinx", "elementpath (>=4.1.5,<5.0.0)", "jinja2", "sphinx-rtd-theme"]
 
 [[package]]
 name = "zipp"
-version = "3.19.1"
+version = "3.23.0"
 description = "Backport of pathlib-compatible object wrapper for zip files"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 groups = ["dev"]
-markers = "platform_machine != \"ppc64le\" and platform_machine != \"s390x\" and python_version < \"3.12\" or python_version < \"3.10\""
+markers = "python_version < \"3.12\" and platform_machine != \"ppc64le\" and platform_machine != \"s390x\""
 files = [
-    {file = "zipp-3.19.1-py3-none-any.whl", hash = "sha256:2828e64edb5386ea6a52e7ba7cdb17bb30a73a858f5eb6eb93d8d36f5ea26091"},
-    {file = "zipp-3.19.1.tar.gz", hash = "sha256:35427f6d5594f4acf82d25541438348c26736fa9b3afa2754bcd63cdb99d8e8f"},
+    {file = "zipp-3.23.0-py3-none-any.whl", hash = "sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e"},
+    {file = "zipp-3.23.0.tar.gz", hash = "sha256:a07157588a12518c9d4034df3fbbee09c814741a33ff63c05fa29d26a2404166"},
 ]
 
 [package.extras]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\""]
+cover = ["pytest-cov"]
 doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
-test = ["big-O", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more-itertools", "pytest (>=6,!=8.1.*)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-ignore-flaky", "pytest-mypy", "pytest-ruff (>=0.2.1)"]
+enabler = ["pytest-enabler (>=2.2)"]
+test = ["big-O", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more_itertools", "pytest (>=6,!=8.1.*)", "pytest-ignore-flaky"]
+type = ["pytest-mypy"]
 
 [[package]]
 name = "zope-event"
-version = "4.6"
+version = "6.1"
 description = "Very basic event publishing system"
 optional = false
-python-versions = "*"
+python-versions = ">=3.10"
 groups = ["dev"]
 files = [
-    {file = "zope.event-4.6-py2.py3-none-any.whl", hash = "sha256:73d9e3ef750cca14816a9c322c7250b0d7c9dbc337df5d1b807ff8d3d0b9e97c"},
-    {file = "zope.event-4.6.tar.gz", hash = "sha256:81d98813046fc86cc4136e3698fee628a3282f9c320db18658c21749235fce80"},
+    {file = "zope_event-6.1-py3-none-any.whl", hash = "sha256:0ca78b6391b694272b23ec1335c0294cc471065ed10f7f606858fc54566c25a0"},
+    {file = "zope_event-6.1.tar.gz", hash = "sha256:6052a3e0cb8565d3d4ef1a3a7809336ac519bc4fe38398cb8d466db09adef4f0"},
 ]
 
-[package.dependencies]
-setuptools = "*"
-
 [package.extras]
 docs = ["Sphinx"]
-test = ["zope.testrunner"]
+test = ["zope.testrunner (>=6.4)"]
 
 [[package]]
 name = "zope-interface"
-version = "7.1.0"
+version = "8.2"
 description = "Interfaces for Python"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main", "dev"]
 files = [
-    {file = "zope.interface-7.1.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:2bd9e9f366a5df08ebbdc159f8224904c1c5ce63893984abb76954e6fbe4381a"},
-    {file = "zope.interface-7.1.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:661d5df403cd3c5b8699ac480fa7f58047a3253b029db690efa0c3cf209993ef"},
-    {file = "zope.interface-7.1.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:91b6c30689cfd87c8f264acb2fc16ad6b3c72caba2aec1bf189314cf1a84ca33"},
-    {file = "zope.interface-7.1.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2b6a4924f5bad9fe21d99f66a07da60d75696a136162427951ec3cb223a5570d"},
-    {file = "zope.interface-7.1.0-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:80a3c00b35f6170be5454b45abe2719ea65919a2f09e8a6e7b1362312a872cd3"},
-    {file = "zope.interface-7.1.0-cp310-cp310-win_amd64.whl", hash = "sha256:b936d61dbe29572fd2cfe13e30b925e5383bed1aba867692670f5a2a2eb7b4e9"},
-    {file = "zope.interface-7.1.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0ac20581fc6cd7c754f6dff0ae06fedb060fa0e9ea6309d8be8b2701d9ea51c4"},
-    {file = "zope.interface-7.1.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:848b6fa92d7c8143646e64124ed46818a0049a24ecc517958c520081fd147685"},
-    {file = "zope.interface-7.1.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ec1ef1fdb6f014d5886b97e52b16d0f852364f447d2ab0f0c6027765777b6667"},
-    {file = "zope.interface-7.1.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3bcff5c09d0215f42ba64b49205a278e44413d9bf9fa688fd9e42bfe472b5f4f"},
-    {file = "zope.interface-7.1.0-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:07add15de0cc7e69917f7d286b64d54125c950aeb43efed7a5ea7172f000fbc1"},
-    {file = "zope.interface-7.1.0-cp311-cp311-win_amd64.whl", hash = "sha256:9940d5bc441f887c5f375ec62bcf7e7e495a2d5b1da97de1184a88fb567f06af"},
-    {file = "zope.interface-7.1.0-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:f245d039f72e6f802902375755846f5de1ee1e14c3e8736c078565599bcab621"},
-    {file = "zope.interface-7.1.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:6159e767d224d8f18deff634a1d3722e68d27488c357f62ebeb5f3e2f5288b1f"},
-    {file = "zope.interface-7.1.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5e956b1fd7f3448dd5e00f273072e73e50dfafcb35e4227e6d5af208075593c9"},
-    {file = "zope.interface-7.1.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ff115ef91c0eeac69cd92daeba36a9d8e14daee445b504eeea2b1c0b55821984"},
-    {file = "zope.interface-7.1.0-cp312-cp312-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bec001798ab62c3fc5447162bf48496ae9fba02edc295a9e10a0b0c639a6452e"},
-    {file = "zope.interface-7.1.0-cp312-cp312-win_amd64.whl", hash = "sha256:124149e2d42067b9c6597f4dafdc7a0983d0163868f897b7bb5dc850b14f9a87"},
-    {file = "zope.interface-7.1.0-cp313-cp313-macosx_10_9_x86_64.whl", hash = "sha256:9733a9a0f94ef53d7aa64661811b20875b5bc6039034c6e42fb9732170130573"},
-    {file = "zope.interface-7.1.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5fcf379b875c610b5a41bc8a891841533f98de0520287d7f85e25386cd10d3e9"},
-    {file = "zope.interface-7.1.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d0a45b5af9f72c805ee668d1479480ca85169312211bed6ed18c343e39307d5f"},
-    {file = "zope.interface-7.1.0-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4af4a12b459a273b0b34679a5c3dc5e34c1847c3dd14a628aa0668e19e638ea2"},
-    {file = "zope.interface-7.1.0-cp313-cp313-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a735f82d2e3ed47ca01a20dfc4c779b966b16352650a8036ab3955aad151ed8a"},
-    {file = "zope.interface-7.1.0-cp313-cp313-win_amd64.whl", hash = "sha256:5501e772aff595e3c54266bc1bfc5858e8f38974ce413a8f1044aae0f32a83a3"},
-    {file = "zope.interface-7.1.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:ec59fe53db7d32abb96c6d4efeed84aab4a7c38c62d7a901a9b20c09dd936e7a"},
-    {file = "zope.interface-7.1.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:e53c291debef523b09e1fe3dffe5f35dde164f1c603d77f770b88a1da34b7ed6"},
-    {file = "zope.interface-7.1.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:711eebc77f2092c6a8b304bad0b81a6ce3cf5490b25574e7309fbc07d881e3af"},
-    {file = "zope.interface-7.1.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4a00ead2e24c76436e1b457a5132d87f83858330f6c923640b7ef82d668525d1"},
-    {file = "zope.interface-7.1.0-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5e28ea0bc4b084fc93a483877653a033062435317082cdc6388dec3438309faf"},
-    {file = "zope.interface-7.1.0-cp38-cp38-win_amd64.whl", hash = "sha256:27cfb5205d68b12682b6e55ab8424662d96e8ead19550aad0796b08dd2c9a45e"},
-    {file = "zope.interface-7.1.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:9e3e48f3dea21c147e1b10c132016cb79af1159facca9736d231694ef5a740a8"},
-    {file = "zope.interface-7.1.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:a99240b1d02dc469f6afbe7da1bf617645e60290c272968f4e53feec18d7dce8"},
-    {file = "zope.interface-7.1.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cc8a318162123eddbdf22fcc7b751288ce52e4ad096d3766ff1799244352449d"},
-    {file = "zope.interface-7.1.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b7b25db127db3e6b597c5f74af60309c4ad65acd826f89609662f0dc33a54728"},
-    {file = "zope.interface-7.1.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2a29ac607e970b5576547f0e3589ec156e04de17af42839eedcf478450687317"},
-    {file = "zope.interface-7.1.0-cp39-cp39-win_amd64.whl", hash = "sha256:a14c9decf0eb61e0892631271d500c1e306c7b6901c998c7035e194d9150fdd1"},
-    {file = "zope_interface-7.1.0.tar.gz", hash = "sha256:3f005869a1a05e368965adb2075f97f8ee9a26c61898a9e52a9764d93774f237"},
+    {file = "zope_interface-8.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:788c293f3165964ec6527b2d861072c68eef53425213f36d3893ebee89a89623"},
+    {file = "zope_interface-8.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9a4e785097e741a1c953b3970ce28f2823bd63c00adc5d276f2981dd66c96c15"},
+    {file = "zope_interface-8.2-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:16c69da19a06566664ddd4785f37cad5693a51d48df1515d264c20d005d322e2"},
+    {file = "zope_interface-8.2-cp310-cp310-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:c31acfa3d7cde48bec45701b0e1f4698daffc378f559bfb296837d8c834732f6"},
+    {file = "zope_interface-8.2-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0723507127f8269b8f3f22663168f717e9c9742107d1b6c9f419df561b71aa6d"},
+    {file = "zope_interface-8.2-cp310-cp310-win_amd64.whl", hash = "sha256:3bf73a910bb27344def2d301a03329c559a79b308e1e584686b74171d736be4e"},
+    {file = "zope_interface-8.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:c65ade7ea85516e428651048489f5e689e695c79188761de8c622594d1e13322"},
+    {file = "zope_interface-8.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a1ef4b43659e1348f35f38e7d1a6bbc1682efde239761f335ffc7e31e798b65b"},
+    {file = "zope_interface-8.2-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:dfc4f44e8de2ff4eba20af4f0a3ca42d3c43ab24a08e49ccd8558b7a4185b466"},
+    {file = "zope_interface-8.2-cp311-cp311-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:8f094bfb49179ec5dc9981cb769af1275702bd64720ef94874d9e34da1390d4c"},
+    {file = "zope_interface-8.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d2bb8e7364e18f083bf6744ccf30433b2a5f236c39c95df8514e3c13007098ce"},
+    {file = "zope_interface-8.2-cp311-cp311-win_amd64.whl", hash = "sha256:6f4b4dfcfdfaa9177a600bb31cebf711fdb8c8e9ed84f14c61c420c6aa398489"},
+    {file = "zope_interface-8.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:624b6787fc7c3e45fa401984f6add2c736b70a7506518c3b537ffaacc4b29d4c"},
+    {file = "zope_interface-8.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:bc9ded9e97a0ed17731d479596ed1071e53b18e6fdb2fc33af1e43f5fd2d3aaa"},
+    {file = "zope_interface-8.2-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:532367553e4420c80c0fc0cabcc2c74080d495573706f66723edee6eae53361d"},
+    {file = "zope_interface-8.2-cp312-cp312-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2bf9cf275468bafa3c72688aad8cfcbe3d28ee792baf0b228a1b2d93bd1d541a"},
+    {file = "zope_interface-8.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0009d2d3c02ea783045d7804da4fd016245e5c5de31a86cebba66dd6914d59a2"},
+    {file = "zope_interface-8.2-cp312-cp312-win_amd64.whl", hash = "sha256:845d14e580220ae4544bd4d7eb800f0b6034fe5585fc2536806e0a26c2ee6640"},
+    {file = "zope_interface-8.2-cp313-cp313-macosx_10_9_x86_64.whl", hash = "sha256:6068322004a0158c80dfd4708dfb103a899635408c67c3b10e9acec4dbacefec"},
+    {file = "zope_interface-8.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2499de92e8275d0dd68f84425b3e19e9268cd1fa8507997900fa4175f157733c"},
+    {file = "zope_interface-8.2-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:f777e68c76208503609c83ca021a6864902b646530a1a39abb9ed310d1100664"},
+    {file = "zope_interface-8.2-cp313-cp313-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:9b05a919fdb0ed6ea942e5a7800e09a8b6cdae6f98fee1bef1c9d1a3fc43aaa0"},
+    {file = "zope_interface-8.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ccc62b5712dd7bd64cfba3ee63089fb11e840f5914b990033beeae3b2180b6cb"},
+    {file = "zope_interface-8.2-cp313-cp313-win_amd64.whl", hash = "sha256:34f877d1d3bb7565c494ed93828fa6417641ca26faf6e8f044e0d0d500807028"},
+    {file = "zope_interface-8.2-cp314-cp314-macosx_10_9_x86_64.whl", hash = "sha256:46c7e4e8cbc698398a67e56ca985d19cb92365b4aafbeb6a712e8c101090f4cb"},
+    {file = "zope_interface-8.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:a87fc7517f825a97ff4a4ca4c8a950593c59e0f8e7bfe1b6f898a38d5ba9f9cf"},
+    {file = "zope_interface-8.2-cp314-cp314-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:ccf52f7d44d669203c2096c1a0c2c15d52e36b2e7a9413df50f48392c7d4d080"},
+    {file = "zope_interface-8.2-cp314-cp314-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:aae807efc7bd26302eb2fea05cd6de7d59269ed6ae23a6de1ee47add6de99b8c"},
+    {file = "zope_interface-8.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:05a0e42d6d830f547e114de2e7cd15750dc6c0c78f8138e6c5035e51ddfff37c"},
+    {file = "zope_interface-8.2-cp314-cp314-win_amd64.whl", hash = "sha256:561ce42390bee90bae51cf1c012902a8033b2aaefbd0deed81e877562a116d48"},
+    {file = "zope_interface-8.2.tar.gz", hash = "sha256:afb20c371a601d261b4f6edb53c3c418c249db1a9717b0baafc9a9bb39ba1224"},
 ]
 
-[package.dependencies]
-setuptools = "*"
-
 [package.extras]
 docs = ["Sphinx", "furo", "repoze.sphinx.autointerface"]
 test = ["coverage[toml]", "zope.event", "zope.testing"]
@@ -3219,41 +3720,39 @@ testing = ["coverage[toml]", "zope.event", "zope.testing"]
 
 [[package]]
 name = "zope-schema"
-version = "7.0.1"
+version = "8.1"
 description = "zope.interface extension for defining data schemas"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "zope.schema-7.0.1-py3-none-any.whl", hash = "sha256:cf006c678793b00e0075ad54d55281c8785ea21e5bc1f5ec0584787719c2aab2"},
-    {file = "zope.schema-7.0.1.tar.gz", hash = "sha256:ead4dbcb03354d4e410c9a3b904451eb44d90254751b1cbdedf4a61aede9fbb9"},
+    {file = "zope_schema-8.1-py3-none-any.whl", hash = "sha256:e5313ef0f20b0e5b6ecf9a75fd7bd59bc772244351144097e086a5822fe8b0bb"},
+    {file = "zope_schema-8.1.tar.gz", hash = "sha256:2d9faa7f91a7bf09fcab2c039d9182fcc9ce7042dc77e18d3df277904aee0948"},
 ]
 
 [package.dependencies]
-setuptools = "*"
 "zope.event" = "*"
 "zope.interface" = ">=5.0.0"
 
 [package.extras]
 docs = ["Sphinx", "repoze.sphinx.autointerface"]
-test = ["zope.i18nmessageid", "zope.testing", "zope.testrunner"]
+test = ["zope.i18nmessageid", "zope.testing", "zope.testrunner (>=6.4)"]
 
 [extras]
-all = ["Pympler", "authlib", "hiredis", "jaeger-client", "lxml", "matrix-synapse-ldap3", "opentracing", "psycopg2", "psycopg2cffi", "psycopg2cffi-compat", "pysaml2", "sentry-sdk", "txredisapi"]
-cache-memory = ["Pympler"]
+all = ["authlib", "defusedxml", "hiredis", "jaeger-client", "lxml", "matrix-synapse-ldap3", "opentracing", "psycopg2", "psycopg2cffi", "psycopg2cffi-compat", "pympler", "pysaml2", "pytz", "sentry-sdk", "thrift", "tornado", "txredisapi"]
+cache-memory = ["pympler"]
 jwt = ["authlib"]
 matrix-synapse-ldap3 = ["matrix-synapse-ldap3"]
 oidc = ["authlib"]
-opentracing = ["jaeger-client", "opentracing"]
+opentracing = ["jaeger-client", "opentracing", "thrift", "tornado"]
 postgres = ["psycopg2", "psycopg2cffi", "psycopg2cffi-compat"]
 redis = ["hiredis", "txredisapi"]
-saml2 = ["pysaml2"]
+saml2 = ["defusedxml", "pysaml2", "pytz"]
 sentry = ["sentry-sdk"]
-systemd = ["systemd-python"]
 test = ["idna", "parameterized"]
 url-preview = ["lxml"]
 
 [metadata]
 lock-version = "2.1"
-python-versions = "^3.9.0"
-content-hash = "2e8ea085e1a0c6f0ac051d4bc457a96827d01f621b1827086de01a5ffa98cf79"
+python-versions = ">=3.10.0,<4.0.0"
+content-hash = "ce9ac9da9e7ffaf24b3e1e7892342ba486e7af4ea25385f875d0f3a2d5c5d133"
diff --git a/pyproject.toml b/pyproject.toml
index 54fdd5e707..5fa7dade52 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,3 +1,309 @@
+[project]
+name = "matrix-synapse"
+version = "1.151.0"
+description = "Homeserver for the Matrix decentralised comms protocol"
+readme = "README.rst"
+authors = [
+    { name = "Matrix.org Team and Contributors", email = "packages@matrix.org" }
+]
+requires-python = ">=3.10.0,<4.0.0"
+license = "AGPL-3.0-or-later OR LicenseRef-Element-Commercial"
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Topic :: Communications :: Chat",
+]
+
+# Mandatory Dependencies
+dependencies = [
+    # we use the TYPE_CHECKER.redefine method added in jsonschema 3.0.0
+    "jsonschema>=3.0.0",
+    # 0.25.0 is the first version to support Python 3.14.
+    # We can remove this once https://github.com/python-jsonschema/jsonschema/issues/1426 is fixed
+    # and included in a release.
+    "rpds-py>=0.25.0",
+    # We choose 2.0 as a lower bound: the most recent backwards incompatible release.
+    # It seems generally available, judging by https://pkgs.org/search/?q=immutabledict
+    "immutabledict>=2.0",
+    # We require 2.1.0 or higher for type hints. Previous guard was >= 1.1.0
+    "unpaddedbase64>=2.1.0",
+    # We require 2.0.0 for immutabledict support.
+    "canonicaljson>=2.0.0,<3.0.0",
+    # we use the type definitions added in signedjson 1.1.
+    "signedjson>=1.1.0,<2.0.0",
+    # validating SSL certs for IP addresses requires service_identity 18.1.
+    "service-identity>=18.1.0",
+    # Twisted 18.9 introduces some logger improvements that the structured
+    # logger utilises
+    # Twisted 19.7.0 moves test helpers to a new module and deprecates the old location.
+    # Twisted 21.2.0 introduces contextvar support.
+    # We could likely bump this to 22.1 without making distro packagers'
+    # lives hard (as of 2025-07, distro support is Ubuntu LTS: 22.1, Debian stable: 22.4,
+    # RHEL 9: 22.10)
+    "Twisted[tls]>=21.2.0",
+    "treq>=21.5.0",
+    # Twisted has required pyopenssl 16.0 since about Twisted 16.6.
+    # pyOpenSSL 16.2.0 fixes compatibility with OpenSSL 1.1.0. 
+    "pyOpenSSL>=16.2.0",
+    "PyYAML>=5.3",
+    "pyasn1>=0.1.9",
+    "pyasn1-modules>=0.0.7",
+    "bcrypt>=3.1.7",
+    # 10.0.1 minimum is mandatory here because of libwebp CVE-2023-4863.
+    # Packagers that already took care of libwebp can lower that down to 5.4.0.
+    "Pillow>=10.0.1",
+    # We use SortedDict.peekitem(), which was added in sortedcontainers 1.5.2.
+    # 2.0.5 updates collections.abc imports to avoid Python 3.10 incompatibility.
+    "sortedcontainers>=2.0.5",
+    "pymacaroons>=0.13.0",
+    "msgpack>=0.5.2",
+    "phonenumbers>=8.2.0",
+    # we use GaugeHistogramMetric, which was added in prom-client 0.4.0.
+    # `prometheus_client.metrics` was added in 0.5.0, so we require that too.
+    # We chose 0.6.0 as that is the current version in Debian Buster (oldstable).
+    "prometheus-client>=0.6.0",
+    # we use `order`, which arrived in attrs 19.2.0.
+    # Note: 21.1.0 broke `/sync`, see https://github.com/matrix-org/synapse/issues/9936
+    "attrs>=19.2.0,!=21.1.0",
+    "netaddr>=0.7.18",
+    # Jinja 2.x is incompatible with MarkupSafe>=2.1. To ensure that admins do not
+    # end up with a broken installation, with recent MarkupSafe but old Jinja, we
+    # add a lower bound to the Jinja2 dependency.
+    "Jinja2>=3.0",
+    # 3.2.0 updates collections.abc imports to avoid Python 3.10 incompatibility.
+    "bleach>=3.2.0",
+    # pydantic 2.12 depends on typing-extensions>=4.14.1
+    "typing-extensions>=4.14.1",
+    # We enforce that we have a `cryptography` version that bundles an `openssl`
+    # with the latest security patches.
+    "cryptography>=3.4.7",
+    # ijson 3.1.4 fixes a bug with "." in property names
+    "ijson>=3.1.4",
+    "matrix-common>=1.3.0,<2.0.0",
+    # We need packaging.verison.Version(...).major added in 20.0.
+    "packaging>=20.0",
+    "pydantic>=2.8;python_version < '3.14'",
+    "pydantic>=2.12;python_version >= '3.14'",
+
+    # This is for building the rust components during "poetry install", which
+    # currently ignores the `build-system.requires` directive (c.f.
+    # https://github.com/python-poetry/poetry/issues/6154). Both `pip install` and
+    # `poetry build` do the right thing without this explicit dependency.
+    #
+    # This isn't really a dev-dependency, as `poetry install --without dev` will fail,
+    # but the alternative is to add it to the main list of deps where it isn't
+    # needed.
+    "setuptools_rust>=1.3",
+
+    # This is used for parsing multipart responses
+    "python-multipart>=0.0.9",
+
+    # Transitive dependency constraints
+    # These dependencies aren't directly required by Synapse.
+    # However, in order for Synapse to build, Synapse requires a higher minimum version
+    # for these dependencies than the minimum specified by the direct dependency.
+    # We should periodically check to see if these dependencies are still necessary and
+    # remove any that are no longer required.
+    "cffi>=1.15", # via cryptography
+    "pynacl>=1.3", # via signedjson
+    "pyparsing>=2.4",  # via packaging
+    "pyrsistent>=0.18.0",  # via jsonschema
+    "requests>=2.16.0", # 2.16.0+ no longer vendors urllib3, avoiding Python 3.10+ incompatibility
+    "urllib3>=1.26.5", # via treq; 1.26.5 fixes Python 3.10+ collections.abc compatibility
+    # 5.2 is the current version in Debian oldstable. If we don't care to support that, then 5.4 is
+    # the minimum version from Ubuntu 22.04 and RHEL 9. (as of 2025-12)
+    # When bumping this version to 6.2 or above, refer to https://github.com/element-hq/synapse/pull/19274
+    # for details of Synapse improvements that may be unlocked. Particularly around the use of `|`
+    # syntax with zope interface types.
+    "zope-interface>=5.2", # via twisted
+]
+
+[project.optional-dependencies]
+matrix-synapse-ldap3 = ["matrix-synapse-ldap3>=0.1"]
+postgres = [
+    "psycopg2>=2.8;platform_python_implementation != 'PyPy'",
+    "psycopg2cffi>=2.8;platform_python_implementation == 'PyPy'",
+    "psycopg2cffi-compat==1.1;platform_python_implementation == 'PyPy'",
+]
+saml2 = [
+    "pysaml2>=4.5.0",
+
+    # Transitive dependencies from pysaml2
+    # These dependencies aren't directly required by Synapse.
+    # However, in order for Synapse to build, Synapse requires a higher minimum version
+    # for these dependencies than the minimum specified by the direct dependency.
+    "defusedxml>=0.7.1", # via pysaml2
+    "pytz>=2018.3",  # via pysaml2
+]
+oidc = ["authlib>=0.15.1"]
+url-preview = ["lxml>=4.6.3"]
+sentry = ["sentry-sdk>=0.7.2"]
+opentracing = [
+    "jaeger-client>=4.2.0",
+    "opentracing>=2.2.0",
+
+    # Transitive dependencies from jaeger-client
+    # These dependencies aren't directly required by Synapse.
+    # However, in order for Synapse to build, Synapse requires a higher minimum version
+    # for these dependencies than the minimum specified by the direct dependency.
+    "thrift>=0.10",  # via jaeger-client
+    "tornado>=6.0",  # via jaeger-client
+]
+jwt = ["authlib"]
+# hiredis is not a *strict* dependency, but it makes things much faster.
+# (if it is not installed, we fall back to slow code.)
+redis = ["txredisapi>=1.4.7", "hiredis>=0.3"]
+# Required to use experimental `caches.track_memory_usage` config option.
+cache-memory = ["pympler>=1.0"]
+# If this is updated, don't forget to update the equivalent lines in
+# `dependency-groups.dev` below.
+test = ["parameterized>=0.9.0", "idna>=3.3"]
+
+# The duplication here is awful.
+#
+# TODO: This can be resolved via PEP 735 dependency groups, which poetry supports
+# since 2.2.0. However, switching to that would require updating the command
+# developers use to install the `all` group. This would require some coordination.
+#
+# NB: the strings in this list must be *package* names, not extra names.
+# Some of our extra names _are_ package names, which can lead to great confusion.
+all = [
+    # matrix-synapse-ldap3
+    "matrix-synapse-ldap3>=0.1",
+    # postgres
+    "psycopg2>=2.8;platform_python_implementation != 'PyPy'",
+    "psycopg2cffi>=2.8;platform_python_implementation == 'PyPy'",
+    "psycopg2cffi-compat==1.1;platform_python_implementation == 'PyPy'",
+    # saml2
+    "pysaml2>=4.5.0",
+    # oidc and jwt
+    "authlib>=0.15.1",
+    # url-preview
+    "lxml>=4.6.3",
+    # sentry
+    "sentry-sdk>=0.7.2",
+    # opentracing
+    "jaeger-client>=4.2.0", "opentracing>=2.2.0",
+    # redis
+    "txredisapi>=1.4.7", "hiredis>=0.3",
+    # cache-memory
+    # 1.0 added support for python 3.10, our current minimum supported python version
+    "pympler>=1.0",
+    # omitted:
+    #   - test: it's useful to have this separate from dev deps in the olddeps job
+
+    # Transitive dependencies
+    # These dependencies aren't directly required by Synapse.
+    # However, in order for Synapse to build, Synapse requires a higher minimum version
+    # for these dependencies than the minimum specified by the direct dependency.
+    "defusedxml>=0.7.1", # via pysaml2
+    "pytz>=2018.3",  # via pysaml2
+    "thrift>=0.10",  # via jaeger-client
+    "tornado>=6.0",  # via jaeger-client
+]
+
+[project.urls]
+repository = "https://github.com/element-hq/synapse"
+documentation = "https://element-hq.github.io/synapse/latest"
+"Issue Tracker" = "https://github.com/element-hq/synapse/issues"
+
+[project.scripts]
+synapse_homeserver = "synapse.app.homeserver:main"
+synapse_worker = "synapse.app.generic_worker:main"
+synctl = "synapse._scripts.synctl:main"
+
+export_signing_key = "synapse._scripts.export_signing_key:main"
+generate_config = "synapse._scripts.generate_config:main"
+generate_log_config = "synapse._scripts.generate_log_config:main"
+generate_signing_key = "synapse._scripts.generate_signing_key:main"
+hash_password = "synapse._scripts.hash_password:main"
+register_new_matrix_user = "synapse._scripts.register_new_matrix_user:main"
+synapse_port_db = "synapse._scripts.synapse_port_db:main"
+synapse_review_recent_signups = "synapse._scripts.review_recent_signups:main"
+update_synapse_database = "synapse._scripts.update_synapse_database:main"
+
+[tool.poetry]
+packages = [{ include = "synapse" }]
+
+# We're using PEP 735 dependency groups, which requires Poetry 2.2.0+
+requires-poetry = ">=2.2.0"
+
+[tool.poetry.build]
+# Compile our rust module when using `poetry install`. This is still required
+# while using `poetry` as the build frontend. Saves the developer from needing
+# to run both:
+#
+# $ poetry install
+# $ maturin develop
+script = "build_rust.py"
+# Create a `setup.py` file which will call the `build` method in our build
+# script.
+#
+# Our build script currently uses the "old" build method, where we define a
+# `build` method and `setup.py` calls it. Poetry developers have mentioned that
+# this will eventually be removed:
+# https://github.com/matrix-org/synapse/pull/14949#issuecomment-1418001859
+#
+# The new build method is defined here:
+# https://python-poetry.org/docs/building-extension-modules/#maturin-build-script
+# but is still marked as "unstable" at the time of writing. This would also
+# bump our minimum `poetry-core` version to 1.5.0.
+#
+# We can just drop this work-around entirely if migrating away from
+# Poetry, thus there's little motivation to update the build script.
+generate-setup-file = true
+
+# Dependencies used for developing Synapse itself.
+#
+# We pin development dependencies in poetry.lock so that our tests don't start
+# failing on new releases. Keeping lower bounds loose here means that dependabot
+# can bump versions without having to update the content-hash in the lockfile.
+# This helps prevents merge conflicts when running a batch of dependabot updates.
+[dependency-groups]
+dev = [
+    "ruff==0.14.6",
+
+    # Typechecking
+    "lxml-stubs>=0.4.0",
+    "mypy",
+    "mypy-zope",
+    "types-bleach>=4.1.0",
+    "types-jsonschema>=3.2.0",
+    "types-netaddr>=0.8.0.6",
+    "types-opentracing>=2.4.2",
+    "types-Pillow>=8.3.4",
+    "types-psycopg2>=2.9.9",
+    "types-pyOpenSSL>=20.0.7",
+    "types-PyYAML>=5.4.10",
+    "types-requests>=2.26.0",
+    "types-setuptools>=57.4.0",
+
+    # Dependencies which are exclusively required by unit test code. This is
+    # NOT a list of all modules that are necessary to run the unit tests.
+    # Tests assume that all optional dependencies are installed.
+    #
+    # If this is updated, don't forget to update the equivalent lines in
+    # project.optional-dependencies.test.
+    "parameterized>=0.9.0",
+    "idna>=3.3",
+
+    # The following are used by the release script
+    "click>=8.1.3",
+    # GitPython was == 3.1.14; bumped to 3.1.20, the first release with type hints.
+    "GitPython>=3.1.20",
+    "markdown-it-py>=3.0.0",
+    "pygithub>=1.59",
+    # The following are executed as commands by the release script.
+    "twine",
+    # Towncrier min version comes from https://github.com/matrix-org/synapse/pull/3425. Rationale unclear.
+    "towncrier>=18.6.0rc1",
+
+    # Used for checking the Poetry lockfile
+    "tomli>=1.2.3",
+
+    # Used for checking the schema delta files
+    "sqlglot>=28.0.0",
+]
+
 [tool.towncrier]
     package = "synapse"
     filename = "CHANGES.md"
@@ -36,7 +342,7 @@
 
 [tool.ruff]
 line-length = 88
-target-version = "py39"
+target-version = "py310"
 
 [tool.ruff.lint]
 # See https://beta.ruff.rs/docs/rules/#error-e
@@ -78,6 +384,14 @@ select = [
     "LOG",
     # flake8-logging-format
     "G",
+    # pyupgrade
+    "UP006",
+]
+extend-safe-fixes = [
+    # pyupgrade rules compatible with Python >= 3.9
+    "UP006",
+    # Allow ruff to automatically fix trailing spaces within a multi-line string/comment.
+    "W293"
 ]
 
 [tool.ruff.lint.isort]
@@ -95,39 +409,32 @@ indent-style = "space"
 skip-magic-trailing-comma = false
 line-ending = "auto"
 
+[tool.ruff.lint.flake8-bugbear]
+extend-immutable-calls = [
+    # Durations are immutable
+    "synapse.util.duration.Duration",
+]
+
 [tool.maturin]
 manifest-path = "rust/Cargo.toml"
 module-name = "synapse.synapse_rust"
-
-[tool.poetry]
-name = "matrix-synapse"
-version = "1.138.0rc1"
-description = "Homeserver for the Matrix decentralised comms protocol"
-authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
-license = "AGPL-3.0-or-later"
-readme = "README.rst"
-repository = "https://github.com/element-hq/synapse"
-packages = [
-    { include = "synapse" },
-]
-classifiers = [
-    "Development Status :: 5 - Production/Stable",
-    "Topic :: Communications :: Chat",
-]
+python-source = "."
 include = [
     { path = "AUTHORS.rst", format = "sdist" },
     { path = "book.toml", format = "sdist" },
-    { path = "changelog.d", format = "sdist" },
+    { path = "changelog.d/**/*", format = "sdist" },
     { path = "CHANGES.md", format = "sdist" },
     { path = "CONTRIBUTING.md", format = "sdist" },
-    { path = "demo", format = "sdist" },
-    { path = "docs", format = "sdist" },
+    { path = "demo/**/*", format = "sdist" },
+    { path = "docs/**/*", format = "sdist" },
     { path = "INSTALL.md", format = "sdist" },
+    { path = "LICENSE-AGPL-3.0", format = "sdist" },
+    { path = "LICENSE-COMMERCIAL", format = "sdist" },
     { path = "mypy.ini", format = "sdist" },
-    { path = "scripts-dev", format = "sdist" },
-    { path = "synmark", format="sdist" },
+    { path = "scripts-dev/**/*", format = "sdist" },
+    { path = "synmark/**/*", format = "sdist" },
     { path = "sytest-blacklist", format = "sdist" },
-    { path = "tests", format = "sdist" },
+    { path = "tests/**/*", format = "sdist" },
     { path = "UPGRADE.rst", format = "sdist" },
     { path = "Cargo.toml", format = "sdist" },
     { path = "Cargo.lock", format = "sdist" },
@@ -136,236 +443,9 @@ include = [
     { path = "rust/src/**", format = "sdist" },
 ]
 exclude = [
-    { path = "synapse/*.so", format = "sdist"}
+    { path = "synapse/*.so", format = "sdist" },
 ]
 
-[tool.poetry.build]
-script = "build_rust.py"
-generate-setup-file = true
-
-[tool.poetry.scripts]
-synapse_homeserver = "synapse.app.homeserver:main"
-synapse_worker = "synapse.app.generic_worker:main"
-synctl = "synapse._scripts.synctl:main"
-
-export_signing_key = "synapse._scripts.export_signing_key:main"
-generate_config = "synapse._scripts.generate_config:main"
-generate_log_config = "synapse._scripts.generate_log_config:main"
-generate_signing_key = "synapse._scripts.generate_signing_key:main"
-hash_password = "synapse._scripts.hash_password:main"
-register_new_matrix_user = "synapse._scripts.register_new_matrix_user:main"
-synapse_port_db = "synapse._scripts.synapse_port_db:main"
-synapse_review_recent_signups = "synapse._scripts.review_recent_signups:main"
-update_synapse_database = "synapse._scripts.update_synapse_database:main"
-
-[tool.poetry.dependencies]
-python = "^3.9.0"
-
-# Mandatory Dependencies
-# ----------------------
-# we use the TYPE_CHECKER.redefine method added in jsonschema 3.0.0
-jsonschema = ">=3.0.0"
-# We choose 2.0 as a lower bound: the most recent backwards incompatible release.
-# It seems generally available, judging by https://pkgs.org/search/?q=immutabledict
-immutabledict = ">=2.0"
-# We require 2.1.0 or higher for type hints. Previous guard was >= 1.1.0
-unpaddedbase64 = ">=2.1.0"
-# We require 2.0.0 for immutabledict support.
-canonicaljson = "^2.0.0"
-# we use the type definitions added in signedjson 1.1.
-signedjson = "^1.1.0"
-# validating SSL certs for IP addresses requires service_identity 18.1.
-service-identity = ">=18.1.0"
-# Twisted 18.9 introduces some logger improvements that the structured
-# logger utilises
-# Twisted 19.7.0 moves test helpers to a new module and deprecates the old location.
-# Twisted 21.2.0 introduces contextvar support.
-# We could likely bump this to 22.1 without making distro packagers'
-# lives hard (as of 2025-07, distro support is Ubuntu LTS: 22.1, Debian stable: 22.4,
-# RHEL 9: 22.10)
-Twisted = {extras = ["tls"], version = ">=21.2.0"}
-treq = ">=21.5.0"
-# Twisted has required pyopenssl 16.0 since about Twisted 16.6.
-pyOpenSSL = ">=16.0.0"
-PyYAML = ">=5.3"
-pyasn1 = ">=0.1.9"
-pyasn1-modules = ">=0.0.7"
-bcrypt = ">=3.1.7"
-# 10.0.1 minimum is mandatory here because of libwebp CVE-2023-4863.
-# Packagers that already took care of libwebp can lower that down to 5.4.0.
-Pillow = ">=10.0.1"
-# We use SortedDict.peekitem(), which was added in sortedcontainers 1.5.2.
-sortedcontainers = ">=1.5.2"
-pymacaroons = ">=0.13.0"
-msgpack = ">=0.5.2"
-phonenumbers = ">=8.2.0"
-# we use GaugeHistogramMetric, which was added in prom-client 0.4.0.
-# `prometheus_client.metrics` was added in 0.5.0, so we require that too.
-# We chose 0.6.0 as that is the current version in Debian Buster (oldstable).
-prometheus-client = ">=0.6.0"
-# we use `order`, which arrived in attrs 19.2.0.
-# Note: 21.1.0 broke `/sync`, see https://github.com/matrix-org/synapse/issues/9936
-attrs = ">=19.2.0,!=21.1.0"
-netaddr = ">=0.7.18"
-# Jinja 2.x is incompatible with MarkupSafe>=2.1. To ensure that admins do not
-# end up with a broken installation, with recent MarkupSafe but old Jinja, we
-# add a lower bound to the Jinja2 dependency.
-Jinja2 = ">=3.0"
-bleach = ">=1.4.3"
-# We use `assert_never`, which were added in `typing-extensions` 4.1.
-typing-extensions = ">=4.1"
-# We enforce that we have a `cryptography` version that bundles an `openssl`
-# with the latest security patches.
-cryptography = ">=3.4.7"
-# ijson 3.1.4 fixes a bug with "." in property names
-ijson = ">=3.1.4"
-matrix-common = "^1.3.0"
-# We need packaging.verison.Version(...).major added in 20.0.
-packaging = ">=20.0"
-# We support pydantic v1 and pydantic v2 via the pydantic.v1 compat module.
-# See https://github.com/matrix-org/synapse/issues/15858
-pydantic = ">=1.7.4, <3"
-
-# This is for building the rust components during "poetry install", which
-# currently ignores the `build-system.requires` directive (c.f.
-# https://github.com/python-poetry/poetry/issues/6154). Both `pip install` and
-# `poetry build` do the right thing without this explicit dependency.
-#
-# This isn't really a dev-dependency, as `poetry install --without dev` will fail,
-# but the alternative is to add it to the main list of deps where it isn't
-# needed.
-setuptools_rust = ">=1.3"
-
-# This is used for parsing multipart responses
-python-multipart = ">=0.0.9"
-
-# Optional Dependencies
-# ---------------------
-matrix-synapse-ldap3 = { version = ">=0.1", optional = true }
-psycopg2 = { version = ">=2.8", markers = "platform_python_implementation != 'PyPy'", optional = true }
-psycopg2cffi = { version = ">=2.8", markers = "platform_python_implementation == 'PyPy'", optional = true }
-psycopg2cffi-compat = { version = "==1.1", markers = "platform_python_implementation == 'PyPy'", optional = true }
-pysaml2 = { version = ">=4.5.0", optional = true }
-authlib = { version = ">=0.15.1", optional = true }
-# systemd-python is necessary for logging to the systemd journal via
-# `systemd.journal.JournalHandler`, as is documented in
-# `contrib/systemd/log_config.yaml`.
-# Note: systemd-python 231 appears to have been yanked from pypi
-systemd-python = { version = ">=231", optional = true }
-lxml = { version = ">=4.5.2", optional = true }
-sentry-sdk = { version = ">=0.7.2", optional = true }
-opentracing = { version = ">=2.2.0", optional = true }
-jaeger-client = { version = ">=4.0.0", optional = true }
-txredisapi = { version = ">=1.4.7", optional = true }
-hiredis = { version = "*", optional = true }
-Pympler = { version = "*", optional = true }
-parameterized = { version = ">=0.7.4", optional = true }
-idna = { version = ">=2.5", optional = true }
-
-[tool.poetry.extras]
-# NB: Packages that should be part of `pip install matrix-synapse[all]` need to be specified
-# twice: once here, and once in the `all` extra.
-matrix-synapse-ldap3 = ["matrix-synapse-ldap3"]
-postgres = ["psycopg2", "psycopg2cffi", "psycopg2cffi-compat"]
-saml2 = ["pysaml2"]
-oidc = ["authlib"]
-# systemd-python is necessary for logging to the systemd journal via
-# `systemd.journal.JournalHandler`, as is documented in
-# `contrib/systemd/log_config.yaml`.
-systemd = ["systemd-python"]
-url-preview = ["lxml"]
-sentry = ["sentry-sdk"]
-opentracing = ["jaeger-client", "opentracing"]
-jwt = ["authlib"]
-# hiredis is not a *strict* dependency, but it makes things much faster.
-# (if it is not installed, we fall back to slow code.)
-redis = ["txredisapi", "hiredis"]
-# Required to use experimental `caches.track_memory_usage` config option.
-cache-memory = ["pympler"]
-test = ["parameterized", "idna"]
-
-# The duplication here is awful. I hate hate hate hate hate it. However, for now I want
-# to ensure you can still `pip install matrix-synapse[all]` like today. Two motivations:
-# 1) for new installations, I want instructions in existing documentation and tutorials
-#    out there to still work.
-# 2) I don't want to hard-code a list of extras into CI if I can help it. The ideal
-#    solution here would be something like https://github.com/python-poetry/poetry/issues/3413
-# Poetry 1.2's dependency groups might make this easier. But I'm not trying that out
-# until there's a stable release of 1.2.
-#
-# NB: the strings in this list must be *package* names, not extra names.
-# Some of our extra names _are_ package names, which can lead to great confusion.
-all = [
-    # matrix-synapse-ldap3
-    "matrix-synapse-ldap3",
-    # postgres
-    "psycopg2", "psycopg2cffi", "psycopg2cffi-compat",
-    # saml2
-    "pysaml2",
-    # oidc and jwt
-    "authlib",
-    # url-preview
-    "lxml",
-    # sentry
-    "sentry-sdk",
-    # opentracing
-    "jaeger-client", "opentracing",
-    # redis
-    "txredisapi", "hiredis",
-    # cache-memory
-    "pympler",
-    # omitted:
-    #   - test: it's useful to have this separate from dev deps in the olddeps job
-    #   - systemd: this is a system-based requirement
-]
-
-[tool.poetry.dev-dependencies]
-# We pin development dependencies in poetry.lock so that our tests don't start
-# failing on new releases. Keeping lower bounds loose here means that dependabot
-# can bump versions without having to update the content-hash in the lockfile.
-# This helps prevents merge conflicts when running a batch of dependabot updates.
-ruff = "0.12.10"
-# Type checking only works with the pydantic.v1 compat module from pydantic v2
-pydantic = "^2"
-
-# Typechecking
-lxml-stubs = ">=0.4.0"
-mypy = "*"
-mypy-zope = "*"
-types-bleach = ">=4.1.0"
-types-jsonschema = ">=3.2.0"
-types-netaddr = ">=0.8.0.6"
-types-opentracing = ">=2.4.2"
-types-Pillow = ">=8.3.4"
-types-psycopg2 = ">=2.9.9"
-types-pyOpenSSL = ">=20.0.7"
-types-PyYAML = ">=5.4.10"
-types-requests = ">=2.26.0"
-types-setuptools = ">=57.4.0"
-
-# Dependencies which are exclusively required by unit test code. This is
-# NOT a list of all modules that are necessary to run the unit tests.
-# Tests assume that all optional dependencies are installed.
-# parameterized<0.7.4 can create classes with names that would normally be invalid
-# identifiers. trial really does not like this when running with multiple workers.
-parameterized = ">=0.7.4"
-idna = ">=2.5"
-
-# The following are used by the release script
-click = ">=8.1.3"
-# GitPython was == 3.1.14; bumped to 3.1.20, the first release with type hints.
-GitPython = ">=3.1.20"
-markdown-it-py = ">=3.0.0"
-pygithub = ">=1.55"
-# The following are executed as commands by the release script.
-twine = "*"
-# Towncrier min version comes from https://github.com/matrix-org/synapse/pull/3425. Rationale unclear.
-towncrier = ">=18.6.0rc1"
-
-# Used for checking the Poetry lockfile
-tomli = ">=1.2.3"
-
-
 [build-system]
 # The upper bounds here are defensive, intended to prevent situations like
 # https://github.com/matrix-org/synapse/issues/13849 and
@@ -373,26 +453,32 @@ tomli = ">=1.2.3"
 # runtime errors caused by build system changes.
 # We are happy to raise these upper bounds upon request,
 # provided we check that it's safe to do so (i.e. that CI passes).
-requires = ["poetry-core>=1.1.0,<=2.1.3", "setuptools_rust>=1.3,<=1.11.1"]
-build-backend = "poetry.core.masonry.api"
+requires = ["maturin>=1.0,<2.0"]
+build-backend = "maturin"
 
 
 [tool.cibuildwheel]
 # Skip unsupported platforms (by us or by Rust).
-# See https://cibuildwheel.readthedocs.io/en/stable/options/#build-skip for the list of build targets.
+#
+# See https://cibuildwheel.readthedocs.io/en/stable/options/#build-skip for the
+# list of supported build targets.
+#
+# Also see `.github/workflows/release-artifacts.yml` for the list of
+# architectures we build for (based on the runner OS types we use), as well as
+# the platforms we exclude from testing in CI.
+#
 # We skip:
-#  - CPython and PyPy 3.8: EOLed
-#  - musllinux i686: excluded to reduce number of wheels we build.
-#    c.f. https://github.com/matrix-org/synapse/pull/12595#discussion_r963107677
-skip = "cp38* pp38* *-musllinux_i686"
-# Enable non-default builds.
+#  - free-threaded cpython builds: these are not currently supported.
+#  - i686: We don't support 32-bit platforms.
+#  - *macosx*: we don't support building wheels for MacOS.
+skip = "cp3??t-* *i686* *macosx*"
+# Enable non-default builds. See the list of available options:
+# https://cibuildwheel.pypa.io/en/stable/options#enable
+#
 # "pypy" used to be included by default up until cibuildwheel 3.
 enable = "pypy"
 
 # We need a rust compiler.
-#
-# We temporarily pin Rust to 1.82.0 to work around
-# https://github.com/element-hq/synapse/issues/17988
 before-all =  "sh .ci/before_build_wheel.sh"
 environment= { PATH = "$PATH:$HOME/.cargo/bin" }
 
@@ -402,12 +488,3 @@ environment= { PATH = "$PATH:$HOME/.cargo/bin" }
 before-build = "rm -rf {project}/build"
 build-frontend = "build"
 test-command = "python -c 'from synapse.synapse_rust import sum_as_string; print(sum_as_string(1, 2))'"
-
-
-[tool.cibuildwheel.linux]
-# Wrap the repair command to correctly rename the built cpython wheels as ABI3.
-repair-wheel-command = "./.ci/scripts/auditwheel_wrapper.py -w {dest_dir} {wheel}"
-
-[tool.cibuildwheel.macos]
-# Wrap the repair command to correctly rename the built cpython wheels as ABI3.
-repair-wheel-command = "./.ci/scripts/auditwheel_wrapper.py --require-archs {delocate_archs} -w {dest_dir} {wheel}"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 0706357294..bca2f6ed70 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -30,14 +30,17 @@ http = "1.1.0"
 lazy_static = "1.4.0"
 log = "0.4.17"
 mime = "0.3.17"
-pyo3 = { version = "0.25.1", features = [
+pyo3 = { version = "0.27.2", features = [
     "macros",
     "anyhow",
     "abi3",
-    "abi3-py39",
+    "abi3-py310",
+    # So we can pass `bytes::Bytes` directly back to Python efficiently,
+    # https://docs.rs/pyo3/latest/pyo3/bytes/index.html
+    "bytes",
 ] }
-pyo3-log = "0.12.4"
-pythonize = "0.25.0"
+pyo3-log = "0.13.1"
+pythonize = "0.27.0"
 regex = "1.6.0"
 sha2 = "0.10.8"
 serde = { version = "1.0.144", features = ["derive"] }
@@ -61,3 +64,4 @@ default = ["extension-module"]
 [build-dependencies]
 blake2 = "0.10.4"
 hex = "0.4.3"
+rustc_version = "0.4.1"
diff --git a/rust/build.rs b/rust/build.rs
index ef370e6b41..2a99a9b95d 100644
--- a/rust/build.rs
+++ b/rust/build.rs
@@ -8,6 +8,7 @@
 use std::path::PathBuf;
 
 use blake2::{Blake2b512, Digest};
+use rustc_version::version_meta;
 
 fn main() -> Result<(), std::io::Error> {
     let mut dirs = vec![PathBuf::from("src")];
@@ -29,6 +30,13 @@ fn main() -> Result<(), std::io::Error> {
         }
     }
 
+    // Manually add Cargo.toml's, Cargo.lock and build.rs to the hash, since changes to
+    // these files should also invalidate the built module.
+    paths.push("Cargo.toml".to_string());
+    paths.push("../Cargo.lock".to_string());
+    paths.push("../Cargo.toml".to_string());
+    paths.push("build.rs".to_string());
+
     paths.sort();
 
     let mut hasher = Blake2b512::new();
@@ -41,5 +49,17 @@ fn main() -> Result<(), std::io::Error> {
     let hex_digest = hex::encode(hasher.finalize());
     println!("cargo:rustc-env=SYNAPSE_RUST_DIGEST={hex_digest}");
 
+    let rustc_version = version_meta()
+        .map(|v| v.short_version_string)
+        .unwrap_or_else(|_| "unknown".to_string());
+    println!("cargo:rustc-env=SYNAPSE_RUSTC_VERSION={}", rustc_version,);
+
+    // The default rules don't pick up trivial changes to the workspace config
+    // files, but we need to rebuild if those change to pick up the changed
+    // hashes.
+    println!("cargo::rerun-if-changed=.");
+    println!("cargo::rerun-if-changed=../Cargo.lock");
+    println!("cargo::rerun-if-changed=../Cargo.toml");
+
     Ok(())
 }
diff --git a/rust/src/duration.rs b/rust/src/duration.rs
new file mode 100644
index 0000000000..a3dbe919b2
--- /dev/null
+++ b/rust/src/duration.rs
@@ -0,0 +1,56 @@
+/*
+ * This file is licensed under the Affero General Public License (AGPL) version 3.
+ *
+ * Copyright (C) 2025 Element Creations, Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * See the GNU Affero General Public License for more details:
+ * <https://www.gnu.org/licenses/agpl-3.0.html>.
+ */
+
+use once_cell::sync::OnceCell;
+use pyo3::{
+    types::{IntoPyDict, PyAnyMethods},
+    Bound, BoundObject, IntoPyObject, Py, PyAny, PyErr, PyResult, Python,
+};
+
+/// A reference to the `synapse.util.duration` module.
+static DURATION: OnceCell<Py<PyAny>> = OnceCell::new();
+
+/// Access to the `synapse.util.duration` module.
+fn duration_module(py: Python<'_>) -> PyResult<&Bound<'_, PyAny>> {
+    Ok(DURATION
+        .get_or_try_init(|| py.import("synapse.util.duration").map(Into::into))?
+        .bind(py))
+}
+
+/// Mirrors the `synapse.util.duration.Duration` Python class.
+pub struct SynapseDuration {
+    microseconds: u64,
+}
+
+impl SynapseDuration {
+    /// For now we only need to create durations from milliseconds.
+    pub fn from_milliseconds(milliseconds: u64) -> Self {
+        Self {
+            microseconds: milliseconds * 1_000,
+        }
+    }
+}
+
+impl<'py> IntoPyObject<'py> for &SynapseDuration {
+    type Target = PyAny;
+    type Output = Bound<'py, Self::Target>;
+    type Error = PyErr;
+
+    fn into_pyobject(self, py: Python<'py>) -> Result<Self::Output, Self::Error> {
+        let duration_module = duration_module(py)?;
+        let kwargs = [("microseconds", self.microseconds)].into_py_dict(py)?;
+        let duration_instance = duration_module.call_method("Duration", (), Some(&kwargs))?;
+        Ok(duration_instance.into_bound())
+    }
+}
diff --git a/rust/src/errors.rs b/rust/src/errors.rs
index 149019ff4b..012f9a7990 100644
--- a/rust/src/errors.rs
+++ b/rust/src/errors.rs
@@ -62,7 +62,7 @@ impl NotFoundError {
 import_exception!(synapse.api.errors, HttpResponseException);
 
 impl HttpResponseException {
-    pub fn new(status: StatusCode, bytes: Vec<u8>) -> pyo3::PyErr {
+    pub fn new(status: StatusCode, bytes: bytes::Bytes) -> pyo3::PyErr {
         HttpResponseException::new_err((
             status.as_u16(),
             status.canonical_reason().unwrap_or_default(),
diff --git a/rust/src/events/internal_metadata.rs b/rust/src/events/internal_metadata.rs
index 4711fc540f..a53c1e771b 100644
--- a/rust/src/events/internal_metadata.rs
+++ b/rust/src/events/internal_metadata.rs
@@ -41,7 +41,7 @@ use pyo3::{
     pybacked::PyBackedStr,
     pyclass, pymethods,
     types::{PyAnyMethods, PyDict, PyDictMethods, PyString},
-    Bound, IntoPyObject, PyAny, PyObject, PyResult, Python,
+    Bound, IntoPyObject, Py, PyAny, PyResult, Python,
 };
 
 use crate::UnwrapInfallible;
@@ -57,6 +57,7 @@ enum EventInternalMetadataData {
     PolicyServerSpammy(bool),
     Redacted(bool),
     TxnId(Box<str>),
+    DelayId(Box<str>),
     TokenId(i64),
     DeviceId(Box<str>),
 }
@@ -115,6 +116,10 @@ impl EventInternalMetadataData {
                 pyo3::intern!(py, "txn_id"),
                 o.into_pyobject(py).unwrap_infallible().into_any(),
             ),
+            EventInternalMetadataData::DelayId(o) => (
+                pyo3::intern!(py, "delay_id"),
+                o.into_pyobject(py).unwrap_infallible().into_any(),
+            ),
             EventInternalMetadataData::TokenId(o) => (
                 pyo3::intern!(py, "token_id"),
                 o.into_pyobject(py).unwrap_infallible().into_any(),
@@ -179,6 +184,12 @@ impl EventInternalMetadataData {
                     .map(String::into_boxed_str)
                     .with_context(|| format!("'{key_str}' has invalid type"))?,
             ),
+            "delay_id" => EventInternalMetadataData::DelayId(
+                value
+                    .extract()
+                    .map(String::into_boxed_str)
+                    .with_context(|| format!("'{key_str}' has invalid type"))?,
+            ),
             "token_id" => EventInternalMetadataData::TokenId(
                 value
                     .extract()
@@ -250,6 +261,11 @@ pub struct EventInternalMetadata {
     #[pyo3(get, set)]
     instance_name: Option<String>,
 
+    /// The event ID of the redaction event, if this event has been redacted.
+    /// This is set dynamically at load time and is not persisted to the database.
+    #[pyo3(get, set)]
+    redacted_by: Option<String>,
+
     /// whether this event is an outlier (ie, whether we have the state at that
     /// point in the DAG)
     #[pyo3(get, set)]
@@ -278,6 +294,7 @@ impl EventInternalMetadata {
             data,
             stream_ordering: None,
             instance_name: None,
+            redacted_by: None,
             outlier: false,
         })
     }
@@ -289,7 +306,7 @@ impl EventInternalMetadata {
     /// Get a dict holding the data stored in the `internal_metadata` column in the database.
     ///
     /// Note that `outlier` and `stream_ordering` are stored in separate columns so are not returned here.
-    fn get_dict(&self, py: Python<'_>) -> PyResult<PyObject> {
+    fn get_dict(&self, py: Python<'_>) -> PyResult<Py<PyAny>> {
         let dict = PyDict::new(py);
 
         for entry in &self.data {
@@ -472,6 +489,17 @@ impl EventInternalMetadata {
         set_property!(self, TxnId, obj.into_boxed_str());
     }
 
+    /// The delay ID, set only if the event was a delayed event.
+    #[getter]
+    fn get_delay_id(&self) -> PyResult<&str> {
+        let s = get_property!(self, DelayId)?;
+        Ok(s)
+    }
+    #[setter]
+    fn set_delay_id(&mut self, obj: String) {
+        set_property!(self, DelayId, obj.into_boxed_str());
+    }
+
     /// The access token ID of the user who sent this event, if any.
     #[getter]
     fn get_token_id(&self) -> PyResult<i64> {
diff --git a/rust/src/http.rs b/rust/src/http.rs
index 63ed05be54..8d462f2e5e 100644
--- a/rust/src/http.rs
+++ b/rust/src/http.rs
@@ -32,7 +32,7 @@ fn read_io_body(body: &Bound<'_, PyAny>, chunk_size: usize) -> PyResult<Bytes> {
     let mut buf = BytesMut::new();
     loop {
         let bound = &body.call_method1("read", (chunk_size,))?;
-        let bytes: &Bound<'_, PyBytes> = bound.downcast()?;
+        let bytes: &Bound<'_, PyBytes> = bound.cast()?;
         if bytes.as_bytes().is_empty() {
             return Ok(buf.into());
         }
@@ -58,12 +58,12 @@ pub fn http_request_from_twisted(request: &Bound<'_, PyAny>) -> PyResult<Request
     let mut req = Request::new(body);
 
     let bound = &request.getattr("uri")?;
-    let uri: &Bound<'_, PyBytes> = bound.downcast()?;
+    let uri: &Bound<'_, PyBytes> = bound.cast()?;
     *req.uri_mut() =
         Uri::try_from(uri.as_bytes()).map_err(|_| PyValueError::new_err("invalid uri"))?;
 
     let bound = &request.getattr("method")?;
-    let method: &Bound<'_, PyBytes> = bound.downcast()?;
+    let method: &Bound<'_, PyBytes> = bound.cast()?;
     *req.method_mut() = Method::from_bytes(method.as_bytes())
         .map_err(|_| PyValueError::new_err("invalid method"))?;
 
@@ -74,17 +74,17 @@ pub fn http_request_from_twisted(request: &Bound<'_, PyAny>) -> PyResult<Request
 
     for header in headers_iter {
         let header = header?;
-        let header: &Bound<'_, PyTuple> = header.downcast()?;
+        let header: &Bound<'_, PyTuple> = header.cast()?;
         let bound = &header.get_item(0)?;
-        let name: &Bound<'_, PyBytes> = bound.downcast()?;
+        let name: &Bound<'_, PyBytes> = bound.cast()?;
         let name = HeaderName::from_bytes(name.as_bytes())
             .map_err(|_| PyValueError::new_err("invalid header name"))?;
 
         let bound = &header.get_item(1)?;
-        let values: &Bound<'_, PySequence> = bound.downcast()?;
+        let values: &Bound<'_, PySequence> = bound.cast()?;
         for index in 0..values.len()? {
             let bound = &values.get_item(index)?;
-            let value: &Bound<'_, PyBytes> = bound.downcast()?;
+            let value: &Bound<'_, PyBytes> = bound.cast()?;
             let value = HeaderValue::from_bytes(value.as_bytes())
                 .map_err(|_| PyValueError::new_err("invalid header value"))?;
             req.headers_mut().append(name.clone(), value);
diff --git a/rust/src/http_client.rs b/rust/src/http_client.rs
index b6cdf98f55..398ba9041f 100644
--- a/rust/src/http_client.rs
+++ b/rust/src/http_client.rs
@@ -12,10 +12,10 @@
  * <https://www.gnu.org/licenses/agpl-3.0.html>.
  */
 
-use std::{collections::HashMap, future::Future};
+use std::{collections::HashMap, future::Future, sync::OnceLock};
 
 use anyhow::Context;
-use futures::TryStreamExt;
+use http_body_util::BodyExt;
 use once_cell::sync::OnceCell;
 use pyo3::{create_exception, exceptions::PyException, prelude::*};
 use reqwest::RequestBuilder;
@@ -134,10 +134,10 @@ fn get_runtime<'a>(reactor: &Bound<'a, PyAny>) -> PyResult<PyRef<'a, PyTokioRunt
 }
 
 /// A reference to the `twisted.internet.defer` module.
-static DEFER: OnceCell<PyObject> = OnceCell::new();
+static DEFER: OnceCell<Py<PyAny>> = OnceCell::new();
 
 /// Access to the `twisted.internet.defer` module.
-fn defer(py: Python<'_>) -> PyResult<&Bound<PyAny>> {
+fn defer(py: Python<'_>) -> PyResult<&Bound<'_, PyAny>> {
     Ok(DEFER
         .get_or_try_init(|| py.import("twisted.internet.defer").map(Into::into))?
         .bind(py))
@@ -165,21 +165,33 @@ pub fn register_module(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()>
 #[pyclass]
 struct HttpClient {
     client: reqwest::Client,
-    reactor: PyObject,
+    reactor: Py<PyAny>,
 }
 
 #[pymethods]
 impl HttpClient {
     #[new]
-    pub fn py_new(reactor: Bound<PyAny>, user_agent: &str) -> PyResult<HttpClient> {
+    #[pyo3(signature = (reactor, user_agent, http2_only = false))]
+    pub fn py_new(
+        reactor: Bound<PyAny>,
+        user_agent: &str,
+        http2_only: bool,
+    ) -> PyResult<HttpClient> {
         // Make sure the runtime gets installed
         let _ = runtime(&reactor)?;
 
+        let mut builder = reqwest::Client::builder().user_agent(user_agent);
+
+        if http2_only {
+            // Create the client with 'HTTP/2 prior knowledge' enabled, which
+            // means it will always use HTTP/2 for unencrypted connections
+            builder = builder.http2_prior_knowledge();
+        }
+
+        let client = builder.build().context("building reqwest client")?;
+
         Ok(HttpClient {
-            client: reqwest::Client::builder()
-                .user_agent(user_agent)
-                .build()
-                .context("building reqwest client")?,
+            client,
             reactor: reactor.unbind(),
         })
     }
@@ -223,23 +235,30 @@ impl HttpClient {
 
             let status = response.status();
 
-            let mut stream = response.bytes_stream();
-            let mut buffer = Vec::new();
-            while let Some(chunk) = stream.try_next().await.context("reading body")? {
-                if buffer.len() + chunk.len() > response_limit {
-                    Err(anyhow::anyhow!("Response size too large"))?;
-                }
-
-                buffer.extend_from_slice(&chunk);
-            }
+            // A light-weight way to read the response up until the `response_limit`. We
+            // want to avoid allocating a giant response object on the server above our
+            // expected `response_limit` to avoid out-of-memory DOS problems.
+            let body = reqwest::Body::from(response);
+            let limited_body = http_body_util::Limited::new(body, response_limit);
+            let collected = limited_body
+                .collect()
+                .await
+                .map_err(anyhow::Error::from_boxed)
+                .with_context(|| {
+                    format!(
+                        "Response body exceeded response limit ({} bytes)",
+                        response_limit
+                    )
+                })?;
+            let bytes: bytes::Bytes = collected.to_bytes();
 
             if !status.is_success() {
-                return Err(HttpResponseException::new(status, buffer));
+                return Err(HttpResponseException::new(status, bytes));
             }
 
-            let r = Python::with_gil(|py| buffer.into_pyobject(py).map(|o| o.unbind()))?;
-
-            Ok(r)
+            // Because of the `pyo3` `bytes` feature, we can pass this back to Python
+            // land efficiently
+            Ok(bytes)
         })
     }
 }
@@ -270,7 +289,7 @@ where
     handle.spawn(async move {
         let res = task.await;
 
-        Python::with_gil(move |py| {
+        Python::attach(move |py| {
             // Flatten the panic into standard python error
             let res = match res {
                 Ok(r) => r,
@@ -299,5 +318,25 @@ where
         });
     });
 
-    Ok(deferred)
+    // Make the deferred follow the Synapse logcontext rules
+    make_deferred_yieldable(py, &deferred)
+}
+
+static MAKE_DEFERRED_YIELDABLE: OnceLock<pyo3::Py<pyo3::PyAny>> = OnceLock::new();
+
+/// Given a deferred, make it follow the Synapse logcontext rules
+fn make_deferred_yieldable<'py>(
+    py: Python<'py>,
+    deferred: &Bound<'py, PyAny>,
+) -> PyResult<Bound<'py, PyAny>> {
+    let make_deferred_yieldable = MAKE_DEFERRED_YIELDABLE.get_or_init(|| {
+        let sys = PyModule::import(py, "synapse.logging.context").unwrap();
+        let func = sys.getattr("make_deferred_yieldable").unwrap().unbind();
+        func
+    });
+
+    make_deferred_yieldable
+        .call1(py, (deferred,))?
+        .extract(py)
+        .map_err(Into::into)
 }
diff --git a/rust/src/lib.rs b/rust/src/lib.rs
index 6522148fa1..3b049a51b7 100644
--- a/rust/src/lib.rs
+++ b/rust/src/lib.rs
@@ -5,14 +5,17 @@ use pyo3::prelude::*;
 use pyo3_log::ResetHandle;
 
 pub mod acl;
+pub mod duration;
 pub mod errors;
 pub mod events;
 pub mod http;
 pub mod http_client;
 pub mod identifier;
 pub mod matrix_const;
+pub mod msc4388_rendezvous;
 pub mod push;
 pub mod rendezvous;
+pub mod room_versions;
 pub mod segmenter;
 
 lazy_static! {
@@ -27,6 +30,14 @@ fn get_rust_file_digest() -> &'static str {
     env!("SYNAPSE_RUST_DIGEST")
 }
 
+/// Returns the `rustc` version used when this native module was built.
+///
+/// This value is embedded at build time, so it can be exported as a prometheus metrics.
+#[pyfunction]
+pub fn get_rustc_version() -> &'static str {
+    env!("SYNAPSE_RUSTC_VERSION")
+}
+
 /// Formats the sum of two numbers as string.
 #[pyfunction]
 #[pyo3(text_signature = "(a, b, /)")]
@@ -47,6 +58,7 @@ fn reset_logging_config() {
 fn synapse_rust(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(sum_as_string, m)?)?;
     m.add_function(wrap_pyfunction!(get_rust_file_digest, m)?)?;
+    m.add_function(wrap_pyfunction!(get_rustc_version, m)?)?;
     m.add_function(wrap_pyfunction!(reset_logging_config, m)?)?;
 
     acl::register_module(py, m)?;
@@ -54,7 +66,9 @@ fn synapse_rust(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
     events::register_module(py, m)?;
     http_client::register_module(py, m)?;
     rendezvous::register_module(py, m)?;
+    msc4388_rendezvous::register_module(py, m)?;
     segmenter::register_module(py, m)?;
+    room_versions::register_module(py, m)?;
 
     Ok(())
 }
diff --git a/rust/src/msc4388_rendezvous/mod.rs b/rust/src/msc4388_rendezvous/mod.rs
new file mode 100644
index 0000000000..bc9463639f
--- /dev/null
+++ b/rust/src/msc4388_rendezvous/mod.rs
@@ -0,0 +1,370 @@
+/*
+ * This file is licensed under the Affero General Public License (AGPL) version 3.
+ *
+ * Copyright (C) 2026 Element Creations Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * See the GNU Affero General Public License for more details:
+ * <https://www.gnu.org/licenses/agpl-3.0.html>.
+ */
+
+use std::{
+    collections::BTreeMap,
+    time::{Duration, SystemTime},
+};
+
+use http::StatusCode;
+use pyo3::{
+    pyclass, pymethods,
+    types::{PyAnyMethods, PyModule, PyModuleMethods},
+    Bound, IntoPyObject, Py, PyAny, PyResult, Python,
+};
+use serde::Deserialize;
+use ulid::Ulid;
+
+use self::session::Session;
+use crate::{
+    duration::SynapseDuration,
+    errors::{NotFoundError, SynapseError},
+    http::http_request_from_twisted,
+    msc4388_rendezvous::session::{GetResponse, PostResponse, PutResponse},
+    UnwrapInfallible,
+};
+
+mod session;
+
+#[pyclass]
+struct MSC4388RendezvousHandler {
+    clock: Py<PyAny>,
+    sessions: BTreeMap<Ulid, Session>,
+    soft_limit: usize,
+    hard_limit: usize,
+    max_content_length: u64,
+    ttl: Duration,
+}
+
+impl MSC4388RendezvousHandler {
+    /// Check the length of the data parameter and throw error if invalid.
+    fn check_data_length(&self, data: &str) -> PyResult<()> {
+        let data_length = data.len() as u64;
+        if data_length > self.max_content_length {
+            return Err(SynapseError::new(
+                StatusCode::PAYLOAD_TOO_LARGE,
+                "Payload too large".to_owned(),
+                "M_TOO_LARGE",
+                None,
+                None,
+            ));
+        }
+        Ok(())
+    }
+
+    /// Evict expired sessions and remove the oldest sessions until we're under the capacity.
+    fn evict(&mut self, now: SystemTime) {
+        // First remove all the entries which expired
+        self.sessions.retain(|_, session| !session.expired(now));
+
+        // Then we remove the oldest entries until we're under the soft limit
+        while self.sessions.len() > self.soft_limit {
+            self.sessions.pop_first();
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub struct PostRequest {
+    data: String,
+}
+
+#[derive(Deserialize)]
+pub struct PutRequest {
+    sequence_token: String,
+    data: String,
+}
+
+#[pymethods]
+impl MSC4388RendezvousHandler {
+    #[new]
+    #[pyo3(signature = (homeserver, /, soft_limit=100, hard_limit=200,max_content_length=4*1024, eviction_interval=60*1000, ttl=2*60*1000))]
+    fn new(
+        py: Python<'_>,
+        homeserver: &Bound<'_, PyAny>,
+        soft_limit: usize,
+        hard_limit: usize,
+        max_content_length: u64,
+        eviction_interval: u64,
+        ttl: u64,
+    ) -> PyResult<Py<Self>> {
+        let clock = homeserver
+            .call_method0("get_clock")?
+            .into_pyobject(py)
+            .unwrap_infallible()
+            .unbind();
+
+        // Construct a Python object so that we can get a reference to the
+        // evict method and schedule it to run.
+        let self_ = Py::new(
+            py,
+            Self {
+                clock,
+                sessions: BTreeMap::new(),
+                soft_limit,
+                hard_limit,
+                max_content_length,
+                ttl: Duration::from_millis(ttl),
+            },
+        )?;
+
+        let eviction_duration = SynapseDuration::from_milliseconds(eviction_interval);
+
+        let evict = self_.getattr(py, "_evict")?;
+        homeserver.call_method0("get_clock")?.call_method(
+            "looping_call",
+            (evict, &eviction_duration),
+            None,
+        )?;
+
+        Ok(self_)
+    }
+
+    fn _evict(&mut self, py: Python<'_>) -> PyResult<()> {
+        let clock = self.clock.bind(py);
+        let now: u64 = clock.call_method0("time_msec")?.extract()?;
+        let now = SystemTime::UNIX_EPOCH + Duration::from_millis(now);
+        self.evict(now);
+
+        Ok(())
+    }
+
+    fn handle_post(
+        &mut self,
+        py: Python<'_>,
+        twisted_request: &Bound<'_, PyAny>,
+    ) -> PyResult<(u8, PostResponse)> {
+        let clock = self.clock.bind(py);
+        let now: u64 = clock.call_method0("time_msec")?.extract()?;
+        let now = SystemTime::UNIX_EPOCH + Duration::from_millis(now);
+
+        // We trigger an immediate eviction if we're at the hard limit
+        if self.sessions.len() >= self.hard_limit {
+            self.evict(now);
+        }
+
+        // Generate a new ULID for the session from the current time.
+        let id = Ulid::from_datetime(now);
+
+        let request = http_request_from_twisted(twisted_request)?;
+        // parse JSON body
+        let post_request: PostRequest =
+            serde_json::from_slice(&request.into_body()).map_err(|_| {
+                SynapseError::new(
+                    StatusCode::BAD_REQUEST,
+                    "Invalid JSON in request body".to_owned(),
+                    "M_INVALID_PARAM",
+                    None,
+                    None,
+                )
+            })?;
+
+        let data: String = post_request.data;
+        self.check_data_length(&data)?;
+
+        let session = Session::new(id, data, now, self.ttl);
+        let response = session.post_response(now);
+        self.sessions.insert(id, session);
+
+        Ok((200, response))
+    }
+
+    fn handle_get(
+        &mut self,
+        py: Python<'_>,
+        id: &str,
+        twisted_request: &Bound<'_, PyAny>,
+    ) -> PyResult<(u8, GetResponse)> {
+        let request = http_request_from_twisted(twisted_request)?;
+
+        // As per the MSC, we check the Sec-Fetch-* headers to ensure this request did not come from somewhere that will
+        // be rendered directly to the user, as the response may contain sensitive data. These headers are added by
+        // well behaved browsers so are helpful for protecting regular users.
+
+        // Sec-Fetch-Dest: https://www.w3.org/TR/fetch-metadata/#sec-fetch-dest-header
+        //
+        // If the header is present then this must be "empty". All other values such as document, image etc.
+        // are considered potentially dangerous as they might be rendered to the user.
+        //
+        // Note that because we only ever return JSON, so it is unlikely that it could somehow be rendered as an image,
+        // video or other media.
+        let sec_fetch_dest: Option<String> = request
+            .headers()
+            .get("sec-fetch-dest")
+            .and_then(|v| v.to_str().ok())
+            .map(|s| s.to_owned());
+        if sec_fetch_dest.is_some() && sec_fetch_dest.as_deref() != Some("empty") {
+            return Err(SynapseError::new(
+                StatusCode::FORBIDDEN,
+                "Rendezvous content is not accessible from the request destination".to_owned(),
+                "M_FORBIDDEN",
+                None,
+                None,
+            ));
+        }
+
+        // Sec-Fetch-Mode: https://www.w3.org/TR/fetch-metadata/#sec-fetch-mode-header
+        //
+        // A request mode of "navigate" is not allowed as this indicates the request is being made by the
+        // browser to navigate to a URL, which could lead to the response being rendered directly to the user.
+        //
+        // Note that usually Sec-Fetch-Dest would be "document" in this case and so the request would be rejected earlier,
+        // but we check the mode just in case the destination is not set correctly.
+        let sec_fetch_mode: Option<String> = request
+            .headers()
+            .get("sec-fetch-mode")
+            .and_then(|v| v.to_str().ok())
+            .map(|s| s.to_owned());
+        if sec_fetch_mode.as_deref() == Some("navigate") {
+            return Err(SynapseError::new(
+                StatusCode::FORBIDDEN,
+                "Rendezvous content is not accessible via top-level navigation".to_owned(),
+                "M_FORBIDDEN",
+                None,
+                None,
+            ));
+        }
+
+        // Sec-Fetch-User: https://www.w3.org/TR/fetch-metadata/#sec-fetch-user-header
+        //
+        // If the request has a Sec-Fetch-User header with a value of "?1", this indicates that the
+        // request was triggered by user activation, such as a click.
+        //
+        // Note that usually Sec-Fetch-Mode would be "navigate" or the Sec-Fetch-Dest would be "document" in this case
+        // and so the request would be rejected earlier, but we check the user activation just in case those headers are
+        // not set correctly.
+        let sec_fetch_user: Option<String> = request
+            .headers()
+            .get("sec-fetch-user")
+            .and_then(|v| v.to_str().ok())
+            .map(|s| s.to_owned());
+        if sec_fetch_user.as_deref() == Some("?1") {
+            return Err(SynapseError::new(
+                StatusCode::FORBIDDEN,
+                "Rendezvous content is not accessible from requests with user activation"
+                    .to_owned(),
+                "M_FORBIDDEN",
+                None,
+                None,
+            ));
+        }
+
+        // Sec-Fetch-Site: https://www.w3.org/TR/fetch-metadata/#sec-fetch-site-header
+        //
+        // "none" indicates the request did not originate from a web page
+        // (e.g. typed URL, bookmark, or browser extension), so we disallow it.
+        let sec_fetch_site: Option<String> = request
+            .headers()
+            .get("sec-fetch-site")
+            .and_then(|v| v.to_str().ok())
+            .map(|s| s.to_owned());
+        if sec_fetch_site.as_deref() == Some("none") {
+            return Err(SynapseError::new(
+                StatusCode::FORBIDDEN,
+                "Rendezvous content is not accessible from requests from user interaction"
+                    .to_owned(),
+                "M_FORBIDDEN",
+                None,
+                None,
+            ));
+        }
+
+        let clock = self.clock.bind(py);
+        let now: u64 = clock.call_method0("time_msec")?.extract()?;
+        let now = SystemTime::UNIX_EPOCH + Duration::from_millis(now);
+
+        let id: Ulid = id.parse().map_err(|_| NotFoundError::new())?;
+        let session = self
+            .sessions
+            .get(&id)
+            .filter(|s| !s.expired(now))
+            .ok_or_else(NotFoundError::new)?;
+
+        Ok((200, session.get_response(now)))
+    }
+
+    fn handle_put(
+        &mut self,
+        py: Python<'_>,
+        id: &str,
+        twisted_request: &Bound<'_, PyAny>,
+    ) -> PyResult<(u8, PutResponse)> {
+        let request = http_request_from_twisted(twisted_request)?;
+        // parse JSON body
+        let put_request: PutRequest =
+            serde_json::from_slice(&request.into_body()).map_err(|_| {
+                SynapseError::new(
+                    StatusCode::BAD_REQUEST,
+                    "Invalid JSON in request body".to_owned(),
+                    "M_INVALID_PARAM",
+                    None,
+                    None,
+                )
+            })?;
+
+        let sequence_token: String = put_request.sequence_token;
+
+        let data: String = put_request.data;
+
+        self.check_data_length(&data)?;
+
+        let clock = self.clock.bind(py);
+        let now: u64 = clock.call_method0("time_msec")?.extract()?;
+        let now = SystemTime::UNIX_EPOCH + Duration::from_millis(now);
+
+        let id: Ulid = id.parse().map_err(|_| NotFoundError::new())?;
+        let session = self
+            .sessions
+            .get_mut(&id)
+            .filter(|s| !s.expired(now))
+            .ok_or_else(NotFoundError::new)?;
+
+        if !session.sequence_token().eq(&sequence_token) {
+            return Err(SynapseError::new(
+                StatusCode::CONFLICT,
+                "sequence_token does not match".to_owned(),
+                "IO_ELEMENT_MSC4388_CONCURRENT_WRITE",
+                None,
+                None,
+            ));
+        }
+
+        session.update(data, now);
+
+        Ok((200, session.put_response()))
+    }
+
+    fn handle_delete(&mut self, id: &str) -> PyResult<(u8, ())> {
+        let id: Ulid = id.parse().map_err(|_| NotFoundError::new())?;
+        let _session = self.sessions.remove(&id).ok_or_else(NotFoundError::new)?;
+
+        Ok((200, ()))
+    }
+}
+
+pub fn register_module(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
+    let child_module = PyModule::new(py, "msc4388_rendezvous")?;
+
+    child_module.add_class::<MSC4388RendezvousHandler>()?;
+
+    m.add_submodule(&child_module)?;
+
+    // We need to manually add the module to sys.modules to make `from
+    // synapse.synapse_rust import rendezvous` work.
+    py.import("sys")?
+        .getattr("modules")?
+        .set_item("synapse.synapse_rust.msc4388_rendezvous", child_module)?;
+
+    Ok(())
+}
diff --git a/rust/src/msc4388_rendezvous/session.rs b/rust/src/msc4388_rendezvous/session.rs
new file mode 100644
index 0000000000..467d1b5baf
--- /dev/null
+++ b/rust/src/msc4388_rendezvous/session.rs
@@ -0,0 +1,153 @@
+/*
+ * This file is licensed under the Affero General Public License (AGPL) version 3.
+ *
+ * Copyright (C) 2026 Element Creations Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * See the GNU Affero General Public License for more details:
+ * <https://www.gnu.org/licenses/agpl-3.0.html>.
+ */
+
+use std::time::{Duration, SystemTime};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use pyo3::{Bound, IntoPyObject, PyAny, Python};
+use pythonize::{pythonize, PythonizeError};
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+use ulid::Ulid;
+
+/// A single session, containing data, metadata, and expiry information.
+pub struct Session {
+    id: Ulid,
+    hash: [u8; 32],
+    data: String,
+    last_modified: SystemTime,
+    expires: SystemTime,
+}
+
+#[derive(Serialize)]
+pub struct PostResponse {
+    id: String,
+    sequence_token: String,
+    expires_in_ms: u64,
+}
+
+impl<'source> IntoPyObject<'source> for PostResponse {
+    type Target = PyAny;
+    type Output = Bound<'source, Self::Target>;
+    type Error = PythonizeError;
+
+    fn into_pyobject(self, py: Python<'source>) -> Result<Self::Output, Self::Error> {
+        pythonize(py, &self)
+    }
+}
+
+#[derive(Serialize)]
+pub struct GetResponse {
+    data: String,
+    sequence_token: String,
+    expires_in_ms: u64,
+}
+
+impl<'source> IntoPyObject<'source> for GetResponse {
+    type Target = PyAny;
+    type Output = Bound<'source, Self::Target>;
+    type Error = PythonizeError;
+
+    fn into_pyobject(self, py: Python<'source>) -> Result<Self::Output, Self::Error> {
+        pythonize(py, &self)
+    }
+}
+
+#[derive(Serialize)]
+pub struct PutResponse {
+    sequence_token: String,
+}
+
+impl<'source> IntoPyObject<'source> for PutResponse {
+    type Target = PyAny;
+    type Output = Bound<'source, Self::Target>;
+    type Error = PythonizeError;
+
+    fn into_pyobject(self, py: Python<'source>) -> Result<Self::Output, Self::Error> {
+        pythonize(py, &self)
+    }
+}
+
+impl Session {
+    /// Create a new session with the given data and time-to-live.
+    pub fn new(id: Ulid, data: String, now: SystemTime, ttl: Duration) -> Self {
+        let hash = Self::compute_hash(&data, now);
+        Self {
+            id,
+            hash,
+            data,
+            expires: now + ttl,
+            last_modified: now,
+        }
+    }
+
+    /// Returns true if the session has expired at the given time.
+    pub fn expired(&self, now: SystemTime) -> bool {
+        self.expires <= now
+    }
+
+    /// Update the session with new data and last modified time.
+    pub fn update(&mut self, data: String, now: SystemTime) {
+        self.hash = Self::compute_hash(&data, now);
+        self.data = data;
+        self.last_modified = now;
+    }
+
+    /// Compute the hash of the data and timestamp.
+    fn compute_hash(data: &str, now: SystemTime) -> [u8; 32] {
+        let mut hasher = Sha256::new();
+        hasher.update(data);
+        let now_millis = now
+            .duration_since(SystemTime::UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_millis();
+        hasher.update(now_millis.to_be_bytes());
+        hasher.finalize().into()
+    }
+
+    /// The sequence token for the session.
+    pub fn sequence_token(&self) -> String {
+        URL_SAFE_NO_PAD.encode(self.hash)
+    }
+
+    pub fn get_response(&self, now: SystemTime) -> GetResponse {
+        GetResponse {
+            data: self.data.clone(),
+            sequence_token: self.sequence_token(),
+            expires_in_ms: self
+                .expires
+                .duration_since(now)
+                .unwrap_or_default()
+                .as_millis() as u64,
+        }
+    }
+
+    pub fn post_response(&self, now: SystemTime) -> PostResponse {
+        PostResponse {
+            id: self.id.to_string(),
+            sequence_token: self.sequence_token(),
+            expires_in_ms: self
+                .expires
+                .duration_since(now)
+                .unwrap_or_default()
+                .as_millis() as u64,
+        }
+    }
+
+    pub fn put_response(&self) -> PutResponse {
+        PutResponse {
+            sequence_token: self.sequence_token(),
+        }
+    }
+}
diff --git a/rust/src/push/base_rules.rs b/rust/src/push/base_rules.rs
index ec027ca251..47d5289006 100644
--- a/rust/src/push/base_rules.rs
+++ b/rust/src/push/base_rules.rs
@@ -289,10 +289,10 @@ pub const BASE_APPEND_CONTENT_RULES: &[PushRule] = &[PushRule {
     default_enabled: true,
 }];
 
-pub const BASE_APPEND_UNDERRIDE_RULES: &[PushRule] = &[
+pub const BASE_APPEND_POSTCONTENT_RULES: &[PushRule] = &[
     PushRule {
-        rule_id: Cow::Borrowed("global/content/.io.element.msc4306.rule.unsubscribed_thread"),
-        priority_class: 1,
+        rule_id: Cow::Borrowed("global/postcontent/.io.element.msc4306.rule.unsubscribed_thread"),
+        priority_class: 6,
         conditions: Cow::Borrowed(&[Condition::Known(
             KnownCondition::Msc4306ThreadSubscription { subscribed: false },
         )]),
@@ -301,8 +301,8 @@ pub const BASE_APPEND_UNDERRIDE_RULES: &[PushRule] = &[
         default_enabled: true,
     },
     PushRule {
-        rule_id: Cow::Borrowed("global/content/.io.element.msc4306.rule.subscribed_thread"),
-        priority_class: 1,
+        rule_id: Cow::Borrowed("global/postcontent/.io.element.msc4306.rule.subscribed_thread"),
+        priority_class: 6,
         conditions: Cow::Borrowed(&[Condition::Known(
             KnownCondition::Msc4306ThreadSubscription { subscribed: true },
         )]),
@@ -310,6 +310,9 @@ pub const BASE_APPEND_UNDERRIDE_RULES: &[PushRule] = &[
         default: true,
         default_enabled: true,
     },
+];
+
+pub const BASE_APPEND_UNDERRIDE_RULES: &[PushRule] = &[
     PushRule {
         rule_id: Cow::Borrowed("global/underride/.m.rule.call"),
         priority_class: 1,
@@ -726,6 +729,7 @@ lazy_static! {
             .iter()
             .chain(BASE_APPEND_OVERRIDE_RULES.iter())
             .chain(BASE_APPEND_CONTENT_RULES.iter())
+            .chain(BASE_APPEND_POSTCONTENT_RULES.iter())
             .chain(BASE_APPEND_UNDERRIDE_RULES.iter())
             .map(|rule| { (&*rule.rule_id, rule) })
             .collect();
diff --git a/rust/src/push/mod.rs b/rust/src/push/mod.rs
index b07a12e5cc..ac9b9c93e4 100644
--- a/rust/src/push/mod.rs
+++ b/rust/src/push/mod.rs
@@ -273,14 +273,16 @@ pub enum SimpleJsonValue {
     Null,
 }
 
-impl<'source> FromPyObject<'source> for SimpleJsonValue {
-    fn extract_bound(ob: &Bound<'source, PyAny>) -> PyResult<Self> {
-        if let Ok(s) = ob.downcast::<PyString>() {
+impl<'source> FromPyObject<'_, 'source> for SimpleJsonValue {
+    type Error = PyErr;
+
+    fn extract(ob: Borrowed<'_, 'source, PyAny>) -> Result<Self, Self::Error> {
+        if let Ok(s) = ob.cast::<PyString>() {
             Ok(SimpleJsonValue::Str(Cow::Owned(s.to_string())))
         // A bool *is* an int, ensure we try bool first.
-        } else if let Ok(b) = ob.downcast::<PyBool>() {
+        } else if let Ok(b) = ob.cast::<PyBool>() {
             Ok(SimpleJsonValue::Bool(b.extract()?))
-        } else if let Ok(i) = ob.downcast::<PyInt>() {
+        } else if let Ok(i) = ob.cast::<PyInt>() {
             Ok(SimpleJsonValue::Int(i.extract()?))
         } else if ob.is_none() {
             Ok(SimpleJsonValue::Null)
@@ -301,12 +303,14 @@ pub enum JsonValue {
     Value(SimpleJsonValue),
 }
 
-impl<'source> FromPyObject<'source> for JsonValue {
-    fn extract_bound(ob: &Bound<'source, PyAny>) -> PyResult<Self> {
-        if let Ok(l) = ob.downcast::<PyList>() {
+impl<'source> FromPyObject<'_, 'source> for JsonValue {
+    type Error = PyErr;
+
+    fn extract(ob: Borrowed<'_, 'source, PyAny>) -> Result<Self, Self::Error> {
+        if let Ok(l) = ob.cast::<PyList>() {
             match l
                 .iter()
-                .map(|it| SimpleJsonValue::extract_bound(&it))
+                .map(|it| SimpleJsonValue::extract(it.as_borrowed()))
                 .collect()
             {
                 Ok(a) => Ok(JsonValue::Array(a)),
@@ -314,7 +318,7 @@ impl<'source> FromPyObject<'source> for JsonValue {
                     "Can't convert to JsonValue::Array: {e}"
                 ))),
             }
-        } else if let Ok(v) = SimpleJsonValue::extract_bound(ob) {
+        } else if let Ok(v) = SimpleJsonValue::extract(ob) {
             Ok(JsonValue::Value(v))
         } else {
             Err(PyTypeError::new_err(format!(
@@ -385,9 +389,11 @@ impl<'source> IntoPyObject<'source> for Condition {
     }
 }
 
-impl<'source> FromPyObject<'source> for Condition {
-    fn extract_bound(ob: &Bound<'source, PyAny>) -> PyResult<Self> {
-        Ok(depythonize(ob)?)
+impl<'source> FromPyObject<'_, 'source> for Condition {
+    type Error = PyErr;
+
+    fn extract(ob: Borrowed<'_, 'source, PyAny>) -> Result<Self, Self::Error> {
+        Ok(depythonize(&ob)?)
     }
 }
 
@@ -527,6 +533,7 @@ impl PushRules {
             .chain(base_rules::BASE_APPEND_OVERRIDE_RULES.iter())
             .chain(self.content.iter())
             .chain(base_rules::BASE_APPEND_CONTENT_RULES.iter())
+            .chain(base_rules::BASE_APPEND_POSTCONTENT_RULES.iter())
             .chain(self.room.iter())
             .chain(self.sender.iter())
             .chain(self.underride.iter())
diff --git a/rust/src/rendezvous/mod.rs b/rust/src/rendezvous/mod.rs
index 3148e0f67a..9a6da9fcc3 100644
--- a/rust/src/rendezvous/mod.rs
+++ b/rust/src/rendezvous/mod.rs
@@ -29,12 +29,13 @@ use pyo3::{
     exceptions::PyValueError,
     pyclass, pymethods,
     types::{PyAnyMethods, PyModule, PyModuleMethods},
-    Bound, IntoPyObject, Py, PyAny, PyObject, PyResult, Python,
+    Bound, IntoPyObject, Py, PyAny, PyResult, Python,
 };
 use ulid::Ulid;
 
 use self::session::Session;
 use crate::{
+    duration::SynapseDuration,
     errors::{NotFoundError, SynapseError},
     http::{http_request_from_twisted, http_response_to_twisted, HeaderMapPyExt},
     UnwrapInfallible,
@@ -56,7 +57,7 @@ fn prepare_headers(headers: &mut HeaderMap, session: &Session) {
 #[pyclass]
 struct RendezvousHandler {
     base: Uri,
-    clock: PyObject,
+    clock: Py<PyAny>,
     sessions: BTreeMap<Ulid, Session>,
     capacity: usize,
     max_content_length: u64,
@@ -132,6 +133,8 @@ impl RendezvousHandler {
             .unwrap_infallible()
             .unbind();
 
+        let eviction_duration = SynapseDuration::from_milliseconds(eviction_interval);
+
         // Construct a Python object so that we can get a reference to the
         // evict method and schedule it to run.
         let self_ = Py::new(
@@ -149,7 +152,7 @@ impl RendezvousHandler {
         let evict = self_.getattr(py, "_evict")?;
         homeserver.call_method0("get_clock")?.call_method(
             "looping_call",
-            (evict, eviction_interval),
+            (evict, &eviction_duration),
             None,
         )?;
 
diff --git a/rust/src/room_versions.rs b/rust/src/room_versions.rs
new file mode 100644
index 0000000000..fbcc32516a
--- /dev/null
+++ b/rust/src/room_versions.rs
@@ -0,0 +1,835 @@
+/*
+ * This file is licensed under the Affero General Public License (AGPL) version 3.
+ *
+ * Copyright (C) 2026 Element Creations Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * See the GNU Affero General Public License for more details:
+ * <https://www.gnu.org/licenses/agpl-3.0.html>.
+ */
+
+//! Rust implementation of room version definitions.
+
+use std::sync::{Arc, LazyLock, RwLock};
+
+use pyo3::{
+    exceptions::{PyKeyError, PyRuntimeError},
+    prelude::*,
+    types::{PyFrozenSet, PyIterator, PyModule, PyModuleMethods},
+    Bound, IntoPyObjectExt, PyResult, Python,
+};
+
+/// Internal enum for tracking the version of the event format,
+/// independently of the room version.
+///
+/// To reduce confusion, the event format versions are named after the room
+/// versions that they were used or introduced in.
+/// The concept of an 'event format version' is specific to Synapse (the
+/// specification does not mention this term.)
+#[pyclass(frozen)]
+pub struct EventFormatVersions {}
+
+#[pymethods]
+impl EventFormatVersions {
+    /// $id:server event id format: used for room v1 and v2
+    #[classattr]
+    const ROOM_V1_V2: i32 = 1;
+    /// MSC1659-style $hash event id format: used for room v3
+    #[classattr]
+    const ROOM_V3: i32 = 2;
+    /// MSC1884-style $hash format: introduced for room v4
+    #[classattr]
+    const ROOM_V4_PLUS: i32 = 3;
+    /// MSC4291 room IDs as hashes: introduced for room HydraV11
+    #[classattr]
+    const ROOM_V11_HYDRA_PLUS: i32 = 4;
+}
+
+/// Enum to identify the state resolution algorithms.
+#[pyclass(frozen)]
+pub struct StateResolutionVersions {}
+
+#[pymethods]
+impl StateResolutionVersions {
+    /// Room v1 state res
+    #[classattr]
+    const V1: i32 = 1;
+    /// MSC1442 state res: room v2 and later
+    #[classattr]
+    const V2: i32 = 2;
+    /// MSC4297 state res
+    #[classattr]
+    const V2_1: i32 = 3;
+}
+
+/// Room disposition constants.
+#[pyclass(frozen)]
+pub struct RoomDisposition {}
+
+#[pymethods]
+impl RoomDisposition {
+    #[classattr]
+    const STABLE: &'static str = "stable";
+    #[classattr]
+    const UNSTABLE: &'static str = "unstable";
+}
+
+/// Enum for listing possible MSC3931 room version feature flags, for push rules.
+#[pyclass(frozen)]
+pub struct PushRuleRoomFlag {}
+
+#[pymethods]
+impl PushRuleRoomFlag {
+    /// MSC3932: Room version supports MSC1767 Extensible Events.
+    #[classattr]
+    const EXTENSIBLE_EVENTS: &'static str = "org.matrix.msc3932.extensible_events";
+}
+
+/// An object which describes the unique attributes of a room version.
+#[pyclass(frozen, eq, hash, get_all)]
+#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct RoomVersion {
+    /// The identifier for this version.
+    pub identifier: &'static str,
+    /// One of the RoomDisposition constants.
+    pub disposition: &'static str,
+    /// One of the EventFormatVersions constants.
+    pub event_format: i32,
+    /// One of the StateResolutionVersions constants.
+    pub state_res: i32,
+    pub enforce_key_validity: bool,
+    /// Before MSC2432, m.room.aliases had special auth rules and redaction rules.
+    pub special_case_aliases_auth: bool,
+    /// Strictly enforce canonicaljson, do not allow:
+    /// * Integers outside the range of [-2^53 + 1, 2^53 - 1]
+    /// * Floats
+    /// * NaN, Infinity, -Infinity
+    pub strict_canonicaljson: bool,
+    /// MSC2209: Check 'notifications' key while verifying
+    /// m.room.power_levels auth rules.
+    pub limit_notifications_power_levels: bool,
+    /// MSC3820: No longer include the creator in m.room.create events (room version 11).
+    pub implicit_room_creator: bool,
+    /// MSC3820: Apply updated redaction rules algorithm from room version 11.
+    pub updated_redaction_rules: bool,
+    /// Support the 'restricted' join rule.
+    pub restricted_join_rule: bool,
+    /// Support for the proper redaction rules for the restricted join rule.
+    /// This requires restricted_join_rule to be enabled.
+    pub restricted_join_rule_fix: bool,
+    /// Support the 'knock' join rule.
+    pub knock_join_rule: bool,
+    /// MSC3389: Protect relation information from redaction.
+    pub msc3389_relation_redactions: bool,
+    /// Support the 'knock_restricted' join rule.
+    pub knock_restricted_join_rule: bool,
+    /// Enforce integer power levels.
+    pub enforce_int_power_levels: bool,
+    /// MSC3931: Adds a push rule condition for "room version feature flags", making
+    /// some push rules room version dependent. Note that adding a flag to this list
+    /// is not enough to mark it "supported": the push rule evaluator also needs to
+    /// support the flag. Unknown flags are ignored by the evaluator, making conditions
+    /// fail if used. Values from PushRuleRoomFlag.
+    pub msc3931_push_features: &'static [&'static str],
+    /// MSC3757: Restricting who can overwrite a state event.
+    pub msc3757_enabled: bool,
+    /// MSC4289: Creator power enabled.
+    pub msc4289_creator_power_enabled: bool,
+    /// MSC4291: Room IDs as hashes of the create event.
+    pub msc4291_room_ids_as_hashes: bool,
+    /// Set of room versions where Synapse strictly enforces event key size limits
+    /// in bytes, rather than in codepoints.
+    ///
+    /// In these room versions, we are stricter with event size validation.
+    pub strict_event_byte_limits_room_versions: bool,
+}
+
+const ROOM_VERSION_V1: RoomVersion = RoomVersion {
+    identifier: "1",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V1_V2,
+    state_res: StateResolutionVersions::V1,
+    enforce_key_validity: false,
+    special_case_aliases_auth: true,
+    strict_canonicaljson: false,
+    limit_notifications_power_levels: false,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: false,
+    restricted_join_rule_fix: false,
+    knock_join_rule: false,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V2: RoomVersion = RoomVersion {
+    identifier: "2",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V1_V2,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: false,
+    special_case_aliases_auth: true,
+    strict_canonicaljson: false,
+    limit_notifications_power_levels: false,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: false,
+    restricted_join_rule_fix: false,
+    knock_join_rule: false,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V3: RoomVersion = RoomVersion {
+    identifier: "3",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V3,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: false,
+    special_case_aliases_auth: true,
+    strict_canonicaljson: false,
+    limit_notifications_power_levels: false,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: false,
+    restricted_join_rule_fix: false,
+    knock_join_rule: false,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V4: RoomVersion = RoomVersion {
+    identifier: "4",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: false,
+    special_case_aliases_auth: true,
+    strict_canonicaljson: false,
+    limit_notifications_power_levels: false,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: false,
+    restricted_join_rule_fix: false,
+    knock_join_rule: false,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V5: RoomVersion = RoomVersion {
+    identifier: "5",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: true,
+    strict_canonicaljson: false,
+    limit_notifications_power_levels: false,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: false,
+    restricted_join_rule_fix: false,
+    knock_join_rule: false,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V6: RoomVersion = RoomVersion {
+    identifier: "6",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: false,
+    restricted_join_rule_fix: false,
+    knock_join_rule: false,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V7: RoomVersion = RoomVersion {
+    identifier: "7",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: false,
+    restricted_join_rule_fix: false,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V8: RoomVersion = RoomVersion {
+    identifier: "8",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: true,
+    restricted_join_rule_fix: false,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V9: RoomVersion = RoomVersion {
+    identifier: "9",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: false,
+    enforce_int_power_levels: false,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V10: RoomVersion = RoomVersion {
+    identifier: "10",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+/// MSC3389 (Redaction changes for events with a relation) based on room version "10".
+const ROOM_VERSION_MSC3389V10: RoomVersion = RoomVersion {
+    identifier: "org.matrix.msc3389.10",
+    disposition: RoomDisposition::UNSTABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: true, // Changed from v10
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: true,
+};
+
+/// MSC1767 (Extensible Events) based on room version "10".
+const ROOM_VERSION_MSC1767V10: RoomVersion = RoomVersion {
+    identifier: "org.matrix.msc1767.10",
+    disposition: RoomDisposition::UNSTABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[PushRuleRoomFlag::EXTENSIBLE_EVENTS],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+/// MSC3757 (Restricting who can overwrite a state event) based on room version "10".
+const ROOM_VERSION_MSC3757V10: RoomVersion = RoomVersion {
+    identifier: "org.matrix.msc3757.10",
+    disposition: RoomDisposition::UNSTABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: false,
+    updated_redaction_rules: false,
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[],
+    msc3757_enabled: true,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: false,
+};
+
+const ROOM_VERSION_V11: RoomVersion = RoomVersion {
+    identifier: "11",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: true,   // Used by MSC3820
+    updated_redaction_rules: true, // Used by MSC3820
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: true, // Changed from v10
+};
+
+/// MSC3757 (Restricting who can overwrite a state event) based on room version "11".
+const ROOM_VERSION_MSC3757V11: RoomVersion = RoomVersion {
+    identifier: "org.matrix.msc3757.11",
+    disposition: RoomDisposition::UNSTABLE,
+    event_format: EventFormatVersions::ROOM_V4_PLUS,
+    state_res: StateResolutionVersions::V2,
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: true,   // Used by MSC3820
+    updated_redaction_rules: true, // Used by MSC3820
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[],
+    msc3757_enabled: true,
+    msc4289_creator_power_enabled: false,
+    msc4291_room_ids_as_hashes: false,
+    strict_event_byte_limits_room_versions: true,
+};
+
+const ROOM_VERSION_HYDRA_V11: RoomVersion = RoomVersion {
+    identifier: "org.matrix.hydra.11",
+    disposition: RoomDisposition::UNSTABLE,
+    event_format: EventFormatVersions::ROOM_V11_HYDRA_PLUS,
+    state_res: StateResolutionVersions::V2_1, // Changed from v11
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: true,   // Used by MSC3820
+    updated_redaction_rules: true, // Used by MSC3820
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: true, // Changed from v11
+    msc4291_room_ids_as_hashes: true,    // Changed from v11
+    strict_event_byte_limits_room_versions: true,
+};
+
+const ROOM_VERSION_V12: RoomVersion = RoomVersion {
+    identifier: "12",
+    disposition: RoomDisposition::STABLE,
+    event_format: EventFormatVersions::ROOM_V11_HYDRA_PLUS,
+    state_res: StateResolutionVersions::V2_1, // Changed from v11
+    enforce_key_validity: true,
+    special_case_aliases_auth: false,
+    strict_canonicaljson: true,
+    limit_notifications_power_levels: true,
+    implicit_room_creator: true,   // Used by MSC3820
+    updated_redaction_rules: true, // Used by MSC3820
+    restricted_join_rule: true,
+    restricted_join_rule_fix: true,
+    knock_join_rule: true,
+    msc3389_relation_redactions: false,
+    knock_restricted_join_rule: true,
+    enforce_int_power_levels: true,
+    msc3931_push_features: &[],
+    msc3757_enabled: false,
+    msc4289_creator_power_enabled: true, // Changed from v11
+    msc4291_room_ids_as_hashes: true,    // Changed from v11
+    strict_event_byte_limits_room_versions: true,
+};
+
+/// Helper class for managing the known room versions, and providing dict-like
+/// access to them for Python.
+///
+/// Note: this is not necessarily all room versions, as we may not want to
+/// support all experimental room versions.
+///
+/// Note: room versions can be added to this mapping at startup (allowing
+/// support for experimental room versions to be behind experimental feature
+/// flags).
+#[pyclass(frozen, mapping)]
+#[derive(Clone)]
+pub struct KnownRoomVersionsMapping {
+    // Note we use a Vec here to ensure that the order of keys is
+    // deterministic. We rely on this when generating parameterized tests in
+    // Python, as Python will generate the tests names including the room
+    // version and index (and we need test names to be stable to e.g. support
+    // running tests in parallel).
+    pub versions: Arc<RwLock<Vec<RoomVersion>>>,
+}
+
+#[pymethods]
+impl KnownRoomVersionsMapping {
+    /// Add a new room version to the mapping, indicating that this instance
+    /// supports it.
+    fn add_room_version(&self, version: RoomVersion) -> PyResult<()> {
+        let mut versions = self
+            .versions
+            .write()
+            .map_err(|_| PyRuntimeError::new_err("KnownRoomVersionsMapping lock poisoned"))?;
+
+        if versions.iter().any(|v| v.identifier == version.identifier) {
+            // We already have this room version, so we don't add it again (as
+            // otherwise we'd end up with duplicates).
+            return Ok(());
+        }
+
+        versions.push(version);
+        Ok(())
+    }
+
+    fn __getitem__(&self, key: &Bound<'_, PyAny>) -> PyResult<RoomVersion> {
+        // We need to accept anything as the key, but we know that only strings
+        // are valid keys, so if it's not a string we just raise a KeyError.
+        let Ok(key) = key.extract::<&str>() else {
+            return Err(PyKeyError::new_err(key.to_string()));
+        };
+        let versions = self.versions.read().unwrap();
+        versions
+            .iter()
+            .find(|v| v.identifier == key)
+            .copied()
+            .ok_or_else(|| PyKeyError::new_err(key.to_string()))
+    }
+
+    fn __contains__(&self, key: &Bound<'_, PyAny>) -> bool {
+        // We need to accept anything as the key, but we know that only strings
+        // are valid keys, so if it's not a string we just return false.
+        let Ok(key) = key.extract::<&str>() else {
+            return false;
+        };
+        let versions = self.versions.read().unwrap();
+        versions.iter().any(|v| v.identifier == key)
+    }
+
+    fn keys(&self) -> PyResult<Vec<&'static str>> {
+        // Note that technically we should return a view here (that also acts
+        // like a Set *and* has a stable ordering). We don't depend on this, so
+        // for simplicity we just return a list of the keys.
+        let versions = self.versions.read().unwrap();
+        Ok(versions.iter().map(|v| v.identifier).collect())
+    }
+
+    fn values(&self) -> PyResult<Vec<RoomVersion>> {
+        let versions = self.versions.read().unwrap();
+        Ok(versions.clone())
+    }
+
+    fn items(&self) -> PyResult<Vec<(&'static str, RoomVersion)>> {
+        // Note that technically we should return a view here (that also acts
+        // like a Set *and* has a stable ordering). We don't depend on this, so
+        // for simplicity we just return a list of the items.
+        let versions = self.versions.read().unwrap();
+        Ok(versions.iter().map(|v| (v.identifier, *v)).collect())
+    }
+
+    #[pyo3(signature = (key, default=None))]
+    fn get<'py>(
+        &self,
+        py: Python<'py>,
+        key: Bound<'py, PyAny>,
+        default: Option<Bound<'py, PyAny>>,
+    ) -> PyResult<Option<Bound<'py, PyAny>>> {
+        // We need to accept anything as the key, but we know that only strings
+        // are valid keys, so if it's not a string we just return the default.
+        let Ok(key) = key.extract::<&str>() else {
+            return Ok(default);
+        };
+
+        let versions = self.versions.read().unwrap();
+        if let Some(version) = versions.iter().find(|v| v.identifier == key).copied() {
+            return Ok(Some(version.into_bound_py_any(py)?));
+        }
+
+        Ok(default)
+    }
+
+    fn __len__(&self) -> PyResult<usize> {
+        let versions = self
+            .versions
+            .read()
+            .map_err(|_| PyRuntimeError::new_err("KnownRoomVersionsMapping lock poisoned"))?;
+        Ok(versions.len())
+    }
+
+    fn __iter__<'py>(&self, py: Python<'py>) -> PyResult<Bound<'py, PyIterator>> {
+        let key_list = self.keys()?;
+
+        let bound_key_list = key_list.into_bound_py_any(py)?;
+        PyIterator::from_object(&bound_key_list)
+    }
+}
+
+impl<'py> IntoPyObject<'py> for &KnownRoomVersionsMapping {
+    type Target = KnownRoomVersionsMapping;
+
+    type Output = Bound<'py, Self::Target>;
+
+    type Error = PyErr;
+
+    fn into_pyobject(self, py: Python<'py>) -> Result<Self::Output, Self::Error> {
+        self.clone().into_pyobject(py)
+    }
+}
+
+/// All room versions this instance knows about, used to build the
+/// `KNOWN_ROOM_VERSIONS` dict.
+///
+/// Note: this is not necessarily all room versions, as we may not want to
+/// support all experimental room versions.
+static KNOWN_ROOM_VERSIONS: LazyLock<KnownRoomVersionsMapping> = LazyLock::new(|| {
+    let vec = vec![
+        ROOM_VERSION_V1,
+        ROOM_VERSION_V2,
+        ROOM_VERSION_V3,
+        ROOM_VERSION_V4,
+        ROOM_VERSION_V5,
+        ROOM_VERSION_V6,
+        ROOM_VERSION_V7,
+        ROOM_VERSION_V8,
+        ROOM_VERSION_V9,
+        ROOM_VERSION_V10,
+        ROOM_VERSION_V11,
+        ROOM_VERSION_V12,
+        ROOM_VERSION_MSC3757V10,
+        ROOM_VERSION_MSC3757V11,
+        ROOM_VERSION_HYDRA_V11,
+    ];
+
+    KnownRoomVersionsMapping {
+        versions: Arc::new(RwLock::new(vec)),
+    }
+});
+
+/// Container class for room version constants.
+///
+/// This should contain all room versions that we know about.
+#[pyclass(frozen)]
+pub struct RoomVersions {}
+
+#[pymethods]
+#[allow(non_snake_case)]
+impl RoomVersions {
+    #[classattr]
+    fn V1(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V1.into_py_any(py)
+    }
+    #[classattr]
+    fn V2(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V2.into_py_any(py)
+    }
+    #[classattr]
+    fn V3(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V3.into_py_any(py)
+    }
+    #[classattr]
+    fn V4(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V4.into_py_any(py)
+    }
+    #[classattr]
+    fn V5(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V5.into_py_any(py)
+    }
+    #[classattr]
+    fn V6(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V6.into_py_any(py)
+    }
+    #[classattr]
+    fn V7(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V7.into_py_any(py)
+    }
+    #[classattr]
+    fn V8(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V8.into_py_any(py)
+    }
+    #[classattr]
+    fn V9(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V9.into_py_any(py)
+    }
+    #[classattr]
+    fn V10(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V10.into_py_any(py)
+    }
+    #[classattr]
+    fn MSC1767v10(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_MSC1767V10.into_py_any(py)
+    }
+    #[classattr]
+    fn MSC3389v10(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_MSC3389V10.into_py_any(py)
+    }
+    #[classattr]
+    fn MSC3757v10(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_MSC3757V10.into_py_any(py)
+    }
+    #[classattr]
+    fn V11(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V11.into_py_any(py)
+    }
+    #[classattr]
+    fn MSC3757v11(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_MSC3757V11.into_py_any(py)
+    }
+    #[classattr]
+    fn HydraV11(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_HYDRA_V11.into_py_any(py)
+    }
+    #[classattr]
+    fn V12(py: Python<'_>) -> PyResult<Py<PyAny>> {
+        ROOM_VERSION_V12.into_py_any(py)
+    }
+}
+
+/// Called when registering modules with python.
+pub fn register_module(py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
+    let child_module = PyModule::new(py, "room_versions")?;
+    child_module.add_class::<EventFormatVersions>()?;
+    child_module.add_class::<StateResolutionVersions>()?;
+    child_module.add_class::<PushRuleRoomFlag>()?;
+    child_module.add_class::<RoomVersion>()?;
+    child_module.add_class::<RoomVersions>()?;
+    child_module.add_class::<KnownRoomVersionsMapping>()?;
+    child_module.add_class::<RoomDisposition>()?;
+
+    // Build KNOWN_EVENT_FORMAT_VERSIONS as a frozenset
+    let known_ef: [i32; 4] = [
+        EventFormatVersions::ROOM_V1_V2,
+        EventFormatVersions::ROOM_V3,
+        EventFormatVersions::ROOM_V4_PLUS,
+        EventFormatVersions::ROOM_V11_HYDRA_PLUS,
+    ];
+    let known_event_format_versions = PyFrozenSet::new(py, known_ef)?;
+    child_module.add("KNOWN_EVENT_FORMAT_VERSIONS", known_event_format_versions)?;
+    child_module.add("KNOWN_ROOM_VERSIONS", &*KNOWN_ROOM_VERSIONS)?;
+
+    m.add_submodule(&child_module)?;
+
+    // Register in sys.modules
+    py.import("sys")?
+        .getattr("modules")?
+        .set_item("synapse.synapse_rust.room_versions", child_module)?;
+
+    Ok(())
+}
diff --git a/schema/synapse-config.schema.yaml b/schema/synapse-config.schema.yaml
index 83e16de397..6acc5c3762 100644
--- a/schema/synapse-config.schema.yaml
+++ b/schema/synapse-config.schema.yaml
@@ -1,5 +1,5 @@
 $schema: https://element-hq.github.io/synapse/latest/schema/v1/meta.schema.json
-$id: https://element-hq.github.io/synapse/schema/synapse/v1.138/synapse-config.schema.json
+$id: https://element-hq.github.io/synapse/schema/synapse/v1.151/synapse-config.schema.json
 type: object
 properties:
   modules:
@@ -677,6 +677,13 @@ properties:
           and `oauth` resources mounted.
         default: http://localhost:8080
 
+      force_http2:
+        type: boolean
+        description: >-
+          Force HTTP/2 over plaintext (H2C) when connecting to MAS. MAS supports
+          this natively, but a reverse proxy between Synapse and MAS may not.
+        default: false
+
       secret:
         type: ["string", "null"]
         description: >-
@@ -1113,8 +1120,11 @@ properties:
       When this option is enabled, the room "complexity" will be checked before
       a user joins a new remote room. If it is above the complexity limit, the
       server will disallow joining, or will instantly leave. This is useful for
-      homeservers that are resource-constrained. Room complexity is an arbitrary
-      measure based on factors such as the number of users in the room.
+      homeservers that are resource-constrained. In Synapse, the complexity of a
+      room is measured by the number of current state events in a room, divided
+      by 500. "Current" here means the latest state, i.e. if a user joins, then
+      leaves, then joins, that will count as 1 current `m.room.member` state
+      event.
     properties:
       enabled:
         type: boolean
@@ -2259,9 +2269,8 @@ properties:
       Setting this to a high value allows users to report content quickly, possibly in
       duplicate. This can result in higher database usage.
     default:
-      per_user:
-        per_second: 1.0
-        burst_count: 5.0
+      per_second: 1.0
+      burst_count: 5.0
     examples:
       - per_second: 2.0
         burst_count: 20.0
@@ -2270,12 +2279,21 @@ properties:
     description: >-
       Sets rate limits for how often users are able to create rooms.
     default:
-      per_user:
-        per_second: 0.016
-        burst_count: 10.0
+      per_second: 0.016
+      burst_count: 10.0
     examples:
       - per_second: 1.0
         burst_count: 5.0
+  rc_user_directory:
+    $ref: "#/$defs/rc"
+    description: >-
+      This option allows admins to ratelimit searches in the user directory.
+
+
+      _Added in Synapse 1.145.0._
+    default:
+      per_second: 0.016
+      burst_count: 200.0
   federation_rr_transactions_per_room_per_second:
     type: integer
     description: >-
@@ -2340,6 +2358,19 @@ properties:
     default: true
     examples:
       - false
+  enable_local_media_storage:
+    type: boolean
+    description: >-
+      Enable the local on-disk media storage provider. When disabled, media is
+      stored only in configured `media_storage_providers` and temporary files are
+      used for processing.
+      
+      **Warning:** If this option is set to `false` and no `media_storage_providers`
+      are configured, all media requests will return 404 errors as there will be
+      no storage backend available.
+    default: true
+    examples:
+      - false
   media_store_path:
     type: string
     description: Directory where uploaded images and attachments are stored.
@@ -2415,8 +2446,15 @@ properties:
       A list of media upload limits defining how much data a given user can
       upload in a given time period.
 
+      These limits are applied in addition to the `max_upload_size` limit above
+      (which applies to individual uploads).
+
 
       An empty list means no limits are applied.
+
+
+      These settings can be overridden using the `get_media_upload_limits_for_user`
+      module API [callback](../../modules/media_repository_callbacks.md#get_media_upload_limits_for_user).
     default: []
     items:
       time_period:
@@ -2879,6 +2917,35 @@ properties:
     default: true
     examples:
       - false
+  matrix_rtc:
+    type: object 
+    description: >-
+      Options related to MatrixRTC.
+    properties:
+      transports:
+        type: array
+        items:
+          type: object
+          required:
+            - type
+          properties:
+            type:
+              type: string
+              description: The type of transport to use to connect to the selective forwarding unit (SFU).
+              example: livekit
+            livekit_service_url:
+              type: string
+              description: >-
+                The base URL of the LiveKit service. Should only be used with LiveKit-based transports.
+              example: https://matrix-rtc.example.com/livekit/jwt
+        description:
+          A list of transport types and arguments to use for MatrixRTC connections.
+        default: []
+    default: {}
+    examples:
+      - transports:
+        - type: livekit
+          livekit_service_url: https://matrix-rtc.example.com/livekit/jwt
   enable_registration:
     type: boolean
     description: >-
@@ -4661,8 +4728,9 @@ properties:
       pepper:
         type: ["string", "null"]
         description: >-
-          Set the value here to a secret random string for extra security. DO
-          NOT CHANGE THIS AFTER INITIAL SETUP!
+          A secret random string that will be appended to user's passwords
+          before they are hashed. This improves the security of short passwords.
+          DO NOT CHANGE THIS AFTER INITIAL SETUP!
         default: null
       policy:
         type: object
@@ -5468,11 +5536,13 @@ properties:
   outbound_federation_restricted_to:
     type: array
     description: >-
-      When using workers, you can restrict outbound federation traffic to only
-      go through a specific subset of workers. Any worker specified here must
-      also be in the [`instance_map`](#instance_map).
-      [`worker_replication_secret`](#worker_replication_secret) must also be
-      configured to authorize inter-worker communication.
+      You can restrict outbound federation traffic to only go through a specific subset
+      of workers including the [Secure Border Gateway
+      (SBG)](https://element.io/en/server-suite/secure-border-gateways). Any worker
+      specified here (including the SBG) must also be in the
+      [`instance_map`](#instance_map).
+      [`worker_replication_secret`](#worker_replication_secret) must also be configured
+      to authorize inter-worker communication.
 
 
       Also see the [worker
diff --git a/scripts-dev/build_debian_packages.py b/scripts-dev/build_debian_packages.py
index 6ee695b2ba..cdde81ee2c 100755
--- a/scripts-dev/build_debian_packages.py
+++ b/scripts-dev/build_debian_packages.py
@@ -18,21 +18,20 @@ import sys
 import threading
 from concurrent.futures import ThreadPoolExecutor
 from types import FrameType
-from typing import Collection, Optional, Sequence, Set
+from typing import Collection, Sequence
 
 # These are expanded inside the dockerfile to be a fully qualified image name.
-# e.g. docker.io/library/debian:bullseye
+# e.g. docker.io/library/debian:bookworm
 #
 # If an EOL is forced by a Python version and we're dropping support for it, make sure
-# to remove references to the distibution across Synapse (search for "bullseye" for
+# to remove references to the distibution across Synapse (search for "bookworm" for
 # example)
 DISTS = (
-    "debian:bullseye",  # (EOL ~2024-07) (our EOL forced by Python 3.9 is 2025-10-05)
     "debian:bookworm",  # (EOL 2026-06) (our EOL forced by Python 3.11 is 2027-10-24)
     "debian:sid",  # (rolling distro, no EOL)
     "ubuntu:jammy",  # 22.04 LTS (EOL 2027-04) (our EOL forced by Python 3.10 is 2026-10-04)
     "ubuntu:noble",  # 24.04 LTS (EOL 2029-06)
-    "ubuntu:oracular",  # 24.10 (EOL 2025-07)
+    "ubuntu:questing",  # 25.10 (EOL 2026-07)
     "debian:trixie",  # (EOL not specified yet)
 )
 
@@ -50,11 +49,11 @@ class Builder:
     def __init__(
         self,
         redirect_stdout: bool = False,
-        docker_build_args: Optional[Sequence[str]] = None,
+        docker_build_args: Sequence[str] | None = None,
     ):
         self.redirect_stdout = redirect_stdout
         self._docker_build_args = tuple(docker_build_args or ())
-        self.active_containers: Set[str] = set()
+        self.active_containers: set[str] = set()
         self._lock = threading.Lock()
         self._failed = False
 
@@ -95,6 +94,7 @@ class Builder:
         build_args = (
             (
                 "docker",
+                "buildx",
                 "build",
                 "--tag",
                 "dh-venv-builder:" + tag,
@@ -168,7 +168,7 @@ class Builder:
 def run_builds(
     builder: Builder, dists: Collection[str], jobs: int = 1, skip_tests: bool = False
 ) -> None:
-    def sig(signum: int, _frame: Optional[FrameType]) -> None:
+    def sig(signum: int, _frame: FrameType | None) -> None:
         print("Caught SIGINT")
         builder.kill_containers()
 
diff --git a/scripts-dev/check_locked_deps_have_sdists.py b/scripts-dev/check_locked_deps_have_sdists.py
index cabe3b8de1..f035ecb644 100755
--- a/scripts-dev/check_locked_deps_have_sdists.py
+++ b/scripts-dev/check_locked_deps_have_sdists.py
@@ -21,7 +21,6 @@
 #
 import sys
 from pathlib import Path
-from typing import Dict, List
 
 import tomli
 
@@ -33,7 +32,7 @@ def main() -> None:
 
     # Poetry 1.3+ lockfile format:
     # There's a `files` inline table in each [[package]]
-    packages_to_assets: Dict[str, List[Dict[str, str]]] = {
+    packages_to_assets: dict[str, list[dict[str, str]]] = {
         package["name"]: package["files"] for package in lockfile_content["package"]
     }
 
diff --git a/scripts-dev/check_pydantic_models.py b/scripts-dev/check_pydantic_models.py
deleted file mode 100755
index 26a473a61b..0000000000
--- a/scripts-dev/check_pydantic_models.py
+++ /dev/null
@@ -1,478 +0,0 @@
-#! /usr/bin/env python
-#
-# This file is licensed under the Affero General Public License (AGPL) version 3.
-#
-# Copyright 2022 The Matrix.org Foundation C.I.C.
-# Copyright (C) 2023 New Vector, Ltd
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# See the GNU Affero General Public License for more details:
-# <https://www.gnu.org/licenses/agpl-3.0.html>.
-#
-# Originally licensed under the Apache License, Version 2.0:
-# <http://www.apache.org/licenses/LICENSE-2.0>.
-#
-# [This file includes modifications made by New Vector Limited]
-#
-#
-"""
-A script which enforces that Synapse always uses strict types when defining a Pydantic
-model.
-
-Pydantic does not yet offer a strict mode, but it is planned for pydantic v2. See
-
-    https://github.com/pydantic/pydantic/issues/1098
-    https://pydantic-docs.helpmanual.io/blog/pydantic-v2/#strict-mode
-
-until then, this script is a best effort to stop us from introducing type coersion bugs
-(like the infamous stringy power levels fixed in room version 10).
-"""
-
-import argparse
-import contextlib
-import functools
-import importlib
-import logging
-import os
-import pkgutil
-import sys
-import textwrap
-import traceback
-import unittest.mock
-from contextlib import contextmanager
-from typing import (
-    Any,
-    Callable,
-    Dict,
-    Generator,
-    List,
-    Set,
-    Type,
-    TypeVar,
-)
-
-from parameterized import parameterized
-from typing_extensions import ParamSpec
-
-from synapse._pydantic_compat import (
-    BaseModel as PydanticBaseModel,
-    conbytes,
-    confloat,
-    conint,
-    constr,
-    get_args,
-)
-
-logger = logging.getLogger(__name__)
-
-CONSTRAINED_TYPE_FACTORIES_WITH_STRICT_FLAG: List[Callable] = [
-    constr,
-    conbytes,
-    conint,
-    confloat,
-]
-
-TYPES_THAT_PYDANTIC_WILL_COERCE_TO = [
-    str,
-    bytes,
-    int,
-    float,
-    bool,
-]
-
-
-P = ParamSpec("P")
-R = TypeVar("R")
-
-
-class ModelCheckerException(Exception):
-    """Dummy exception. Allows us to detect unwanted types during a module import."""
-
-
-class MissingStrictInConstrainedTypeException(ModelCheckerException):
-    factory_name: str
-
-    def __init__(self, factory_name: str):
-        self.factory_name = factory_name
-
-
-class FieldHasUnwantedTypeException(ModelCheckerException):
-    message: str
-
-    def __init__(self, message: str):
-        self.message = message
-
-
-def make_wrapper(factory: Callable[P, R]) -> Callable[P, R]:
-    """We patch `constr` and friends with wrappers that enforce strict=True."""
-
-    @functools.wraps(factory)
-    def wrapper(*args: P.args, **kwargs: P.kwargs) -> R:
-        if "strict" not in kwargs:
-            raise MissingStrictInConstrainedTypeException(factory.__name__)
-        if not kwargs["strict"]:
-            raise MissingStrictInConstrainedTypeException(factory.__name__)
-        return factory(*args, **kwargs)
-
-    return wrapper
-
-
-def field_type_unwanted(type_: Any) -> bool:
-    """Very rough attempt to detect if a type is unwanted as a Pydantic annotation.
-
-    At present, we exclude types which will coerce, or any generic type involving types
-    which will coerce."""
-    logger.debug("Is %s unwanted?")
-    if type_ in TYPES_THAT_PYDANTIC_WILL_COERCE_TO:
-        logger.debug("yes")
-        return True
-    logger.debug("Maybe. Subargs are %s", get_args(type_))
-    rv = any(field_type_unwanted(t) for t in get_args(type_))
-    logger.debug("Conclusion: %s %s unwanted", type_, "is" if rv else "is not")
-    return rv
-
-
-class PatchedBaseModel(PydanticBaseModel):
-    """A patched version of BaseModel that inspects fields after models are defined.
-
-    We complain loudly if we see an unwanted type.
-
-    Beware: ModelField.type_ is presumably private; this is likely to be very brittle.
-    """
-
-    @classmethod
-    def __init_subclass__(cls: Type[PydanticBaseModel], **kwargs: object):
-        for field in cls.__fields__.values():
-            # Note that field.type_ and field.outer_type are computed based on the
-            # annotation type, see pydantic.fields.ModelField._type_analysis
-            if field_type_unwanted(field.outer_type_):
-                # TODO: this only reports the first bad field. Can we find all bad ones
-                #  and report them all?
-                raise FieldHasUnwantedTypeException(
-                    f"{cls.__module__}.{cls.__qualname__} has field '{field.name}' "
-                    f"with unwanted type `{field.outer_type_}`"
-                )
-
-
-@contextmanager
-def monkeypatch_pydantic() -> Generator[None, None, None]:
-    """Patch pydantic with our snooping versions of BaseModel and the con* functions.
-
-    If the snooping functions see something they don't like, they'll raise a
-    ModelCheckingException instance.
-    """
-    with contextlib.ExitStack() as patches:
-        # Most Synapse code ought to import the patched objects directly from
-        # `pydantic`. But we also patch their containing modules `pydantic.main` and
-        # `pydantic.types` for completeness.
-        patch_basemodel = unittest.mock.patch(
-            "synapse._pydantic_compat.BaseModel", new=PatchedBaseModel
-        )
-        patches.enter_context(patch_basemodel)
-        for factory in CONSTRAINED_TYPE_FACTORIES_WITH_STRICT_FLAG:
-            wrapper: Callable = make_wrapper(factory)
-            patch = unittest.mock.patch(
-                f"synapse._pydantic_compat.{factory.__name__}", new=wrapper
-            )
-            patches.enter_context(patch)
-        yield
-
-
-def format_model_checker_exception(e: ModelCheckerException) -> str:
-    """Work out which line of code caused e. Format the line in a human-friendly way."""
-    # TODO. FieldHasUnwantedTypeException gives better error messages. Can we ditch the
-    #   patches of constr() etc, and instead inspect fields to look for ConstrainedStr
-    #   with strict=False? There is some difficulty with the inheritance hierarchy
-    #   because StrictStr < ConstrainedStr < str.
-    if isinstance(e, FieldHasUnwantedTypeException):
-        return e.message
-    elif isinstance(e, MissingStrictInConstrainedTypeException):
-        frame_summary = traceback.extract_tb(e.__traceback__)[-2]
-        return (
-            f"Missing `strict=True` from {e.factory_name}() call \n"
-            + traceback.format_list([frame_summary])[0].lstrip()
-        )
-    else:
-        raise ValueError(f"Unknown exception {e}") from e
-
-
-def lint() -> int:
-    """Try to import all of Synapse and see if we spot any Pydantic type coercions.
-
-    Print any problems, then return a status code suitable for sys.exit."""
-    failures = do_lint()
-    if failures:
-        print(f"Found {len(failures)} problem(s)")
-    for failure in sorted(failures):
-        print(failure)
-    return os.EX_DATAERR if failures else os.EX_OK
-
-
-def do_lint() -> Set[str]:
-    """Try to import all of Synapse and see if we spot any Pydantic type coercions."""
-    failures = set()
-
-    with monkeypatch_pydantic():
-        logger.debug("Importing synapse")
-        try:
-            # TODO: make "synapse" an argument so we can target this script at
-            # a subpackage
-            module = importlib.import_module("synapse")
-        except ModelCheckerException as e:
-            logger.warning("Bad annotation found when importing synapse")
-            failures.add(format_model_checker_exception(e))
-            return failures
-
-        try:
-            logger.debug("Fetching subpackages")
-            module_infos = list(
-                pkgutil.walk_packages(module.__path__, f"{module.__name__}.")
-            )
-        except ModelCheckerException as e:
-            logger.warning("Bad annotation found when looking for modules to import")
-            failures.add(format_model_checker_exception(e))
-            return failures
-
-        for module_info in module_infos:
-            logger.debug("Importing %s", module_info.name)
-            try:
-                importlib.import_module(module_info.name)
-            except ModelCheckerException as e:
-                logger.warning(
-                    "Bad annotation found when importing %s", module_info.name
-                )
-                failures.add(format_model_checker_exception(e))
-
-    return failures
-
-
-def run_test_snippet(source: str) -> None:
-    """Exec a snippet of source code in an isolated environment."""
-    # To emulate `source` being called at the top level of the module,
-    # the globals and locals we provide apparently have to be the same mapping.
-    #
-    # > Remember that at the module level, globals and locals are the same dictionary.
-    # > If exec gets two separate objects as globals and locals, the code will be
-    # > executed as if it were embedded in a class definition.
-    globals_: Dict[str, object]
-    locals_: Dict[str, object]
-    globals_ = locals_ = {}
-    exec(textwrap.dedent(source), globals_, locals_)
-
-
-class TestConstrainedTypesPatch(unittest.TestCase):
-    def test_expression_without_strict_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import constr
-                except ImportError:
-                    from pydantic import constr
-                constr()
-                """
-            )
-
-    def test_called_as_module_attribute_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                import pydantic
-                pydantic.constr()
-                """
-            )
-
-    def test_wildcard_import_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import *
-                except ImportError:
-                    from pydantic import *
-                constr()
-                """
-            )
-
-    def test_alternative_import_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1.types import constr
-                except ImportError:
-                    from pydantic.types import constr
-                constr()
-                """
-            )
-
-    def test_alternative_import_attribute_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import types as pydantic_types
-                except ImportError:
-                    from pydantic import types as pydantic_types
-                pydantic_types.constr()
-                """
-            )
-
-    def test_kwarg_but_no_strict_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import constr
-                except ImportError:
-                    from pydantic import constr
-                constr(min_length=10)
-                """
-            )
-
-    def test_kwarg_strict_False_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import constr
-                except ImportError:
-                    from pydantic import constr
-                constr(strict=False)
-                """
-            )
-
-    def test_kwarg_strict_True_doesnt_raise(self) -> None:
-        with monkeypatch_pydantic():
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import constr
-                except ImportError:
-                    from pydantic import constr
-                constr(strict=True)
-                """
-            )
-
-    def test_annotation_without_strict_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import constr
-                except ImportError:
-                    from pydantic import constr
-                x: constr()
-                """
-            )
-
-    def test_field_annotation_without_strict_raises(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1 import BaseModel, conint
-                except ImportError:
-                    from pydantic import BaseModel, conint
-                class C:
-                    x: conint()
-                """
-            )
-
-
-class TestFieldTypeInspection(unittest.TestCase):
-    @parameterized.expand(
-        [
-            ("str",),
-            ("bytes"),
-            ("int",),
-            ("float",),
-            ("bool"),
-            ("Optional[str]",),
-            ("Union[None, str]",),
-            ("List[str]",),
-            ("List[List[str]]",),
-            ("Dict[StrictStr, str]",),
-            ("Dict[str, StrictStr]",),
-            ("TypedDict('D', x=int)",),
-        ]
-    )
-    def test_field_holding_unwanted_type_raises(self, annotation: str) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                f"""
-                from typing import *
-                try:
-                    from pydantic.v1 import *
-                except ImportError:
-                    from pydantic import *
-                class C(BaseModel):
-                    f: {annotation}
-                """
-            )
-
-    @parameterized.expand(
-        [
-            ("StrictStr",),
-            ("StrictBytes"),
-            ("StrictInt",),
-            ("StrictFloat",),
-            ("StrictBool"),
-            ("constr(strict=True, min_length=10)",),
-            ("Optional[StrictStr]",),
-            ("Union[None, StrictStr]",),
-            ("List[StrictStr]",),
-            ("List[List[StrictStr]]",),
-            ("Dict[StrictStr, StrictStr]",),
-            ("TypedDict('D', x=StrictInt)",),
-        ]
-    )
-    def test_field_holding_accepted_type_doesnt_raise(self, annotation: str) -> None:
-        with monkeypatch_pydantic():
-            run_test_snippet(
-                f"""
-                from typing import *
-                try:
-                    from pydantic.v1 import *
-                except ImportError:
-                    from pydantic import *
-                class C(BaseModel):
-                    f: {annotation}
-                """
-            )
-
-    def test_field_holding_str_raises_with_alternative_import(self) -> None:
-        with monkeypatch_pydantic(), self.assertRaises(ModelCheckerException):
-            run_test_snippet(
-                """
-                try:
-                    from pydantic.v1.main import BaseModel
-                except ImportError:
-                    from pydantic.main import BaseModel
-                class C(BaseModel):
-                    f: str
-                """
-            )
-
-
-parser = argparse.ArgumentParser()
-parser.add_argument("mode", choices=["lint", "test"], default="lint", nargs="?")
-parser.add_argument("-v", "--verbose", action="store_true")
-
-
-if __name__ == "__main__":
-    args = parser.parse_args(sys.argv[1:])
-    logging.basicConfig(
-        format="%(asctime)s %(name)s:%(lineno)d %(levelname)s %(message)s",
-        level=logging.DEBUG if args.verbose else logging.INFO,
-    )
-    # suppress logs we don't care about
-    logging.getLogger("xmlschema").setLevel(logging.WARNING)
-    if args.mode == "lint":
-        sys.exit(lint())
-    elif args.mode == "test":
-        unittest.main(argv=sys.argv[:1])
diff --git a/scripts-dev/check_schema_delta.py b/scripts-dev/check_schema_delta.py
index 454784c3ae..12ed5d258c 100755
--- a/scripts-dev/check_schema_delta.py
+++ b/scripts-dev/check_schema_delta.py
@@ -5,15 +5,14 @@
 # Also checks that schema deltas do not try and create or drop indices.
 
 import re
-from typing import Any, Dict, List
+from typing import Any
 
 import click
 import git
+import sqlglot
+import sqlglot.expressions
 
 SCHEMA_FILE_REGEX = re.compile(r"^synapse/storage/schema/(.*)/delta/(.*)/(.*)$")
-INDEX_CREATION_REGEX = re.compile(r"CREATE .*INDEX .*ON ([a-z_]+)", flags=re.IGNORECASE)
-INDEX_DELETION_REGEX = re.compile(r"DROP .*INDEX ([a-z_]+)", flags=re.IGNORECASE)
-TABLE_CREATION_REGEX = re.compile(r"CREATE .*TABLE ([a-z_]+)", flags=re.IGNORECASE)
 
 # The base branch we want to check against. We use the main development branch
 # on the assumption that is what we are developing against.
@@ -48,16 +47,16 @@ def main(force_colors: bool) -> None:
 
     r = repo.git.show(f"origin/{DEVELOP_BRANCH}:synapse/storage/schema/__init__.py")
 
-    locals: Dict[str, Any] = {}
+    locals: dict[str, Any] = {}
     exec(r, locals)
     current_schema_version = locals["SCHEMA_VERSION"]
 
-    diffs: List[git.Diff] = repo.remote().refs[DEVELOP_BRANCH].commit.diff(None)
+    diffs: list[git.Diff] = repo.remote().refs[DEVELOP_BRANCH].commit.diff(None)
 
     # Get the schema version of the local file to check against current schema on develop
     with open("synapse/storage/schema/__init__.py") as file:
         local_schema = file.read()
-    new_locals: Dict[str, Any] = {}
+    new_locals: dict[str, Any] = {}
     exec(local_schema, new_locals)
     local_schema_version = new_locals["SCHEMA_VERSION"]
 
@@ -137,6 +136,9 @@ def main(force_colors: bool) -> None:
             color=force_colors,
         )
 
+        # Mark this run as not successful, but continue so that we report *all*
+        # errors.
+        return_code = 1
     else:
         click.secho(
             f"All deltas are in the correct folder: {current_schema_version}!",
@@ -149,54 +151,98 @@ def main(force_colors: bool) -> None:
     # and delta files are also numbered in order.
     changed_delta_files.sort()
 
-    # Now check that we're not trying to create or drop indices. If we want to
-    # do that they should be in background updates. The exception is when we
-    # create indices on tables we've just created.
-    created_tables = set()
-    for delta_file in changed_delta_files:
-        with open(delta_file) as fd:
-            delta_lines = fd.readlines()
-
-        for line in delta_lines:
-            # Strip SQL comments
-            line = line.split("--", maxsplit=1)[0]
-
-            # Check and track any tables we create
-            match = TABLE_CREATION_REGEX.search(line)
-            if match:
-                table_name = match.group(1)
-                created_tables.add(table_name)
-
-            # Check for dropping indices, these are always banned
-            match = INDEX_DELETION_REGEX.search(line)
-            if match:
-                clause = match.group()
-
-                click.secho(
-                    f"Found delta with index deletion: '{clause}' in {delta_file}\nThese should be in background updates.",
-                    fg="red",
-                    bold=True,
-                    color=force_colors,
-                )
-                return_code = 1
-
-            # Check for index creation, which is only allowed for tables we've
-            # created.
-            match = INDEX_CREATION_REGEX.search(line)
-            if match:
-                clause = match.group()
-                table_name = match.group(1)
-                if table_name not in created_tables:
-                    click.secho(
-                        f"Found delta with index creation: '{clause}' in {delta_file}\nThese should be in background updates.",
-                        fg="red",
-                        bold=True,
-                        color=force_colors,
-                    )
-                    return_code = 1
+    success = check_schema_delta(changed_delta_files, force_colors)
+    if not success:
+        return_code = 1
 
     click.get_current_context().exit(return_code)
 
 
+def check_schema_delta(delta_files: list[str], force_colors: bool) -> bool:
+    """Check that the given schema delta files do not create or drop indices
+    inappropriately.
+
+    Index creation is only allowed on tables created in the same set of deltas.
+
+    Index deletion is never allowed and should be done in background updates.
+
+    Returns:
+        True if all checks succeeded, False if at least one failed.
+    """
+
+    # The tables created in this delta
+    created_tables = set[str]()
+
+    # The indices created/dropped in this delta, each a tuple of (table_name, sql)
+    created_indices = list[tuple[str, str]]()
+
+    # The indices dropped in this delta, just the sql
+    dropped_indices = list[str]()
+
+    for delta_file in delta_files:
+        with open(delta_file) as fd:
+            delta_contents = fd.read()
+
+        # Assume the SQL dialect from the file extension, defaulting to Postgres.
+        sql_lang = "postgres"
+        if delta_file.endswith(".sqlite"):
+            sql_lang = "sqlite"
+        elif delta_file.endswith(".py"):
+            click.secho(
+                f"Skipping Python delta file: '{delta_file}'",
+                fg="yellow",
+                bold=True,
+                color=force_colors,
+            )
+            return True
+
+        statements = sqlglot.parse(delta_contents, read=sql_lang)
+
+        for statement in statements:
+            if isinstance(statement, sqlglot.expressions.Create):
+                if statement.kind == "TABLE":
+                    assert isinstance(statement.this, sqlglot.expressions.Schema)
+                    assert isinstance(statement.this.this, sqlglot.expressions.Table)
+
+                    table_name = statement.this.this.name
+                    created_tables.add(table_name)
+                elif statement.kind == "INDEX":
+                    assert isinstance(statement.this, sqlglot.expressions.Index)
+
+                    table_name = statement.this.args["table"].name
+                    created_indices.append((table_name, statement.sql()))
+            elif isinstance(statement, sqlglot.expressions.Drop):
+                if statement.kind == "INDEX":
+                    dropped_indices.append(statement.sql())
+
+    success = True
+    for table_name, clause in created_indices:
+        if table_name not in created_tables:
+            click.secho(
+                f"Found delta with index creation for existing table: '{clause}'",
+                fg="red",
+                bold=True,
+                color=force_colors,
+            )
+            click.secho(
+                " ↪ These should be in background updates (or the table should be created in the same delta).",
+            )
+            success = False
+
+    for clause in dropped_indices:
+        click.secho(
+            f"Found delta with index deletion: '{clause}'",
+            fg="red",
+            bold=True,
+            color=force_colors,
+        )
+        click.secho(
+            " ↪ These should be in background updates.",
+        )
+        success = False
+
+    return success
+
+
 if __name__ == "__main__":
     main()
diff --git a/scripts-dev/complement.sh b/scripts-dev/complement.sh
index 08b500ecd6..cca87d42a9 100755
--- a/scripts-dev/complement.sh
+++ b/scripts-dev/complement.sh
@@ -35,6 +35,31 @@
 # Exit if a line returns a non-zero exit code
 set -e
 
+# Tag local builds with a dummy registry namespace so that later builds may reference
+# them exactly instead of accidentally pulling from a remote registry.
+#
+# This is important as some Docker storage drivers/types prefer remote images over local
+# (like `containerd`) which causes problems as we're testing against some remote image
+# that doesn't include all of the changes that we're trying to test (be it locally or in
+# a PR in CI). This is spawning from a real-world problem where the GitHub runners were
+# updated to use Docker Engine 29.0.0+ which uses `containerd` by default for new
+# installations.
+#
+# XXX: If the Docker image name changes, don't forget to update
+# `.github/workflows/push_complement_image.yml` as well
+LOCAL_IMAGE_NAMESPACE=localhost
+
+# The image tags for how these images will be stored in the registry
+SYNAPSE_IMAGE_PATH="$LOCAL_IMAGE_NAMESPACE/synapse"
+SYNAPSE_WORKERS_IMAGE_PATH="$LOCAL_IMAGE_NAMESPACE/synapse-workers"
+# XXX: If the Docker image name changes, don't forget to update
+# `.github/workflows/push_complement_image.yml` as well
+COMPLEMENT_SYNAPSE_IMAGE_PATH="$LOCAL_IMAGE_NAMESPACE/complement-synapse"
+
+SYNAPSE_EDITABLE_IMAGE_PATH="$LOCAL_IMAGE_NAMESPACE/synapse-editable"
+SYNAPSE_WORKERS_EDITABLE_IMAGE_PATH="$LOCAL_IMAGE_NAMESPACE/synapse-workers-editable"
+COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH="$LOCAL_IMAGE_NAMESPACE/complement-synapse-editable"
+
 # Helper to emit annotations that collapse portions of the log in GitHub Actions
 echo_if_github() {
   if [[ -n "$GITHUB_WORKFLOW" ]]; then
@@ -47,10 +72,13 @@ usage() {
     cat >&2 <<EOF
 Usage: $0 [-f] <go test arguments>...
 Run the complement test suite on Synapse.
+  --in-repo
+        Whether to run the in-repo suite of Complement tests (see `./complement` in this project)
+        vs the Complement tests from the Complement repo.
 
   -f, --fast
         Skip rebuilding the docker images, and just use the most recent
-        'complement-synapse:latest' image.
+        'localhost/complement-synapse:latest' image.
         Conflicts with --build-only.
 
   --build-only
@@ -72,153 +100,179 @@ For help on arguments to 'go test', run 'go help testflag'.
 EOF
 }
 
-# parse our arguments
-skip_docker_build=""
-skip_complement_run=""
-while [ $# -ge 1 ]; do
+# We use a function to wrap the script logic so that we can use `return` to exit early
+# if needed. This is particularly useful so that this script can be sourced by other
+# scripts without exiting the calling subshell (composable). This allows us to share
+# variables like `SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES` with other scripts.
+#
+# Returns an exit code of 0 on success, or 1 on failure.
+main() {
+  # parse our arguments
+  skip_docker_build=""
+  skip_complement_run=""
+  use_in_repo_tests=""
+  while [ $# -ge 1 ]; do
     arg=$1
     case "$arg" in
-        "-h")
-            usage
-            exit 1
-            ;;
-        "-f"|"--fast")
-            skip_docker_build=1
-            ;;
-        "--build-only")
-            skip_complement_run=1
-            ;;
-        "-e"|"--editable")
-            use_editable_synapse=1
-            ;;
-        "--rebuild-editable")
-            rebuild_editable_synapse=1
-            ;;
-        *)
-            # unknown arg: presumably an argument to gotest. break the loop.
-            break
+      "-h")
+        usage
+        return 1
+        ;;
+      "--in-repo")
+        use_in_repo_tests=1
+        ;;
+      "-f"|"--fast")
+        skip_docker_build=1
+        ;;
+      "--build-only")
+        skip_complement_run=1
+        ;;
+      "-e"|"--editable")
+        use_editable_synapse=1
+        ;;
+      "--rebuild-editable")
+        rebuild_editable_synapse=1
+        ;;
+      *)
+        # unknown arg: presumably an argument to gotest. break the loop.
+        break
     esac
     shift
-done
+  done
 
-# enable buildkit for the docker builds
-export DOCKER_BUILDKIT=1
+  # enable buildkit for the docker builds
+  export DOCKER_BUILDKIT=1
 
-# Determine whether to use the docker or podman container runtime.
-if [ -n "$PODMAN" ]; then
-  export CONTAINER_RUNTIME=podman
-  export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock
-  export BUILDAH_FORMAT=docker
-  export COMPLEMENT_HOSTNAME_RUNNING_COMPLEMENT=host.containers.internal
-else
-  export CONTAINER_RUNTIME=docker
-fi
+  # Determine whether to use the docker or podman container runtime.
+  if [ -n "$PODMAN" ]; then
+    export CONTAINER_RUNTIME=podman
+    export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock
+    export BUILDAH_FORMAT=docker
+    export COMPLEMENT_HOSTNAME_RUNNING_COMPLEMENT=host.containers.internal
+  else
+    export CONTAINER_RUNTIME=docker
+  fi
 
-# Change to the repository root
-cd "$(dirname $0)/.."
+  # Change to the repository root
+  cd "$(dirname $0)/.."
 
-# Check for a user-specified Complement checkout
-if [[ -z "$COMPLEMENT_DIR" ]]; then
-  COMPLEMENT_REF=${COMPLEMENT_REF:-main}
-  echo "COMPLEMENT_DIR not set. Fetching Complement checkout from ${COMPLEMENT_REF}..."
-  wget -Nq https://github.com/matrix-org/complement/archive/${COMPLEMENT_REF}.tar.gz
-  tar -xzf ${COMPLEMENT_REF}.tar.gz
-  COMPLEMENT_DIR=complement-${COMPLEMENT_REF}
-  echo "Checkout available at 'complement-${COMPLEMENT_REF}'"
-fi
+  # Check for a user-specified Complement checkout
+  if [[ -z "$COMPLEMENT_DIR" ]]; then
+    COMPLEMENT_REF=${COMPLEMENT_REF:-main}
+    echo "COMPLEMENT_DIR not set. Fetching Complement checkout from ${COMPLEMENT_REF}..."
+    
+    # Download the Complement checkout at the specified ref.
+    wget -q https://github.com/matrix-org/complement/archive/${COMPLEMENT_REF}.tar.gz
 
-if [ -n "$use_editable_synapse" ]; then
+    # Delete the existing complement checkout. Otherwise we'll end up with stale
+    # test files after they're deleted server-side, and `tar` will not delete
+    # old files.
+    rm -rf complement-${COMPLEMENT_REF}
+
+    # Extract the checkout.
+    tar -xzf ${COMPLEMENT_REF}.tar.gz
+
+    COMPLEMENT_DIR=complement-${COMPLEMENT_REF}
+    echo "Checkout available at 'complement-${COMPLEMENT_REF}'"
+  fi
+
+  if [ -n "$use_editable_synapse" ]; then
     if [[ -e synapse/synapse_rust.abi3.so ]]; then
-        # In an editable install, back up the host's compiled Rust module to prevent
-        # inconvenience; the container will overwrite the module with its own copy.
-        mv -n synapse/synapse_rust.abi3.so synapse/synapse_rust.abi3.so~host
-        # And restore it on exit:
-        synapse_pkg=`realpath synapse`
-        trap "mv -f '$synapse_pkg/synapse_rust.abi3.so~host' '$synapse_pkg/synapse_rust.abi3.so'" EXIT
+      # In an editable install, back up the host's compiled Rust module to prevent
+      # inconvenience; the container will overwrite the module with its own copy.
+      mv -n synapse/synapse_rust.abi3.so synapse/synapse_rust.abi3.so~host
+      # And restore it on exit:
+      synapse_pkg=`realpath synapse`
+      trap "mv -f '$synapse_pkg/synapse_rust.abi3.so~host' '$synapse_pkg/synapse_rust.abi3.so'" EXIT
     fi
 
     editable_mount="$(realpath .):/editable-src:z"
     if [ -n "$rebuild_editable_synapse" ]; then
+      unset skip_docker_build
+    elif $CONTAINER_RUNTIME inspect "$COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH" &>/dev/null; then
+      # complement-synapse-editable already exists: see if we can still use it:
+      # - The Rust module must still be importable; it will fail to import if the Rust source has changed.
+      # - The Poetry lock file must be the same (otherwise we assume dependencies have changed)
+
+      # First set up the module in the right place for an editable installation.
+      $CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'cp' "$COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH" -- /synapse_rust.abi3.so.bak /editable-src/synapse/synapse_rust.abi3.so
+
+      if ($CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'python' "$COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH" -c 'import synapse.synapse_rust' \
+        && $CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'diff' "$COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH" --brief /editable-src/poetry.lock /poetry.lock.bak); then
+        skip_docker_build=1
+      else
+        echo "Editable Synapse image is stale. Will rebuild."
         unset skip_docker_build
-    elif $CONTAINER_RUNTIME inspect complement-synapse-editable &>/dev/null; then
-        # complement-synapse-editable already exists: see if we can still use it:
-        # - The Rust module must still be importable; it will fail to import if the Rust source has changed.
-        # - The Poetry lock file must be the same (otherwise we assume dependencies have changed)
-
-        # First set up the module in the right place for an editable installation.
-        $CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'cp' complement-synapse-editable -- /synapse_rust.abi3.so.bak /editable-src/synapse/synapse_rust.abi3.so
-
-        if ($CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'python' complement-synapse-editable -c 'import synapse.synapse_rust' \
-            && $CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'diff' complement-synapse-editable --brief /editable-src/poetry.lock /poetry.lock.bak); then
-            skip_docker_build=1
-        else
-            echo "Editable Synapse image is stale. Will rebuild."
-            unset skip_docker_build
-        fi
+      fi
     fi
-fi
+  fi
 
-if [ -z "$skip_docker_build" ]; then
+  if [ -z "$skip_docker_build" ]; then
     if [ -n "$use_editable_synapse" ]; then
 
-        # Build a special image designed for use in development with editable
-        # installs.
-        $CONTAINER_RUNTIME build -t synapse-editable \
-            -f "docker/editable.Dockerfile" .
+      # Build a special image designed for use in development with editable
+      # installs.
+      $CONTAINER_RUNTIME build \
+        -t "$SYNAPSE_EDITABLE_IMAGE_PATH" \
+        -f "docker/editable.Dockerfile" .
 
-        $CONTAINER_RUNTIME build -t synapse-workers-editable \
-            --build-arg FROM=synapse-editable \
-            -f "docker/Dockerfile-workers" .
+      $CONTAINER_RUNTIME build \
+        -t "$SYNAPSE_WORKERS_EDITABLE_IMAGE_PATH" \
+        --build-arg FROM="$SYNAPSE_EDITABLE_IMAGE_PATH" \
+        -f "docker/Dockerfile-workers" .
 
-        $CONTAINER_RUNTIME build -t complement-synapse-editable \
-            --build-arg FROM=synapse-workers-editable \
-            -f "docker/complement/Dockerfile" "docker/complement"
+      $CONTAINER_RUNTIME build \
+        -t "$COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH" \
+        --build-arg FROM="$SYNAPSE_WORKERS_EDITABLE_IMAGE_PATH" \
+        -f "docker/complement/Dockerfile" "docker/complement"
 
-        # Prepare the Rust module
-        $CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'cp' complement-synapse-editable -- /synapse_rust.abi3.so.bak /editable-src/synapse/synapse_rust.abi3.so
+      # Prepare the Rust module
+      $CONTAINER_RUNTIME run --rm -v $editable_mount --entrypoint 'cp' "$COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH" -- /synapse_rust.abi3.so.bak /editable-src/synapse/synapse_rust.abi3.so
 
     else
+      # We remove the `egg-info` as it can contain outdated information which won't line
+      # up with our current reality.
+      rm -rf matrix_synapse.egg-info/
+      # Figure out the Synapse version string in our current checkout
+      synapse_version_string="$(poetry run python -c 'from synapse.util import SYNAPSE_VERSION; print(SYNAPSE_VERSION)')"
 
-        # Build the base Synapse image from the local checkout
-        echo_if_github "::group::Build Docker image: matrixdotorg/synapse"
-        $CONTAINER_RUNTIME build -t matrixdotorg/synapse \
+      # Build the base Synapse image from the local checkout
+      echo_if_github "::group::Build Docker image: matrixdotorg/synapse"
+      $CONTAINER_RUNTIME build \
+        -t "$SYNAPSE_IMAGE_PATH" \
+        --build-arg SYNAPSE_VERSION_STRING="$synapse_version_string" \
         --build-arg TEST_ONLY_SKIP_DEP_HASH_VERIFICATION \
         --build-arg TEST_ONLY_IGNORE_POETRY_LOCKFILE \
         -f "docker/Dockerfile" .
-        echo_if_github "::endgroup::"
+      echo_if_github "::endgroup::"
 
-        # Build the workers docker image (from the base Synapse image we just built).
-        echo_if_github "::group::Build Docker image: matrixdotorg/synapse-workers"
-        $CONTAINER_RUNTIME build -t matrixdotorg/synapse-workers -f "docker/Dockerfile-workers" .
-        echo_if_github "::endgroup::"
+      # Build the workers docker image (from the base Synapse image we just built).
+      echo_if_github "::group::Build Docker image: matrixdotorg/synapse-workers"
+      $CONTAINER_RUNTIME build \
+        -t "$SYNAPSE_WORKERS_IMAGE_PATH" \
+        --build-arg FROM="$SYNAPSE_IMAGE_PATH" \
+        -f "docker/Dockerfile-workers" .
+      echo_if_github "::endgroup::"
 
-        # Build the unified Complement image (from the worker Synapse image we just built).
-        echo_if_github "::group::Build Docker image: complement/Dockerfile"
-        $CONTAINER_RUNTIME build -t complement-synapse \
-            `# This is the tag we end up pushing to the registry (see` \
-            `# .github/workflows/push_complement_image.yml) so let's just label it now` \
-            `# so people can reference it by the same name locally.` \
-            -t ghcr.io/element-hq/synapse/complement-synapse \
-            -f "docker/complement/Dockerfile" "docker/complement"
-        echo_if_github "::endgroup::"
+      # Build the unified Complement image (from the worker Synapse image we just built).
+      echo_if_github "::group::Build Docker image: complement/Dockerfile"
+      $CONTAINER_RUNTIME build \
+        -t "$COMPLEMENT_SYNAPSE_IMAGE_PATH" \
+        --build-arg FROM="$SYNAPSE_WORKERS_IMAGE_PATH" \
+        -f "docker/complement/Dockerfile" "docker/complement"
+      echo_if_github "::endgroup::"
 
     fi
-fi
+  
+    echo "Docker images built."
+  else
+    echo "Skipping Docker image build as requested."
+  fi
 
-if [ -n "$skip_complement_run" ]; then
-    echo "Skipping Complement run as requested."
-    exit
-fi
-
-export COMPLEMENT_BASE_IMAGE=complement-synapse
-if [ -n "$use_editable_synapse" ]; then
-    export COMPLEMENT_BASE_IMAGE=complement-synapse-editable
-    export COMPLEMENT_HOST_MOUNTS="$editable_mount"
-fi
-
-extra_test_args=()
-
-test_packages=(
+  # Default set of Complement tests to run from the Complement repo
+  #
+  # We pick and choose the specific MSC's that Synapse supports.
+  default_complement_test_packages=(
     ./tests/csapi
     ./tests
     ./tests/msc3874
@@ -230,71 +284,129 @@ test_packages=(
     ./tests/msc3967
     ./tests/msc4140
     ./tests/msc4155
-)
+    ./tests/msc4306
+    ./tests/msc4222
+  )
 
-# Enable dirty runs, so tests will reuse the same container where possible.
-# This significantly speeds up tests, but increases the possibility of test pollution.
-export COMPLEMENT_ENABLE_DIRTY_RUNS=1
+  # Export the list of test packages as a space-separated environment variable, so other
+  # scripts can use it.
+  export SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES="${default_complement_test_packages[@]}"
 
-# All environment variables starting with PASS_ will be shared.
-# (The prefix is stripped off before reaching the container.)
-export COMPLEMENT_SHARE_ENV_PREFIX=PASS_
+  # Default set of Complement tests to run when using the in-repo test suite. Most
+  # likely, this should be all tests.
+  #
+  # Relative to the `./complement` repo in this project
+  default_in_repo_complement_test_packages=(
+    ./tests/...
+  )
 
-# It takes longer than 10m to run the whole suite.
-extra_test_args+=("-timeout=60m")
-
-if [[ -n "$WORKERS" ]]; then
-  # Use workers.
-  export PASS_SYNAPSE_COMPLEMENT_USE_WORKERS=true
-
-  # Pass through the workers defined. If none, it will be an empty string
-  export PASS_SYNAPSE_WORKER_TYPES="$WORKER_TYPES"
-
-  # Workers can only use Postgres as a database.
-  export PASS_SYNAPSE_COMPLEMENT_DATABASE=postgres
-
-  # And provide some more configuration to complement.
-
-  # It can take quite a while to spin up a worker-mode Synapse for the first
-  # time (the main problem is that we start 14 python processes for each test,
-  # and complement likes to do two of them in parallel).
-  export COMPLEMENT_SPAWN_HS_TIMEOUT_SECS=120
-else
-  export PASS_SYNAPSE_COMPLEMENT_USE_WORKERS=
-  if [[ -n "$POSTGRES" ]]; then
-    export PASS_SYNAPSE_COMPLEMENT_DATABASE=postgres
-  else
-    export PASS_SYNAPSE_COMPLEMENT_DATABASE=sqlite
+  export COMPLEMENT_BASE_IMAGE="$COMPLEMENT_SYNAPSE_IMAGE_PATH"
+  if [ -n "$use_editable_synapse" ]; then
+    export COMPLEMENT_BASE_IMAGE="$COMPLEMENT_SYNAPSE_EDITABLE_IMAGE_PATH"
+    export COMPLEMENT_HOST_MOUNTS="$editable_mount"
   fi
+
+  # Enable dirty runs, so tests will reuse the same container where possible.
+  # This significantly speeds up tests, but increases the possibility of test pollution.
+  export COMPLEMENT_ENABLE_DIRTY_RUNS=1
+
+  # All environment variables starting with PASS_ will be shared.
+  # (The prefix is stripped off before reaching the container.)
+  export COMPLEMENT_SHARE_ENV_PREFIX=PASS_
+
+  # * -count=1: Only run tests once, and disable caching for tests.
+  # * -v: Output test logs, even if those tests pass.
+  # * -tags=synapse_blacklist: Enable the `synapse_blacklist` build tag, which is
+  #   necessary for `runtime.Synapse` checks/skips to work in the tests
+  test_args=(
+    -v
+    -tags="synapse_blacklist"
+    -count=1
+  )
+
+  # It takes longer than 10m to run the whole suite.
+  test_args+=("-timeout=60m")
+
+  if [[ -n "$WORKERS" ]]; then
+    # Use workers.
+    export PASS_SYNAPSE_COMPLEMENT_USE_WORKERS=true
+
+    # Pass through the workers defined. If none, it will be an empty string
+    export PASS_SYNAPSE_WORKER_TYPES="$WORKER_TYPES"
+
+    # Workers can only use Postgres as a database.
+    export PASS_SYNAPSE_COMPLEMENT_DATABASE=postgres
+
+    # And provide some more configuration to complement.
+
+    # It can take quite a while to spin up a worker-mode Synapse for the first
+    # time (the main problem is that we start 14 python processes for each test,
+    # and complement likes to do two of them in parallel).
+    export COMPLEMENT_SPAWN_HS_TIMEOUT_SECS=120
+  else
+    export PASS_SYNAPSE_COMPLEMENT_USE_WORKERS=
+    if [[ -n "$POSTGRES" ]]; then
+      export PASS_SYNAPSE_COMPLEMENT_DATABASE=postgres
+    else
+      export PASS_SYNAPSE_COMPLEMENT_DATABASE=sqlite
+    fi
+  fi
+
+  if [[ -n "$ASYNCIO_REACTOR" ]]; then
+    # Enable the Twisted asyncio reactor
+    export PASS_SYNAPSE_COMPLEMENT_USE_ASYNCIO_REACTOR=true
+  fi
+
+  if [[ -n "$UNIX_SOCKETS" ]]; then
+    # Enable full on Unix socket mode for Synapse, Redis and Postgresql
+    export PASS_SYNAPSE_USE_UNIX_SOCKET=1
+  fi
+
+  if [[ -n "$SYNAPSE_TEST_LOG_LEVEL" ]]; then
+    # Set the log level to what is desired
+    export PASS_SYNAPSE_LOG_LEVEL="$SYNAPSE_TEST_LOG_LEVEL"
+
+    # Allow logging sensitive things (currently SQL queries & parameters).
+    # (This won't have any effect if we're not logging at DEBUG level overall.)
+    # Since this is just a test suite, this is fine and won't reveal anyone's
+    # personal information
+    export PASS_SYNAPSE_LOG_SENSITIVE=1
+  fi
+
+  # Log a few more useful things for a developer attempting to debug something
+  # particularly tricky.
+  export PASS_SYNAPSE_LOG_TESTING=1
+
+  if [ -n "$skip_complement_run" ]; then
+    echo "Skipping Complement run as requested."
+    return 0
+  fi
+
+  # Print out the executed commands so it's more obvious what's happening at the end here.
+  # Things are slightly ambiguous with the in-repo vs Complement tests.
+  set -x
+  
+  if [ -n "$use_in_repo_tests" ]; then
+    # Run the suite of Complement tests in the `./complement` directory in this repo
+    cd "./complement"
+    go test "${test_args[@]}" "$@" "${default_in_repo_complement_test_packages[@]}"
+  else
+    # Run the tests (from the Complement repo)!
+    cd "$COMPLEMENT_DIR"
+    go test "${test_args[@]}" "$@" "${default_complement_test_packages[@]}"
+  fi
+
+  # We don't need to print out executed commands anymore
+  #
+  # This is just `set +x` without printing `+ set +x` to the console (via
+  # https://stackoverflow.com/questions/13195655/bash-set-x-without-it-being-printed/19226038#19226038)
+  { set +x; } 2>/dev/null
+}
+
+main "$@"
+# For any non-zero exit code (indicating some sort of error happened), we want to exit
+# with that code.
+exit_code=$?
+if [ $exit_code -ne 0 ]; then
+    exit $exit_code
 fi
-
-if [[ -n "$ASYNCIO_REACTOR" ]]; then
-  # Enable the Twisted asyncio reactor
-  export PASS_SYNAPSE_COMPLEMENT_USE_ASYNCIO_REACTOR=true
-fi
-
-if [[ -n "$UNIX_SOCKETS" ]]; then
-  # Enable full on Unix socket mode for Synapse, Redis and Postgresql
-  export PASS_SYNAPSE_USE_UNIX_SOCKET=1
-fi
-
-if [[ -n "$SYNAPSE_TEST_LOG_LEVEL" ]]; then
-  # Set the log level to what is desired
-  export PASS_SYNAPSE_LOG_LEVEL="$SYNAPSE_TEST_LOG_LEVEL"
-
-  # Allow logging sensitive things (currently SQL queries & parameters).
-  # (This won't have any effect if we're not logging at DEBUG level overall.)
-  # Since this is just a test suite, this is fine and won't reveal anyone's
-  # personal information
-  export PASS_SYNAPSE_LOG_SENSITIVE=1
-fi
-
-# Log a few more useful things for a developer attempting to debug something
-# particularly tricky.
-export PASS_SYNAPSE_LOG_TESTING=1
-
-# Run the tests!
-echo "Images built; running complement with ${extra_test_args[@]} $@ ${test_packages[@]}"
-cd "$COMPLEMENT_DIR"
-
-go test -v -tags "synapse_blacklist" -count=1 "${extra_test_args[@]}" "$@" "${test_packages[@]}"
diff --git a/scripts-dev/federation_client.py b/scripts-dev/federation_client.py
index fb879ef555..cb14f357cb 100755
--- a/scripts-dev/federation_client.py
+++ b/scripts-dev/federation_client.py
@@ -43,7 +43,7 @@ import argparse
 import base64
 import json
 import sys
-from typing import Any, Dict, Mapping, Optional, Tuple, Union
+from typing import Any, Mapping
 from urllib import parse as urlparse
 
 import requests
@@ -103,12 +103,12 @@ def sign_json(
 
 
 def request(
-    method: Optional[str],
+    method: str | None,
     origin_name: str,
     origin_key: signedjson.types.SigningKey,
     destination: str,
     path: str,
-    content: Optional[str],
+    content: str | None,
     verify_tls: bool,
 ) -> requests.Response:
     if method is None:
@@ -145,9 +145,9 @@ def request(
     print("Requesting %s" % dest, file=sys.stderr)
 
     s = requests.Session()
-    s.mount("matrix-federation://", MatrixConnectionAdapter())
+    s.mount("matrix-federation://", MatrixConnectionAdapter(verify_tls=verify_tls))
 
-    headers: Dict[str, str] = {
+    headers: dict[str, str] = {
         "Authorization": authorization_headers[0],
     }
 
@@ -267,6 +267,17 @@ def read_args_from_config(args: argparse.Namespace) -> None:
 
 
 class MatrixConnectionAdapter(HTTPAdapter):
+    """
+    A Matrix federation-aware HTTP Adapter.
+    """
+
+    verify_tls: bool
+    """whether to verify the remote server's TLS certificate."""
+
+    def __init__(self, verify_tls: bool = True) -> None:
+        self.verify_tls = verify_tls
+        super().__init__()
+
     def send(
         self,
         request: PreparedRequest,
@@ -280,7 +291,7 @@ class MatrixConnectionAdapter(HTTPAdapter):
         assert isinstance(request.url, str)
         parsed = urlparse.urlsplit(request.url)
         server_name = parsed.netloc
-        well_known = self._get_well_known(parsed.netloc)
+        well_known = self._get_well_known(parsed.netloc, verify_tls=self.verify_tls)
 
         if well_known:
             server_name = well_known
@@ -301,9 +312,9 @@ class MatrixConnectionAdapter(HTTPAdapter):
     def get_connection_with_tls_context(
         self,
         request: PreparedRequest,
-        verify: Optional[Union[bool, str]],
-        proxies: Optional[Mapping[str, str]] = None,
-        cert: Optional[Union[Tuple[str, str], str]] = None,
+        verify: bool | str | None,
+        proxies: Mapping[str, str] | None = None,
+        cert: tuple[str, str] | str | None = None,
     ) -> HTTPConnectionPool:
         # overrides the get_connection_with_tls_context() method in the base class
         parsed = urlparse.urlsplit(request.url)
@@ -318,6 +329,21 @@ class MatrixConnectionAdapter(HTTPAdapter):
         print(
             f"Connecting to {host}:{port} with SNI {ssl_server_name}", file=sys.stderr
         )
+
+        if proxies:
+            scheme = parsed.scheme
+            if isinstance(scheme, bytes):
+                scheme = scheme.decode("utf-8")
+
+            proxy_for_scheme = proxies.get(scheme)
+            if proxy_for_scheme:
+                return self.proxy_manager_for(proxy_for_scheme).connection_from_host(
+                    host,
+                    port=port,
+                    scheme="https",
+                    pool_kwargs={"server_hostname": ssl_server_name},
+                )
+
         return self.poolmanager.connection_from_host(
             host,
             port=port,
@@ -326,7 +352,7 @@ class MatrixConnectionAdapter(HTTPAdapter):
         )
 
     @staticmethod
-    def _lookup(server_name: str) -> Tuple[str, int, str]:
+    def _lookup(server_name: str) -> tuple[str, int, str]:
         """
         Do an SRV lookup on a server name and return the host:port to connect to
         Given the server_name (after any .well-known lookup), return the host, port and
@@ -368,7 +394,7 @@ class MatrixConnectionAdapter(HTTPAdapter):
             return server_name, 8448, server_name
 
     @staticmethod
-    def _get_well_known(server_name: str) -> Optional[str]:
+    def _get_well_known(server_name: str, verify_tls: bool = True) -> str | None:
         if ":" in server_name:
             # explicit port, or ipv6 literal. Either way, no .well-known
             return None
@@ -379,7 +405,7 @@ class MatrixConnectionAdapter(HTTPAdapter):
         print(f"fetching {uri}", file=sys.stderr)
 
         try:
-            resp = requests.get(uri)
+            resp = requests.get(uri, verify=verify_tls)
             if resp.status_code != 200:
                 print("%s gave %i" % (uri, resp.status_code), file=sys.stderr)
                 return None
diff --git a/scripts-dev/gen_config_documentation.py b/scripts-dev/gen_config_documentation.py
index 9a49c07a34..aad25a4fc1 100755
--- a/scripts-dev/gen_config_documentation.py
+++ b/scripts-dev/gen_config_documentation.py
@@ -4,7 +4,7 @@
 import json
 import re
 import sys
-from typing import Any, Optional
+from typing import Any
 
 import yaml
 
@@ -259,17 +259,17 @@ def indent(text: str, first_line: bool = True) -> str:
     return text
 
 
-def em(s: Optional[str]) -> str:
+def em(s: str | None) -> str:
     """Add emphasis to text."""
     return f"*{s}*" if s else ""
 
 
-def a(s: Optional[str], suffix: str = " ") -> str:
+def a(s: str | None, suffix: str = " ") -> str:
     """Appends a space if the given string is not empty."""
     return s + suffix if s else ""
 
 
-def p(s: Optional[str], prefix: str = " ") -> str:
+def p(s: str | None, prefix: str = " ") -> str:
     """Prepend a space if the given string is not empty."""
     return prefix + s if s else ""
 
diff --git a/scripts-dev/lint.sh b/scripts-dev/lint.sh
index 7096100a3e..b10cf8b80a 100755
--- a/scripts-dev/lint.sh
+++ b/scripts-dev/lint.sh
@@ -134,11 +134,19 @@ fi
 # Ensure the formatting of Rust code.
 cargo-fmt
 
-# Ensure all Pydantic models use strict types.
-./scripts-dev/check_pydantic_models.py lint
-
 # Ensure type hints are correct.
 mypy
 
 # Generate configuration documentation from the JSON Schema
 ./scripts-dev/gen_config_documentation.py schema/synapse-config.schema.yaml > docs/usage/configuration/config_documentation.md
+
+# Lint/format the in-repo Complement test code (Go)
+pushd ./complement
+# Run golangci-lint with:
+#  - The `run` command will lint the code
+#  - `--fix`: Will apply any suggested fixes like autofixes from `linters` *and*
+#    `formatters` which always produce suggested fixes that are equivalent to running
+#    `golangci-lint fmt`.
+#  - `--max-issues-per-linter=0`: Show all issues, don't limit the number reported
+go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.1 run ./... --fix --max-issues-per-linter=0
+popd
diff --git a/scripts-dev/mypy_synapse_plugin.py b/scripts-dev/mypy_synapse_plugin.py
index 610dec415a..7fe4d6cd86 100644
--- a/scripts-dev/mypy_synapse_plugin.py
+++ b/scripts-dev/mypy_synapse_plugin.py
@@ -24,7 +24,7 @@ can crop up, e.g the cache descriptors.
 """
 
 import enum
-from typing import Callable, Mapping, Optional, Tuple, Type, Union
+from typing import Callable, Mapping
 
 import attr
 import mypy.types
@@ -68,6 +68,42 @@ PROMETHEUS_METRIC_MISSING_FROM_LIST_TO_CHECK = ErrorCode(
     category="per-homeserver-tenant-metrics",
 )
 
+PREFER_SYNAPSE_CLOCK_CALL_LATER = ErrorCode(
+    "call-later-not-tracked",
+    "Prefer using `synapse.util.Clock.call_later` instead of `reactor.callLater`",
+    category="synapse-reactor-clock",
+)
+
+PREFER_SYNAPSE_CLOCK_LOOPING_CALL = ErrorCode(
+    "prefer-synapse-clock-looping-call",
+    "Prefer using `synapse.util.Clock.looping_call` instead of `task.LoopingCall`",
+    category="synapse-reactor-clock",
+)
+
+PREFER_SYNAPSE_CLOCK_CALL_WHEN_RUNNING = ErrorCode(
+    "prefer-synapse-clock-call-when-running",
+    "Prefer using `synapse.util.Clock.call_when_running` instead of `reactor.callWhenRunning`",
+    category="synapse-reactor-clock",
+)
+
+PREFER_SYNAPSE_CLOCK_ADD_SYSTEM_EVENT_TRIGGER = ErrorCode(
+    "prefer-synapse-clock-add-system-event-trigger",
+    "Prefer using `synapse.util.Clock.add_system_event_trigger` instead of `reactor.addSystemEventTrigger`",
+    category="synapse-reactor-clock",
+)
+
+MULTIPLE_INTERNAL_CLOCKS_CREATED = ErrorCode(
+    "multiple-internal-clocks",
+    "Only one instance of `clock.Clock` should be created",
+    category="synapse-reactor-clock",
+)
+
+UNTRACKED_BACKGROUND_PROCESS = ErrorCode(
+    "untracked-background-process",
+    "Prefer using `HomeServer.run_as_background_process` method over the bare `run_as_background_process`",
+    category="synapse-tracked-calls",
+)
+
 
 class Sentinel(enum.Enum):
     # defining a sentinel in this way allows mypy to correctly handle the
@@ -87,7 +123,7 @@ class ArgLocation:
     """
 
 
-prometheus_metric_fullname_to_label_arg_map: Mapping[str, Optional[ArgLocation]] = {
+prometheus_metric_fullname_to_label_arg_map: Mapping[str, ArgLocation | None] = {
     # `Collector` subclasses:
     "prometheus_client.metrics.MetricWrapperBase": ArgLocation("labelnames", 2),
     "prometheus_client.metrics.Counter": ArgLocation("labelnames", 2),
@@ -97,6 +133,7 @@ prometheus_metric_fullname_to_label_arg_map: Mapping[str, Optional[ArgLocation]]
     "prometheus_client.metrics.Info": ArgLocation("labelnames", 2),
     "prometheus_client.metrics.Enum": ArgLocation("labelnames", 2),
     "synapse.metrics.LaterGauge": ArgLocation("labelnames", 2),
+    "synapse.metrics._InFlightGaugeRuntime": ArgLocation("labels", 2),
     "synapse.metrics.InFlightGauge": ArgLocation("labels", 2),
     "synapse.metrics.GaugeBucketCollector": ArgLocation("labelnames", 2),
     "prometheus_client.registry.Collector": None,
@@ -148,8 +185,8 @@ should be in the source code.
 
 # Unbound at this point because we don't know the mypy version yet.
 # This is set in the `plugin(...)` function below.
-MypyPydanticPluginClass: Type[Plugin]
-MypyZopePluginClass: Type[Plugin]
+MypyPydanticPluginClass: type[Plugin]
+MypyZopePluginClass: type[Plugin]
 
 
 class SynapsePlugin(Plugin):
@@ -175,7 +212,7 @@ class SynapsePlugin(Plugin):
 
     def get_base_class_hook(
         self, fullname: str
-    ) -> Optional[Callable[[ClassDefContext], None]]:
+    ) -> Callable[[ClassDefContext], None] | None:
         def _get_base_class_hook(ctx: ClassDefContext) -> None:
             # Run any `get_base_class_hook` checks from other plugins first.
             #
@@ -196,7 +233,7 @@ class SynapsePlugin(Plugin):
 
     def get_function_signature_hook(
         self, fullname: str
-    ) -> Optional[Callable[[FunctionSigContext], FunctionLike]]:
+    ) -> Callable[[FunctionSigContext], FunctionLike] | None:
         # Strip off the unique identifier for classes that are dynamically created inside
         # functions. ex. `synapse.metrics.jemalloc.JemallocCollector@185` (this is the line
         # number)
@@ -210,11 +247,23 @@ class SynapsePlugin(Plugin):
             # callback, let's just pass it in while we have it.
             return lambda ctx: check_prometheus_metric_instantiation(ctx, fullname)
 
+        if fullname == "twisted.internet.task.LoopingCall":
+            return check_looping_call
+
+        if fullname == "synapse.util.clock.Clock":
+            return check_clock_creation
+
+        if (
+            fullname
+            == "synapse.metrics.background_process_metrics.run_as_background_process"
+        ):
+            return check_background_process
+
         return None
 
     def get_method_signature_hook(
         self, fullname: str
-    ) -> Optional[Callable[[MethodSigContext], CallableType]]:
+    ) -> Callable[[MethodSigContext], CallableType] | None:
         if fullname.startswith(
             (
                 "synapse.util.caches.descriptors.CachedFunction.__call__",
@@ -229,9 +278,177 @@ class SynapsePlugin(Plugin):
         ):
             return check_is_cacheable_wrapper
 
+        if fullname in (
+            "twisted.internet.interfaces.IReactorTime.callLater",
+            "synapse.types.ISynapseThreadlessReactor.callLater",
+            "synapse.types.ISynapseReactor.callLater",
+        ):
+            return check_call_later
+
+        if fullname in (
+            "twisted.internet.interfaces.IReactorCore.callWhenRunning",
+            "synapse.types.ISynapseThreadlessReactor.callWhenRunning",
+            "synapse.types.ISynapseReactor.callWhenRunning",
+        ):
+            return check_call_when_running
+
+        if fullname in (
+            "twisted.internet.interfaces.IReactorCore.addSystemEventTrigger",
+            "synapse.types.ISynapseThreadlessReactor.addSystemEventTrigger",
+            "synapse.types.ISynapseReactor.addSystemEventTrigger",
+        ):
+            return check_add_system_event_trigger
+
         return None
 
 
+def check_clock_creation(ctx: FunctionSigContext) -> CallableType:
+    """
+    Ensure that the only `clock.Clock` instance is the one used by the `HomeServer`.
+    This is so that the `HomeServer` can cancel any tracked delayed or looping calls
+    during server shutdown.
+
+    Args:
+        ctx: The `FunctionSigContext` from mypy.
+    """
+    signature: CallableType = ctx.default_signature
+    ctx.api.fail(
+        "Expected the only `clock.Clock` instance to be the one used by the `HomeServer`. "
+        "This is so that the `HomeServer` can cancel any tracked delayed or looping calls "
+        "during server shutdown",
+        ctx.context,
+        code=MULTIPLE_INTERNAL_CLOCKS_CREATED,
+    )
+
+    return signature
+
+
+def check_call_later(ctx: MethodSigContext) -> CallableType:
+    """
+    Ensure that the `reactor.callLater` callsites aren't used.
+
+    `synapse.util.Clock.call_later` should always be used instead of `reactor.callLater`.
+    This is because the `synapse.util.Clock` tracks delayed calls in order to cancel any
+    outstanding calls during server shutdown. Delayed calls which are either short lived
+    (<~60s) or frequently called and can be tracked via other means could be candidates for
+    using `synapse.util.Clock.call_later` with `call_later_cancel_on_shutdown` set to
+    `False`. There shouldn't be a need to use `reactor.callLater` outside of tests or the
+    `Clock` class itself. If a need arises, you can use a type ignore comment to disable the
+    check, e.g. `# type: ignore[call-later-not-tracked]`.
+
+    Args:
+        ctx: The `FunctionSigContext` from mypy.
+    """
+    signature: CallableType = ctx.default_signature
+    ctx.api.fail(
+        "Expected all `reactor.callLater` calls to use `synapse.util.Clock.call_later` "
+        "instead. This is so that long lived calls can be tracked for cancellation during "
+        "server shutdown",
+        ctx.context,
+        code=PREFER_SYNAPSE_CLOCK_CALL_LATER,
+    )
+
+    return signature
+
+
+def check_looping_call(ctx: FunctionSigContext) -> CallableType:
+    """
+    Ensure that the `task.LoopingCall` callsites aren't used.
+
+    `synapse.util.Clock.looping_call` should always be used instead of `task.LoopingCall`.
+    `synapse.util.Clock` tracks looping calls in order to cancel any outstanding calls
+    during server shutdown.
+
+    Args:
+        ctx: The `FunctionSigContext` from mypy.
+    """
+    signature: CallableType = ctx.default_signature
+    ctx.api.fail(
+        "Expected all `task.LoopingCall` instances to use `synapse.util.Clock.looping_call` "
+        "instead. This is so that long lived calls can be tracked for cancellation during "
+        "server shutdown",
+        ctx.context,
+        code=PREFER_SYNAPSE_CLOCK_LOOPING_CALL,
+    )
+
+    return signature
+
+
+def check_call_when_running(ctx: MethodSigContext) -> CallableType:
+    """
+    Ensure that the `reactor.callWhenRunning` callsites aren't used.
+
+    `synapse.util.Clock.call_when_running` should always be used instead of
+    `reactor.callWhenRunning`.
+
+    Since `reactor.callWhenRunning` is a reactor callback, the callback will start out
+    with the sentinel logcontext. `synapse.util.Clock` starts a default logcontext as we
+    want to know which server the logs came from.
+
+    Args:
+        ctx: The `FunctionSigContext` from mypy.
+    """
+    signature: CallableType = ctx.default_signature
+    ctx.api.fail(
+        (
+            "Expected all `reactor.callWhenRunning` calls to use `synapse.util.Clock.call_when_running` instead. "
+            "This is so all Synapse code runs with a logcontext as we want to know which server the logs came from."
+        ),
+        ctx.context,
+        code=PREFER_SYNAPSE_CLOCK_CALL_WHEN_RUNNING,
+    )
+
+    return signature
+
+
+def check_add_system_event_trigger(ctx: MethodSigContext) -> CallableType:
+    """
+    Ensure that the `reactor.addSystemEventTrigger` callsites aren't used.
+
+    `synapse.util.Clock.add_system_event_trigger` should always be used instead of
+    `reactor.addSystemEventTrigger`.
+
+    Since `reactor.addSystemEventTrigger` is a reactor callback, the callback will start out
+    with the sentinel logcontext. `synapse.util.Clock` starts a default logcontext as we
+    want to know which server the logs came from.
+
+    Args:
+        ctx: The `FunctionSigContext` from mypy.
+    """
+    signature: CallableType = ctx.default_signature
+    ctx.api.fail(
+        (
+            "Expected all `reactor.addSystemEventTrigger` calls to use `synapse.util.Clock.add_system_event_trigger` instead. "
+            "This is so all Synapse code runs with a logcontext as we want to know which server the logs came from."
+        ),
+        ctx.context,
+        code=PREFER_SYNAPSE_CLOCK_ADD_SYSTEM_EVENT_TRIGGER,
+    )
+
+    return signature
+
+
+def check_background_process(ctx: FunctionSigContext) -> CallableType:
+    """
+    Ensure that calls to `run_as_background_process` use the `HomeServer` method.
+    This is so that the `HomeServer` can cancel any running background processes during
+    server shutdown.
+
+    Args:
+        ctx: The `FunctionSigContext` from mypy.
+    """
+    signature: CallableType = ctx.default_signature
+    ctx.api.fail(
+        "Prefer using `HomeServer.run_as_background_process` method over the bare "
+        "`run_as_background_process`. This is so that the `HomeServer` can cancel "
+        "any background processes during server shutdown",
+        ctx.context,
+        code=UNTRACKED_BACKGROUND_PROCESS,
+    )
+
+    return signature
+
+
 def analyze_prometheus_metric_classes(ctx: ClassDefContext) -> None:
     """
     Cross-check the list of Prometheus metric classes against the
@@ -505,7 +722,7 @@ def check_is_cacheable_wrapper(ctx: MethodSigContext) -> CallableType:
 
 def check_is_cacheable(
     signature: CallableType,
-    ctx: Union[MethodSigContext, FunctionSigContext],
+    ctx: MethodSigContext | FunctionSigContext,
 ) -> None:
     """
     Check if a callable returns a type which can be cached.
@@ -579,7 +796,7 @@ AT_CACHED_MUTABLE_RETURN = ErrorCode(
 
 def is_cacheable(
     rt: mypy.types.Type, signature: CallableType, verbose: bool
-) -> Tuple[bool, Optional[str]]:
+) -> tuple[bool, str | None]:
     """
     Check if a particular type is cachable.
 
@@ -689,7 +906,7 @@ def is_cacheable(
         return False, f"Don't know how to handle {type(rt).__qualname__} return type"
 
 
-def plugin(version: str) -> Type[SynapsePlugin]:
+def plugin(version: str) -> type[SynapsePlugin]:
     global MypyPydanticPluginClass, MypyZopePluginClass
     # This is the entry point of the plugin, and lets us deal with the fact
     # that the mypy plugin interface is *not* stable by looking at the version
diff --git a/scripts-dev/release.py b/scripts-dev/release.py
index 73a4e7b7a9..f429f7e048 100755
--- a/scripts-dev/release.py
+++ b/scripts-dev/release.py
@@ -32,11 +32,13 @@ import time
 import urllib.request
 from os import path
 from tempfile import TemporaryDirectory
-from typing import Any, List, Match, Optional, Union
+from typing import Any
 
 import attr
 import click
 import git
+import github
+import github.Auth
 from click.exceptions import ClickException
 from git import GitCommandError, Repo
 from github import BadCredentialsException, Github
@@ -289,6 +291,12 @@ def _prepare() -> None:
     synapse_repo.git.add("-u")
     subprocess.run("git diff --cached", shell=True)
 
+    print(
+        "Consider any upcoming platform deprecations that should be mentioned in the changelog. (e.g. upcoming Python, PostgreSQL or SQLite deprecations)"
+    )
+    print(
+        "Platform deprecations should be mentioned at least 1 release prior to being unsupported."
+    )
     if click.confirm("Edit changelog?", default=False):
         click.edit(filename="CHANGES.md")
 
@@ -314,7 +322,10 @@ def _prepare() -> None:
     )
 
     print("Opening the changelog in your browser...")
-    print("Please ask #synapse-dev to give it a check.")
+    print(
+        "Please review it using the release notes review checklist: https://element-hq.github.io/synapse/develop/development/internal_documentation/release_notes_review_checklist.html"
+    )
+    print("And post it in #synapse-dev for cursory review from the team.")
     click.launch(
         f"https://github.com/element-hq/synapse/blob/{synapse_repo.active_branch.name}/CHANGES.md"
     )
@@ -322,11 +333,11 @@ def _prepare() -> None:
 
 @cli.command()
 @click.option("--gh-token", envvar=["GH_TOKEN", "GITHUB_TOKEN"])
-def tag(gh_token: Optional[str]) -> None:
+def tag(gh_token: str | None) -> None:
     _tag(gh_token)
 
 
-def _tag(gh_token: Optional[str]) -> None:
+def _tag(gh_token: str | None) -> None:
     """Tags the release and generates a draft GitHub release"""
 
     # Test that the GH Token is valid before continuing.
@@ -397,7 +408,7 @@ def _tag(gh_token: Optional[str]) -> None:
         return
 
     # Create a new draft release
-    gh = Github(gh_token)
+    gh = Github(auth=github.Auth.Token(token=gh_token))
     gh_repo = gh.get_repo("element-hq/synapse")
     release = gh_repo.create_git_release(
         tag=tag_name,
@@ -428,7 +439,7 @@ def _publish(gh_token: str) -> None:
 
     if gh_token:
         # Test that the GH Token is valid before continuing.
-        gh = Github(gh_token)
+        gh = Github(auth=github.Auth.Token(token=gh_token))
         gh.get_user()
 
     # Make sure we're in a git repo.
@@ -441,22 +452,22 @@ def _publish(gh_token: str) -> None:
         return
 
     # Publish the draft release
-    gh = Github(gh_token)
+    gh = Github(auth=github.Auth.Token(token=gh_token))
     gh_repo = gh.get_repo("element-hq/synapse")
     for release in gh_repo.get_releases():
-        if release.title == tag_name:
+        if release.name == tag_name:
             break
     else:
         raise ClickException(f"Failed to find GitHub release for {tag_name}")
 
-    assert release.title == tag_name
+    assert release.name == tag_name
 
     if not release.draft:
         click.echo("Release already published.")
         return
 
     release = release.update_release(
-        name=release.title,
+        name=release.name,
         message=release.body,
         tag_name=release.tag_name,
         prerelease=release.prerelease,
@@ -466,11 +477,11 @@ def _publish(gh_token: str) -> None:
 
 @cli.command()
 @click.option("--gh-token", envvar=["GH_TOKEN", "GITHUB_TOKEN"], required=False)
-def upload(gh_token: Optional[str]) -> None:
+def upload(gh_token: str | None) -> None:
     _upload(gh_token)
 
 
-def _upload(gh_token: Optional[str]) -> None:
+def _upload(gh_token: str | None) -> None:
     """Upload release to pypi."""
 
     # Test that the GH Token is valid before continuing.
@@ -486,8 +497,13 @@ def _upload(gh_token: Optional[str]) -> None:
         click.echo(f"Tag {tag_name} ({tag.commit}) is not currently checked out!")
         click.get_current_context().abort()
 
+    if gh_token:
+        gh = Github(auth=github.Auth.Token(token=gh_token))
+    else:
+        # Use github anonymously.
+        gh = Github()
+
     # Query all the assets corresponding to this release.
-    gh = Github(gh_token)
     gh_repo = gh.get_repo("element-hq/synapse")
     gh_release = gh_repo.get_release(tag_name)
 
@@ -566,11 +582,11 @@ def _merge_into(repo: Repo, source: str, target: str) -> None:
 
 @cli.command()
 @click.option("--gh-token", envvar=["GH_TOKEN", "GITHUB_TOKEN"], required=False)
-def wait_for_actions(gh_token: Optional[str]) -> None:
+def wait_for_actions(gh_token: str | None) -> None:
     _wait_for_actions(gh_token)
 
 
-def _wait_for_actions(gh_token: Optional[str]) -> None:
+def _wait_for_actions(gh_token: str | None) -> None:
     # Test that the GH Token is valid before continuing.
     check_valid_gh_token(gh_token)
 
@@ -639,7 +655,16 @@ def _notify(message: str) -> None:
 
 
 @cli.command()
-def merge_back() -> None:
+# Although this option is not used, allow it anyways. Otherwise the user will
+# receive an error when providing it, which is annoying as other commands accept
+# it.
+@click.option(
+    "--gh-token",
+    "_gh_token",
+    envvar=["GH_TOKEN", "GITHUB_TOKEN"],
+    required=False,
+)
+def merge_back(_gh_token: str | None) -> None:
     _merge_back()
 
 
@@ -687,7 +712,16 @@ def _merge_back() -> None:
 
 
 @cli.command()
-def announce() -> None:
+# Although this option is not used, allow it anyways. Otherwise the user will
+# receive an error when providing it, which is annoying as other commands accept
+# it.
+@click.option(
+    "--gh-token",
+    "_gh_token",
+    envvar=["GH_TOKEN", "GITHUB_TOKEN"],
+    required=False,
+)
+def announce(_gh_token: str | None) -> None:
     _announce()
 
 
@@ -696,18 +730,31 @@ def _announce() -> None:
 
     current_version = get_package_version()
     tag_name = f"v{current_version}"
+    is_rc = "rc" in tag_name
+
+    release_text = f"""
+### Synapse {current_version} {"🧪" if is_rc else "🚀"}
 
-    click.echo(
-        f"""
 Hi everyone. Synapse {current_version} has just been released.
+"""
 
+    if "rc" in tag_name:
+        release_text += (
+            "\nThis is a release candidate. Please help us test it out "
+            "before the final release by deploying it to non-production environments, "
+            "and reporting any issues you find to "
+            "[the issue tracker](https://github.com/element-hq/synapse/issues). Thanks!\n"
+        )
+
+    release_text += f"""
 [notes](https://github.com/element-hq/synapse/releases/tag/{tag_name}) | \
 [docker](https://hub.docker.com/r/matrixdotorg/synapse/tags?name={tag_name}) | \
 [debs](https://packages.matrix.org/debian/) | \
 [pypi](https://pypi.org/project/matrix-synapse/{current_version}/)"""
-    )
 
-    if "rc" in tag_name:
+    click.echo(release_text)
+
+    if is_rc:
         click.echo(
             """
 Announce the RC in
@@ -732,7 +779,7 @@ Ask the designated people to do the blog and tweets."""
 def full(gh_token: str) -> None:
     if gh_token:
         # Test that the GH Token is valid before continuing.
-        gh = Github(gh_token)
+        gh = Github(auth=github.Auth.Token(token=gh_token))
         gh.get_user()
 
     click.echo("1. If this is a security release, read the security wiki page.")
@@ -801,12 +848,16 @@ def get_repo_and_check_clean_checkout(
         raise click.ClickException(
             f"{path} is not a git repository (expecting a {name} repository)."
         )
-    if repo.is_dirty():
-        raise click.ClickException(f"Uncommitted changes exist in {path}.")
+    while repo.is_dirty():
+        if not click.confirm(
+            f"Uncommitted changes exist in {path}. Commit or stash them. Ready to continue?"
+        ):
+            raise click.ClickException("Aborted.")
+
     return repo
 
 
-def check_valid_gh_token(gh_token: Optional[str]) -> None:
+def check_valid_gh_token(gh_token: str | None) -> None:
     """Check that a github token is valid, if supplied"""
 
     if not gh_token:
@@ -814,7 +865,7 @@ def check_valid_gh_token(gh_token: Optional[str]) -> None:
         return
 
     try:
-        gh = Github(gh_token)
+        gh = Github(auth=github.Auth.Token(token=gh_token))
 
         # We need to lookup name to trigger a request.
         _name = gh.get_user().name
@@ -822,7 +873,7 @@ def check_valid_gh_token(gh_token: Optional[str]) -> None:
         raise click.ClickException(f"Github credentials are bad: {e}")
 
 
-def find_ref(repo: git.Repo, ref_name: str) -> Optional[git.HEAD]:
+def find_ref(repo: git.Repo, ref_name: str) -> git.HEAD | None:
     """Find the branch/ref, looking first locally then in the remote."""
     if ref_name in repo.references:
         return repo.references[ref_name]
@@ -859,9 +910,9 @@ def get_changes_for_version(wanted_version: version.Version) -> str:
 
         # These are 0-based.
         start_line: int
-        end_line: Optional[int] = None  # Is none if its the last entry
+        end_line: int | None = None  # Is none if its the last entry
 
-    headings: List[VersionSection] = []
+    headings: list[VersionSection] = []
     for i, token in enumerate(tokens):
         # We look for level 1 headings (h1 tags).
         if token.type != "heading_open" or token.tag != "h1":
@@ -917,10 +968,6 @@ def generate_and_write_changelog(
     new_changes = new_changes.replace(
         "No significant changes.", f"No significant changes since {current_version}."
     )
-    new_changes += build_dependabot_changelog(
-        repo,
-        current_version,
-    )
 
     # Prepend changes to changelog
     with open("CHANGES.md", "r+") as f:
@@ -935,49 +982,5 @@ def generate_and_write_changelog(
         os.remove(filename)
 
 
-def build_dependabot_changelog(repo: Repo, current_version: version.Version) -> str:
-    """Summarise dependabot commits between `current_version` and `release_branch`.
-
-    Returns an empty string if there have been no such commits; otherwise outputs a
-    third-level markdown header followed by an unordered list."""
-    last_release_commit = repo.tag("v" + str(current_version)).commit
-    rev_spec = f"{last_release_commit.hexsha}.."
-    commits = list(git.objects.Commit.iter_items(repo, rev_spec))
-    messages = []
-    for commit in reversed(commits):
-        if commit.author.name == "dependabot[bot]":
-            message: Union[str, bytes] = commit.message
-            if isinstance(message, bytes):
-                message = message.decode("utf-8")
-            messages.append(message.split("\n", maxsplit=1)[0])
-
-    if not messages:
-        print(f"No dependabot commits in range {rev_spec}", file=sys.stderr)
-        return ""
-
-    messages.sort()
-
-    def replacer(match: Match[str]) -> str:
-        desc = match.group(1)
-        number = match.group(2)
-        return f"* {desc}. ([\\#{number}](https://github.com/element-hq/synapse/issues/{number}))"
-
-    for i, message in enumerate(messages):
-        messages[i] = re.sub(r"(.*) \(#(\d+)\)$", replacer, message)
-    messages.insert(0, "### Updates to locked dependencies\n")
-    # Add an extra blank line to the bottom of the section
-    messages.append("")
-    return "\n".join(messages)
-
-
-@cli.command()
-@click.argument("since")
-def test_dependabot_changelog(since: str) -> None:
-    """Test building the dependabot changelog.
-
-    Summarises all dependabot commits between the SINCE tag and the current git HEAD."""
-    print(build_dependabot_changelog(git.Repo("."), version.Version(since)))
-
-
 if __name__ == "__main__":
     cli()
diff --git a/scripts-dev/schema_versions.py b/scripts-dev/schema_versions.py
index 5a79a43355..8a36b94711 100755
--- a/scripts-dev/schema_versions.py
+++ b/scripts-dev/schema_versions.py
@@ -38,7 +38,7 @@ import io
 import json
 import sys
 from collections import defaultdict
-from typing import Any, Dict, Iterator, Optional, Tuple
+from typing import Any, Iterator
 
 import git
 from packaging import version
@@ -57,7 +57,7 @@ SCHEMA_VERSION_FILES = (
 OLDEST_SHOWN_VERSION = version.parse("v1.0")
 
 
-def get_schema_versions(tag: git.Tag) -> Tuple[Optional[int], Optional[int]]:
+def get_schema_versions(tag: git.Tag) -> tuple[int | None, int | None]:
     """Get the schema and schema compat versions for a tag."""
     schema_version = None
     schema_compat_version = None
@@ -81,7 +81,7 @@ def get_schema_versions(tag: git.Tag) -> Tuple[Optional[int], Optional[int]]:
             # SCHEMA_COMPAT_VERSION is sometimes across multiple lines, the easist
             # thing to do is exec the code. Luckily it has only ever existed in
             # a file which imports nothing else from Synapse.
-            locals: Dict[str, Any] = {}
+            locals: dict[str, Any] = {}
             exec(schema_file.data_stream.read().decode("utf-8"), {}, locals)
             schema_version = locals["SCHEMA_VERSION"]
             schema_compat_version = locals.get("SCHEMA_COMPAT_VERSION")
@@ -172,7 +172,7 @@ if __name__ == "__main__":
         # Expect JSON data on stdin.
         context, book = json.load(sys.stdin)
 
-        for section in book["sections"]:
+        for section in book["items"]:
             if "Chapter" in section and section["Chapter"]["path"] == "upgrade.md":
                 section["Chapter"]["content"] = section["Chapter"]["content"].replace(
                     "<!-- REPLACE_WITH_SCHEMA_VERSIONS -->", calculate_version_chart()
diff --git a/scripts-dev/sign_json.py b/scripts-dev/sign_json.py
index 14aacf9382..40e0c529da 100755
--- a/scripts-dev/sign_json.py
+++ b/scripts-dev/sign_json.py
@@ -30,7 +30,7 @@ from signedjson.sign import sign_json
 
 from synapse.api.room_versions import KNOWN_ROOM_VERSIONS
 from synapse.crypto.event_signing import add_hashes_and_signatures
-from synapse.util import json_encoder
+from synapse.util.json import json_encoder
 
 
 def main() -> None:
diff --git a/stubs/sortedcontainers/sorteddict.pyi b/stubs/sortedcontainers/sorteddict.pyi
index 81f581b034..8616f8d4f7 100644
--- a/stubs/sortedcontainers/sorteddict.pyi
+++ b/stubs/sortedcontainers/sorteddict.pyi
@@ -7,20 +7,14 @@ from __future__ import annotations
 from typing import (
     Any,
     Callable,
-    Dict,
     Hashable,
     ItemsView,
     Iterable,
     Iterator,
     KeysView,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     ValuesView,
     overload,
 )
@@ -35,14 +29,14 @@ _VT_co = TypeVar("_VT_co", covariant=True)
 _SD = TypeVar("_SD", bound=SortedDict)
 _Key = Callable[[_T], Any]
 
-class SortedDict(Dict[_KT, _VT]):
+class SortedDict(dict[_KT, _VT]):
     @overload
     def __init__(self, **kwargs: _VT) -> None: ...
     @overload
     def __init__(self, __map: Mapping[_KT, _VT], **kwargs: _VT) -> None: ...
     @overload
     def __init__(
-        self, __iterable: Iterable[Tuple[_KT, _VT]], **kwargs: _VT
+        self, __iterable: Iterable[tuple[_KT, _VT]], **kwargs: _VT
     ) -> None: ...
     @overload
     def __init__(self, __key: _Key[_KT], **kwargs: _VT) -> None: ...
@@ -52,10 +46,10 @@ class SortedDict(Dict[_KT, _VT]):
     ) -> None: ...
     @overload
     def __init__(
-        self, __key: _Key[_KT], __iterable: Iterable[Tuple[_KT, _VT]], **kwargs: _VT
+        self, __key: _Key[_KT], __iterable: Iterable[tuple[_KT, _VT]], **kwargs: _VT
     ) -> None: ...
     @property
-    def key(self) -> Optional[_Key[_KT]]: ...
+    def key(self) -> _Key[_KT] | None: ...
     @property
     def iloc(self) -> SortedKeysView[_KT]: ...
     def clear(self) -> None: ...
@@ -83,10 +77,10 @@ class SortedDict(Dict[_KT, _VT]):
     @overload
     def pop(self, key: _KT) -> _VT: ...
     @overload
-    def pop(self, key: _KT, default: _T = ...) -> Union[_VT, _T]: ...
-    def popitem(self, index: int = ...) -> Tuple[_KT, _VT]: ...
-    def peekitem(self, index: int = ...) -> Tuple[_KT, _VT]: ...
-    def setdefault(self, key: _KT, default: Optional[_VT] = ...) -> _VT: ...
+    def pop(self, key: _KT, default: _T = ...) -> _VT | _T: ...
+    def popitem(self, index: int = ...) -> tuple[_KT, _VT]: ...
+    def peekitem(self, index: int = ...) -> tuple[_KT, _VT]: ...
+    def setdefault(self, key: _KT, default: _VT | None = ...) -> _VT: ...
     # Mypy now reports the first overload as an error, because typeshed widened the type
     # of `__map` to its internal `_typeshed.SupportsKeysAndGetItem` type in
     #   https://github.com/python/typeshed/pull/6653
@@ -102,16 +96,16 @@ class SortedDict(Dict[_KT, _VT]):
     # def update(self, **kwargs: _VT) -> None: ...
     def __reduce__(
         self,
-    ) -> Tuple[
-        Type[SortedDict[_KT, _VT]],
-        Tuple[Callable[[_KT], Any], List[Tuple[_KT, _VT]]],
+    ) -> tuple[
+        type[SortedDict[_KT, _VT]],
+        tuple[Callable[[_KT], Any], list[tuple[_KT, _VT]]],
     ]: ...
     def __repr__(self) -> str: ...
     def _check(self) -> None: ...
     def islice(
         self,
-        start: Optional[int] = ...,
-        stop: Optional[int] = ...,
+        start: int | None = ...,
+        stop: int | None = ...,
         reverse: bool = ...,
     ) -> Iterator[_KT]: ...
     def bisect_left(self, value: _KT) -> int: ...
@@ -121,20 +115,20 @@ class SortedKeysView(KeysView[_KT_co], Sequence[_KT_co]):
     @overload
     def __getitem__(self, index: int) -> _KT_co: ...
     @overload
-    def __getitem__(self, index: slice) -> List[_KT_co]: ...
-    def __delitem__(self, index: Union[int, slice]) -> None: ...
+    def __getitem__(self, index: slice) -> list[_KT_co]: ...
+    def __delitem__(self, index: int | slice) -> None: ...
 
-class SortedItemsView(ItemsView[_KT_co, _VT_co], Sequence[Tuple[_KT_co, _VT_co]]):
-    def __iter__(self) -> Iterator[Tuple[_KT_co, _VT_co]]: ...
+class SortedItemsView(ItemsView[_KT_co, _VT_co], Sequence[tuple[_KT_co, _VT_co]]):
+    def __iter__(self) -> Iterator[tuple[_KT_co, _VT_co]]: ...
     @overload
-    def __getitem__(self, index: int) -> Tuple[_KT_co, _VT_co]: ...
+    def __getitem__(self, index: int) -> tuple[_KT_co, _VT_co]: ...
     @overload
-    def __getitem__(self, index: slice) -> List[Tuple[_KT_co, _VT_co]]: ...
-    def __delitem__(self, index: Union[int, slice]) -> None: ...
+    def __getitem__(self, index: slice) -> list[tuple[_KT_co, _VT_co]]: ...
+    def __delitem__(self, index: int | slice) -> None: ...
 
 class SortedValuesView(ValuesView[_VT_co], Sequence[_VT_co]):
     @overload
     def __getitem__(self, index: int) -> _VT_co: ...
     @overload
-    def __getitem__(self, index: slice) -> List[_VT_co]: ...
-    def __delitem__(self, index: Union[int, slice]) -> None: ...
+    def __getitem__(self, index: slice) -> list[_VT_co]: ...
+    def __delitem__(self, index: int | slice) -> None: ...
diff --git a/stubs/sortedcontainers/sortedlist.pyi b/stubs/sortedcontainers/sortedlist.pyi
index 0e745c0a79..f5e056111b 100644
--- a/stubs/sortedcontainers/sortedlist.pyi
+++ b/stubs/sortedcontainers/sortedlist.pyi
@@ -9,14 +9,9 @@ from typing import (
     Callable,
     Iterable,
     Iterator,
-    List,
     MutableSequence,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     overload,
 )
 
@@ -32,20 +27,20 @@ class SortedList(MutableSequence[_T]):
     DEFAULT_LOAD_FACTOR: int = ...
     def __init__(
         self,
-        iterable: Optional[Iterable[_T]] = ...,
-        key: Optional[_Key[_T]] = ...,
+        iterable: Iterable[_T] | None = ...,
+        key: _Key[_T] | None = ...,
     ): ...
     # NB: currently mypy does not honour return type, see mypy #3307
     @overload
-    def __new__(cls: Type[_SL], iterable: None, key: None) -> _SL: ...
+    def __new__(cls: type[_SL], iterable: None, key: None) -> _SL: ...
     @overload
-    def __new__(cls: Type[_SL], iterable: None, key: _Key[_T]) -> SortedKeyList[_T]: ...
+    def __new__(cls: type[_SL], iterable: None, key: _Key[_T]) -> SortedKeyList[_T]: ...
     @overload
-    def __new__(cls: Type[_SL], iterable: Iterable[_T], key: None) -> _SL: ...
+    def __new__(cls: type[_SL], iterable: Iterable[_T], key: None) -> _SL: ...
     @overload
     def __new__(cls, iterable: Iterable[_T], key: _Key[_T]) -> SortedKeyList[_T]: ...
     @property
-    def key(self) -> Optional[Callable[[_T], Any]]: ...
+    def key(self) -> Callable[[_T], Any] | None: ...
     def _reset(self, load: int) -> None: ...
     def clear(self) -> None: ...
     def _clear(self) -> None: ...
@@ -60,15 +55,15 @@ class SortedList(MutableSequence[_T]):
     def _pos(self, idx: int) -> int: ...
     def _build_index(self) -> None: ...
     def __contains__(self, value: Any) -> bool: ...
-    def __delitem__(self, index: Union[int, slice]) -> None: ...
+    def __delitem__(self, index: int | slice) -> None: ...
     @overload
     def __getitem__(self, index: int) -> _T: ...
     @overload
-    def __getitem__(self, index: slice) -> List[_T]: ...
+    def __getitem__(self, index: slice) -> list[_T]: ...
     @overload
     def _getitem(self, index: int) -> _T: ...
     @overload
-    def _getitem(self, index: slice) -> List[_T]: ...
+    def _getitem(self, index: slice) -> list[_T]: ...
     @overload
     def __setitem__(self, index: int, value: _T) -> None: ...
     @overload
@@ -79,8 +74,8 @@ class SortedList(MutableSequence[_T]):
     def reverse(self) -> None: ...
     def islice(
         self,
-        start: Optional[int] = ...,
-        stop: Optional[int] = ...,
+        start: int | None = ...,
+        stop: int | None = ...,
         reverse: bool = ...,
     ) -> Iterator[_T]: ...
     def _islice(
@@ -93,9 +88,9 @@ class SortedList(MutableSequence[_T]):
     ) -> Iterator[_T]: ...
     def irange(
         self,
-        minimum: Optional[int] = ...,
-        maximum: Optional[int] = ...,
-        inclusive: Tuple[bool, bool] = ...,
+        minimum: int | None = ...,
+        maximum: int | None = ...,
+        inclusive: tuple[bool, bool] = ...,
         reverse: bool = ...,
     ) -> Iterator[_T]: ...
     def bisect_left(self, value: _T) -> int: ...
@@ -110,7 +105,7 @@ class SortedList(MutableSequence[_T]):
     def insert(self, index: int, value: _T) -> None: ...
     def pop(self, index: int = ...) -> _T: ...
     def index(
-        self, value: _T, start: Optional[int] = ..., stop: Optional[int] = ...
+        self, value: _T, start: int | None = ..., stop: int | None = ...
     ) -> int: ...
     def __add__(self: _SL, other: Iterable[_T]) -> _SL: ...
     def __radd__(self: _SL, other: Iterable[_T]) -> _SL: ...
@@ -129,10 +124,10 @@ class SortedList(MutableSequence[_T]):
 
 class SortedKeyList(SortedList[_T]):
     def __init__(
-        self, iterable: Optional[Iterable[_T]] = ..., key: _Key[_T] = ...
+        self, iterable: Iterable[_T] | None = ..., key: _Key[_T] = ...
     ) -> None: ...
     def __new__(
-        cls, iterable: Optional[Iterable[_T]] = ..., key: _Key[_T] = ...
+        cls, iterable: Iterable[_T] | None = ..., key: _Key[_T] = ...
     ) -> SortedKeyList[_T]: ...
     @property
     def key(self) -> Callable[[_T], Any]: ...
@@ -149,16 +144,16 @@ class SortedKeyList(SortedList[_T]):
     def _delete(self, pos: int, idx: int) -> None: ...
     def irange(
         self,
-        minimum: Optional[int] = ...,
-        maximum: Optional[int] = ...,
-        inclusive: Tuple[bool, bool] = ...,
+        minimum: int | None = ...,
+        maximum: int | None = ...,
+        inclusive: tuple[bool, bool] = ...,
         reverse: bool = ...,
     ) -> Iterator[_T]: ...
     def irange_key(
         self,
-        min_key: Optional[Any] = ...,
-        max_key: Optional[Any] = ...,
-        inclusive: Tuple[bool, bool] = ...,
+        min_key: Any | None = ...,
+        max_key: Any | None = ...,
+        inclusive: tuple[bool, bool] = ...,
         reserve: bool = ...,
     ) -> Iterator[_T]: ...
     def bisect_left(self, value: _T) -> int: ...
@@ -173,7 +168,7 @@ class SortedKeyList(SortedList[_T]):
     def copy(self: _SKL) -> _SKL: ...
     def __copy__(self: _SKL) -> _SKL: ...
     def index(
-        self, value: _T, start: Optional[int] = ..., stop: Optional[int] = ...
+        self, value: _T, start: int | None = ..., stop: int | None = ...
     ) -> int: ...
     def __add__(self: _SKL, other: Iterable[_T]) -> _SKL: ...
     def __radd__(self: _SKL, other: Iterable[_T]) -> _SKL: ...
diff --git a/stubs/sortedcontainers/sortedset.pyi b/stubs/sortedcontainers/sortedset.pyi
index 6db11eacbe..da2696b262 100644
--- a/stubs/sortedcontainers/sortedset.pyi
+++ b/stubs/sortedcontainers/sortedset.pyi
@@ -10,15 +10,9 @@ from typing import (
     Hashable,
     Iterable,
     Iterator,
-    List,
     MutableSet,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     overload,
 )
 
@@ -32,21 +26,19 @@ _Key = Callable[[_T], Any]
 class SortedSet(MutableSet[_T], Sequence[_T]):
     def __init__(
         self,
-        iterable: Optional[Iterable[_T]] = ...,
-        key: Optional[_Key[_T]] = ...,
+        iterable: Iterable[_T] | None = ...,
+        key: _Key[_T] | None = ...,
     ) -> None: ...
     @classmethod
-    def _fromset(
-        cls, values: Set[_T], key: Optional[_Key[_T]] = ...
-    ) -> SortedSet[_T]: ...
+    def _fromset(cls, values: set[_T], key: _Key[_T] | None = ...) -> SortedSet[_T]: ...
     @property
-    def key(self) -> Optional[_Key[_T]]: ...
+    def key(self) -> _Key[_T] | None: ...
     def __contains__(self, value: Any) -> bool: ...
     @overload
     def __getitem__(self, index: int) -> _T: ...
     @overload
-    def __getitem__(self, index: slice) -> List[_T]: ...
-    def __delitem__(self, index: Union[int, slice]) -> None: ...
+    def __getitem__(self, index: slice) -> list[_T]: ...
+    def __delitem__(self, index: int | slice) -> None: ...
     def __eq__(self, other: Any) -> bool: ...
     def __ne__(self, other: Any) -> bool: ...
     def __lt__(self, other: Iterable[_T]) -> bool: ...
@@ -66,53 +58,49 @@ class SortedSet(MutableSet[_T], Sequence[_T]):
     def _discard(self, value: _T) -> None: ...
     def pop(self, index: int = ...) -> _T: ...
     def remove(self, value: _T) -> None: ...
-    def difference(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __sub__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def difference_update(
-        self, *iterables: Iterable[_S]
-    ) -> SortedSet[Union[_T, _S]]: ...
-    def __isub__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def intersection(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __and__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __rand__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def intersection_update(
-        self, *iterables: Iterable[_S]
-    ) -> SortedSet[Union[_T, _S]]: ...
-    def __iand__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def symmetric_difference(self, other: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __xor__(self, other: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __rxor__(self, other: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
+    def difference(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __sub__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def difference_update(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __isub__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def intersection(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __and__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __rand__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def intersection_update(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __iand__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def symmetric_difference(self, other: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __xor__(self, other: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __rxor__(self, other: Iterable[_S]) -> SortedSet[_T | _S]: ...
     def symmetric_difference_update(
         self, other: Iterable[_S]
-    ) -> SortedSet[Union[_T, _S]]: ...
-    def __ixor__(self, other: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def union(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __or__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __ror__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def update(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def __ior__(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
-    def _update(self, *iterables: Iterable[_S]) -> SortedSet[Union[_T, _S]]: ...
+    ) -> SortedSet[_T | _S]: ...
+    def __ixor__(self, other: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def union(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __or__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __ror__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def update(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def __ior__(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
+    def _update(self, *iterables: Iterable[_S]) -> SortedSet[_T | _S]: ...
     def __reduce__(
         self,
-    ) -> Tuple[Type[SortedSet[_T]], Set[_T], Callable[[_T], Any]]: ...
+    ) -> tuple[type[SortedSet[_T]], set[_T], Callable[[_T], Any]]: ...
     def __repr__(self) -> str: ...
     def _check(self) -> None: ...
     def bisect_left(self, value: _T) -> int: ...
     def bisect_right(self, value: _T) -> int: ...
     def islice(
         self,
-        start: Optional[int] = ...,
-        stop: Optional[int] = ...,
+        start: int | None = ...,
+        stop: int | None = ...,
         reverse: bool = ...,
     ) -> Iterator[_T]: ...
     def irange(
         self,
-        minimum: Optional[_T] = ...,
-        maximum: Optional[_T] = ...,
-        inclusive: Tuple[bool, bool] = ...,
+        minimum: _T | None = ...,
+        maximum: _T | None = ...,
+        inclusive: tuple[bool, bool] = ...,
         reverse: bool = ...,
     ) -> Iterator[_T]: ...
     def index(
-        self, value: _T, start: Optional[int] = ..., stop: Optional[int] = ...
+        self, value: _T, start: int | None = ..., stop: int | None = ...
     ) -> int: ...
     def _reset(self, load: int) -> None: ...
diff --git a/stubs/txredisapi.pyi b/stubs/txredisapi.pyi
index c9a4114b1e..50ab54037a 100644
--- a/stubs/txredisapi.pyi
+++ b/stubs/txredisapi.pyi
@@ -15,7 +15,7 @@
 
 """Contains *incomplete* type hints for txredisapi."""
 
-from typing import Any, List, Optional, Type, Union
+from typing import Any
 
 from twisted.internet import protocol
 from twisted.internet.defer import Deferred
@@ -29,8 +29,8 @@ class RedisProtocol(protocol.Protocol):
         self,
         key: str,
         value: Any,
-        expire: Optional[int] = None,
-        pexpire: Optional[int] = None,
+        expire: int | None = None,
+        pexpire: int | None = None,
         only_if_not_exists: bool = False,
         only_if_exists: bool = False,
     ) -> "Deferred[None]": ...
@@ -38,8 +38,8 @@ class RedisProtocol(protocol.Protocol):
 
 class SubscriberProtocol(RedisProtocol):
     def __init__(self, *args: object, **kwargs: object): ...
-    password: Optional[str]
-    def subscribe(self, channels: Union[str, List[str]]) -> "Deferred[None]": ...
+    password: str | None
+    def subscribe(self, channels: str | list[str]) -> "Deferred[None]": ...
     def connectionMade(self) -> None: ...
     # type-ignore: twisted.internet.protocol.Protocol provides a default argument for
     # `reason`. txredisapi's LineReceiver Protocol doesn't. But that's fine: it's what's
@@ -49,12 +49,12 @@ class SubscriberProtocol(RedisProtocol):
 def lazyConnection(
     host: str = ...,
     port: int = ...,
-    dbid: Optional[int] = ...,
+    dbid: int | None = ...,
     reconnect: bool = ...,
     charset: str = ...,
-    password: Optional[str] = ...,
-    connectTimeout: Optional[int] = ...,
-    replyTimeout: Optional[int] = ...,
+    password: str | None = ...,
+    connectTimeout: int | None = ...,
+    replyTimeout: int | None = ...,
     convertNumbers: bool = ...,
 ) -> RedisProtocol: ...
 
@@ -69,19 +69,19 @@ class UnixConnectionHandler(ConnectionHandler): ...
 class RedisFactory(protocol.ReconnectingClientFactory):
     continueTrying: bool
     handler: ConnectionHandler
-    pool: List[RedisProtocol]
-    replyTimeout: Optional[int]
+    pool: list[RedisProtocol]
+    replyTimeout: int | None
     def __init__(
         self,
         uuid: str,
-        dbid: Optional[int],
+        dbid: int | None,
         poolsize: int,
         isLazy: bool = False,
-        handler: Type = ConnectionHandler,
+        handler: type = ConnectionHandler,
         charset: str = "utf-8",
-        password: Optional[str] = None,
-        replyTimeout: Optional[int] = None,
-        convertNumbers: Optional[int] = True,
+        password: str | None = None,
+        replyTimeout: int | None = None,
+        convertNumbers: int | None = True,
     ): ...
     def buildProtocol(self, addr: IAddress) -> RedisProtocol: ...
 
diff --git a/synapse/__init__.py b/synapse/__init__.py
index 3bd1b3307e..2bed060878 100644
--- a/synapse/__init__.py
+++ b/synapse/__init__.py
@@ -24,7 +24,7 @@
 
 import os
 import sys
-from typing import Any, Dict
+from typing import Any
 
 from PIL import ImageFile
 
@@ -39,8 +39,8 @@ ImageFile.LOAD_TRUNCATED_IMAGES = True
 # Note that we use an (unneeded) variable here so that pyupgrade doesn't nuke the
 # if-statement completely.
 py_version = sys.version_info
-if py_version < (3, 9):
-    print("Synapse requires Python 3.9 or above.")
+if py_version < (3, 10):
+    print("Synapse requires Python 3.10 or above.")
     sys.exit(1)
 
 # Allow using the asyncio reactor via env var.
@@ -70,7 +70,7 @@ try:
     from canonicaljson import register_preserialisation_callback
     from immutabledict import immutabledict
 
-    def _immutabledict_cb(d: immutabledict) -> Dict[str, Any]:
+    def _immutabledict_cb(d: immutabledict) -> dict[str, Any]:
         try:
             return d._dict
         except Exception:
diff --git a/synapse/_pydantic_compat.py b/synapse/_pydantic_compat.py
deleted file mode 100644
index a520c0e897..0000000000
--- a/synapse/_pydantic_compat.py
+++ /dev/null
@@ -1,104 +0,0 @@
-#
-# This file is licensed under the Affero General Public License (AGPL) version 3.
-#
-# Copyright 2023 Maxwell G <maxwell@gtmx.me>
-# Copyright (C) 2023 New Vector, Ltd
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# See the GNU Affero General Public License for more details:
-# <https://www.gnu.org/licenses/agpl-3.0.html>.
-#
-# Originally licensed under the Apache License, Version 2.0:
-# <http://www.apache.org/licenses/LICENSE-2.0>.
-#
-# [This file includes modifications made by New Vector Limited]
-#
-#
-
-from typing import TYPE_CHECKING
-
-from packaging.version import Version
-
-try:
-    from pydantic import __version__ as pydantic_version
-except ImportError:
-    import importlib.metadata
-
-    pydantic_version = importlib.metadata.version("pydantic")
-
-HAS_PYDANTIC_V2: bool = Version(pydantic_version).major == 2
-
-if TYPE_CHECKING or HAS_PYDANTIC_V2:
-    from pydantic.v1 import (
-        AnyHttpUrl,
-        BaseModel,
-        Extra,
-        Field,
-        FilePath,
-        MissingError,
-        PydanticValueError,
-        StrictBool,
-        StrictInt,
-        StrictStr,
-        ValidationError,
-        conbytes,
-        confloat,
-        conint,
-        constr,
-        parse_obj_as,
-        root_validator,
-        validator,
-    )
-    from pydantic.v1.error_wrappers import ErrorWrapper
-    from pydantic.v1.typing import get_args
-else:
-    from pydantic import (
-        AnyHttpUrl,
-        BaseModel,
-        Extra,
-        Field,
-        FilePath,
-        MissingError,
-        PydanticValueError,
-        StrictBool,
-        StrictInt,
-        StrictStr,
-        ValidationError,
-        conbytes,
-        confloat,
-        conint,
-        constr,
-        parse_obj_as,
-        root_validator,
-        validator,
-    )
-    from pydantic.error_wrappers import ErrorWrapper
-    from pydantic.typing import get_args
-
-__all__ = (
-    "HAS_PYDANTIC_V2",
-    "AnyHttpUrl",
-    "BaseModel",
-    "constr",
-    "conbytes",
-    "conint",
-    "confloat",
-    "ErrorWrapper",
-    "Extra",
-    "Field",
-    "FilePath",
-    "get_args",
-    "MissingError",
-    "parse_obj_as",
-    "PydanticValueError",
-    "StrictBool",
-    "StrictInt",
-    "StrictStr",
-    "ValidationError",
-    "validator",
-    "root_validator",
-)
diff --git a/synapse/_scripts/export_signing_key.py b/synapse/_scripts/export_signing_key.py
index 690115aabe..bab5953802 100755
--- a/synapse/_scripts/export_signing_key.py
+++ b/synapse/_scripts/export_signing_key.py
@@ -22,13 +22,13 @@
 import argparse
 import sys
 import time
-from typing import NoReturn, Optional
+from typing import NoReturn
 
 from signedjson.key import encode_verify_key_base64, get_verify_key, read_signing_keys
 from signedjson.types import VerifyKey
 
 
-def exit(status: int = 0, message: Optional[str] = None) -> NoReturn:
+def exit(status: int = 0, message: str | None = None) -> NoReturn:
     if message:
         print(message, file=sys.stderr)
     sys.exit(status)
diff --git a/synapse/_scripts/generate_workers_map.py b/synapse/_scripts/generate_workers_map.py
index 09feb8cf30..3fa27b4b2a 100755
--- a/synapse/_scripts/generate_workers_map.py
+++ b/synapse/_scripts/generate_workers_map.py
@@ -25,7 +25,7 @@ import logging
 import re
 from collections import defaultdict
 from dataclasses import dataclass
-from typing import Dict, Iterable, Optional, Pattern, Set, Tuple
+from typing import Iterable, Pattern
 
 import yaml
 
@@ -46,7 +46,7 @@ logger = logging.getLogger("generate_workers_map")
 class MockHomeserver(HomeServer):
     DATASTORE_CLASS = DataStore
 
-    def __init__(self, config: HomeServerConfig, worker_app: Optional[str]) -> None:
+    def __init__(self, config: HomeServerConfig, worker_app: str | None) -> None:
         super().__init__(config.server.server_name, config=config)
         self.config.worker.worker_app = worker_app
 
@@ -65,7 +65,7 @@ class EndpointDescription:
 
     # The category of this endpoint. Is read from the `CATEGORY` constant in the servlet
     # class.
-    category: Optional[str]
+    category: str | None
 
     # TODO:
     #  - does it need to be routed based on a stream writer config?
@@ -81,7 +81,7 @@ class EnumerationResource(HttpServer):
     """
 
     def __init__(self, is_worker: bool) -> None:
-        self.registrations: Dict[Tuple[str, str], EndpointDescription] = {}
+        self.registrations: dict[tuple[str, str], EndpointDescription] = {}
         self._is_worker = is_worker
 
     def register_paths(
@@ -115,7 +115,7 @@ class EnumerationResource(HttpServer):
 
 def get_registered_paths_for_hs(
     hs: HomeServer,
-) -> Dict[Tuple[str, str], EndpointDescription]:
+) -> dict[tuple[str, str], EndpointDescription]:
     """
     Given a homeserver, get all registered endpoints and their descriptions.
     """
@@ -141,8 +141,8 @@ def get_registered_paths_for_hs(
 
 
 def get_registered_paths_for_default(
-    worker_app: Optional[str], base_config: HomeServerConfig
-) -> Dict[Tuple[str, str], EndpointDescription]:
+    worker_app: str | None, base_config: HomeServerConfig
+) -> dict[tuple[str, str], EndpointDescription]:
     """
     Given the name of a worker application and a base homeserver configuration,
     returns:
@@ -153,15 +153,24 @@ def get_registered_paths_for_default(
     """
 
     hs = MockHomeserver(base_config, worker_app)
+
     # TODO We only do this to avoid an error, but don't need the database etc
     hs.setup()
-    return get_registered_paths_for_hs(hs)
+    registered_paths = get_registered_paths_for_hs(hs)
+    # NOTE: a more robust implementation would properly shutdown/cleanup each server
+    # to avoid resource buildup.
+    # However, the call to `shutdown` is `async` so it would require additional complexity here.
+    # We are intentionally skipping this cleanup because this is a short-lived, one-off
+    # utility script where the simpler approach is sufficient and we shouldn't run into
+    # any resource buildup issues.
+
+    return registered_paths
 
 
 def elide_http_methods_if_unconflicting(
-    registrations: Dict[Tuple[str, str], EndpointDescription],
-    all_possible_registrations: Dict[Tuple[str, str], EndpointDescription],
-) -> Dict[Tuple[str, str], EndpointDescription]:
+    registrations: dict[tuple[str, str], EndpointDescription],
+    all_possible_registrations: dict[tuple[str, str], EndpointDescription],
+) -> dict[tuple[str, str], EndpointDescription]:
     """
     Elides HTTP methods (by replacing them with `*`) if all possible registered methods
     can be handled by the worker whose registration map is `registrations`.
@@ -171,13 +180,13 @@ def elide_http_methods_if_unconflicting(
     """
 
     def paths_to_methods_dict(
-        methods_and_paths: Iterable[Tuple[str, str]],
-    ) -> Dict[str, Set[str]]:
+        methods_and_paths: Iterable[tuple[str, str]],
+    ) -> dict[str, set[str]]:
         """
         Given (method, path) pairs, produces a dict from path to set of methods
         available at that path.
         """
-        result: Dict[str, Set[str]] = {}
+        result: dict[str, set[str]] = {}
         for method, path in methods_and_paths:
             result.setdefault(path, set()).add(method)
         return result
@@ -201,8 +210,8 @@ def elide_http_methods_if_unconflicting(
 
 
 def simplify_path_regexes(
-    registrations: Dict[Tuple[str, str], EndpointDescription],
-) -> Dict[Tuple[str, str], EndpointDescription]:
+    registrations: dict[tuple[str, str], EndpointDescription],
+) -> dict[tuple[str, str], EndpointDescription]:
     """
     Simplify all the path regexes for the dict of endpoint descriptions,
     so that we don't use the Python-specific regex extensions
@@ -261,8 +270,8 @@ def main() -> None:
 
     # TODO SSO endpoints (pick_idp etc) NOT REGISTERED BY THIS SCRIPT
 
-    categories_to_methods_and_paths: Dict[
-        Optional[str], Dict[Tuple[str, str], EndpointDescription]
+    categories_to_methods_and_paths: dict[
+        str | None, dict[tuple[str, str], EndpointDescription]
     ] = defaultdict(dict)
 
     for (method, path), desc in elided_worker_paths.items():
@@ -273,8 +282,8 @@ def main() -> None:
 
 
 def print_category(
-    category_name: Optional[str],
-    elided_worker_paths: Dict[Tuple[str, str], EndpointDescription],
+    category_name: str | None,
+    elided_worker_paths: dict[tuple[str, str], EndpointDescription],
 ) -> None:
     """
     Prints out a category, in documentation page style.
diff --git a/synapse/_scripts/hash_password.py b/synapse/_scripts/hash_password.py
index 2b7d3585cb..ae475b8490 100755
--- a/synapse/_scripts/hash_password.py
+++ b/synapse/_scripts/hash_password.py
@@ -73,8 +73,18 @@ def main() -> None:
 
     pw = unicodedata.normalize("NFKC", password)
 
+    bytes_to_hash = pw.encode("utf8") + password_pepper.encode("utf8")
+    if len(bytes_to_hash) > 72:
+        # bcrypt only looks at the first 72 bytes
+        print(
+            f"Password + pepper is too long ({len(bytes_to_hash)} bytes); truncating to 72 bytes for bcrypt. "
+            "This is expected behaviour and will not affect a user's ability to log in. 72 bytes is "
+            "sufficient entropy for a password."
+        )
+        bytes_to_hash = bytes_to_hash[:72]
+
     hashed = bcrypt.hashpw(
-        pw.encode("utf8") + password_pepper.encode("utf8"),
+        bytes_to_hash,
         bcrypt.gensalt(bcrypt_rounds),
     ).decode("ascii")
 
diff --git a/synapse/_scripts/register_new_matrix_user.py b/synapse/_scripts/register_new_matrix_user.py
index 4897fa94b0..ff6e4e297b 100644
--- a/synapse/_scripts/register_new_matrix_user.py
+++ b/synapse/_scripts/register_new_matrix_user.py
@@ -26,7 +26,7 @@ import hashlib
 import hmac
 import logging
 import sys
-from typing import Any, Callable, Dict, Optional
+from typing import Any, Callable, Iterable, TextIO
 
 import requests
 import yaml
@@ -54,7 +54,7 @@ def request_registration(
     server_location: str,
     shared_secret: str,
     admin: bool = False,
-    user_type: Optional[str] = None,
+    user_type: str | None = None,
     _print: Callable[[str], None] = print,
     exit: Callable[[int], None] = sys.exit,
     exists_ok: bool = False,
@@ -123,13 +123,13 @@ def register_new_user(
     password: str,
     server_location: str,
     shared_secret: str,
-    admin: Optional[bool],
-    user_type: Optional[str],
+    admin: bool | None,
+    user_type: str | None,
     exists_ok: bool = False,
 ) -> None:
     if not user:
         try:
-            default_user: Optional[str] = getpass.getuser()
+            default_user: str | None = getpass.getuser()
         except Exception:
             default_user = None
 
@@ -244,6 +244,7 @@ def main() -> None:
     group.add_argument(
         "-c",
         "--config",
+        action="append",
         type=argparse.FileType("r"),
         help="Path to server config file. Used to read in shared secret.",
     )
@@ -262,9 +263,9 @@ def main() -> None:
 
     args = parser.parse_args()
 
-    config: Optional[Dict[str, Any]] = None
+    config: dict[str, Any] | None = None
     if "config" in args and args.config:
-        config = yaml.safe_load(args.config)
+        config = _read_config_files(args.config)
 
     if args.shared_secret:
         secret = args.shared_secret
@@ -326,6 +327,33 @@ def main() -> None:
     )
 
 
+# Adapted from synapse.config._base.
+def _read_config_files(config_files: Iterable[TextIO]) -> dict[str, Any]:
+    """Read the config files and shallowly merge them into a dict.
+
+    Successive configurations are shallowly merged into ones provided earlier,
+    i.e., entirely replacing top-level sections of the configuration.
+
+    Args:
+        config_files: A list of the config files to read
+
+    Returns:
+        The configuration dictionary.
+    """
+    specified_config = {}
+    for config_file in config_files:
+        yaml_config = yaml.safe_load(config_file)
+
+        if not isinstance(yaml_config, dict):
+            err = "File %r is empty or doesn't parse into a key-value map. IGNORING."
+            print(err % (config_file,))
+            continue
+
+        specified_config.update(yaml_config)
+
+    return specified_config
+
+
 def _read_file(file_path: Any, config_path: str) -> str:
     """Check the given file exists, and read it into a string
 
@@ -350,7 +378,7 @@ def _read_file(file_path: Any, config_path: str) -> str:
         sys.exit(1)
 
 
-def _find_client_listener(config: Dict[str, Any]) -> Optional[str]:
+def _find_client_listener(config: dict[str, Any]) -> str | None:
     # try to find a listener in the config. Returns a host:port pair
     for listener in config.get("listeners", []):
         if listener.get("type") != "http" or listener.get("tls", False):
diff --git a/synapse/_scripts/review_recent_signups.py b/synapse/_scripts/review_recent_signups.py
index 0ff7fae567..d760a84bf2 100644
--- a/synapse/_scripts/review_recent_signups.py
+++ b/synapse/_scripts/review_recent_signups.py
@@ -23,7 +23,6 @@ import argparse
 import sys
 import time
 from datetime import datetime
-from typing import List
 
 import attr
 
@@ -50,15 +49,15 @@ class ReviewConfig(RootConfig):
 class UserInfo:
     user_id: str
     creation_ts: int
-    emails: List[str] = attr.Factory(list)
-    private_rooms: List[str] = attr.Factory(list)
-    public_rooms: List[str] = attr.Factory(list)
-    ips: List[str] = attr.Factory(list)
+    emails: list[str] = attr.Factory(list)
+    private_rooms: list[str] = attr.Factory(list)
+    public_rooms: list[str] = attr.Factory(list)
+    ips: list[str] = attr.Factory(list)
 
 
 def get_recent_users(
     txn: LoggingTransaction, since_ms: int, exclude_app_service: bool
-) -> List[UserInfo]:
+) -> list[UserInfo]:
     """Fetches recently registered users and some info on them."""
 
     sql = """
diff --git a/synapse/_scripts/synapse_port_db.py b/synapse/_scripts/synapse_port_db.py
index 0f54cfc64a..eedceb170e 100755
--- a/synapse/_scripts/synapse_port_db.py
+++ b/synapse/_scripts/synapse_port_db.py
@@ -33,15 +33,10 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
     Generator,
     Iterable,
-    List,
     NoReturn,
     Optional,
-    Set,
-    Tuple,
-    Type,
     TypedDict,
     TypeVar,
     cast,
@@ -54,15 +49,16 @@ from twisted.internet import defer, reactor as reactor_
 from synapse.config.database import DatabaseConnectionConfig
 from synapse.config.homeserver import HomeServerConfig
 from synapse.logging.context import (
-    LoggingContext,
     make_deferred_yieldable,
     run_in_background,
 )
-from synapse.notifier import ReplicationNotifier
+from synapse.server import HomeServer
+from synapse.storage import DataStore
 from synapse.storage.database import DatabasePool, LoggingTransaction, make_conn
 from synapse.storage.databases.main import FilteringWorkerStore
 from synapse.storage.databases.main.account_data import AccountDataWorkerStore
 from synapse.storage.databases.main.client_ips import ClientIpBackgroundUpdateStore
+from synapse.storage.databases.main.delayed_events import DelayedEventsStore
 from synapse.storage.databases.main.deviceinbox import DeviceInboxBackgroundUpdateStore
 from synapse.storage.databases.main.devices import DeviceBackgroundUpdateStore
 from synapse.storage.databases.main.e2e_room_keys import EndToEndRoomKeyBackgroundStore
@@ -98,7 +94,6 @@ from synapse.storage.databases.state.bg_updates import StateBackgroundUpdateStor
 from synapse.storage.engines import create_engine
 from synapse.storage.prepare_database import prepare_database
 from synapse.types import ISynapseReactor
-from synapse.util import SYNAPSE_VERSION, Clock
 
 # Cast safety: Twisted does some naughty magic which replaces the
 # twisted.internet.reactor module with a Reactor instance at runtime.
@@ -113,6 +108,7 @@ logger = logging.getLogger("synapse_port_db")
 BOOLEAN_COLUMNS = {
     "access_tokens": ["used"],
     "account_validity": ["email_sent"],
+    "delayed_events": ["is_processed"],
     "device_lists_changes_in_room": ["converted_to_destinations"],
     "device_lists_outbound_pokes": ["sent"],
     "devices": ["hidden"],
@@ -126,7 +122,7 @@ BOOLEAN_COLUMNS = {
     "presence_stream": ["currently_active"],
     "public_room_list_stream": ["visibility"],
     "pushers": ["enabled"],
-    "redactions": ["have_censored"],
+    "redactions": ["have_censored", "recheck"],
     "remote_media_cache": ["authenticated"],
     "room_memberships": ["participant"],
     "room_stats_state": ["is_federatable"],
@@ -239,14 +235,14 @@ IGNORED_BACKGROUND_UPDATES = {
 
 # Error returned by the run function. Used at the top-level part of the script to
 # handle errors and return codes.
-end_error: Optional[str] = None
+end_error: str | None = None
 # The exec_info for the error, if any. If error is defined but not exec_info the script
 # will show only the error message without the stacktrace, if exec_info is defined but
 # not the error then the script will show nothing outside of what's printed in the run
 # function. If both are defined, the script will print both the error and the stacktrace.
-end_error_exec_info: Optional[
-    Tuple[Type[BaseException], BaseException, TracebackType]
-] = None
+end_error_exec_info: tuple[type[BaseException], BaseException, TracebackType] | None = (
+    None
+)
 
 R = TypeVar("R")
 
@@ -278,12 +274,13 @@ class Store(
     RelationsWorkerStore,
     EventFederationWorkerStore,
     SlidingSyncStore,
+    DelayedEventsStore,
 ):
     def execute(self, f: Callable[..., R], *args: Any, **kwargs: Any) -> Awaitable[R]:
         return self.db_pool.runInteraction(f.__name__, f, *args, **kwargs)
 
-    def execute_sql(self, sql: str, *args: object) -> Awaitable[List[Tuple]]:
-        def r(txn: LoggingTransaction) -> List[Tuple]:
+    def execute_sql(self, sql: str, *args: object) -> Awaitable[list[tuple]]:
+        def r(txn: LoggingTransaction) -> list[tuple]:
             txn.execute(sql, args)
             return txn.fetchall()
 
@@ -293,8 +290,8 @@ class Store(
         self,
         txn: LoggingTransaction,
         table: str,
-        headers: List[str],
-        rows: List[Tuple],
+        headers: list[str],
+        rows: list[tuple],
         override_system_value: bool = False,
     ) -> None:
         sql = "INSERT INTO %s (%s) %s VALUES (%s)" % (
@@ -317,43 +314,31 @@ class Store(
         )
 
 
-class MockHomeserver:
+class MockHomeserver(HomeServer):
+    DATASTORE_CLASS = DataStore
+
     def __init__(self, config: HomeServerConfig):
-        self.clock = Clock(reactor)
-        self.config = config
-        self.hostname = config.server.server_name
-        self.version_string = SYNAPSE_VERSION
-
-    def get_clock(self) -> Clock:
-        return self.clock
-
-    def get_reactor(self) -> ISynapseReactor:
-        return reactor
-
-    def get_instance_name(self) -> str:
-        return "master"
-
-    def should_send_federation(self) -> bool:
-        return False
-
-    def get_replication_notifier(self) -> ReplicationNotifier:
-        return ReplicationNotifier()
+        super().__init__(
+            hostname=config.server.server_name,
+            config=config,
+            reactor=reactor,
+        )
 
 
 class Porter:
     def __init__(
         self,
-        sqlite_config: Dict[str, Any],
+        sqlite_config: dict[str, Any],
         progress: "Progress",
         batch_size: int,
-        hs_config: HomeServerConfig,
+        hs: HomeServer,
     ):
         self.sqlite_config = sqlite_config
         self.progress = progress
         self.batch_size = batch_size
-        self.hs_config = hs_config
+        self.hs = hs
 
-    async def setup_table(self, table: str) -> Tuple[str, int, int, int, int]:
+    async def setup_table(self, table: str) -> tuple[str, int, int, int, int]:
         if table in APPEND_ONLY_TABLES:
             # It's safe to just carry on inserting.
             row = await self.postgres_store.db_pool.simple_select_one(
@@ -416,10 +401,10 @@ class Porter:
 
         return table, already_ported, total_to_port, forward_chunk, backward_chunk
 
-    async def get_table_constraints(self) -> Dict[str, Set[str]]:
+    async def get_table_constraints(self) -> dict[str, set[str]]:
         """Returns a map of tables that have foreign key constraints to tables they depend on."""
 
-        def _get_constraints(txn: LoggingTransaction) -> Dict[str, Set[str]]:
+        def _get_constraints(txn: LoggingTransaction) -> dict[str, set[str]]:
             # We can pull the information about foreign key constraints out from
             # the postgres schema tables.
             sql = """
@@ -435,7 +420,7 @@ class Porter:
             """
             txn.execute(sql)
 
-            results: Dict[str, Set[str]] = {}
+            results: dict[str, set[str]] = {}
             for table, foreign_table in txn:
                 results.setdefault(table, set()).add(foreign_table)
             return results
@@ -503,7 +488,7 @@ class Porter:
 
             def r(
                 txn: LoggingTransaction,
-            ) -> Tuple[Optional[List[str]], List[Tuple], List[Tuple]]:
+            ) -> tuple[list[str] | None, list[tuple], list[tuple]]:
                 forward_rows = []
                 backward_rows = []
                 if do_forward[0]:
@@ -520,7 +505,7 @@ class Porter:
 
                 if forward_rows or backward_rows:
                     assert txn.description is not None
-                    headers: Optional[List[str]] = [
+                    headers: list[str] | None = [
                         column[0] for column in txn.description
                     ]
                 else:
@@ -587,7 +572,7 @@ class Porter:
 
         while True:
 
-            def r(txn: LoggingTransaction) -> Tuple[List[str], List[Tuple]]:
+            def r(txn: LoggingTransaction) -> tuple[list[str], list[tuple]]:
                 txn.execute(select, (forward_chunk, self.batch_size))
                 rows = txn.fetchall()
                 assert txn.description is not None
@@ -671,8 +656,7 @@ class Porter:
 
         engine = create_engine(db_config.config)
 
-        hs = MockHomeserver(self.hs_config)
-        server_name = hs.hostname
+        server_name = self.hs.hostname
 
         with make_conn(
             db_config=db_config,
@@ -683,9 +667,17 @@ class Porter:
             engine.check_database(
                 db_conn, allow_outdated_version=allow_outdated_version
             )
-            prepare_database(db_conn, engine, config=self.hs_config)
+            prepare_database(db_conn, engine, config=self.hs.config)
             # Type safety: ignore that we're using Mock homeservers here.
-            store = Store(DatabasePool(hs, db_config, engine), db_conn, hs)  # type: ignore[arg-type]
+            store = Store(
+                DatabasePool(
+                    self.hs,
+                    db_config,
+                    engine,
+                ),
+                db_conn,
+                self.hs,
+            )
             db_conn.commit()
 
         return store
@@ -782,7 +774,7 @@ class Porter:
                 return
 
             self.postgres_store = self.build_db_store(
-                self.hs_config.database.get_single_database()
+                self.hs.config.database.get_single_database()
             )
 
             await self.remove_ignored_background_updates_from_database()
@@ -962,7 +954,7 @@ class Porter:
             self.progress.set_state("Copying to postgres")
 
             constraints = await self.get_table_constraints()
-            tables_ported = set()  # type: Set[str]
+            tables_ported = set()  # type: set[str]
 
             while tables_to_port_info_map:
                 # Pulls out all tables that are still to be ported and which
@@ -1001,8 +993,8 @@ class Porter:
             reactor.stop()
 
     def _convert_rows(
-        self, table: str, headers: List[str], rows: List[Tuple]
-    ) -> List[Tuple]:
+        self, table: str, headers: list[str], rows: list[tuple]
+    ) -> list[tuple]:
         bool_col_names = BOOLEAN_COLUMNS.get(table, [])
 
         bool_cols = [i for i, h in enumerate(headers) if h in bool_col_names]
@@ -1036,7 +1028,7 @@ class Porter:
 
         return outrows
 
-    async def _setup_sent_transactions(self) -> Tuple[int, int, int]:
+    async def _setup_sent_transactions(self) -> tuple[int, int, int]:
         # Only save things from the last day
         yesterday = int(time.time() * 1000) - 86400000
 
@@ -1048,7 +1040,7 @@ class Porter:
             ")"
         )
 
-        def r(txn: LoggingTransaction) -> Tuple[List[str], List[Tuple]]:
+        def r(txn: LoggingTransaction) -> tuple[list[str], list[tuple]]:
             txn.execute(select)
             rows = txn.fetchall()
             assert txn.description is not None
@@ -1118,14 +1110,14 @@ class Porter:
         self, table: str, forward_chunk: int, backward_chunk: int
     ) -> int:
         frows = cast(
-            List[Tuple[int]],
+            list[tuple[int]],
             await self.sqlite_store.execute_sql(
                 "SELECT count(*) FROM %s WHERE rowid >= ?" % (table,), forward_chunk
             ),
         )
 
         brows = cast(
-            List[Tuple[int]],
+            list[tuple[int]],
             await self.sqlite_store.execute_sql(
                 "SELECT count(*) FROM %s WHERE rowid <= ?" % (table,), backward_chunk
             ),
@@ -1142,7 +1134,7 @@ class Porter:
 
     async def _get_total_count_to_port(
         self, table: str, forward_chunk: int, backward_chunk: int
-    ) -> Tuple[int, int]:
+    ) -> tuple[int, int]:
         remaining, done = await make_deferred_yieldable(
             defer.gatherResults(
                 [
@@ -1163,9 +1155,7 @@ class Porter:
         return done, remaining + done
 
     async def _setup_state_group_id_seq(self) -> None:
-        curr_id: Optional[
-            int
-        ] = await self.sqlite_store.db_pool.simple_select_one_onecol(
+        curr_id: int | None = await self.sqlite_store.db_pool.simple_select_one_onecol(
             table="state_groups", keyvalues={}, retcol="MAX(id)", allow_none=True
         )
 
@@ -1227,7 +1217,7 @@ class Porter:
     async def _setup_sequence(
         self,
         sequence_name: str,
-        stream_id_tables: Iterable[Tuple[str, str]],
+        stream_id_tables: Iterable[tuple[str, str]],
     ) -> None:
         """Set a sequence to the correct value."""
         current_stream_ids = []
@@ -1282,10 +1272,10 @@ class Porter:
 
         await self.postgres_store.db_pool.runInteraction("_setup_%s" % (seq_name,), r)
 
-    async def _pg_get_serial_sequence(self, table: str, column: str) -> Optional[str]:
+    async def _pg_get_serial_sequence(self, table: str, column: str) -> str | None:
         """Returns the name of the postgres sequence associated with a column, or NULL."""
 
-        def r(txn: LoggingTransaction) -> Optional[str]:
+        def r(txn: LoggingTransaction) -> str | None:
             txn.execute("SELECT pg_get_serial_sequence('%s', '%s')" % (table, column))
             result = txn.fetchone()
             if not result:
@@ -1297,9 +1287,9 @@ class Porter:
         )
 
     async def _setup_auth_chain_sequence(self) -> None:
-        curr_chain_id: Optional[
-            int
-        ] = await self.sqlite_store.db_pool.simple_select_one_onecol(
+        curr_chain_id: (
+            int | None
+        ) = await self.sqlite_store.db_pool.simple_select_one_onecol(
             table="event_auth_chains",
             keyvalues={},
             retcol="MAX(chain_id)",
@@ -1337,7 +1327,7 @@ class Progress:
     """Used to report progress of the port"""
 
     def __init__(self) -> None:
-        self.tables: Dict[str, TableProgress] = {}
+        self.tables: dict[str, TableProgress] = {}
 
         self.start_time = int(time.time())
 
@@ -1571,6 +1561,8 @@ def main() -> None:
     config = HomeServerConfig()
     config.parse_config_dict(hs_config, "", "")
 
+    hs = MockHomeserver(config)
+
     def start(stdscr: Optional["curses.window"] = None) -> None:
         progress: Progress
         if stdscr:
@@ -1582,15 +1574,14 @@ def main() -> None:
             sqlite_config=sqlite_config,
             progress=progress,
             batch_size=args.batch_size,
-            hs_config=config,
+            hs=hs,
         )
 
         @defer.inlineCallbacks
         def run() -> Generator["defer.Deferred[Any]", Any, None]:
-            with LoggingContext("synapse_port_db_run"):
-                yield defer.ensureDeferred(porter.run())
+            yield defer.ensureDeferred(porter.run())
 
-        reactor.callWhenRunning(run)
+        hs.get_clock().call_when_running(run)
 
         reactor.run()
 
diff --git a/synapse/_scripts/synctl.py b/synapse/_scripts/synctl.py
index 2e2aa27a17..29ab955c45 100755
--- a/synapse/_scripts/synctl.py
+++ b/synapse/_scripts/synctl.py
@@ -30,7 +30,7 @@ import signal
 import subprocess
 import sys
 import time
-from typing import Iterable, NoReturn, Optional, TextIO
+from typing import Iterable, NoReturn, TextIO
 
 import yaml
 
@@ -135,7 +135,7 @@ def start(pidfile: str, app: str, config_files: Iterable[str], daemonize: bool)
         return False
 
 
-def stop(pidfile: str, app: str) -> Optional[int]:
+def stop(pidfile: str, app: str) -> int | None:
     """Attempts to kill a synapse worker from the pidfile.
     Args:
         pidfile: path to file containing worker's pid
diff --git a/synapse/_scripts/update_synapse_database.py b/synapse/_scripts/update_synapse_database.py
index 70e5598418..ce32f47d63 100644
--- a/synapse/_scripts/update_synapse_database.py
+++ b/synapse/_scripts/update_synapse_database.py
@@ -28,11 +28,9 @@ import yaml
 from twisted.internet import defer, reactor as reactor_
 
 from synapse.config.homeserver import HomeServerConfig
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.server import HomeServer
 from synapse.storage import DataStore
 from synapse.types import ISynapseReactor
-from synapse.util import SYNAPSE_VERSION
 
 # Cast safety: Twisted does some naughty magic which replaces the
 # twisted.internet.reactor module with a Reactor instance at runtime.
@@ -48,12 +46,10 @@ class MockHomeserver(HomeServer):
             hostname=config.server.server_name,
             config=config,
             reactor=reactor,
-            version_string=f"Synapse/{SYNAPSE_VERSION}",
         )
 
 
 def run_background_updates(hs: HomeServer) -> None:
-    server_name = hs.hostname
     main = hs.get_datastores().main
     state = hs.get_datastores().state
 
@@ -67,14 +63,13 @@ def run_background_updates(hs: HomeServer) -> None:
     def run() -> None:
         # Apply all background updates on the database.
         defer.ensureDeferred(
-            run_as_background_process(
+            hs.run_as_background_process(
                 "background_updates",
-                server_name,
                 run_background_updates,
             )
         )
 
-    reactor.callWhenRunning(run)
+    hs.get_clock().call_when_running(run)
 
     reactor.run()
 
@@ -120,6 +115,13 @@ def main() -> None:
     # DB.
     hs.setup()
 
+    # This will cause all of the relevant storage classes to be instantiated and call
+    # `register_background_update_handler(...)`,
+    # `register_background_index_update(...)`,
+    # `register_background_validate_constraint(...)`, etc so they are available to use
+    # if we are asked to run those background updates.
+    hs.get_storage_controllers()
+
     if args.run_background_updates:
         run_background_updates(hs)
 
diff --git a/synapse/api/auth/__init__.py b/synapse/api/auth/__init__.py
index d253938329..201c295f06 100644
--- a/synapse/api/auth/__init__.py
+++ b/synapse/api/auth/__init__.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import TYPE_CHECKING, Optional, Protocol, Tuple
+from typing import TYPE_CHECKING, Protocol
 
 from prometheus_client import Histogram
 
@@ -51,7 +51,7 @@ class Auth(Protocol):
         room_id: str,
         requester: Requester,
         allow_departed_users: bool = False,
-    ) -> Tuple[str, Optional[str]]:
+    ) -> tuple[str, str | None]:
         """Check if the user is in the room, or was at some point.
         Args:
             room_id: The room to check.
@@ -190,7 +190,7 @@ class Auth(Protocol):
 
     async def check_user_in_room_or_world_readable(
         self, room_id: str, requester: Requester, allow_departed_users: bool = False
-    ) -> Tuple[str, Optional[str]]:
+    ) -> tuple[str, str | None]:
         """Checks that the user is or was in the room or the room is world
         readable. If it isn't then an exception is raised.
 
diff --git a/synapse/api/auth/base.py b/synapse/api/auth/base.py
index f97a71caf7..ff876b9d22 100644
--- a/synapse/api/auth/base.py
+++ b/synapse/api/auth/base.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from netaddr import IPAddress
 
@@ -64,7 +64,7 @@ class BaseAuth:
         room_id: str,
         requester: Requester,
         allow_departed_users: bool = False,
-    ) -> Tuple[str, Optional[str]]:
+    ) -> tuple[str, str | None]:
         """Check if the user is in the room, or was at some point.
         Args:
             room_id: The room to check.
@@ -114,7 +114,7 @@ class BaseAuth:
     @trace
     async def check_user_in_room_or_world_readable(
         self, room_id: str, requester: Requester, allow_departed_users: bool = False
-    ) -> Tuple[str, Optional[str]]:
+    ) -> tuple[str, str | None]:
         """Checks that the user is or was in the room or the room is world
         readable. If it isn't then an exception is raised.
 
@@ -294,7 +294,7 @@ class BaseAuth:
     @cancellable
     async def get_appservice_user(
         self, request: Request, access_token: str
-    ) -> Optional[Requester]:
+    ) -> Requester | None:
         """
         Given a request, reads the request parameters to determine:
         - whether it's an application service that's making this request
@@ -302,12 +302,9 @@ class BaseAuth:
           (the user_id URI parameter allows an application service to masquerade
           any applicable user in its namespace)
         - what device the application service should be treated as controlling
-          (the device_id[^1] URI parameter allows an application service to masquerade
+          (the device_id URI parameter allows an application service to masquerade
           as any device that exists for the relevant user)
 
-        [^1] Unstable and provided by MSC3202.
-             Must use `org.matrix.msc3202.device_id` in place of `device_id` for now.
-
         Returns:
             the application service `Requester` of that request
 
@@ -319,7 +316,8 @@ class BaseAuth:
         - The returned device ID, if present, has been checked to be a valid device ID
           for the returned user ID.
         """
-        DEVICE_ID_ARG_NAME = b"org.matrix.msc3202.device_id"
+        # TODO: We can drop unstable support after 2026-01-01 (couple months after stable support)
+        UNSTABLE_DEVICE_ID_ARG_NAME = b"org.matrix.msc3202.device_id"
 
         app_service = self.store.get_app_service_by_token(access_token)
         if app_service is None:
@@ -341,26 +339,24 @@ class BaseAuth:
         else:
             effective_user_id = app_service.sender
 
-        effective_device_id: Optional[str] = None
-
-        if (
-            self.hs.config.experimental.msc3202_device_masquerading_enabled
-            and DEVICE_ID_ARG_NAME in request.args
-        ):
-            effective_device_id = request.args[DEVICE_ID_ARG_NAME][0].decode("utf8")
+        effective_device_id_args = request.args.get(
+            b"device_id", request.args.get(UNSTABLE_DEVICE_ID_ARG_NAME)
+        )
+        if effective_device_id_args:
+            effective_device_id = effective_device_id_args[0].decode("utf8")
             # We only just set this so it can't be None!
             assert effective_device_id is not None
             device_opt = await self.store.get_device(
                 effective_user_id, effective_device_id
             )
             if device_opt is None:
-                # For now, use 400 M_EXCLUSIVE if the device doesn't exist.
-                # This is an open thread of discussion on MSC3202 as of 2021-12-09.
                 raise AuthError(
                     400,
                     f"Application service trying to use a device that doesn't exist ('{effective_device_id}' for {effective_user_id})",
-                    Codes.EXCLUSIVE,
+                    Codes.UNKNOWN_DEVICE,
                 )
+        else:
+            effective_device_id = None
 
         return create_requester(
             effective_user_id, app_service=app_service, device_id=effective_device_id
diff --git a/synapse/api/auth/mas.py b/synapse/api/auth/mas.py
index 40b4a5bd34..95c6d62a9d 100644
--- a/synapse/api/auth/mas.py
+++ b/synapse/api/auth/mas.py
@@ -13,17 +13,18 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Optional, Set
+from typing import TYPE_CHECKING
 from urllib.parse import urlencode
 
-from synapse._pydantic_compat import (
+from pydantic import (
     BaseModel,
-    Extra,
+    ConfigDict,
     StrictBool,
     StrictInt,
     StrictStr,
     ValidationError,
 )
+
 from synapse.api.auth.base import BaseAuth
 from synapse.api.errors import (
     AuthError,
@@ -33,7 +34,6 @@ from synapse.api.errors import (
     UnrecognizedRequestError,
 )
 from synapse.http.site import SynapseRequest
-from synapse.logging.context import PreserveLoggingContext
 from synapse.logging.opentracing import (
     active_span,
     force_tracing,
@@ -43,9 +43,10 @@ from synapse.logging.opentracing import (
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.synapse_rust.http_client import HttpClient
 from synapse.types import JsonDict, Requester, UserID, create_requester
-from synapse.util import json_decoder
 from synapse.util.caches.cached_call import RetryOnExceptionCachedCall
 from synapse.util.caches.response_cache import ResponseCache, ResponseCacheContext
+from synapse.util.duration import Duration
+from synapse.util.json import json_decoder
 
 from . import introspection_response_timer
 
@@ -64,8 +65,7 @@ STABLE_SCOPE_MATRIX_DEVICE_PREFIX = "urn:matrix:client:device:"
 
 
 class ServerMetadata(BaseModel):
-    class Config:
-        extra = Extra.allow
+    model_config = ConfigDict(extra="allow")
 
     issuer: StrictStr
     account_management_uri: StrictStr
@@ -74,14 +74,12 @@ class ServerMetadata(BaseModel):
 class IntrospectionResponse(BaseModel):
     retrieved_at_ms: StrictInt
     active: StrictBool
-    scope: Optional[StrictStr]
-    username: Optional[StrictStr]
-    sub: Optional[StrictStr]
-    device_id: Optional[StrictStr]
-    expires_in: Optional[StrictInt]
-
-    class Config:
-        extra = Extra.allow
+    scope: StrictStr | None = None
+    username: StrictStr | None = None
+    sub: StrictStr | None = None
+    device_id: StrictStr | None = None
+    expires_in: StrictInt | None = None
+    model_config = ConfigDict(extra="allow")
 
     def get_scope_set(self) -> set[str]:
         if not self.scope:
@@ -113,6 +111,7 @@ class MasDelegatedAuth(BaseAuth):
         self._rust_http_client = HttpClient(
             reactor=hs.get_reactor(),
             user_agent=self._http_client.user_agent.decode("utf8"),
+            http2_only=self._config.force_http2,
         )
         self._server_metadata = RetryOnExceptionCachedCall[ServerMetadata](
             self._load_metadata
@@ -142,18 +141,20 @@ class MasDelegatedAuth(BaseAuth):
             clock=self._clock,
             name="mas_token_introspection",
             server_name=self.server_name,
-            timeout_ms=120_000,
+            timeout=Duration(minutes=2),
             # don't log because the keys are access tokens
             enable_logging=False,
         )
 
     @property
     def _metadata_url(self) -> str:
-        return f"{self._config.endpoint.rstrip('/')}/.well-known/openid-configuration"
+        return (
+            f"{str(self._config.endpoint).rstrip('/')}/.well-known/openid-configuration"
+        )
 
     @property
     def _introspection_endpoint(self) -> str:
-        return f"{self._config.endpoint.rstrip('/')}/oauth2/introspect"
+        return f"{str(self._config.endpoint).rstrip('/')}/oauth2/introspect"
 
     async def _load_metadata(self) -> ServerMetadata:
         response = await self._http_client.get_json(self._metadata_url)
@@ -229,13 +230,12 @@ class MasDelegatedAuth(BaseAuth):
         try:
             with start_active_span("mas-introspect-token"):
                 inject_request_headers(raw_headers)
-                with PreserveLoggingContext():
-                    resp_body = await self._rust_http_client.post(
-                        url=self._introspection_endpoint,
-                        response_limit=1 * 1024 * 1024,
-                        headers=raw_headers,
-                        request_body=body,
-                    )
+                resp_body = await self._rust_http_client.post(
+                    url=self._introspection_endpoint,
+                    response_limit=1 * 1024 * 1024,
+                    headers=raw_headers,
+                    request_body=body,
+                )
         except HttpResponseException as e:
             end_time = self._clock.time()
             introspection_response_timer.labels(
@@ -371,7 +371,7 @@ class MasDelegatedAuth(BaseAuth):
             # We only allow a single device_id in the scope, so we find them all in the
             # scope list, and raise if there are more than one. The OIDC server should be
             # the one enforcing valid scopes, so we raise a 500 if we find an invalid scope.
-            device_ids: Set[str] = set()
+            device_ids: set[str] = set()
             for tok in scope:
                 if tok.startswith(UNSTABLE_SCOPE_MATRIX_DEVICE_PREFIX):
                     device_ids.add(tok[len(UNSTABLE_SCOPE_MATRIX_DEVICE_PREFIX) :])
diff --git a/synapse/api/auth/msc3861_delegated.py b/synapse/api/auth/msc3861_delegated.py
index c406c683e7..27ab4af805 100644
--- a/synapse/api/auth/msc3861_delegated.py
+++ b/synapse/api/auth/msc3861_delegated.py
@@ -20,7 +20,7 @@
 #
 import logging
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any, Callable, Dict, List, Optional, Set
+from typing import TYPE_CHECKING, Any, Callable
 from urllib.parse import urlencode
 
 from authlib.oauth2 import ClientAuth
@@ -38,7 +38,6 @@ from synapse.api.errors import (
     UnrecognizedRequestError,
 )
 from synapse.http.site import SynapseRequest
-from synapse.logging.context import PreserveLoggingContext
 from synapse.logging.opentracing import (
     active_span,
     force_tracing,
@@ -48,9 +47,10 @@ from synapse.logging.opentracing import (
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.synapse_rust.http_client import HttpClient
 from synapse.types import Requester, UserID, create_requester
-from synapse.util import json_decoder
 from synapse.util.caches.cached_call import RetryOnExceptionCachedCall
 from synapse.util.caches.response_cache import ResponseCache, ResponseCacheContext
+from synapse.util.duration import Duration
+from synapse.util.json import json_decoder
 
 from . import introspection_response_timer
 
@@ -71,7 +71,7 @@ STABLE_SCOPE_MATRIX_DEVICE_PREFIX = "urn:matrix:client:device:"
 SCOPE_SYNAPSE_ADMIN = "urn:synapse:admin:*"
 
 
-def scope_to_list(scope: str) -> List[str]:
+def scope_to_list(scope: str) -> list[str]:
     """Convert a scope string to a list of scope tokens"""
     return scope.strip().split(" ")
 
@@ -97,31 +97,31 @@ class IntrospectionResult:
         absolute_expiry_ms = expires_in * 1000 + self.retrieved_at_ms
         return now_ms < absolute_expiry_ms
 
-    def get_scope_list(self) -> List[str]:
+    def get_scope_list(self) -> list[str]:
         value = self._inner.get("scope")
         if not isinstance(value, str):
             return []
         return scope_to_list(value)
 
-    def get_sub(self) -> Optional[str]:
+    def get_sub(self) -> str | None:
         value = self._inner.get("sub")
         if not isinstance(value, str):
             return None
         return value
 
-    def get_username(self) -> Optional[str]:
+    def get_username(self) -> str | None:
         value = self._inner.get("username")
         if not isinstance(value, str):
             return None
         return value
 
-    def get_name(self) -> Optional[str]:
+    def get_name(self) -> str | None:
         value = self._inner.get("name")
         if not isinstance(value, str):
             return None
         return value
 
-    def get_device_id(self) -> Optional[str]:
+    def get_device_id(self) -> str | None:
         value = self._inner.get("device_id")
         if value is not None and not isinstance(value, str):
             raise AuthError(
@@ -175,7 +175,7 @@ class MSC3861DelegatedAuth(BaseAuth):
         self._clock = hs.get_clock()
         self._http_client = hs.get_proxied_http_client()
         self._hostname = hs.hostname
-        self._admin_token: Callable[[], Optional[str]] = self._config.admin_token
+        self._admin_token: Callable[[], str | None] = self._config.admin_token
         self._force_tracing_for_users = hs.config.tracing.force_tracing_for_users
 
         self._rust_http_client = HttpClient(
@@ -206,7 +206,7 @@ class MSC3861DelegatedAuth(BaseAuth):
             clock=self._clock,
             name="token_introspection",
             server_name=self.server_name,
-            timeout_ms=120_000,
+            timeout=Duration(minutes=2),
             # don't log because the keys are access tokens
             enable_logging=False,
         )
@@ -248,7 +248,7 @@ class MSC3861DelegatedAuth(BaseAuth):
         metadata = await self._issuer_metadata.get()
         return metadata.issuer or self._config.issuer
 
-    async def account_management_url(self) -> Optional[str]:
+    async def account_management_url(self) -> str | None:
         """
         Get the configured account management URL
 
@@ -265,7 +265,7 @@ class MSC3861DelegatedAuth(BaseAuth):
             logger.warning("Failed to load metadata:", exc_info=True)
             return None
 
-    async def auth_metadata(self) -> Dict[str, Any]:
+    async def auth_metadata(self) -> dict[str, Any]:
         """
         Returns the auth metadata dict
         """
@@ -304,7 +304,7 @@ class MSC3861DelegatedAuth(BaseAuth):
         # By default, we shouldn't cache the result unless we know it's valid
         cache_context.should_cache = False
         introspection_endpoint = await self._introspection_endpoint()
-        raw_headers: Dict[str, str] = {
+        raw_headers: dict[str, str] = {
             "Content-Type": "application/x-www-form-urlencoded",
             "Accept": "application/json",
             # Tell MAS that we support reading the device ID as an explicit
@@ -327,13 +327,12 @@ class MSC3861DelegatedAuth(BaseAuth):
         try:
             with start_active_span("mas-introspect-token"):
                 inject_request_headers(raw_headers)
-                with PreserveLoggingContext():
-                    resp_body = await self._rust_http_client.post(
-                        url=uri,
-                        response_limit=1 * 1024 * 1024,
-                        headers=raw_headers,
-                        request_body=body,
-                    )
+                resp_body = await self._rust_http_client.post(
+                    url=uri,
+                    response_limit=1 * 1024 * 1024,
+                    headers=raw_headers,
+                    request_body=body,
+                )
         except HttpResponseException as e:
             end_time = self._clock.time()
             introspection_response_timer.labels(
@@ -522,7 +521,7 @@ class MSC3861DelegatedAuth(BaseAuth):
             raise InvalidClientTokenError("Token is not active")
 
         # Let's look at the scope
-        scope: List[str] = introspection_result.get_scope_list()
+        scope: list[str] = introspection_result.get_scope_list()
 
         # Determine type of user based on presence of particular scopes
         has_user_scope = (
@@ -577,7 +576,7 @@ class MSC3861DelegatedAuth(BaseAuth):
             # We only allow a single device_id in the scope, so we find them all in the
             # scope list, and raise if there are more than one. The OIDC server should be
             # the one enforcing valid scopes, so we raise a 500 if we find an invalid scope.
-            device_ids: Set[str] = set()
+            device_ids: set[str] = set()
             for tok in scope:
                 if tok.startswith(UNSTABLE_SCOPE_MATRIX_DEVICE_PREFIX):
                     device_ids.add(tok[len(UNSTABLE_SCOPE_MATRIX_DEVICE_PREFIX) :])
diff --git a/synapse/api/auth_blocking.py b/synapse/api/auth_blocking.py
index 303c9ba03e..3ed47b20c4 100644
--- a/synapse/api/auth_blocking.py
+++ b/synapse/api/auth_blocking.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import LimitBlockingTypes, UserTypes
 from synapse.api.errors import Codes, ResourceLimitError
@@ -51,10 +51,10 @@ class AuthBlocking:
 
     async def check_auth_blocking(
         self,
-        user_id: Optional[str] = None,
-        threepid: Optional[dict] = None,
-        user_type: Optional[str] = None,
-        requester: Optional[Requester] = None,
+        user_id: str | None = None,
+        threepid: dict | None = None,
+        user_type: str | None = None,
+        requester: Requester | None = None,
     ) -> None:
         """Checks if the user should be rejected for some external reason,
         such as monthly active user limiting or global disable flag
diff --git a/synapse/api/constants.py b/synapse/api/constants.py
index 7a8f546d6b..eb9e6cc39b 100644
--- a/synapse/api/constants.py
+++ b/synapse/api/constants.py
@@ -24,11 +24,26 @@
 """Contains constants from the specification."""
 
 import enum
-from typing import Final
+from typing import Final, TypedDict
+
+from synapse.util.duration import Duration
 
 # the max size of a (canonical-json-encoded) event
 MAX_PDU_SIZE = 65536
 
+# The maximum allowed size of an HTTP request.
+# Other than media uploads, the biggest request we expect to see is a fully-loaded
+# /federation/v1/send request.
+#
+# The main thing in such a request is up to 50 PDUs, and up to 100 EDUs. PDUs are
+# limited to 65536 bytes (possibly slightly more if the sender didn't use canonical
+# json encoding); there is no specced limit to EDUs (see
+# https://github.com/matrix-org/matrix-doc/issues/3121).
+#
+# in short, we somewhat arbitrarily limit requests to 200 * 64K (about 12.5M)
+#
+MAX_REQUEST_SIZE = 200 * MAX_PDU_SIZE
+
 # Max/min size of ints in canonical JSON
 CANONICALJSON_MAX_INT = (2**53) - 1
 CANONICALJSON_MIN_INT = -CANONICALJSON_MAX_INT
@@ -143,6 +158,8 @@ class EventTypes:
 
     PollStart: Final = "m.poll.start"
 
+    RoomPolicy: Final = "m.room.policy"
+
 
 class ToDeviceEventTypes:
     RoomKeyRequest: Final = "m.room_key_request"
@@ -279,6 +296,8 @@ class EventUnsignedContentFields:
     # Requesting user's membership, per MSC4115
     MEMBERSHIP: Final = "membership"
 
+    STICKY_TTL: Final = "msc4354_sticky_duration_ttl_ms"
+
 
 class MTextFields:
     """Fields found inside m.text content blocks."""
@@ -307,6 +326,8 @@ class AccountDataTypes:
     MSC4155_INVITE_PERMISSION_CONFIG: Final = (
         "org.matrix.msc4155.invite_permission_config"
     )
+    # MSC4380: Invite blocking
+    INVITE_PERMISSION_CONFIG: Final = "m.invite_permission_config"
     # Synapse-specific behaviour. See "Client-Server API Extensions" documentation
     # in Admin API for more information.
     SYNAPSE_ADMIN_CLIENT_CONFIG: Final = "io.element.synapse.admin_client_config"
@@ -360,3 +381,40 @@ class Direction(enum.Enum):
 class ProfileFields:
     DISPLAYNAME: Final = "displayname"
     AVATAR_URL: Final = "avatar_url"
+
+
+class StickyEventField(TypedDict):
+    """
+    Dict content of the `sticky` part of an event.
+    """
+
+    duration_ms: int
+
+
+class StickyEvent:
+    QUERY_PARAM_NAME: Final = "org.matrix.msc4354.sticky_duration_ms"
+    """
+    Query parameter used by clients for setting the sticky duration of an event they are sending.
+
+    Applies to:
+        - /rooms/.../send/...
+        - /rooms/.../state/...
+    """
+
+    EVENT_FIELD_NAME: Final = "msc4354_sticky"
+    """
+    Name of the field in the top-level event dict that contains the sticky event dict.
+    """
+
+    MAX_DURATION: Duration = Duration(hours=1)
+    """
+    Maximum stickiness duration as specified in MSC4354.
+    Ensures that data in the /sync response can go down and not grow unbounded.
+    """
+
+    MAX_EVENTS_IN_SYNC: Final = 100
+    """
+    Maximum number of sticky events to include in /sync.
+
+    This is the default specified in the MSC. Chosen arbitrarily.
+    """
diff --git a/synapse/api/errors.py b/synapse/api/errors.py
index ec4d707b7b..0c35b4a7ba 100644
--- a/synapse/api/errors.py
+++ b/synapse/api/errors.py
@@ -26,11 +26,11 @@ import math
 import typing
 from enum import Enum
 from http import HTTPStatus
-from typing import Any, Dict, List, Optional, Union
+from typing import Any, Optional
 
 from twisted.web import http
 
-from synapse.util import json_decoder
+from synapse.util.json import json_decoder
 
 if typing.TYPE_CHECKING:
     from synapse.config.homeserver import HomeServerConfig
@@ -137,8 +137,11 @@ class Codes(str, Enum):
     PROFILE_TOO_LARGE = "M_PROFILE_TOO_LARGE"
     KEY_TOO_LARGE = "M_KEY_TOO_LARGE"
 
-    # Part of MSC4155
-    INVITE_BLOCKED = "ORG.MATRIX.MSC4155.M_INVITE_BLOCKED"
+    # Part of MSC4155/MSC4380
+    INVITE_BLOCKED = "M_INVITE_BLOCKED"
+
+    # Part of MSC4190
+    APPSERVICE_LOGIN_UNSUPPORTED = "IO.ELEMENT.MSC4190.M_APPSERVICE_LOGIN_UNSUPPORTED"
 
     # Part of MSC4306: Thread Subscriptions
     MSC4306_CONFLICTING_UNSUBSCRIPTION = (
@@ -146,6 +149,9 @@ class Codes(str, Enum):
     )
     MSC4306_NOT_IN_THREAD = "IO.ELEMENT.MSC4306.M_NOT_IN_THREAD"
 
+    # Part of MSC4326
+    UNKNOWN_DEVICE = "ORG.MATRIX.MSC4326.M_UNKNOWN_DEVICE"
+
 
 class CodeMessageException(RuntimeError):
     """An exception with integer code, a message string attributes and optional headers.
@@ -158,9 +164,9 @@ class CodeMessageException(RuntimeError):
 
     def __init__(
         self,
-        code: Union[int, HTTPStatus],
+        code: int | HTTPStatus,
         msg: str,
-        headers: Optional[Dict[str, str]] = None,
+        headers: dict[str, str] | None = None,
     ):
         super().__init__("%d: %s" % (code, msg))
 
@@ -195,7 +201,7 @@ class RedirectException(CodeMessageException):
         super().__init__(code=http_code, msg=msg)
         self.location = location
 
-        self.cookies: List[bytes] = []
+        self.cookies: list[bytes] = []
 
 
 class SynapseError(CodeMessageException):
@@ -217,8 +223,8 @@ class SynapseError(CodeMessageException):
         code: int,
         msg: str,
         errcode: str = Codes.UNKNOWN,
-        additional_fields: Optional[Dict] = None,
-        headers: Optional[Dict[str, str]] = None,
+        additional_fields: dict | None = None,
+        headers: dict[str, str] | None = None,
     ):
         """Constructs a synapse error.
 
@@ -230,7 +236,7 @@ class SynapseError(CodeMessageException):
         super().__init__(code, msg, headers)
         self.errcode = errcode
         if additional_fields is None:
-            self._additional_fields: Dict = {}
+            self._additional_fields: dict = {}
         else:
             self._additional_fields = dict(additional_fields)
 
@@ -238,7 +244,7 @@ class SynapseError(CodeMessageException):
         return cs_error(self.msg, self.errcode, **self._additional_fields)
 
     @property
-    def debug_context(self) -> Optional[str]:
+    def debug_context(self) -> str | None:
         """Override this to add debugging context that shouldn't be sent to clients."""
         return None
 
@@ -270,7 +276,7 @@ class ProxiedRequestError(SynapseError):
         code: int,
         msg: str,
         errcode: str = Codes.UNKNOWN,
-        additional_fields: Optional[Dict] = None,
+        additional_fields: dict | None = None,
     ):
         super().__init__(code, msg, errcode, additional_fields)
 
@@ -334,7 +340,7 @@ class FederationDeniedError(SynapseError):
         destination: The destination which has been denied
     """
 
-    def __init__(self, destination: Optional[str]):
+    def __init__(self, destination: str | None):
         """Raised by federation client or server to indicate that we are
         are deliberately not attempting to contact a given server because it is
         not on our federation whitelist.
@@ -393,7 +399,7 @@ class AuthError(SynapseError):
         code: int,
         msg: str,
         errcode: str = Codes.FORBIDDEN,
-        additional_fields: Optional[dict] = None,
+        additional_fields: dict | None = None,
     ):
         super().__init__(code, msg, errcode, additional_fields)
 
@@ -403,7 +409,7 @@ class OAuthInsufficientScopeError(SynapseError):
 
     def __init__(
         self,
-        required_scopes: List[str],
+        required_scopes: list[str],
     ):
         headers = {
             "WWW-Authenticate": 'Bearer error="insufficient_scope", scope="%s"'
@@ -426,7 +432,7 @@ class UnstableSpecAuthError(AuthError):
         msg: str,
         errcode: str,
         previous_errcode: str = Codes.FORBIDDEN,
-        additional_fields: Optional[dict] = None,
+        additional_fields: dict | None = None,
     ):
         self.previous_errcode = previous_errcode
         super().__init__(code, msg, errcode, additional_fields)
@@ -491,8 +497,8 @@ class ResourceLimitError(SynapseError):
         code: int,
         msg: str,
         errcode: str = Codes.RESOURCE_LIMIT_EXCEEDED,
-        admin_contact: Optional[str] = None,
-        limit_type: Optional[str] = None,
+        admin_contact: str | None = None,
+        limit_type: str | None = None,
     ):
         self.admin_contact = admin_contact
         self.limit_type = limit_type
@@ -536,7 +542,7 @@ class InvalidCaptchaError(SynapseError):
         self,
         code: int = 400,
         msg: str = "Invalid captcha.",
-        error_url: Optional[str] = None,
+        error_url: str | None = None,
         errcode: str = Codes.CAPTCHA_INVALID,
     ):
         super().__init__(code, msg, errcode)
@@ -557,9 +563,9 @@ class LimitExceededError(SynapseError):
         self,
         limiter_name: str,
         code: int = 429,
-        retry_after_ms: Optional[int] = None,
+        retry_after_ms: int | None = None,
         errcode: str = Codes.LIMIT_EXCEEDED,
-        pause: Optional[float] = None,
+        pause: float | None = None,
     ):
         # Use HTTP header Retry-After to enable library-assisted retry handling.
         headers = (
@@ -576,7 +582,7 @@ class LimitExceededError(SynapseError):
         return cs_error(self.msg, self.errcode, retry_after_ms=self.retry_after_ms)
 
     @property
-    def debug_context(self) -> Optional[str]:
+    def debug_context(self) -> str | None:
         return self.limiter_name
 
 
@@ -669,7 +675,7 @@ class RequestSendFailed(RuntimeError):
 
 
 class UnredactedContentDeletedError(SynapseError):
-    def __init__(self, content_keep_ms: Optional[int] = None):
+    def __init__(self, content_keep_ms: int | None = None):
         super().__init__(
             404,
             "The content for that event has already been erased from the database",
@@ -745,7 +751,7 @@ class FederationError(RuntimeError):
         code: int,
         reason: str,
         affected: str,
-        source: Optional[str] = None,
+        source: str | None = None,
     ):
         if level not in ["FATAL", "ERROR", "WARN"]:
             raise ValueError("Level is not valid: %s" % (level,))
@@ -780,7 +786,7 @@ class FederationPullAttemptBackoffError(RuntimeError):
     """
 
     def __init__(
-        self, event_ids: "StrCollection", message: Optional[str], retry_after_ms: int
+        self, event_ids: "StrCollection", message: str | None, retry_after_ms: int
     ):
         event_ids = list(event_ids)
 
@@ -850,6 +856,12 @@ class HttpResponseException(CodeMessageException):
         return ProxiedRequestError(self.code, errmsg, errcode, j)
 
 
+class HomeServerNotSetupException(Exception):
+    """
+    Raised when an operation is attempted on the HomeServer before setup() has been called.
+    """
+
+
 class ShadowBanError(Exception):
     """
     Raised when a shadow-banned user attempts to perform an action.
diff --git a/synapse/api/filtering.py b/synapse/api/filtering.py
index 34dd12368a..9b47c20437 100644
--- a/synapse/api/filtering.py
+++ b/synapse/api/filtering.py
@@ -26,14 +26,9 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Set,
     TypeVar,
-    Union,
 )
 
 import jsonschema
@@ -158,7 +153,7 @@ class Filtering:
         self.DEFAULT_FILTER_COLLECTION = FilterCollection(hs, {})
 
     async def get_user_filter(
-        self, user_id: UserID, filter_id: Union[int, str]
+        self, user_id: UserID, filter_id: int | str
     ) -> "FilterCollection":
         result = await self.store.get_user_filter(user_id, filter_id)
         return FilterCollection(self._hs, result)
@@ -248,34 +243,34 @@ class FilterCollection:
 
     async def filter_presence(
         self, presence_states: Iterable[UserPresenceState]
-    ) -> List[UserPresenceState]:
+    ) -> list[UserPresenceState]:
         return await self._presence_filter.filter(presence_states)
 
     async def filter_global_account_data(
         self, events: Iterable[JsonDict]
-    ) -> List[JsonDict]:
+    ) -> list[JsonDict]:
         return await self._global_account_data_filter.filter(events)
 
-    async def filter_room_state(self, events: Iterable[EventBase]) -> List[EventBase]:
+    async def filter_room_state(self, events: Iterable[EventBase]) -> list[EventBase]:
         return await self._room_state_filter.filter(
             await self._room_filter.filter(events)
         )
 
     async def filter_room_timeline(
         self, events: Iterable[EventBase]
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         return await self._room_timeline_filter.filter(
             await self._room_filter.filter(events)
         )
 
-    async def filter_room_ephemeral(self, events: Iterable[JsonDict]) -> List[JsonDict]:
+    async def filter_room_ephemeral(self, events: Iterable[JsonDict]) -> list[JsonDict]:
         return await self._room_ephemeral_filter.filter(
             await self._room_filter.filter(events)
         )
 
     async def filter_room_account_data(
         self, events: Iterable[JsonDict]
-    ) -> List[JsonDict]:
+    ) -> list[JsonDict]:
         return await self._room_account_data_filter.filter(
             await self._room_filter.filter(events)
         )
@@ -440,7 +435,7 @@ class Filter:
 
             return True
 
-    def _check_fields(self, field_matchers: Dict[str, Callable[[str], bool]]) -> bool:
+    def _check_fields(self, field_matchers: dict[str, Callable[[str], bool]]) -> bool:
         """Checks whether the filter matches the given event fields.
 
         Args:
@@ -474,7 +469,7 @@ class Filter:
         # Otherwise, accept it.
         return True
 
-    def filter_rooms(self, room_ids: Iterable[str]) -> Set[str]:
+    def filter_rooms(self, room_ids: Iterable[str]) -> set[str]:
         """Apply the 'rooms' filter to a given list of rooms.
 
         Args:
@@ -496,7 +491,7 @@ class Filter:
 
     async def _check_event_relations(
         self, events: Collection[FilterEvent]
-    ) -> List[FilterEvent]:
+    ) -> list[FilterEvent]:
         # The event IDs to check, mypy doesn't understand the isinstance check.
         event_ids = [event.event_id for event in events if isinstance(event, EventBase)]  # type: ignore[attr-defined]
         event_ids_to_keep = set(
@@ -511,7 +506,7 @@ class Filter:
             if not isinstance(event, EventBase) or event.event_id in event_ids_to_keep
         ]
 
-    async def filter(self, events: Iterable[FilterEvent]) -> List[FilterEvent]:
+    async def filter(self, events: Iterable[FilterEvent]) -> list[FilterEvent]:
         result = [event for event in events if self._check(event)]
 
         if self.related_by_senders or self.related_by_rel_types:
@@ -534,7 +529,7 @@ class Filter:
         return newFilter
 
 
-def _matches_wildcard(actual_value: Optional[str], filter_value: str) -> bool:
+def _matches_wildcard(actual_value: str | None, filter_value: str) -> bool:
     if filter_value.endswith("*") and isinstance(actual_value, str):
         type_prefix = filter_value[:-1]
         return actual_value.startswith(type_prefix)
diff --git a/synapse/api/presence.py b/synapse/api/presence.py
index 28c10403ce..0e2fe625c9 100644
--- a/synapse/api/presence.py
+++ b/synapse/api/presence.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, Optional
+from typing import Any
 
 import attr
 
@@ -41,15 +41,13 @@ class UserDevicePresenceState:
     """
 
     user_id: str
-    device_id: Optional[str]
+    device_id: str | None
     state: str
     last_active_ts: int
     last_sync_ts: int
 
     @classmethod
-    def default(
-        cls, user_id: str, device_id: Optional[str]
-    ) -> "UserDevicePresenceState":
+    def default(cls, user_id: str, device_id: str | None) -> "UserDevicePresenceState":
         """Returns a default presence state."""
         return cls(
             user_id=user_id,
@@ -81,7 +79,7 @@ class UserPresenceState:
     last_active_ts: int
     last_federation_update_ts: int
     last_user_sync_ts: int
-    status_msg: Optional[str]
+    status_msg: str | None
     currently_active: bool
 
     def as_dict(self) -> JsonDict:
diff --git a/synapse/api/ratelimiting.py b/synapse/api/ratelimiting.py
index 509ef6b2c1..d6cc3d26b5 100644
--- a/synapse/api/ratelimiting.py
+++ b/synapse/api/ratelimiting.py
@@ -20,13 +20,15 @@
 #
 #
 
-from typing import TYPE_CHECKING, Dict, Hashable, Optional, Tuple
+from typing import TYPE_CHECKING, Hashable, Optional
 
 from synapse.api.errors import LimitExceededError
 from synapse.config.ratelimiting import RatelimitSettings
 from synapse.storage.databases.main import DataStore
 from synapse.types import Requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+from synapse.util.wheel_timer import WheelTimer
 
 if TYPE_CHECKING:
     # To avoid circular imports:
@@ -92,13 +94,16 @@ class Ratelimiter:
         #   * The number of tokens currently in the bucket,
         #   * The time point when the bucket was last completely empty, and
         #   * The rate_hz (leak rate) of this particular bucket.
-        self.actions: Dict[Hashable, Tuple[float, float, float]] = {}
+        self.actions: dict[Hashable, tuple[int, float, float]] = {}
 
-        self.clock.looping_call(self._prune_message_counts, 60 * 1000)
+        # Records when actions should potentially be pruned. Note that we don't
+        # need to be accurate here, as this is just a cleanup job of `actions`
+        # and doesn't affect correctness.
+        self._timer: WheelTimer[Hashable] = WheelTimer()
 
-    def _get_key(
-        self, requester: Optional[Requester], key: Optional[Hashable]
-    ) -> Hashable:
+        self.clock.looping_call(self._prune_message_counts, Duration(seconds=15))
+
+    def _get_key(self, requester: Requester | None, key: Hashable | None) -> Hashable:
         """Use the requester's MXID as a fallback key if no key is provided."""
         if key is None:
             if not requester:
@@ -109,20 +114,20 @@ class Ratelimiter:
 
     def _get_action_counts(
         self, key: Hashable, time_now_s: float
-    ) -> Tuple[float, float, float]:
+    ) -> tuple[int, float, float]:
         """Retrieve the action counts, with a fallback representing an empty bucket."""
-        return self.actions.get(key, (0.0, time_now_s, 0.0))
+        return self.actions.get(key, (0, time_now_s, self.rate_hz))
 
     async def can_do_action(
         self,
-        requester: Optional[Requester],
-        key: Optional[Hashable] = None,
-        rate_hz: Optional[float] = None,
-        burst_count: Optional[int] = None,
+        requester: Requester | None,
+        key: Hashable | None = None,
+        rate_hz: float | None = None,
+        burst_count: int | None = None,
         update: bool = True,
         n_actions: int = 1,
-        _time_now_s: Optional[float] = None,
-    ) -> Tuple[bool, float]:
+        _time_now_s: float | None = None,
+    ) -> tuple[bool, float]:
         """Can the entity (e.g. user or IP address) perform the action?
 
         Checks if the user has ratelimiting disabled in the database by looking
@@ -217,8 +222,11 @@ class Ratelimiter:
             allowed = True
             action_count = action_count + n_actions
 
-        if update:
-            self.actions[key] = (action_count, time_start, rate_hz)
+        # Only record the action if we're allowed to perform it.
+        if allowed and update:
+            self._record_action_inner(
+                key, action_count, time_start, rate_hz, time_now_s
+            )
 
         if rate_hz > 0:
             # Find out when the count of existing actions expires
@@ -238,10 +246,10 @@ class Ratelimiter:
 
     def record_action(
         self,
-        requester: Optional[Requester],
-        key: Optional[Hashable] = None,
+        requester: Requester | None,
+        key: Hashable | None = None,
         n_actions: int = 1,
-        _time_now_s: Optional[float] = None,
+        _time_now_s: float | None = None,
     ) -> None:
         """Record that an action(s) took place, even if they violate the rate limit.
 
@@ -264,7 +272,37 @@ class Ratelimiter:
         key = self._get_key(requester, key)
         time_now_s = _time_now_s if _time_now_s is not None else self.clock.time()
         action_count, time_start, rate_hz = self._get_action_counts(key, time_now_s)
-        self.actions[key] = (action_count + n_actions, time_start, rate_hz)
+        self._record_action_inner(
+            key, action_count + n_actions, time_start, rate_hz, time_now_s
+        )
+
+    def _record_action_inner(
+        self,
+        key: Hashable,
+        action_count: int,
+        time_start: float,
+        rate_hz: float,
+        time_now_s: float,
+    ) -> None:
+        """Helper to atomically update the action count for a given key."""
+        prune_time_s = time_start + action_count / rate_hz
+
+        # If the prune time is in the past, we can just remove the entry rather
+        # than inserting and immediately pruning.
+        if prune_time_s <= time_now_s:
+            self.actions.pop(key, None)
+            return
+
+        self.actions[key] = (action_count, time_start, rate_hz)
+
+        # We need to make sure that we only call prune *after* the entry
+        # expires, otherwise the scheduled prune may not actually prune it. This
+        # is just a cleanup job, so it doesn't matter if entries aren't pruned
+        # immediately after they expire. Hence we schedule the prune a little
+        # after the entry is due to expire.
+        prune_time_s += 0.1
+
+        self._timer.insert(int(time_now_s * 1000), key, int(prune_time_s * 1000))
 
     def _prune_message_counts(self) -> None:
         """Remove message count entries that have not exceeded their defined
@@ -272,29 +310,35 @@ class Ratelimiter:
         """
         time_now_s = self.clock.time()
 
-        # We create a copy of the key list here as the dictionary is modified during
-        # the loop
-        for key in list(self.actions.keys()):
-            action_count, time_start, rate_hz = self.actions[key]
+        # Pull out all the keys that *might* need pruning. We still need to
+        # verify they haven't since been updated.
+        to_prune = self._timer.fetch(int(time_now_s * 1000))
+
+        for key in to_prune:
+            value = self.actions.get(key)
+            if value is None:
+                continue
+
+            action_count, time_start, rate_hz = value
 
             # Rate limit = "seconds since we started limiting this action" * rate_hz
             # If this limit has not been exceeded, wipe our record of this action
             time_delta = time_now_s - time_start
             if action_count - time_delta * rate_hz > 0:
                 continue
-            else:
-                del self.actions[key]
+
+            del self.actions[key]
 
     async def ratelimit(
         self,
-        requester: Optional[Requester],
-        key: Optional[Hashable] = None,
-        rate_hz: Optional[float] = None,
-        burst_count: Optional[int] = None,
+        requester: Requester | None,
+        key: Hashable | None = None,
+        rate_hz: float | None = None,
+        burst_count: int | None = None,
         update: bool = True,
         n_actions: int = 1,
-        _time_now_s: Optional[float] = None,
-        pause: Optional[float] = 0.5,
+        _time_now_s: float | None = None,
+        pause: float | None = 0.5,
     ) -> None:
         """Checks if an action can be performed. If not, raises a LimitExceededError
 
@@ -351,7 +395,7 @@ class RequestRatelimiter:
         store: DataStore,
         clock: Clock,
         rc_message: RatelimitSettings,
-        rc_admin_redaction: Optional[RatelimitSettings],
+        rc_admin_redaction: RatelimitSettings | None,
     ):
         self.store = store
         self.clock = clock
@@ -367,7 +411,7 @@ class RequestRatelimiter:
         # Check whether ratelimiting room admin message redaction is enabled
         # by the presence of rate limits in the config
         if rc_admin_redaction:
-            self.admin_redaction_ratelimiter: Optional[Ratelimiter] = Ratelimiter(
+            self.admin_redaction_ratelimiter: Ratelimiter | None = Ratelimiter(
                 store=self.store,
                 clock=self.clock,
                 cfg=rc_admin_redaction,
diff --git a/synapse/api/room_versions.py b/synapse/api/room_versions.py
index 71ef5952c3..0035d7a58b 100644
--- a/synapse/api/room_versions.py
+++ b/synapse/api/room_versions.py
@@ -18,518 +18,22 @@
 #
 #
 
-from typing import Callable, Dict, Optional, Tuple
+from synapse.synapse_rust.room_versions import (
+    KNOWN_EVENT_FORMAT_VERSIONS,
+    KNOWN_ROOM_VERSIONS,
+    EventFormatVersions,
+    PushRuleRoomFlag,
+    RoomVersion,
+    RoomVersions,
+    StateResolutionVersions,
+)
 
-import attr
-
-
-class EventFormatVersions:
-    """This is an internal enum for tracking the version of the event format,
-    independently of the room version.
-
-    To reduce confusion, the event format versions are named after the room
-    versions that they were used or introduced in.
-    The concept of an 'event format version' is specific to Synapse (the
-    specification does not mention this term.)
-    """
-
-    ROOM_V1_V2 = 1  # $id:server event id format: used for room v1 and v2
-    ROOM_V3 = 2  # MSC1659-style $hash event id format: used for room v3
-    ROOM_V4_PLUS = 3  # MSC1884-style $hash format: introduced for room v4
-    ROOM_V11_HYDRA_PLUS = 4  # MSC4291 room IDs as hashes: introduced for room HydraV11
-
-
-KNOWN_EVENT_FORMAT_VERSIONS = {
-    EventFormatVersions.ROOM_V1_V2,
-    EventFormatVersions.ROOM_V3,
-    EventFormatVersions.ROOM_V4_PLUS,
-    EventFormatVersions.ROOM_V11_HYDRA_PLUS,
-}
-
-
-class StateResolutionVersions:
-    """Enum to identify the state resolution algorithms"""
-
-    V1 = 1  # room v1 state res
-    V2 = 2  # MSC1442 state res: room v2 and later
-    V2_1 = 3  # MSC4297 state res
-
-
-class RoomDisposition:
-    STABLE = "stable"
-    UNSTABLE = "unstable"
-
-
-class PushRuleRoomFlag:
-    """Enum for listing possible MSC3931 room version feature flags, for push rules"""
-
-    # MSC3932: Room version supports MSC1767 Extensible Events.
-    EXTENSIBLE_EVENTS = "org.matrix.msc3932.extensible_events"
-
-
-@attr.s(slots=True, frozen=True, auto_attribs=True)
-class RoomVersion:
-    """An object which describes the unique attributes of a room version."""
-
-    identifier: str  # the identifier for this version
-    disposition: str  # one of the RoomDispositions
-    event_format: int  # one of the EventFormatVersions
-    state_res: int  # one of the StateResolutionVersions
-    enforce_key_validity: bool
-
-    # Before MSC2432, m.room.aliases had special auth rules and redaction rules
-    special_case_aliases_auth: bool
-    # Strictly enforce canonicaljson, do not allow:
-    # * Integers outside the range of [-2 ^ 53 + 1, 2 ^ 53 - 1]
-    # * Floats
-    # * NaN, Infinity, -Infinity
-    strict_canonicaljson: bool
-    # MSC2209: Check 'notifications' key while verifying
-    # m.room.power_levels auth rules.
-    limit_notifications_power_levels: bool
-    # No longer include the creator in m.room.create events.
-    implicit_room_creator: bool
-    # Apply updated redaction rules algorithm from room version 11.
-    updated_redaction_rules: bool
-    # Support the 'restricted' join rule.
-    restricted_join_rule: bool
-    # Support for the proper redaction rules for the restricted join rule. This requires
-    # restricted_join_rule to be enabled.
-    restricted_join_rule_fix: bool
-    # Support the 'knock' join rule.
-    knock_join_rule: bool
-    # MSC3389: Protect relation information from redaction.
-    msc3389_relation_redactions: bool
-    # Support the 'knock_restricted' join rule.
-    knock_restricted_join_rule: bool
-    # Enforce integer power levels
-    enforce_int_power_levels: bool
-    # MSC3931: Adds a push rule condition for "room version feature flags", making
-    # some push rules room version dependent. Note that adding a flag to this list
-    # is not enough to mark it "supported": the push rule evaluator also needs to
-    # support the flag. Unknown flags are ignored by the evaluator, making conditions
-    # fail if used.
-    msc3931_push_features: Tuple[str, ...]  # values from PushRuleRoomFlag
-    # MSC3757: Restricting who can overwrite a state event
-    msc3757_enabled: bool
-    # MSC4289: Creator power enabled
-    msc4289_creator_power_enabled: bool
-    # MSC4291: Room IDs as hashes of the create event
-    msc4291_room_ids_as_hashes: bool
-
-
-class RoomVersions:
-    V1 = RoomVersion(
-        "1",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V1_V2,
-        StateResolutionVersions.V1,
-        enforce_key_validity=False,
-        special_case_aliases_auth=True,
-        strict_canonicaljson=False,
-        limit_notifications_power_levels=False,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=False,
-        restricted_join_rule_fix=False,
-        knock_join_rule=False,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V2 = RoomVersion(
-        "2",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V1_V2,
-        StateResolutionVersions.V2,
-        enforce_key_validity=False,
-        special_case_aliases_auth=True,
-        strict_canonicaljson=False,
-        limit_notifications_power_levels=False,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=False,
-        restricted_join_rule_fix=False,
-        knock_join_rule=False,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V3 = RoomVersion(
-        "3",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V3,
-        StateResolutionVersions.V2,
-        enforce_key_validity=False,
-        special_case_aliases_auth=True,
-        strict_canonicaljson=False,
-        limit_notifications_power_levels=False,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=False,
-        restricted_join_rule_fix=False,
-        knock_join_rule=False,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V4 = RoomVersion(
-        "4",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=False,
-        special_case_aliases_auth=True,
-        strict_canonicaljson=False,
-        limit_notifications_power_levels=False,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=False,
-        restricted_join_rule_fix=False,
-        knock_join_rule=False,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V5 = RoomVersion(
-        "5",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=True,
-        strict_canonicaljson=False,
-        limit_notifications_power_levels=False,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=False,
-        restricted_join_rule_fix=False,
-        knock_join_rule=False,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V6 = RoomVersion(
-        "6",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=False,
-        restricted_join_rule_fix=False,
-        knock_join_rule=False,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V7 = RoomVersion(
-        "7",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=False,
-        restricted_join_rule_fix=False,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V8 = RoomVersion(
-        "8",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=True,
-        restricted_join_rule_fix=False,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V9 = RoomVersion(
-        "9",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=False,
-        enforce_int_power_levels=False,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V10 = RoomVersion(
-        "10",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=True,
-        enforce_int_power_levels=True,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    MSC1767v10 = RoomVersion(
-        # MSC1767 (Extensible Events) based on room version "10"
-        "org.matrix.msc1767.10",
-        RoomDisposition.UNSTABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=True,
-        enforce_int_power_levels=True,
-        msc3931_push_features=(PushRuleRoomFlag.EXTENSIBLE_EVENTS,),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    MSC3757v10 = RoomVersion(
-        # MSC3757 (Restricting who can overwrite a state event) based on room version "10"
-        "org.matrix.msc3757.10",
-        RoomDisposition.UNSTABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=False,
-        updated_redaction_rules=False,
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=True,
-        enforce_int_power_levels=True,
-        msc3931_push_features=(),
-        msc3757_enabled=True,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    V11 = RoomVersion(
-        "11",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=True,  # Used by MSC3820
-        updated_redaction_rules=True,  # Used by MSC3820
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=True,
-        enforce_int_power_levels=True,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    MSC3757v11 = RoomVersion(
-        # MSC3757 (Restricting who can overwrite a state event) based on room version "11"
-        "org.matrix.msc3757.11",
-        RoomDisposition.UNSTABLE,
-        EventFormatVersions.ROOM_V4_PLUS,
-        StateResolutionVersions.V2,
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=True,  # Used by MSC3820
-        updated_redaction_rules=True,  # Used by MSC3820
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=True,
-        enforce_int_power_levels=True,
-        msc3931_push_features=(),
-        msc3757_enabled=True,
-        msc4289_creator_power_enabled=False,
-        msc4291_room_ids_as_hashes=False,
-    )
-    HydraV11 = RoomVersion(
-        "org.matrix.hydra.11",
-        RoomDisposition.UNSTABLE,
-        EventFormatVersions.ROOM_V11_HYDRA_PLUS,
-        StateResolutionVersions.V2_1,  # Changed from v11
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=True,  # Used by MSC3820
-        updated_redaction_rules=True,  # Used by MSC3820
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=True,
-        enforce_int_power_levels=True,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=True,  # Changed from v11
-        msc4291_room_ids_as_hashes=True,  # Changed from v11
-    )
-    V12 = RoomVersion(
-        "12",
-        RoomDisposition.STABLE,
-        EventFormatVersions.ROOM_V11_HYDRA_PLUS,
-        StateResolutionVersions.V2_1,  # Changed from v11
-        enforce_key_validity=True,
-        special_case_aliases_auth=False,
-        strict_canonicaljson=True,
-        limit_notifications_power_levels=True,
-        implicit_room_creator=True,  # Used by MSC3820
-        updated_redaction_rules=True,  # Used by MSC3820
-        restricted_join_rule=True,
-        restricted_join_rule_fix=True,
-        knock_join_rule=True,
-        msc3389_relation_redactions=False,
-        knock_restricted_join_rule=True,
-        enforce_int_power_levels=True,
-        msc3931_push_features=(),
-        msc3757_enabled=False,
-        msc4289_creator_power_enabled=True,  # Changed from v11
-        msc4291_room_ids_as_hashes=True,  # Changed from v11
-    )
-
-
-KNOWN_ROOM_VERSIONS: Dict[str, RoomVersion] = {
-    v.identifier: v
-    for v in (
-        RoomVersions.V1,
-        RoomVersions.V2,
-        RoomVersions.V3,
-        RoomVersions.V4,
-        RoomVersions.V5,
-        RoomVersions.V6,
-        RoomVersions.V7,
-        RoomVersions.V8,
-        RoomVersions.V9,
-        RoomVersions.V10,
-        RoomVersions.V11,
-        RoomVersions.V12,
-        RoomVersions.MSC3757v10,
-        RoomVersions.MSC3757v11,
-        RoomVersions.HydraV11,
-    )
-}
-
-
-@attr.s(slots=True, frozen=True, auto_attribs=True)
-class RoomVersionCapability:
-    """An object which describes the unique attributes of a room version."""
-
-    identifier: str  # the identifier for this capability
-    preferred_version: Optional[RoomVersion]
-    support_check_lambda: Callable[[RoomVersion], bool]
-
-
-MSC3244_CAPABILITIES = {
-    cap.identifier: {
-        "preferred": (
-            cap.preferred_version.identifier
-            if cap.preferred_version is not None
-            else None
-        ),
-        "support": [
-            v.identifier
-            for v in KNOWN_ROOM_VERSIONS.values()
-            if cap.support_check_lambda(v)
-        ],
-    }
-    for cap in (
-        RoomVersionCapability(
-            "knock",
-            RoomVersions.V7,
-            lambda room_version: room_version.knock_join_rule,
-        ),
-        RoomVersionCapability(
-            "restricted",
-            RoomVersions.V9,
-            lambda room_version: room_version.restricted_join_rule,
-        ),
-    )
-}
+__all__ = [
+    "EventFormatVersions",
+    "KNOWN_EVENT_FORMAT_VERSIONS",
+    "KNOWN_ROOM_VERSIONS",
+    "PushRuleRoomFlag",
+    "RoomVersion",
+    "RoomVersions",
+    "StateResolutionVersions",
+]
diff --git a/synapse/api/urls.py b/synapse/api/urls.py
index 655b5edd7a..b6147353d4 100644
--- a/synapse/api/urls.py
+++ b/synapse/api/urls.py
@@ -22,8 +22,8 @@
 """Contains the URL paths to prefix various aspects of the server with."""
 
 import hmac
+import urllib.parse
 from hashlib import sha256
-from typing import Optional
 from urllib.parse import urlencode, urljoin
 
 from synapse.config import ConfigError
@@ -74,7 +74,7 @@ class LoginSSORedirectURIBuilder:
         self._public_baseurl = hs_config.server.public_baseurl
 
     def build_login_sso_redirect_uri(
-        self, *, idp_id: Optional[str], client_redirect_url: str
+        self, *, idp_id: str | None, client_redirect_url: str
     ) -> str:
         """Build a `/login/sso/redirect` URI for the given identity provider.
 
@@ -96,11 +96,21 @@ class LoginSSORedirectURIBuilder:
         serialized_query_parameters = urlencode({"redirectUrl": client_redirect_url})
 
         if idp_id:
+            # Since this is a user-controlled string, make it safe to include in a URL path.
+            url_encoded_idp_id = urllib.parse.quote(
+                idp_id,
+                # Since this defaults to `safe="/"`, we have to override it. We're
+                # working with an individual URL path parameter so there shouldn't be
+                # any slashes in it which could change the request path.
+                safe="",
+                encoding="utf8",
+            )
+
             resultant_url = urljoin(
                 # We have to add a trailing slash to the base URL to ensure that the
                 # last path segment is not stripped away when joining with another path.
                 f"{base_url}/",
-                f"{idp_id}?{serialized_query_parameters}",
+                f"{url_encoded_idp_id}?{serialized_query_parameters}",
             )
         else:
             resultant_url = f"{base_url}?{serialized_query_parameters}"
diff --git a/synapse/app/__init__.py b/synapse/app/__init__.py
index 56033f5782..fa436e874b 100644
--- a/synapse/app/__init__.py
+++ b/synapse/app/__init__.py
@@ -54,7 +54,9 @@ def check_bind_error(
     """
     if address == "0.0.0.0" and "::" in bind_addresses:
         logger.warning(
-            "Failed to listen on 0.0.0.0, continuing because listening on [::]"
+            "Failed to listen on 0.0.0.0, continuing because listening on [::]. Original exception: %s: %s",
+            type(e).__name__,
+            str(e),
         )
     else:
         raise e
diff --git a/synapse/app/_base.py b/synapse/app/_base.py
index 48989540bb..55df4c382e 100644
--- a/synapse/app/_base.py
+++ b/synapse/app/_base.py
@@ -28,21 +28,21 @@ import sys
 import traceback
 import warnings
 from textwrap import indent
+from threading import Thread
+from types import FrameType
 from typing import (
     TYPE_CHECKING,
     Any,
     Awaitable,
     Callable,
-    Dict,
-    List,
     NoReturn,
     Optional,
-    Tuple,
     cast,
 )
+from wsgiref.simple_server import WSGIServer
 
 from cryptography.utils import CryptographyDeprecationWarning
-from typing_extensions import ParamSpec
+from typing_extensions import ParamSpec, assert_never
 
 import twisted
 from twisted.internet import defer, error, reactor as _reactor
@@ -60,22 +60,24 @@ from twisted.python.threadpool import ThreadPool
 from twisted.web.resource import Resource
 
 import synapse.util.caches
-from synapse.api.constants import MAX_PDU_SIZE
+from synapse.api.constants import MAX_REQUEST_SIZE
 from synapse.app import check_bind_error
-from synapse.app.phone_stats_home import start_phone_stats_home
 from synapse.config import ConfigError
 from synapse.config._base import format_config_error
 from synapse.config.homeserver import HomeServerConfig
-from synapse.config.server import ListenerConfig, ManholeConfig, TCPListenerConfig
+from synapse.config.server import (
+    ListenerConfig,
+    ManholeConfig,
+    TCPListenerConfig,
+    UnixListenerConfig,
+)
 from synapse.crypto import context_factory
 from synapse.events.auto_accept_invites import InviteAutoAccepter
 from synapse.events.presence_router import load_legacy_presence_router
 from synapse.handlers.auth import load_legacy_password_auth_providers
 from synapse.http.site import SynapseSite
-from synapse.logging.context import PreserveLoggingContext
-from synapse.logging.opentracing import init_tracer
+from synapse.logging.context import LoggingContext, PreserveLoggingContext
 from synapse.metrics import install_gc_manager, register_threadpool
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.metrics.jemalloc import setup_jemalloc_stats
 from synapse.module_api.callbacks.spamchecker_callbacks import load_legacy_spam_checkers
 from synapse.module_api.callbacks.third_party_event_rules_callbacks import (
@@ -98,22 +100,53 @@ reactor = cast(ISynapseReactor, _reactor)
 
 logger = logging.getLogger(__name__)
 
-# list of tuples of function, args list, kwargs dict
-_sighup_callbacks: List[
-    Tuple[Callable[..., None], Tuple[object, ...], Dict[str, object]]
-] = []
+_instance_id_to_sighup_callbacks_map: dict[
+    str, list[tuple[Callable[..., None], tuple[object, ...], dict[str, object]]]
+] = {}
+"""
+Map from homeserver instance_id to a list of callbacks.
+
+We use `instance_id` instead of `server_name` because it's possible to have multiple
+workers running in the same process with the same `server_name`.
+"""
 P = ParamSpec("P")
 
 
-def register_sighup(func: Callable[P, None], *args: P.args, **kwargs: P.kwargs) -> None:
+def register_sighup(
+    hs: "HomeServer",
+    func: Callable[P, None],
+    *args: P.args,
+    **kwargs: P.kwargs,
+) -> None:
     """
     Register a function to be called when a SIGHUP occurs.
 
     Args:
+        homeserver_instance_id: The unique ID for this Synapse process instance
+            (`hs.get_instance_id()`) that this hook is associated with.
         func: Function to be called when sent a SIGHUP signal.
         *args, **kwargs: args and kwargs to be passed to the target function.
     """
-    _sighup_callbacks.append((func, args, kwargs))
+
+    # Wrap the function so we can run it within a logcontext
+    def _callback_wrapper(*args: P.args, **kwargs: P.kwargs) -> None:
+        with LoggingContext(name="sighup", server_name=hs.hostname):
+            func(*args, **kwargs)
+
+    _instance_id_to_sighup_callbacks_map.setdefault(hs.get_instance_id(), []).append(
+        (_callback_wrapper, args, kwargs)
+    )
+
+
+def unregister_sighups(homeserver_instance_id: str) -> None:
+    """
+    Unregister all sighup functions associated with this Synapse instance.
+
+    Args:
+        homeserver_instance_id: The unique ID for this Synapse process instance to
+            unregister hooks for (`hs.get_instance_id()`).
+    """
+    _instance_id_to_sighup_callbacks_map.pop(homeserver_instance_id, [])
 
 
 def start_worker_reactor(
@@ -151,8 +184,8 @@ def start_worker_reactor(
 def start_reactor(
     appname: str,
     soft_file_limit: int,
-    gc_thresholds: Optional[Tuple[int, int, int]],
-    pid_file: Optional[str],
+    gc_thresholds: tuple[int, int, int] | None,
+    pid_file: str | None,
     daemonize: bool,
     print_pidfile: bool,
     logger: logging.Logger,
@@ -183,25 +216,23 @@ def start_reactor(
         if gc_thresholds:
             gc.set_threshold(*gc_thresholds)
         install_gc_manager()
-        run_command()
 
-    # make sure that we run the reactor with the sentinel log context,
-    # otherwise other PreserveLoggingContext instances will get confused
-    # and complain when they see the logcontext arbitrarily swapping
-    # between the sentinel and `run` logcontexts.
-    #
-    # We also need to drop the logcontext before forking if we're daemonizing,
-    # otherwise the cputime metrics get confused about the per-thread resource usage
-    # appearing to go backwards.
-    with PreserveLoggingContext():
-        if daemonize:
-            assert pid_file is not None
+        # Reset the logging context when we start the reactor (whenever we yield control
+        # to the reactor, the `sentinel` logging context needs to be set so we don't
+        # leak the current logging context and erroneously apply it to the next task the
+        # reactor event loop picks up)
+        with PreserveLoggingContext():
+            run_command()
 
-            if print_pidfile:
-                print(pid_file)
+    if daemonize:
+        assert pid_file is not None
 
-            daemonize_process(pid_file, logger)
-        run()
+        if print_pidfile:
+            print(pid_file)
+
+        daemonize_process(pid_file, logger)
+
+    run()
 
 
 def quit_with_error(error_string: str) -> NoReturn:
@@ -243,7 +274,7 @@ def redirect_stdio_to_logs() -> None:
 
 
 def register_start(
-    cb: Callable[P, Awaitable], *args: P.args, **kwargs: P.kwargs
+    hs: "HomeServer", cb: Callable[P, Awaitable], *args: P.args, **kwargs: P.kwargs
 ) -> None:
     """Register a callback with the reactor, to be called once it is running
 
@@ -280,10 +311,13 @@ def register_start(
             # on as normal.
             os._exit(1)
 
-    reactor.callWhenRunning(lambda: defer.ensureDeferred(wrapper()))
+    clock = hs.get_clock()
+    clock.call_when_running(lambda: defer.ensureDeferred(wrapper()))
 
 
-def listen_metrics(bind_addresses: StrCollection, port: int) -> None:
+def listen_metrics(
+    bind_addresses: StrCollection, port: int
+) -> list[tuple[WSGIServer, Thread]]:
     """
     Start Prometheus metrics server.
 
@@ -296,14 +330,22 @@ def listen_metrics(bind_addresses: StrCollection, port: int) -> None:
     bytecode at a time), this still works because the metrics thread can preempt the
     Twisted reactor thread between bytecode boundaries and the metrics thread gets
     scheduled with roughly equal priority to the Twisted reactor thread.
+
+    Returns:
+        List of WSGIServer with the thread they are running on.
     """
     from prometheus_client import start_http_server as start_http_server_prometheus
 
     from synapse.metrics import RegistryProxy
 
+    servers: list[tuple[WSGIServer, Thread]] = []
     for host in bind_addresses:
         logger.info("Starting metrics listener on %s:%d", host, port)
-        start_http_server_prometheus(port, addr=host, registry=RegistryProxy)
+        server, thread = start_http_server_prometheus(
+            port, addr=host, registry=RegistryProxy
+        )
+        servers.append((server, thread))
+    return servers
 
 
 def listen_manhole(
@@ -311,7 +353,7 @@ def listen_manhole(
     port: int,
     manhole_settings: ManholeConfig,
     manhole_globals: dict,
-) -> None:
+) -> list[Port]:
     # twisted.conch.manhole 21.1.0 uses "int_from_bytes", which produces a confusing
     # warning. It's fixed by https://github.com/twisted/twisted/pull/1522), so
     # suppress the warning for now.
@@ -323,7 +365,7 @@ def listen_manhole(
 
     from synapse.util.manhole import manhole
 
-    listen_tcp(
+    return listen_tcp(
         bind_addresses,
         port,
         manhole(settings=manhole_settings, globals=manhole_globals),
@@ -336,7 +378,7 @@ def listen_tcp(
     factory: ServerFactory,
     reactor: IReactorTCP = reactor,
     backlog: int = 50,
-) -> List[Port]:
+) -> list[Port]:
     """
     Create a TCP socket for a port and several addresses
 
@@ -361,7 +403,7 @@ def listen_unix(
     factory: ServerFactory,
     reactor: IReactorUNIX = reactor,
     backlog: int = 50,
-) -> List[Port]:
+) -> list[Port]:
     """
     Create a UNIX socket for a given path and 'mode' permission
 
@@ -377,6 +419,37 @@ def listen_unix(
     ]
 
 
+class ListenerException(RuntimeError):
+    """
+    An exception raised when we fail to listen with the given `ListenerConfig`.
+
+    Attributes:
+        listener_config: The listener config that caused the exception.
+    """
+
+    def __init__(
+        self,
+        listener_config: ListenerConfig,
+    ):
+        listener_human_name = ""
+        port = ""
+        if isinstance(listener_config, TCPListenerConfig):
+            listener_human_name = "TCP port"
+            port = str(listener_config.port)
+        elif isinstance(listener_config, UnixListenerConfig):
+            listener_human_name = "unix socket"
+            port = listener_config.path
+        else:
+            assert_never(listener_config)
+
+        super().__init__(
+            "Failed to listen on %s (%s) with the given listener config: %s"
+            % (listener_human_name, port, listener_config)
+        )
+
+        self.listener_config = listener_config
+
+
 def listen_http(
     hs: "HomeServer",
     listener_config: ListenerConfig,
@@ -385,56 +458,81 @@ def listen_http(
     max_request_body_size: int,
     context_factory: Optional[IOpenSSLContextFactory],
     reactor: ISynapseReactor = reactor,
-) -> List[Port]:
+) -> list[Port]:
+    """
+    Args:
+        listener_config: TODO
+        root_resource: TODO
+        version_string: A string to present for the Server header
+        max_request_body_size: TODO
+        context_factory: TODO
+        reactor: TODO
+    """
     assert listener_config.http_options is not None
 
     site_tag = listener_config.get_site_tag()
 
     site = SynapseSite(
-        "synapse.access.%s.%s"
+        logger_name="synapse.access.%s.%s"
         % ("https" if listener_config.is_tls() else "http", site_tag),
-        site_tag,
-        listener_config,
-        root_resource,
-        version_string,
+        site_tag=site_tag,
+        config=listener_config,
+        resource=root_resource,
+        server_version_string=version_string,
         max_request_body_size=max_request_body_size,
         reactor=reactor,
         hs=hs,
     )
 
-    if isinstance(listener_config, TCPListenerConfig):
-        if listener_config.is_tls():
-            # refresh_certificate should have been called before this.
-            assert context_factory is not None
-            ports = listen_ssl(
-                listener_config.bind_addresses,
-                listener_config.port,
-                site,
-                context_factory,
-                reactor=reactor,
+    try:
+        if isinstance(listener_config, TCPListenerConfig):
+            if listener_config.is_tls():
+                # refresh_certificate should have been called before this.
+                assert context_factory is not None
+                ports = listen_ssl(
+                    listener_config.bind_addresses,
+                    listener_config.port,
+                    site,
+                    context_factory,
+                    reactor=reactor,
+                )
+                logger.info(
+                    "Synapse now listening on TCP port %d (TLS)", listener_config.port
+                )
+            else:
+                ports = listen_tcp(
+                    listener_config.bind_addresses,
+                    listener_config.port,
+                    site,
+                    reactor=reactor,
+                )
+                logger.info(
+                    "Synapse now listening on TCP port %d", listener_config.port
+                )
+
+        elif isinstance(listener_config, UnixListenerConfig):
+            ports = listen_unix(
+                listener_config.path, listener_config.mode, site, reactor=reactor
             )
+            # getHost() returns a UNIXAddress which contains an instance variable of 'name'
+            # encoded as a byte string. Decode as utf-8 so pretty.
             logger.info(
-                "Synapse now listening on TCP port %d (TLS)", listener_config.port
+                "Synapse now listening on Unix Socket at: %s",
+                ports[0].getHost().name.decode("utf-8"),
             )
         else:
-            ports = listen_tcp(
-                listener_config.bind_addresses,
-                listener_config.port,
-                site,
-                reactor=reactor,
-            )
-            logger.info("Synapse now listening on TCP port %d", listener_config.port)
-
-    else:
-        ports = listen_unix(
-            listener_config.path, listener_config.mode, site, reactor=reactor
-        )
-        # getHost() returns a UNIXAddress which contains an instance variable of 'name'
-        # encoded as a byte string. Decode as utf-8 so pretty.
-        logger.info(
-            "Synapse now listening on Unix Socket at: %s",
-            ports[0].getHost().name.decode("utf-8"),
-        )
+            assert_never(listener_config)
+    except Exception as exc:
+        # The Twisted interface says that "Users should not call this function
+        # themselves!" but this appears to be the correct/only way handle proper cleanup
+        # of the site when things go wrong. In the normal case, a `Port` is created
+        # which we can call `Port.stopListening()` on to do the same thing (but no
+        # `Port` is created when an error occurs).
+        #
+        # We use `site.stopFactory()` instead of `site.doStop()` as the latter assumes
+        # that `site.doStart()` was called (which won't be the case if an error occurs).
+        site.stopFactory()
+        raise ListenerException(listener_config) from exc
 
     return ports
 
@@ -446,7 +544,7 @@ def listen_ssl(
     context_factory: IOpenSSLContextFactory,
     reactor: IReactorSSL = reactor,
     backlog: int = 50,
-) -> List[Port]:
+) -> list[Port]:
     """
     Create an TLS-over-TCP socket for a port and several addresses
 
@@ -500,7 +598,60 @@ def refresh_certificate(hs: "HomeServer") -> None:
         logger.info("Context factories updated.")
 
 
-async def start(hs: "HomeServer") -> None:
+_already_setup_sighup_handling = False
+"""
+Marks whether we've already successfully ran `setup_sighup_handling()`.
+"""
+
+
+def setup_sighup_handling() -> None:
+    """
+    Set up SIGHUP handling to call registered callbacks.
+
+    This can be called multiple times safely.
+    """
+    global _already_setup_sighup_handling
+    # We only need to set things up once per process.
+    if _already_setup_sighup_handling:
+        return
+
+    previous_sighup_handler: Callable[[int, FrameType | None], Any] | int | None = None
+
+    # Set up the SIGHUP machinery.
+    if hasattr(signal, "SIGHUP"):
+
+        def handle_sighup(*args: Any, **kwargs: Any) -> None:
+            # Tell systemd our state, if we're using it. This will silently fail if
+            # we're not using systemd.
+            sdnotify(b"RELOADING=1")
+
+            if callable(previous_sighup_handler):
+                previous_sighup_handler(*args, **kwargs)
+
+            for sighup_callbacks in _instance_id_to_sighup_callbacks_map.values():
+                for func, args, kwargs in sighup_callbacks:
+                    func(*args, **kwargs)
+
+            sdnotify(b"READY=1")
+
+        # We defer running the sighup handlers until next reactor tick. This
+        # is so that we're in a sane state, e.g. flushing the logs may fail
+        # if the sighup happens in the middle of writing a log entry.
+        def run_sighup(*args: Any, **kwargs: Any) -> None:
+            # `callFromThread` should be "signal safe" as well as thread
+            # safe.
+            reactor.callFromThread(handle_sighup, *args, **kwargs)
+
+        # Register for the SIGHUP signal, chaining any existing handler as there can
+        # only be one handler per signal and we don't want to clobber any existing
+        # handlers (like the `multi_synapse` shard process in the context of Synapse Pro
+        # for small hosts)
+        previous_sighup_handler = signal.signal(signal.SIGHUP, run_sighup)
+
+    _already_setup_sighup_handling = True
+
+
+async def start(hs: "HomeServer", *, freeze: bool = True) -> None:
     """
     Start a Synapse server or worker.
 
@@ -511,6 +662,11 @@ async def start(hs: "HomeServer") -> None:
 
     Args:
         hs: homeserver instance
+        freeze: whether to freeze the homeserver base objects in the garbage collector.
+            May improve garbage collection performance by marking objects with an effectively
+            static lifetime as frozen so they don't need to be considered for cleanup.
+            If you ever want to `shutdown` the homeserver, this needs to be
+            False otherwise the homeserver cannot be garbage collected after `shutdown`.
     """
     server_name = hs.hostname
     reactor = hs.get_reactor()
@@ -519,7 +675,9 @@ async def start(hs: "HomeServer") -> None:
     # numbers of DNS requests don't starve out other users of the threadpool.
     resolver_threadpool = ThreadPool(name="gai_resolver")
     resolver_threadpool.start()
-    reactor.addSystemEventTrigger("during", "shutdown", resolver_threadpool.stop)
+    hs.get_clock().add_system_event_trigger(
+        "during", "shutdown", resolver_threadpool.stop
+    )
     reactor.installNameResolver(
         GAIResolver(reactor, getThreadPool=lambda: resolver_threadpool)
     )
@@ -532,50 +690,24 @@ async def start(hs: "HomeServer") -> None:
         name="gai_resolver", server_name=server_name, threadpool=resolver_threadpool
     )
 
-    # Set up the SIGHUP machinery.
-    if hasattr(signal, "SIGHUP"):
-
-        def handle_sighup(*args: Any, **kwargs: Any) -> "defer.Deferred[None]":
-            async def _handle_sighup(*args: Any, **kwargs: Any) -> None:
-                # Tell systemd our state, if we're using it. This will silently fail if
-                # we're not using systemd.
-                sdnotify(b"RELOADING=1")
-
-                for i, args, kwargs in _sighup_callbacks:
-                    i(*args, **kwargs)
-
-                sdnotify(b"READY=1")
-
-            return run_as_background_process(
-                "sighup",
-                server_name,
-                _handle_sighup,
-                *args,
-                **kwargs,
-            )
-
-        # We defer running the sighup handlers until next reactor tick. This
-        # is so that we're in a sane state, e.g. flushing the logs may fail
-        # if the sighup happens in the middle of writing a log entry.
-        def run_sighup(*args: Any, **kwargs: Any) -> None:
-            # `callFromThread` should be "signal safe" as well as thread
-            # safe.
-            reactor.callFromThread(handle_sighup, *args, **kwargs)
-
-        signal.signal(signal.SIGHUP, run_sighup)
-
-        register_sighup(refresh_certificate, hs)
-        register_sighup(reload_cache_config, hs.config)
+    setup_sighup_handling()
+    register_sighup(hs, refresh_certificate, hs)
+    register_sighup(hs, reload_cache_config, hs.config)
 
     # Apply the cache config.
     hs.config.caches.resize_all_caches()
 
+    # Load the OIDC provider metadatas, if OIDC is enabled.
+    if hs.config.oidc.oidc_enabled:
+        oidc = hs.get_oidc_handler()
+        # Preload the provider metadata.
+        # This will spawn fire-and-forget background processes.
+        # Loading the provider metadata also ensures the provider config is valid.
+        oidc.preload_metadata()
+
     # Load the certificate from disk.
     refresh_certificate(hs)
 
-    # Start the tracer
-    init_tracer(hs)  # noqa
-
     # Instantiate the modules so they can register their web resources to the module API
     # before we start the listeners.
     module_api = hs.get_module_api()
@@ -601,32 +733,58 @@ async def start(hs: "HomeServer") -> None:
     hs.get_datastores().main.db_pool.start_profiling()
     hs.get_pusherpool().start()
 
+    def log_shutdown() -> None:
+        with LoggingContext(name="log_shutdown", server_name=server_name):
+            logger.info("Shutting down...")
+
     # Log when we start the shut down process.
-    hs.get_reactor().addSystemEventTrigger(
-        "before", "shutdown", logger.info, "Shutting down..."
+    hs.register_sync_shutdown_handler(
+        phase="before",
+        eventType="shutdown",
+        shutdown_func=log_shutdown,
     )
 
     setup_sentry(hs)
     setup_sdnotify(hs)
 
-    # If background tasks are running on the main process or this is the worker in
-    # charge of them, start collecting the phone home stats and shared usage metrics.
-    if hs.config.worker.run_background_tasks:
-        await hs.get_common_usage_metrics_manager().setup()
-        start_phone_stats_home(hs)
-
-    # We now freeze all allocated objects in the hopes that (almost)
-    # everything currently allocated are things that will be used for the
-    # rest of time. Doing so means less work each GC (hopefully).
+    # Register background tasks required by this server. This must be done
+    # somewhat manually due to the background tasks not being registered
+    # unless handlers are instantiated.
     #
-    # PyPy does not (yet?) implement gc.freeze()
-    if hasattr(gc, "freeze"):
-        gc.collect()
-        gc.freeze()
+    # While we could "start" these before the reactor runs, nothing will happen until
+    # the reactor is running, so we may as well do it here in `start`.
+    #
+    # Additionally, this means we also start them after we daemonize and fork the
+    # process which means we can avoid any potential problems with cputime metrics
+    # getting confused about the per-thread resource usage appearing to go backwards
+    # because we're comparing the resource usage (`rusage`) from the original process to
+    # the forked process.
+    if hs.config.worker.run_background_tasks:
+        hs.start_background_tasks()
 
-        # Speed up shutdowns by freezing all allocated objects. This moves everything
-        # into the permanent generation and excludes them from the final GC.
-        atexit.register(gc.freeze)
+    if freeze:
+        # We now freeze all allocated objects in the hopes that (almost)
+        # everything currently allocated are things that will be used for the
+        # rest of time. Doing so means less work each GC (hopefully).
+        #
+        # Note that freezing the homeserver object means that it won't be able to be
+        # garbage collected in the case of attempting an in-memory `shutdown`. This only
+        # needs to be considered if such a case is desirable. Exiting the entire Python
+        # process will function expectedly either way.
+        #
+        # PyPy does not (yet?) implement gc.freeze()
+        if hasattr(gc, "freeze"):
+            logger.info(
+                "garbage collector: Freezing all allocated objects in the hopes that (almost) "
+                "everything currently allocated are things that will be used by the homeserver "
+                "for the rest of time. Doing so means less work each GC (hopefully)."
+            )
+            gc.collect()
+            gc.freeze()
+
+            # Speed up process exit by freezing all allocated objects. This moves everything
+            # into the permanent generation and excludes them from the final GC.
+            atexit.register(gc.freeze)
 
 
 def reload_cache_config(config: HomeServerConfig) -> None:
@@ -701,7 +859,7 @@ def setup_sdnotify(hs: "HomeServer") -> None:
     # we're not using systemd.
     sdnotify(b"READY=1\nMAINPID=%i" % (os.getpid(),))
 
-    hs.get_reactor().addSystemEventTrigger(
+    hs.get_clock().add_system_event_trigger(
         "before", "shutdown", sdnotify, b"STOPPING=1"
     )
 
@@ -741,17 +899,8 @@ def sdnotify(state: bytes) -> None:
 def max_request_body_size(config: HomeServerConfig) -> int:
     """Get a suitable maximum size for incoming HTTP requests"""
 
-    # Other than media uploads, the biggest request we expect to see is a fully-loaded
-    # /federation/v1/send request.
-    #
-    # The main thing in such a request is up to 50 PDUs, and up to 100 EDUs. PDUs are
-    # limited to 65536 bytes (possibly slightly more if the sender didn't use canonical
-    # json encoding); there is no specced limit to EDUs (see
-    # https://github.com/matrix-org/matrix-doc/issues/3121).
-    #
-    # in short, we somewhat arbitrarily limit requests to 200 * 64K (about 12.5M)
-    #
-    max_request_size = 200 * MAX_PDU_SIZE
+    # Baseline default for any request that isn't configured in the homeserver config
+    max_request_size = MAX_REQUEST_SIZE
 
     # if we have a media repo enabled, we may need to allow larger uploads than that
     if config.media.can_load_media_repo:
diff --git a/synapse/app/admin_cmd.py b/synapse/app/admin_cmd.py
index 7c9b94c65c..0614c805da 100644
--- a/synapse/app/admin_cmd.py
+++ b/synapse/app/admin_cmd.py
@@ -24,7 +24,7 @@ import logging
 import os
 import sys
 import tempfile
-from typing import List, Mapping, Optional, Sequence
+from typing import Mapping, Optional, Sequence
 
 from twisted.internet import defer, task
 
@@ -64,8 +64,7 @@ from synapse.storage.databases.main.state import StateGroupWorkerStore
 from synapse.storage.databases.main.stream import StreamWorkerStore
 from synapse.storage.databases.main.tags import TagsWorkerStore
 from synapse.storage.databases.main.user_erasure_store import UserErasureWorkerStore
-from synapse.types import JsonMapping, StateMap
-from synapse.util import SYNAPSE_VERSION
+from synapse.types import ISynapseReactor, JsonMapping, StateMap
 from synapse.util.logcontext import LoggingContext
 
 logger = logging.getLogger("synapse.app.admin_cmd")
@@ -137,7 +136,7 @@ class FileExfiltrationWriter(ExfiltrationWriter):
             to a temporary directory.
     """
 
-    def __init__(self, user_id: str, directory: Optional[str] = None):
+    def __init__(self, user_id: str, directory: str | None = None):
         self.user_id = user_id
 
         if directory:
@@ -151,7 +150,7 @@ class FileExfiltrationWriter(ExfiltrationWriter):
         if list(os.listdir(self.base_directory)):
             raise Exception("Directory must be empty")
 
-    def write_events(self, room_id: str, events: List[EventBase]) -> None:
+    def write_events(self, room_id: str, events: list[EventBase]) -> None:
         room_directory = os.path.join(self.base_directory, "rooms", room_id)
         os.makedirs(room_directory, exist_ok=True)
         events_file = os.path.join(room_directory, "events")
@@ -256,7 +255,7 @@ class FileExfiltrationWriter(ExfiltrationWriter):
         return self.base_directory
 
 
-def start(config_options: List[str]) -> None:
+def load_config(argv_options: list[str]) -> tuple[HomeServerConfig, argparse.Namespace]:
     parser = argparse.ArgumentParser(description="Synapse Admin Command")
     HomeServerConfig.add_arguments_to_parser(parser)
 
@@ -282,11 +281,29 @@ def start(config_options: List[str]) -> None:
     export_data_parser.set_defaults(func=export_data_command)
 
     try:
-        config, args = HomeServerConfig.load_config_with_parser(parser, config_options)
+        config, args = HomeServerConfig.load_config_with_parser(parser, argv_options)
     except ConfigError as e:
         sys.stderr.write("\n" + str(e) + "\n")
         sys.exit(1)
 
+    return config, args
+
+
+def create_homeserver(
+    config: HomeServerConfig,
+    reactor: Optional[ISynapseReactor] = None,
+) -> AdminCmdServer:
+    """
+    Create a homeserver instance for the Synapse admin command process.
+
+    Args:
+        config: The configuration for the homeserver.
+        reactor: Optionally provide a reactor to use. Can be useful in different
+            scenarios that you want control over the reactor, such as tests.
+
+    Returns:
+        A homeserver instance.
+    """
     if config.worker.worker_app is not None:
         assert config.worker.worker_app == "synapse.app.admin_cmd"
 
@@ -309,33 +326,63 @@ def start(config_options: List[str]) -> None:
 
     synapse.events.USE_FROZEN_DICTS = config.server.use_frozen_dicts
 
-    ss = AdminCmdServer(
+    admin_command_server = AdminCmdServer(
         config.server.server_name,
         config=config,
-        version_string=f"Synapse/{SYNAPSE_VERSION}",
+        reactor=reactor,
     )
 
-    setup_logging(ss, config, use_worker_options=True)
+    return admin_command_server
 
-    ss.setup()
 
-    # We use task.react as the basic run command as it correctly handles tearing
-    # down the reactor when the deferreds resolve and setting the return value.
-    # We also make sure that `_base.start` gets run before we actually run the
-    # command.
+def setup(admin_command_server: AdminCmdServer) -> None:
+    """
+    Setup a `AdminCmdServer` instance.
 
-    async def run() -> None:
-        with LoggingContext("command"):
-            await _base.start(ss)
-            await args.func(ss, args)
-
-    _base.start_worker_reactor(
-        "synapse-admin-cmd",
-        config,
-        run_command=lambda: task.react(lambda _reactor: defer.ensureDeferred(run())),
+    Args:
+        admin_command_server: The homeserver to setup.
+    """
+    setup_logging(
+        admin_command_server, admin_command_server.config, use_worker_options=True
     )
 
+    admin_command_server.setup()
+
+
+async def start(admin_command_server: AdminCmdServer, args: argparse.Namespace) -> None:
+    """
+    Should be called once the reactor is running.
+
+    Args:
+        admin_command_server: The homeserver to setup.
+        args: Command line arguments.
+    """
+    # This needs a logcontext unlike other entrypoints because we're not using
+    # `register_start(...)` to run this function.
+    with LoggingContext(name="start", server_name=admin_command_server.hostname):
+        # We make sure that `_base.start` gets run before we actually run the command.
+        await _base.start(admin_command_server)
+        # Run the command
+        await args.func(admin_command_server, args)
+
+
+def main() -> None:
+    homeserver_config, args = load_config(sys.argv[1:])
+    with LoggingContext(name="main", server_name=homeserver_config.server.server_name):
+        # Initialize and setup the homeserver
+        admin_command_server = create_homeserver(homeserver_config)
+        setup(admin_command_server)
+
+        _base.start_worker_reactor(
+            "synapse-admin-cmd",
+            admin_command_server.config,
+            # We use task.react as the basic run command as it correctly handles tearing
+            # down the reactor when the deferreds resolve and setting the return value.
+            run_command=lambda: task.react(
+                lambda _reactor: defer.ensureDeferred(start(admin_command_server, args))
+            ),
+        )
+
 
 if __name__ == "__main__":
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    main()
diff --git a/synapse/app/appservice.py b/synapse/app/appservice.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/appservice.py
+++ b/synapse/app/appservice.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/client_reader.py b/synapse/app/client_reader.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/client_reader.py
+++ b/synapse/app/client_reader.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/complement_fork_proxied_reactor.py b/synapse/app/complement_fork_proxied_reactor.py
new file mode 100644
index 0000000000..7b03fede68
--- /dev/null
+++ b/synapse/app/complement_fork_proxied_reactor.py
@@ -0,0 +1,60 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+# [This file includes modifications made by New Vector Limited]
+#
+#
+
+from typing import Any
+
+
+class ProxiedReactor:
+    """
+    Twisted tracks the 'installed' reactor as a global variable.
+    (Actually, it does some module trickery, but the effect is similar.)
+
+    The default EpollReactor is buggy if it's created before a process is
+    forked, then used in the child.
+    See https://twistedmatrix.com/trac/ticket/4759#comment:17.
+
+    However, importing certain Twisted modules will automatically create and
+    install a reactor if one hasn't already been installed.
+    It's not normally possible to re-install a reactor.
+
+    Given the goal of launching workers with fork() to only import the code once,
+    this presents a conflict.
+    Our work around is to 'install' this ProxiedReactor which prevents Twisted
+    from creating and installing one, but which lets us replace the actual reactor
+    in use later on.
+    """
+
+    def __init__(self) -> None:
+        self.___reactor_target: Any = None
+
+    def _install_real_reactor(self, new_reactor: Any) -> None:
+        """
+        Install a real reactor for this ProxiedReactor to forward lookups onto.
+
+        This method is specific to our ProxiedReactor and should not clash with
+        any names used on an actual Twisted reactor.
+        """
+        self.___reactor_target = new_reactor
+
+        # Import here to avoid circular imports.
+        from synapse.metrics._reactor_metrics import install_reactor_metrics
+
+        # Install reactor metrics now we've got a real reactor.
+        install_reactor_metrics(new_reactor)
+
+    def __getattr__(self, attr_name: str) -> Any:
+        return getattr(self.___reactor_target, attr_name)
diff --git a/synapse/app/complement_fork_starter.py b/synapse/app/complement_fork_starter.py
index b981a7631b..83d1d4f5ac 100644
--- a/synapse/app/complement_fork_starter.py
+++ b/synapse/app/complement_fork_starter.py
@@ -26,53 +26,19 @@ import os
 import signal
 import sys
 from types import FrameType
-from typing import Any, Callable, Dict, List, Optional
+from typing import Any, Callable
 
 from twisted.internet.main import installReactor
 
+from synapse.app.complement_fork_proxied_reactor import ProxiedReactor
+
 # a list of the original signal handlers, before we installed our custom ones.
 # We restore these in our child processes.
-_original_signal_handlers: Dict[int, Any] = {}
-
-
-class ProxiedReactor:
-    """
-    Twisted tracks the 'installed' reactor as a global variable.
-    (Actually, it does some module trickery, but the effect is similar.)
-
-    The default EpollReactor is buggy if it's created before a process is
-    forked, then used in the child.
-    See https://twistedmatrix.com/trac/ticket/4759#comment:17.
-
-    However, importing certain Twisted modules will automatically create and
-    install a reactor if one hasn't already been installed.
-    It's not normally possible to re-install a reactor.
-
-    Given the goal of launching workers with fork() to only import the code once,
-    this presents a conflict.
-    Our work around is to 'install' this ProxiedReactor which prevents Twisted
-    from creating and installing one, but which lets us replace the actual reactor
-    in use later on.
-    """
-
-    def __init__(self) -> None:
-        self.___reactor_target: Any = None
-
-    def _install_real_reactor(self, new_reactor: Any) -> None:
-        """
-        Install a real reactor for this ProxiedReactor to forward lookups onto.
-
-        This method is specific to our ProxiedReactor and should not clash with
-        any names used on an actual Twisted reactor.
-        """
-        self.___reactor_target = new_reactor
-
-    def __getattr__(self, attr_name: str) -> Any:
-        return getattr(self.___reactor_target, attr_name)
+_original_signal_handlers: dict[int, Any] = {}
 
 
 def _worker_entrypoint(
-    func: Callable[[], None], proxy_reactor: ProxiedReactor, args: List[str]
+    func: Callable[[], None], proxy_reactor: ProxiedReactor, args: list[str]
 ) -> None:
     """
     Entrypoint for a forked worker process.
@@ -128,7 +94,7 @@ def main() -> None:
 
     # Split up the subsequent arguments into each workers' arguments;
     # `--` is our delimiter of choice.
-    args_by_worker: List[List[str]] = [
+    args_by_worker: list[list[str]] = [
         list(args)
         for cond, args in itertools.groupby(ns.args, lambda ele: ele != "--")
         if cond and args
@@ -167,12 +133,12 @@ def main() -> None:
     update_proc.join()
     print("===== PREPARED DATABASE =====", file=sys.stderr)
 
-    processes: List[multiprocessing.Process] = []
+    processes: list[multiprocessing.Process] = []
 
     # Install signal handlers to propagate signals to all our children, so that they
     # shut down cleanly. This also inhibits our own exit, but that's good: we want to
     # wait until the children have exited.
-    def handle_signal(signum: int, frame: Optional[FrameType]) -> None:
+    def handle_signal(signum: int, frame: FrameType | None) -> None:
         print(
             f"complement_fork_starter: Caught signal {signum}. Stopping children.",
             file=sys.stderr,
diff --git a/synapse/app/event_creator.py b/synapse/app/event_creator.py
index f0d41ed22c..5b18578bd0 100644
--- a/synapse/app/event_creator.py
+++ b/synapse/app/event_creator.py
@@ -18,15 +18,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/federation_reader.py b/synapse/app/federation_reader.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/federation_reader.py
+++ b/synapse/app/federation_reader.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/federation_sender.py b/synapse/app/federation_sender.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/federation_sender.py
+++ b/synapse/app/federation_sender.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/frontend_proxy.py b/synapse/app/frontend_proxy.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/frontend_proxy.py
+++ b/synapse/app/frontend_proxy.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/generic_worker.py b/synapse/app/generic_worker.py
index 4f5bea6bd6..159cd44237 100644
--- a/synapse/app/generic_worker.py
+++ b/synapse/app/generic_worker.py
@@ -21,7 +21,7 @@
 #
 import logging
 import sys
-from typing import Dict, List
+from typing import Optional
 
 from twisted.web.resource import Resource
 
@@ -49,6 +49,7 @@ from synapse.config.server import ListenerConfig, TCPListenerConfig
 from synapse.federation.transport.server import TransportLayerServer
 from synapse.http.server import JsonResource, OptionsResource
 from synapse.logging.context import LoggingContext
+from synapse.logging.opentracing import init_tracer
 from synapse.metrics import METRICS_PREFIX, MetricsResource, RegistryProxy
 from synapse.replication.http import REPLICATION_PREFIX, ReplicationRestResource
 from synapse.rest import ClientRestResource, admin
@@ -101,6 +102,7 @@ from synapse.storage.databases.main.signatures import SignatureWorkerStore
 from synapse.storage.databases.main.sliding_sync import SlidingSyncStore
 from synapse.storage.databases.main.state import StateGroupWorkerStore
 from synapse.storage.databases.main.stats import StatsStore
+from synapse.storage.databases.main.sticky_events import StickyEventsWorkerStore
 from synapse.storage.databases.main.stream import StreamWorkerStore
 from synapse.storage.databases.main.tags import TagsWorkerStore
 from synapse.storage.databases.main.task_scheduler import TaskSchedulerWorkerStore
@@ -111,7 +113,7 @@ from synapse.storage.databases.main.transactions import TransactionWorkerStore
 from synapse.storage.databases.main.ui_auth import UIAuthWorkerStore
 from synapse.storage.databases.main.user_directory import UserDirectoryStore
 from synapse.storage.databases.main.user_erasure_store import UserErasureWorkerStore
-from synapse.util import SYNAPSE_VERSION
+from synapse.types import ISynapseReactor
 from synapse.util.httpresourcetree import create_resource_tree
 
 logger = logging.getLogger("synapse.app.generic_worker")
@@ -136,6 +138,7 @@ class GenericWorkerStore(
     RoomWorkerStore,
     DirectoryWorkerStore,
     ThreadSubscriptionsWorkerStore,
+    StickyEventsWorkerStore,
     PushRulesWorkerStore,
     ApplicationServiceTransactionWorkerStore,
     ApplicationServiceWorkerStore,
@@ -181,7 +184,7 @@ class GenericWorkerServer(HomeServer):
 
         # We always include an admin resource that we populate with servlets as needed
         admin_resource = JsonResource(self, canonical_json=False)
-        resources: Dict[str, Resource] = {
+        resources: dict[str, Resource] = {
             # We always include a health resource.
             "/health": HealthResource(),
             "/_synapse/admin": admin_resource,
@@ -277,11 +280,13 @@ class GenericWorkerServer(HomeServer):
                 self._listen_http(listener)
             elif listener.type == "manhole":
                 if isinstance(listener, TCPListenerConfig):
-                    _base.listen_manhole(
-                        listener.bind_addresses,
-                        listener.port,
-                        manhole_settings=self.config.server.manhole_settings,
-                        manhole_globals={"hs": self},
+                    self._listening_services.extend(
+                        _base.listen_manhole(
+                            listener.bind_addresses,
+                            listener.port,
+                            manhole_settings=self.config.server.manhole_settings,
+                            manhole_globals={"hs": self},
+                        )
                     )
                 else:
                     raise ConfigError(
@@ -295,9 +300,11 @@ class GenericWorkerServer(HomeServer):
                     )
                 else:
                     if isinstance(listener, TCPListenerConfig):
-                        _base.listen_metrics(
-                            listener.bind_addresses,
-                            listener.port,
+                        self._metrics_listeners.extend(
+                            _base.listen_metrics(
+                                listener.bind_addresses,
+                                listener.port,
+                            )
                         )
                     else:
                         raise ConfigError(
@@ -310,13 +317,49 @@ class GenericWorkerServer(HomeServer):
         self.get_replication_command_handler().start_replication(self)
 
 
-def start(config_options: List[str]) -> None:
+def load_config(argv_options: list[str]) -> HomeServerConfig:
+    """
+    Parse the commandline and config files (does not generate config)
+
+    Args:
+        argv_options: The options passed to Synapse. Usually `sys.argv[1:]`.
+
+    Returns:
+        Config object.
+    """
     try:
-        config = HomeServerConfig.load_config("Synapse worker", config_options)
+        config = HomeServerConfig.load_config("Synapse worker", argv_options)
     except ConfigError as e:
         sys.stderr.write("\n" + str(e) + "\n")
         sys.exit(1)
 
+    return config
+
+
+def create_homeserver(
+    config: HomeServerConfig,
+    reactor: Optional[ISynapseReactor] = None,
+) -> GenericWorkerServer:
+    """
+    Create a homeserver instance for the Synapse worker process.
+
+    Our composable functions (`create_homeserver`, `setup`, `start`) should not exit the
+    Python process (call `exit(...)`) and instead raise exceptions which can be handled
+    by the caller as desired. This doesn't matter for the normal case of one Synapse
+    instance running in the Python process (as we're only affecting ourselves), but is
+    important when we have multiple Synapse homeserver tenants running in the same
+    Python process (c.f. Synapse Pro for small hosts) as we don't want some problem from
+    one tenant stopping the rest of the tenants.
+
+    Args:
+        config: The configuration for the homeserver.
+        reactor: Optionally provide a reactor to use. Can be useful in different
+            scenarios that you want control over the reactor, such as tests.
+
+    Returns:
+        A homeserver instance.
+    """
+
     # For backwards compatibility let any of the old app names.
     assert config.worker.worker_app in (
         "synapse.app.appservice",
@@ -341,32 +384,93 @@ def start(config_options: List[str]) -> None:
     hs = GenericWorkerServer(
         config.server.server_name,
         config=config,
-        version_string=f"Synapse/{SYNAPSE_VERSION}",
+        reactor=reactor,
     )
 
-    setup_logging(hs, config, use_worker_options=True)
+    return hs
 
-    try:
-        hs.setup()
 
-        # Ensure the replication streamer is always started in case we write to any
-        # streams. Will no-op if no streams can be written to by this worker.
-        hs.get_replication_streamer()
-    except Exception as e:
-        handle_startup_exception(e)
+def setup(hs: GenericWorkerServer) -> None:
+    """
+    Setup a `GenericWorkerServer` (worker) instance.
 
-    register_start(_base.start, hs)
+    Our composable functions (`create_homeserver`, `setup`, `start`) should not exit the
+    Python process (call `exit(...)`) and instead raise exceptions which can be handled
+    by the caller as desired. This doesn't matter for the normal case of one Synapse
+    instance running in the Python process (as we're only affecting ourselves), but is
+    important when we have multiple Synapse homeserver tenants running in the same
+    Python process (c.f. Synapse Pro for small hosts) as we don't want some problem from
+    one tenant stopping the rest of the tenants.
 
-    # redirect stdio to the logs, if configured.
-    if not hs.config.logging.no_redirect_stdio:
-        redirect_stdio_to_logs()
+    Args:
+        hs: The homeserver to setup.
+    """
 
-    _base.start_worker_reactor("synapse-generic-worker", config)
+    setup_logging(hs, hs.config, use_worker_options=True)
+
+    # Start the tracer
+    init_tracer(hs)  # noqa
+
+    hs.setup()
+
+    # Ensure the replication streamer is always started in case we write to any
+    # streams. Will no-op if no streams can be written to by this worker.
+    hs.get_replication_streamer()
+
+
+async def start(
+    hs: GenericWorkerServer,
+    *,
+    freeze: bool = True,
+) -> None:
+    """
+    Should be called once the reactor is running.
+
+    Our composable functions (`create_homeserver`, `setup`, `start`) should not exit the
+    Python process (call `exit(...)`) and instead raise exceptions which can be handled
+    by the caller as desired. This doesn't matter for the normal case of one Synapse
+    instance running in the Python process (as we're only affecting ourselves), but is
+    important when we have multiple Synapse homeserver tenants running in the same
+    Python process (c.f. Synapse Pro for small hosts) as we don't want some problem from
+    one tenant stopping the rest of the tenants.
+
+    Args:
+        hs: The homeserver to setup.
+        freeze: whether to freeze the homeserver base objects in the garbage collector.
+            May improve garbage collection performance by marking objects with an effectively
+            static lifetime as frozen so they don't need to be considered for cleanup.
+            If you ever want to `shutdown` the homeserver, this needs to be
+            False otherwise the homeserver cannot be garbage collected after `shutdown`.
+    """
+
+    await _base.start(hs, freeze=freeze)
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    homeserver_config = load_config(sys.argv[1:])
+
+    # Create a logging context as soon as possible so we can start associating
+    # everything with this homeserver.
+    with LoggingContext(name="main", server_name=homeserver_config.server.server_name):
+        # Initialize and setup the homeserver
+        hs = create_homeserver(homeserver_config)
+        try:
+            setup(hs)
+        except Exception as e:
+            handle_startup_exception(e)
+
+        # For problems immediately apparent during initialization, we want to log to
+        # stderr in the terminal so that they are obvious and visible to the operator.
+        #
+        # Now that we're past the initialization stage, we can redirect anything printed
+        # to stdio to the logs, if configured.
+        if not homeserver_config.logging.no_redirect_stdio:
+            redirect_stdio_to_logs()
+
+        # Register a callback to be invoked once the reactor is running
+        register_start(hs, start, hs)
+
+        _base.start_worker_reactor("synapse-generic-worker", homeserver_config)
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/homeserver.py b/synapse/app/homeserver.py
index e027b5eaea..2b1760416b 100644
--- a/synapse/app/homeserver.py
+++ b/synapse/app/homeserver.py
@@ -22,14 +22,13 @@
 import logging
 import os
 import sys
-from typing import Dict, Iterable, List
+from typing import Iterable, Optional
 
 from twisted.internet.tcp import Port
 from twisted.web.resource import EncodingResourceWrapper, Resource
 from twisted.web.server import GzipEncoderFactory
 
 import synapse
-import synapse.config.logger
 from synapse import events
 from synapse.api.urls import (
     CLIENT_API_PREFIX,
@@ -50,6 +49,7 @@ from synapse.app._base import (
 )
 from synapse.config._base import ConfigError, format_config_error
 from synapse.config.homeserver import HomeServerConfig
+from synapse.config.logger import setup_logging
 from synapse.config.server import ListenerConfig, TCPListenerConfig
 from synapse.federation.transport.server import TransportLayerServer
 from synapse.http.additional_resource import AdditionalResource
@@ -60,6 +60,7 @@ from synapse.http.server import (
     StaticResource,
 )
 from synapse.logging.context import LoggingContext
+from synapse.logging.opentracing import init_tracer
 from synapse.metrics import METRICS_PREFIX, MetricsResource, RegistryProxy
 from synapse.replication.http import REPLICATION_PREFIX, ReplicationRestResource
 from synapse.rest import ClientRestResource, admin
@@ -69,7 +70,7 @@ from synapse.rest.synapse.client import build_synapse_client_resource_tree
 from synapse.rest.well_known import well_known_resource
 from synapse.server import HomeServer
 from synapse.storage import DataStore
-from synapse.util.check_dependencies import VERSION, check_requirements
+from synapse.types import ISynapseReactor
 from synapse.util.httpresourcetree import create_resource_tree
 from synapse.util.module_loader import load_module
 
@@ -81,6 +82,10 @@ def gz_wrap(r: Resource) -> Resource:
 
 
 class SynapseHomeServer(HomeServer):
+    """
+    Homeserver class for the main Synapse process.
+    """
+
     DATASTORE_CLASS = DataStore
 
     def _listener_http(
@@ -93,7 +98,7 @@ class SynapseHomeServer(HomeServer):
         site_tag = listener_config.get_site_tag()
 
         # We always include a health resource.
-        resources: Dict[str, Resource] = {"/health": HealthResource()}
+        resources: dict[str, Resource] = {"/health": HealthResource()}
 
         for res in listener_config.http_options.resources:
             for name in res.names:
@@ -164,7 +169,7 @@ class SynapseHomeServer(HomeServer):
 
     def _configure_named_resource(
         self, name: str, compress: bool = False
-    ) -> Dict[str, Resource]:
+    ) -> dict[str, Resource]:
         """Build a resource map for a named resource
 
         Args:
@@ -174,7 +179,7 @@ class SynapseHomeServer(HomeServer):
         Returns:
             map from path to HTTP resource
         """
-        resources: Dict[str, Resource] = {}
+        resources: dict[str, Resource] = {}
         if name == "client":
             client_resource: Resource = ClientRestResource(self)
             if compress:
@@ -276,11 +281,13 @@ class SynapseHomeServer(HomeServer):
                 )
             elif listener.type == "manhole":
                 if isinstance(listener, TCPListenerConfig):
-                    _base.listen_manhole(
-                        listener.bind_addresses,
-                        listener.port,
-                        manhole_settings=self.config.server.manhole_settings,
-                        manhole_globals={"hs": self},
+                    self._listening_services.extend(
+                        _base.listen_manhole(
+                            listener.bind_addresses,
+                            listener.port,
+                            manhole_settings=self.config.server.manhole_settings,
+                            manhole_globals={"hs": self},
+                        )
                     )
                 else:
                     raise ConfigError(
@@ -293,9 +300,11 @@ class SynapseHomeServer(HomeServer):
                     )
                 else:
                     if isinstance(listener, TCPListenerConfig):
-                        _base.listen_metrics(
-                            listener.bind_addresses,
-                            listener.port,
+                        self._metrics_listeners.extend(
+                            _base.listen_metrics(
+                                listener.bind_addresses,
+                                listener.port,
+                            )
                         )
                     else:
                         raise ConfigError(
@@ -308,17 +317,21 @@ class SynapseHomeServer(HomeServer):
                 logger.warning("Unrecognized listener type: %s", listener.type)
 
 
-def setup(config_options: List[str]) -> SynapseHomeServer:
+def load_or_generate_config(argv_options: list[str]) -> HomeServerConfig:
     """
+    Parse the commandline and config files
+
+    Supports generation of config files, so is used for the main homeserver app.
+
     Args:
-        config_options_options: The options passed to Synapse. Usually `sys.argv[1:]`.
+        argv_options: The options passed to Synapse. Usually `sys.argv[1:]`.
 
     Returns:
         A homeserver instance.
     """
     try:
         config = HomeServerConfig.load_or_generate_config(
-            "Synapse Homeserver", config_options
+            "Synapse Homeserver", argv_options
         )
     except ConfigError as e:
         sys.stderr.write("\n")
@@ -332,12 +345,38 @@ def setup(config_options: List[str]) -> SynapseHomeServer:
         # generating config files and shouldn't try to continue.
         sys.exit(0)
 
+    return config
+
+
+def create_homeserver(
+    config: HomeServerConfig,
+    reactor: Optional[ISynapseReactor] = None,
+) -> SynapseHomeServer:
+    """
+    Create a homeserver instance for the Synapse main process.
+
+    Our composable functions (`create_homeserver`, `setup`, `start`) should not exit the
+    Python process (call `exit(...)`) and instead raise exceptions which can be handled
+    by the caller as desired. This doesn't matter for the normal case of one Synapse
+    instance running in the Python process (as we're only affecting ourselves), but is
+    important when we have multiple Synapse homeserver tenants running in the same
+    Python process (c.f. Synapse Pro for small hosts) as we don't want some problem from
+    one tenant stopping the rest of the tenants.
+
+    Args:
+        config: The configuration for the homeserver.
+        reactor: Optionally provide a reactor to use. Can be useful in different
+            scenarios that you want control over the reactor, such as tests.
+
+    Returns:
+        A homeserver instance.
+    """
+
     if config.worker.worker_app:
         raise ConfigError(
-            "You have specified `worker_app` in the config but are attempting to start a non-worker "
+            "You have specified `worker_app` in the config but are attempting to setup a non-worker "
             "instance. Please use `python -m synapse.app.generic_worker` instead (or remove the option if this is the main process)."
         )
-        sys.exit(1)
 
     events.USE_FROZEN_DICTS = config.server.use_frozen_dicts
     synapse.util.caches.TRACK_MEMORY_USAGE = config.caches.track_memory_usage
@@ -345,76 +384,121 @@ def setup(config_options: List[str]) -> SynapseHomeServer:
     if config.server.gc_seconds:
         synapse.metrics.MIN_TIME_BETWEEN_GCS = config.server.gc_seconds
 
-    if (
-        config.registration.enable_registration
-        and not config.registration.enable_registration_without_verification
-    ):
-        if (
-            not config.captcha.enable_registration_captcha
-            and not config.registration.registrations_require_3pid
-            and not config.registration.registration_requires_token
-        ):
-            raise ConfigError(
-                "You have enabled open registration without any verification. This is a known vector for "
-                "spam and abuse. If you would like to allow public registration, please consider adding email, "
-                "captcha, or token-based verification. Otherwise this check can be removed by setting the "
-                "`enable_registration_without_verification` config option to `true`."
-            )
-
     hs = SynapseHomeServer(
-        config.server.server_name,
+        hostname=config.server.server_name,
         config=config,
-        version_string=f"Synapse/{VERSION}",
+        reactor=reactor,
     )
 
-    synapse.config.logger.setup_logging(hs, config, use_worker_options=False)
-
-    logger.info("Setting up server")
-
-    try:
-        hs.setup()
-    except Exception as e:
-        handle_startup_exception(e)
-
-    async def start() -> None:
-        # Load the OIDC provider metadatas, if OIDC is enabled.
-        if hs.config.oidc.oidc_enabled:
-            oidc = hs.get_oidc_handler()
-            # Loading the provider metadata also ensures the provider config is valid.
-            await oidc.load_metadata()
-
-        await _base.start(hs)
-
-        hs.get_datastores().main.db_pool.updates.start_doing_background_updates()
-
-    register_start(start)
-
     return hs
 
 
-def run(hs: HomeServer) -> None:
+def setup(
+    hs: SynapseHomeServer,
+) -> None:
+    """
+    Setup a `SynapseHomeServer` (main) instance.
+
+    Our composable functions (`create_homeserver`, `setup`, `start`) should not exit the
+    Python process (call `exit(...)`) and instead raise exceptions which can be handled
+    by the caller as desired. This doesn't matter for the normal case of one Synapse
+    instance running in the Python process (as we're only affecting ourselves), but is
+    important when we have multiple Synapse homeserver tenants running in the same
+    Python process (c.f. Synapse Pro for small hosts) as we don't want some problem from
+    one tenant stopping the rest of the tenants.
+
+    Args:
+        hs: The homeserver to setup.
+    """
+
+    setup_logging(hs, hs.config, use_worker_options=False)
+
+    # Log after we've configured logging.
+    logger.info("Setting up server")
+
+    # Start the tracer
+    init_tracer(hs)  # noqa
+
+    hs.setup()
+
+
+async def start(
+    hs: SynapseHomeServer,
+    *,
+    freeze: bool = True,
+) -> None:
+    """
+    Should be called once the reactor is running.
+
+    Our composable functions (`create_homeserver`, `setup`, `start`) should not exit the
+    Python process (call `exit(...)`) and instead raise exceptions which can be handled
+    by the caller as desired. This doesn't matter for the normal case of one Synapse
+    instance running in the Python process (as we're only affecting ourselves), but is
+    important when we have multiple Synapse homeserver tenants running in the same
+    Python process (c.f. Synapse Pro for small hosts) as we don't want some problem from
+    one tenant stopping the rest of the tenants.
+
+    Args:
+        hs: The homeserver to setup.
+        freeze: whether to freeze the homeserver base objects in the garbage collector.
+            May improve garbage collection performance by marking objects with an effectively
+            static lifetime as frozen so they don't need to be considered for cleanup.
+            If you ever want to `shutdown` the homeserver, this needs to be
+            False otherwise the homeserver cannot be garbage collected after `shutdown`.
+    """
+
+    await _base.start(hs, freeze=freeze)
+
+    # TODO: Feels like this should be moved somewhere else.
+    for db in hs.get_datastores().databases:
+        db.updates.start_doing_background_updates()
+
+
+def start_reactor(
+    config: HomeServerConfig,
+) -> None:
+    """
+    Start the reactor (Twisted event-loop).
+
+    Args:
+        config: The configuration for the homeserver.
+    """
     _base.start_reactor(
         "synapse-homeserver",
-        soft_file_limit=hs.config.server.soft_file_limit,
-        gc_thresholds=hs.config.server.gc_thresholds,
-        pid_file=hs.config.server.pid_file,
-        daemonize=hs.config.server.daemonize,
-        print_pidfile=hs.config.server.print_pidfile,
+        soft_file_limit=config.server.soft_file_limit,
+        gc_thresholds=config.server.gc_thresholds,
+        pid_file=config.server.pid_file,
+        daemonize=config.server.daemonize,
+        print_pidfile=config.server.print_pidfile,
         logger=logger,
     )
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        # check base requirements
-        check_requirements()
-        hs = setup(sys.argv[1:])
+    homeserver_config = load_or_generate_config(sys.argv[1:])
 
-        # redirect stdio to the logs, if configured.
-        if not hs.config.logging.no_redirect_stdio:
+    # Create a logging context as soon as possible so we can start associating
+    # everything with this homeserver.
+    with LoggingContext(name="main", server_name=homeserver_config.server.server_name):
+        # Initialize and setup the homeserver
+        hs = create_homeserver(homeserver_config)
+        try:
+            setup(hs)
+        except Exception as e:
+            handle_startup_exception(e)
+
+        # For problems immediately apparent during initialization, we want to log to
+        # stderr in the terminal so that they are obvious and visible to the operator.
+        #
+        # Now that we're past the initialization stage, we can redirect anything printed
+        # to stdio to the logs, if configured.
+        if not homeserver_config.logging.no_redirect_stdio:
             redirect_stdio_to_logs()
 
-        run(hs)
+        # Register a callback to be invoked once the reactor is running
+        register_start(hs, start, hs)
+
+        start_reactor(homeserver_config)
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/media_repository.py b/synapse/app/media_repository.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/media_repository.py
+++ b/synapse/app/media_repository.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/phone_stats_home.py b/synapse/app/phone_stats_home.py
index 69d3ac78fd..7b4bf25c28 100644
--- a/synapse/app/phone_stats_home.py
+++ b/synapse/app/phone_stats_home.py
@@ -22,40 +22,35 @@ import logging
 import math
 import resource
 import sys
-from typing import TYPE_CHECKING, List, Mapping, Sized, Tuple
+from typing import TYPE_CHECKING, Mapping, Sized
 
 from prometheus_client import Gauge
 
 from twisted.internet import defer
 
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
-)
 from synapse.types import JsonDict
-from synapse.util.constants import ONE_HOUR_SECONDS, ONE_MINUTE_SECONDS
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
 
 logger = logging.getLogger("synapse.app.homeserver")
 
-MILLISECONDS_PER_SECOND = 1000
-
-INITIAL_DELAY_BEFORE_FIRST_PHONE_HOME_SECONDS = 5 * ONE_MINUTE_SECONDS
+INITIAL_DELAY_BEFORE_FIRST_PHONE_HOME = Duration(minutes=5)
 """
 We wait 5 minutes to send the first set of stats as the server can be quite busy the
 first few minutes
 """
 
-PHONE_HOME_INTERVAL_SECONDS = 3 * ONE_HOUR_SECONDS
+PHONE_HOME_INTERVAL = Duration(hours=3)
 """
 Phone home stats are sent every 3 hours
 """
 
 # Contains the list of processes we will be monitoring
 # currently either 0 or 1
-_stats_process: List[Tuple[int, "resource.struct_rusage"]] = []
+_stats_process: list[tuple[int, "resource.struct_rusage"]] = []
 
 # Gauges to expose monthly active user control metrics
 current_mau_gauge = Gauge(
@@ -83,14 +78,12 @@ registered_reserved_users_mau_gauge = Gauge(
 def phone_stats_home(
     hs: "HomeServer",
     stats: JsonDict,
-    stats_process: List[Tuple[int, "resource.struct_rusage"]] = _stats_process,
+    stats_process: list[tuple[int, "resource.struct_rusage"]] = _stats_process,
 ) -> "defer.Deferred[None]":
-    server_name = hs.hostname
-
     async def _phone_stats_home(
         hs: "HomeServer",
         stats: JsonDict,
-        stats_process: List[Tuple[int, "resource.struct_rusage"]] = _stats_process,
+        stats_process: list[tuple[int, "resource.struct_rusage"]] = _stats_process,
     ) -> None:
         """Collect usage statistics and send them to the configured endpoint.
 
@@ -200,8 +193,8 @@ def phone_stats_home(
         except Exception as e:
             logger.warning("Error reporting stats: %s", e)
 
-    return run_as_background_process(
-        "phone_stats_home", server_name, _phone_stats_home, hs, stats, stats_process
+    return hs.run_as_background_process(
+        "phone_stats_home", _phone_stats_home, hs, stats, stats_process
     )
 
 
@@ -225,13 +218,13 @@ def start_phone_stats_home(hs: "HomeServer") -> None:
     # table will decrease
     clock.looping_call(
         hs.get_datastores().main.generate_user_daily_visits,
-        5 * ONE_MINUTE_SECONDS * MILLISECONDS_PER_SECOND,
+        Duration(minutes=5),
     )
 
     # monthly active user limiting functionality
     clock.looping_call(
         hs.get_datastores().main.reap_monthly_active_users,
-        ONE_HOUR_SECONDS * MILLISECONDS_PER_SECOND,
+        Duration(hours=1),
     )
     hs.get_datastores().main.reap_monthly_active_users()
 
@@ -263,32 +256,37 @@ def start_phone_stats_home(hs: "HomeServer") -> None:
                 float(hs.config.server.max_mau_value)
             )
 
-        return run_as_background_process(
+        return hs.run_as_background_process(
             "generate_monthly_active_users",
-            server_name,
             _generate_monthly_active_users,
         )
 
     if hs.config.server.limit_usage_by_mau or hs.config.server.mau_stats_only:
         generate_monthly_active_users()
-        clock.looping_call(generate_monthly_active_users, 5 * 60 * 1000)
+        clock.looping_call(generate_monthly_active_users, Duration(minutes=5))
     # End of monthly active user settings
 
     if hs.config.metrics.report_stats:
         logger.info("Scheduling stats reporting for 3 hour intervals")
         clock.looping_call(
             phone_stats_home,
-            PHONE_HOME_INTERVAL_SECONDS * MILLISECONDS_PER_SECOND,
+            PHONE_HOME_INTERVAL,
             hs,
             stats,
         )
 
         # We need to defer this init for the cases that we daemonize
         # otherwise the process ID we get is that of the non-daemon process
-        clock.call_later(0, performance_stats_init)
+        clock.call_later(
+            Duration(seconds=0),
+            performance_stats_init,
+        )
 
         # We wait 5 minutes to send the first set of stats as the server can
         # be quite busy the first few minutes
         clock.call_later(
-            INITIAL_DELAY_BEFORE_FIRST_PHONE_HOME_SECONDS, phone_stats_home, hs, stats
+            INITIAL_DELAY_BEFORE_FIRST_PHONE_HOME,
+            phone_stats_home,
+            hs,
+            stats,
         )
diff --git a/synapse/app/pusher.py b/synapse/app/pusher.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/pusher.py
+++ b/synapse/app/pusher.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/synchrotron.py b/synapse/app/synchrotron.py
index c85ce2869a..d251d0ab64 100644
--- a/synapse/app/synchrotron.py
+++ b/synapse/app/synchrotron.py
@@ -19,15 +19,11 @@
 #
 #
 
-import sys
-
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/app/user_dir.py b/synapse/app/user_dir.py
index dadcc48779..2c47d9f4fd 100644
--- a/synapse/app/user_dir.py
+++ b/synapse/app/user_dir.py
@@ -19,15 +19,12 @@
 #
 #
 
-import sys
 
-from synapse.app.generic_worker import start
-from synapse.util.logcontext import LoggingContext
+from synapse.app.generic_worker import main as worker_main
 
 
 def main() -> None:
-    with LoggingContext("main"):
-        start(sys.argv[1:])
+    worker_main()
 
 
 if __name__ == "__main__":
diff --git a/synapse/appservice/__init__.py b/synapse/appservice/__init__.py
index 2d8d382e68..620aa29dfc 100644
--- a/synapse/appservice/__init__.py
+++ b/synapse/appservice/__init__.py
@@ -23,15 +23,30 @@
 import logging
 import re
 from enum import Enum
-from typing import TYPE_CHECKING, Dict, Iterable, List, Optional, Pattern, Sequence
+from typing import (
+    TYPE_CHECKING,
+    Iterable,
+    Pattern,
+    Sequence,
+    cast,
+)
 
 import attr
 from netaddr import IPSet
 
+from twisted.internet import reactor
+
 from synapse.api.constants import EventTypes
 from synapse.events import EventBase
-from synapse.types import DeviceListUpdates, JsonDict, JsonMapping, UserID
+from synapse.types import (
+    DeviceListUpdates,
+    ISynapseThreadlessReactor,
+    JsonDict,
+    JsonMapping,
+    UserID,
+)
 from synapse.util.caches.descriptors import _CacheContext, cached
+from synapse.util.clock import Clock
 
 if TYPE_CHECKING:
     from synapse.appservice.api import ApplicationServiceApi
@@ -41,11 +56,11 @@ logger = logging.getLogger(__name__)
 
 # Type for the `device_one_time_keys_count` field in an appservice transaction
 #   user ID -> {device ID -> {algorithm -> count}}
-TransactionOneTimeKeysCount = Dict[str, Dict[str, Dict[str, int]]]
+TransactionOneTimeKeysCount = dict[str, dict[str, dict[str, int]]]
 
 # Type for the `device_unused_fallback_key_types` field in an appservice transaction
 #   user ID -> {device ID -> [algorithm]}
-TransactionUnusedFallbackKeys = Dict[str, Dict[str, List[str]]]
+TransactionUnusedFallbackKeys = dict[str, dict[str, list[str]]]
 
 
 class ApplicationServiceState(Enum):
@@ -79,12 +94,12 @@ class ApplicationService:
         token: str,
         id: str,
         sender: UserID,
-        url: Optional[str] = None,
-        namespaces: Optional[JsonDict] = None,
-        hs_token: Optional[str] = None,
-        protocols: Optional[Iterable[str]] = None,
+        url: str | None = None,
+        namespaces: JsonDict | None = None,
+        hs_token: str | None = None,
+        protocols: Iterable[str] | None = None,
         rate_limited: bool = True,
-        ip_range_whitelist: Optional[IPSet] = None,
+        ip_range_whitelist: IPSet | None = None,
         supports_ephemeral: bool = False,
         msc3202_transaction_extensions: bool = False,
         msc4190_device_management: bool = False,
@@ -98,6 +113,15 @@ class ApplicationService:
         self.sender = sender
         # The application service user should be part of the server's domain.
         self.server_name = sender.domain  # nb must be called this for @cached
+
+        # Ideally we would require passing in the `HomeServer` `Clock` instance.
+        # However this is not currently possible as there are places which use
+        # `@cached` that aren't aware of the `HomeServer` instance.
+        # nb must be called this for @cached
+        self.clock = Clock(
+            cast(ISynapseThreadlessReactor, reactor), server_name=self.server_name
+        )  # type: ignore[multiple-internal-clocks]
+
         self.namespaces = self._check_namespaces(namespaces)
         self.id = id
         self.ip_range_whitelist = ip_range_whitelist
@@ -117,8 +141,8 @@ class ApplicationService:
         self.rate_limited = rate_limited
 
     def _check_namespaces(
-        self, namespaces: Optional[JsonDict]
-    ) -> Dict[str, List[Namespace]]:
+        self, namespaces: JsonDict | None
+    ) -> dict[str, list[Namespace]]:
         # Sanity check that it is of the form:
         # {
         #   users: [ {regex: "[A-z]+.*", exclusive: true}, ...],
@@ -128,7 +152,7 @@ class ApplicationService:
         if namespaces is None:
             namespaces = {}
 
-        result: Dict[str, List[Namespace]] = {}
+        result: dict[str, list[Namespace]] = {}
 
         for ns in ApplicationService.NS_LIST:
             result[ns] = []
@@ -154,9 +178,7 @@ class ApplicationService:
 
         return result
 
-    def _matches_regex(
-        self, namespace_key: str, test_string: str
-    ) -> Optional[Namespace]:
+    def _matches_regex(self, namespace_key: str, test_string: str) -> Namespace | None:
         for namespace in self.namespaces[namespace_key]:
             if namespace.regex.match(test_string):
                 return namespace
@@ -361,7 +383,7 @@ class ApplicationService:
     def is_exclusive_room(self, room_id: str) -> bool:
         return self._is_exclusive(ApplicationService.NS_ROOMS, room_id)
 
-    def get_exclusive_user_regexes(self) -> List[Pattern[str]]:
+    def get_exclusive_user_regexes(self) -> list[Pattern[str]]:
         """Get the list of regexes used to determine if a user is exclusively
         registered by the AS
         """
@@ -390,8 +412,8 @@ class AppServiceTransaction:
         service: ApplicationService,
         id: int,
         events: Sequence[EventBase],
-        ephemeral: List[JsonMapping],
-        to_device_messages: List[JsonMapping],
+        ephemeral: list[JsonMapping],
+        to_device_messages: list[JsonMapping],
         one_time_keys_count: TransactionOneTimeKeysCount,
         unused_fallback_keys: TransactionUnusedFallbackKeys,
         device_list_summary: DeviceListUpdates,
diff --git a/synapse/appservice/api.py b/synapse/appservice/api.py
index 55069cc5d3..d4e9d50b96 100644
--- a/synapse/appservice/api.py
+++ b/synapse/appservice/api.py
@@ -23,21 +23,16 @@ import logging
 import urllib.parse
 from typing import (
     TYPE_CHECKING,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Tuple,
     TypeVar,
-    Union,
 )
 
 from prometheus_client import Counter
 from typing_extensions import ParamSpec, TypeGuard
 
-from synapse.api.constants import EventTypes, Membership, ThirdPartyEntityKind
+from synapse.api.constants import ThirdPartyEntityKind
 from synapse.api.errors import CodeMessageException, HttpResponseException
 from synapse.appservice import (
     ApplicationService,
@@ -45,12 +40,13 @@ from synapse.appservice import (
     TransactionUnusedFallbackKeys,
 )
 from synapse.events import EventBase
-from synapse.events.utils import SerializeEventConfig, serialize_event
+from synapse.events.utils import SerializeEventConfig
 from synapse.http.client import SimpleHttpClient, is_unknown_endpoint
 from synapse.logging import opentracing
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.types import DeviceListUpdates, JsonDict, JsonMapping, ThirdPartyInstanceID
 from synapse.util.caches.response_cache import ResponseCache
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -132,15 +128,16 @@ class ApplicationServiceApi(SimpleHttpClient):
         self.server_name = hs.hostname
         self.clock = hs.get_clock()
         self.config = hs.config.appservice
+        self._event_serializer = hs.get_event_client_serializer()
 
-        self.protocol_meta_cache: ResponseCache[Tuple[str, str]] = ResponseCache(
+        self.protocol_meta_cache: ResponseCache[tuple[str, str]] = ResponseCache(
             clock=hs.get_clock(),
             name="as_protocol_meta",
             server_name=self.server_name,
-            timeout_ms=HOUR_IN_MS,
+            timeout=Duration(hours=1),
         )
 
-    def _get_headers(self, service: "ApplicationService") -> Dict[bytes, List[bytes]]:
+    def _get_headers(self, service: "ApplicationService") -> dict[bytes, list[bytes]]:
         """This makes sure we have always the auth header and opentracing headers set."""
 
         # This is also ensured before in the functions. However this is needed to please
@@ -210,8 +207,8 @@ class ApplicationServiceApi(SimpleHttpClient):
         service: "ApplicationService",
         kind: str,
         protocol: str,
-        fields: Dict[bytes, List[bytes]],
-    ) -> List[JsonDict]:
+        fields: dict[bytes, list[bytes]],
+    ) -> list[JsonDict]:
         if kind == ThirdPartyEntityKind.USER:
             required_field = "userid"
         elif kind == ThirdPartyEntityKind.LOCATION:
@@ -225,7 +222,7 @@ class ApplicationServiceApi(SimpleHttpClient):
         assert service.hs_token is not None
 
         try:
-            args: Mapping[bytes, Union[List[bytes], str]] = fields
+            args: Mapping[bytes, list[bytes] | str] = fields
             if self.config.use_appservice_legacy_authorization:
                 args = {
                     **fields,
@@ -261,11 +258,11 @@ class ApplicationServiceApi(SimpleHttpClient):
 
     async def get_3pe_protocol(
         self, service: "ApplicationService", protocol: str
-    ) -> Optional[JsonDict]:
+    ) -> JsonDict | None:
         if service.url is None:
             return {}
 
-        async def _get() -> Optional[JsonDict]:
+        async def _get() -> JsonDict | None:
             # This is required by the configuration.
             assert service.hs_token is not None
             try:
@@ -303,7 +300,7 @@ class ApplicationServiceApi(SimpleHttpClient):
         key = (service.id, protocol)
         return await self.protocol_meta_cache.wrap(key, _get)
 
-    async def ping(self, service: "ApplicationService", txn_id: Optional[str]) -> None:
+    async def ping(self, service: "ApplicationService", txn_id: str | None) -> None:
         # The caller should check that url is set
         assert service.url is not None, "ping called without URL being set"
 
@@ -320,12 +317,12 @@ class ApplicationServiceApi(SimpleHttpClient):
         self,
         service: "ApplicationService",
         events: Sequence[EventBase],
-        ephemeral: List[JsonMapping],
-        to_device_messages: List[JsonMapping],
+        ephemeral: list[JsonMapping],
+        to_device_messages: list[JsonMapping],
         one_time_keys_count: TransactionOneTimeKeysCount,
         unused_fallback_keys: TransactionUnusedFallbackKeys,
         device_list_summary: DeviceListUpdates,
-        txn_id: Optional[int] = None,
+        txn_id: int | None = None,
     ) -> bool:
         """
         Push data to an application service.
@@ -347,7 +344,7 @@ class ApplicationServiceApi(SimpleHttpClient):
         # This is required by the configuration.
         assert service.hs_token is not None
 
-        serialized_events = self._serialize(service, events)
+        serialized_events = await self._serialize(service, events)
 
         if txn_id is None:
             logger.warning(
@@ -429,9 +426,9 @@ class ApplicationServiceApi(SimpleHttpClient):
         return False
 
     async def claim_client_keys(
-        self, service: "ApplicationService", query: List[Tuple[str, str, str, int]]
-    ) -> Tuple[
-        Dict[str, Dict[str, Dict[str, JsonDict]]], List[Tuple[str, str, str, int]]
+        self, service: "ApplicationService", query: list[tuple[str, str, str, int]]
+    ) -> tuple[
+        dict[str, dict[str, dict[str, JsonDict]]], list[tuple[str, str, str, int]]
     ]:
         """Claim one time keys from an application service.
 
@@ -457,7 +454,7 @@ class ApplicationServiceApi(SimpleHttpClient):
         assert service.hs_token is not None
 
         # Create the expected payload shape.
-        body: Dict[str, Dict[str, List[str]]] = {}
+        body: dict[str, dict[str, list[str]]] = {}
         for user_id, device, algorithm, count in query:
             body.setdefault(user_id, {}).setdefault(device, []).extend(
                 [algorithm] * count
@@ -502,8 +499,8 @@ class ApplicationServiceApi(SimpleHttpClient):
         return response, missing
 
     async def query_keys(
-        self, service: "ApplicationService", query: Dict[str, List[str]]
-    ) -> Dict[str, Dict[str, Dict[str, JsonDict]]]:
+        self, service: "ApplicationService", query: dict[str, list[str]]
+    ) -> dict[str, dict[str, dict[str, JsonDict]]]:
         """Query the application service for keys.
 
         Note that any error (including a timeout) is treated as the application
@@ -543,30 +540,23 @@ class ApplicationServiceApi(SimpleHttpClient):
 
         return response
 
-    def _serialize(
+    async def _serialize(
         self, service: "ApplicationService", events: Iterable[EventBase]
-    ) -> List[JsonDict]:
+    ) -> list[JsonDict]:
         time_now = self.clock.time_msec()
-        return [
-            serialize_event(
-                e,
-                time_now,
-                config=SerializeEventConfig(
-                    as_client_event=True,
-                    # If this is an invite or a knock membership event, and we're interested
-                    # in this user, then include any stripped state alongside the event.
-                    include_stripped_room_state=(
-                        e.type == EventTypes.Member
-                        and (
-                            e.membership == Membership.INVITE
-                            or e.membership == Membership.KNOCK
-                        )
-                        and service.is_interested_in_user(e.state_key)
-                    ),
-                    # Appservices are considered 'trusted' by the admin and should have
-                    # applicable metadata on their events.
-                    include_admin_metadata=True,
-                ),
-            )
-            for e in events
-        ]
+        return await self._event_serializer.serialize_events(
+            list(events),
+            time_now,
+            config=SerializeEventConfig(
+                as_client_event=True,
+                # If this is an invite or a knock membership event, then include
+                # any stripped state alongside the event. We could narrow this
+                # down to only users the appservice is "interested in", however
+                # it's not worth the complexity of doing so, and it's simpler to
+                # just include it for all users.
+                include_stripped_room_state=True,
+                # Appservices are considered 'trusted' by the admin and should have
+                # applicable metadata on their events.
+                include_admin_metadata=True,
+            ),
+        )
diff --git a/synapse/appservice/scheduler.py b/synapse/appservice/scheduler.py
index 01f77c4cb6..c3a83d140c 100644
--- a/synapse/appservice/scheduler.py
+++ b/synapse/appservice/scheduler.py
@@ -61,17 +61,10 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
 )
 
-from twisted.internet.interfaces import IDelayedCall
-
 from synapse.appservice import (
     ApplicationService,
     ApplicationServiceState,
@@ -81,10 +74,10 @@ from synapse.appservice import (
 from synapse.appservice.api import ApplicationServiceApi
 from synapse.events import EventBase
 from synapse.logging.context import run_in_background
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.storage.databases.main import DataStore
 from synapse.types import DeviceListUpdates, JsonMapping
-from synapse.util import Clock
+from synapse.util.clock import Clock, DelayedCallWrapper
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -128,10 +121,10 @@ class ApplicationServiceScheduler:
     def enqueue_for_appservice(
         self,
         appservice: ApplicationService,
-        events: Optional[Collection[EventBase]] = None,
-        ephemeral: Optional[Collection[JsonMapping]] = None,
-        to_device_messages: Optional[Collection[JsonMapping]] = None,
-        device_list_summary: Optional[DeviceListUpdates] = None,
+        events: Collection[EventBase] | None = None,
+        ephemeral: Collection[JsonMapping] | None = None,
+        to_device_messages: Collection[JsonMapping] | None = None,
+        device_list_summary: DeviceListUpdates | None = None,
     ) -> None:
         """
         Enqueue some data to be sent off to an application service.
@@ -184,22 +177,23 @@ class _ServiceQueuer:
 
     def __init__(self, txn_ctrl: "_TransactionController", hs: "HomeServer"):
         # dict of {service_id: [events]}
-        self.queued_events: Dict[str, List[EventBase]] = {}
+        self.queued_events: dict[str, list[EventBase]] = {}
         # dict of {service_id: [events]}
-        self.queued_ephemeral: Dict[str, List[JsonMapping]] = {}
+        self.queued_ephemeral: dict[str, list[JsonMapping]] = {}
         # dict of {service_id: [to_device_message_json]}
-        self.queued_to_device_messages: Dict[str, List[JsonMapping]] = {}
+        self.queued_to_device_messages: dict[str, list[JsonMapping]] = {}
         # dict of {service_id: [device_list_summary]}
-        self.queued_device_list_summaries: Dict[str, List[DeviceListUpdates]] = {}
+        self.queued_device_list_summaries: dict[str, list[DeviceListUpdates]] = {}
 
         # the appservices which currently have a transaction in flight
-        self.requests_in_flight: Set[str] = set()
+        self.requests_in_flight: set[str] = set()
         self.txn_ctrl = txn_ctrl
         self._msc3202_transaction_extensions_enabled: bool = (
             hs.config.experimental.msc3202_transaction_extensions
         )
         self.server_name = hs.hostname
         self.clock = hs.get_clock()
+        self.hs = hs
         self._store = hs.get_datastores().main
 
     def start_background_request(self, service: ApplicationService) -> None:
@@ -207,9 +201,7 @@ class _ServiceQueuer:
         if service.id in self.requests_in_flight:
             return
 
-        run_as_background_process(
-            "as-sender", self.server_name, self._send_request, service
-        )
+        self.hs.run_as_background_process("as-sender", self._send_request, service)
 
     async def _send_request(self, service: ApplicationService) -> None:
         # sanity-check: we shouldn't get here if this service already has a sender
@@ -266,8 +258,8 @@ class _ServiceQueuer:
                 ):
                     return
 
-                one_time_keys_count: Optional[TransactionOneTimeKeysCount] = None
-                unused_fallback_keys: Optional[TransactionUnusedFallbackKeys] = None
+                one_time_keys_count: TransactionOneTimeKeysCount | None = None
+                unused_fallback_keys: TransactionUnusedFallbackKeys | None = None
 
                 if (
                     self._msc3202_transaction_extensions_enabled
@@ -304,7 +296,7 @@ class _ServiceQueuer:
         events: Iterable[EventBase],
         ephemerals: Iterable[JsonMapping],
         to_device_messages: Iterable[JsonMapping],
-    ) -> Tuple[TransactionOneTimeKeysCount, TransactionUnusedFallbackKeys]:
+    ) -> tuple[TransactionOneTimeKeysCount, TransactionUnusedFallbackKeys]:
         """
         Given a list of the events, ephemeral messages and to-device messages,
         - first computes a list of application services users that may have
@@ -315,14 +307,14 @@ class _ServiceQueuer:
         """
 
         # Set of 'interesting' users who may have updates
-        users: Set[str] = set()
+        users: set[str] = set()
 
         # The sender is always included
         users.add(service.sender.to_string())
 
         # All AS users that would receive the PDUs or EDUs sent to these rooms
         # are classed as 'interesting'.
-        rooms_of_interesting_users: Set[str] = set()
+        rooms_of_interesting_users: set[str] = set()
         # PDUs
         rooms_of_interesting_users.update(event.room_id for event in events)
         # EDUs
@@ -361,11 +353,12 @@ class _TransactionController:
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname
         self.clock = hs.get_clock()
+        self.hs = hs
         self.store = hs.get_datastores().main
         self.as_api = hs.get_application_service_api()
 
         # map from service id to recoverer instance
-        self.recoverers: Dict[str, "_Recoverer"] = {}
+        self.recoverers: dict[str, "_Recoverer"] = {}
 
         # for UTs
         self.RECOVERER_CLASS = _Recoverer
@@ -374,11 +367,11 @@ class _TransactionController:
         self,
         service: ApplicationService,
         events: Sequence[EventBase],
-        ephemeral: Optional[List[JsonMapping]] = None,
-        to_device_messages: Optional[List[JsonMapping]] = None,
-        one_time_keys_count: Optional[TransactionOneTimeKeysCount] = None,
-        unused_fallback_keys: Optional[TransactionUnusedFallbackKeys] = None,
-        device_list_summary: Optional[DeviceListUpdates] = None,
+        ephemeral: list[JsonMapping] | None = None,
+        to_device_messages: list[JsonMapping] | None = None,
+        one_time_keys_count: TransactionOneTimeKeysCount | None = None,
+        unused_fallback_keys: TransactionUnusedFallbackKeys | None = None,
+        device_list_summary: DeviceListUpdates | None = None,
     ) -> None:
         """
         Create a transaction with the given data and send to the provided
@@ -448,6 +441,7 @@ class _TransactionController:
         recoverer = self.RECOVERER_CLASS(
             self.server_name,
             self.clock,
+            self.hs,
             self.store,
             self.as_api,
             service,
@@ -494,6 +488,7 @@ class _Recoverer:
         self,
         server_name: str,
         clock: Clock,
+        hs: "HomeServer",
         store: DataStore,
         as_api: ApplicationServiceApi,
         service: ApplicationService,
@@ -501,21 +496,21 @@ class _Recoverer:
     ):
         self.server_name = server_name
         self.clock = clock
+        self.hs = hs
         self.store = store
         self.as_api = as_api
         self.service = service
         self.callback = callback
         self.backoff_counter = 1
-        self.scheduled_recovery: Optional[IDelayedCall] = None
+        self.scheduled_recovery: DelayedCallWrapper | None = None
 
     def recover(self) -> None:
-        delay = 2**self.backoff_counter
-        logger.info("Scheduling retries on %s in %fs", self.service.id, delay)
+        delay = Duration(seconds=2**self.backoff_counter)
+        logger.info("Scheduling retries on %s in %fs", self.service.id, delay.as_secs())
         self.scheduled_recovery = self.clock.call_later(
             delay,
-            run_as_background_process,
+            self.hs.run_as_background_process,
             "as-recoverer",
-            self.server_name,
             self.retry,
         )
 
@@ -535,9 +530,8 @@ class _Recoverer:
         if self.scheduled_recovery:
             self.clock.cancel_call_later(self.scheduled_recovery)
         # Run a retry, which will resechedule a recovery if it fails.
-        run_as_background_process(
+        self.hs.run_as_background_process(
             "retry",
-            self.server_name,
             self.retry,
         )
 
diff --git a/synapse/config/__main__.py b/synapse/config/__main__.py
index ef9d36b507..9169b062bf 100644
--- a/synapse/config/__main__.py
+++ b/synapse/config/__main__.py
@@ -20,13 +20,12 @@
 #
 #
 import sys
-from typing import List
 
 from synapse.config._base import ConfigError
 from synapse.config.homeserver import HomeServerConfig
 
 
-def main(args: List[str]) -> None:
+def main(args: list[str]) -> None:
     action = args[1] if len(args) > 1 and args[1] == "read" else None
     # If we're reading a key in the config file, then `args[1]` will be `read`  and `args[2]`
     # will be the key to read.
diff --git a/synapse/config/_base.py b/synapse/config/_base.py
index 0a01fb5582..fdfbee98a1 100644
--- a/synapse/config/_base.py
+++ b/synapse/config/_base.py
@@ -22,6 +22,7 @@
 
 import argparse
 import errno
+import importlib.resources as importlib_resources
 import logging
 import os
 import re
@@ -32,24 +33,18 @@ from textwrap import dedent
 from typing import (
     Any,
     ClassVar,
-    Dict,
     Iterable,
     Iterator,
-    List,
     MutableMapping,
-    Optional,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
 )
 
 import attr
 import jinja2
-import pkg_resources
 import yaml
 
 from synapse.types import StrSequence
+from synapse.util.stringutils import parse_and_validate_server_name
 from synapse.util.templates import _create_mxc_to_http_filter, _format_ts_filter
 
 logger = logging.getLogger(__name__)
@@ -64,7 +59,7 @@ class ConfigError(Exception):
            the problem lies.
     """
 
-    def __init__(self, msg: str, path: Optional[StrSequence] = None):
+    def __init__(self, msg: str, path: StrSequence | None = None):
         self.msg = msg
         self.path = path
 
@@ -174,12 +169,12 @@ class Config:
         self.root = root_config
 
         # Get the path to the default Synapse template directory
-        self.default_template_dir = pkg_resources.resource_filename(
-            "synapse", "res/templates"
+        self.default_template_dir = str(
+            importlib_resources.files("synapse").joinpath("res").joinpath("templates")
         )
 
     @staticmethod
-    def parse_size(value: Union[str, int]) -> int:
+    def parse_size(value: str | int) -> int:
         """Interpret `value` as a number of bytes.
 
         If an integer is provided it is treated as bytes and is unchanged.
@@ -206,7 +201,7 @@ class Config:
             raise TypeError(f"Bad byte size {value!r}")
 
     @staticmethod
-    def parse_duration(value: Union[str, int]) -> int:
+    def parse_duration(value: str | int) -> int:
         """Convert a duration as a string or integer to a number of milliseconds.
 
         If an integer is provided it is treated as milliseconds and is unchanged.
@@ -274,7 +269,7 @@ class Config:
         return path_exists(file_path)
 
     @classmethod
-    def check_file(cls, file_path: Optional[str], config_name: str) -> str:
+    def check_file(cls, file_path: str | None, config_name: str) -> str:
         if file_path is None:
             raise ConfigError("Missing config for %s." % (config_name,))
         try:
@@ -321,9 +316,9 @@ class Config:
 
     def read_templates(
         self,
-        filenames: List[str],
-        custom_template_directories: Optional[Iterable[str]] = None,
-    ) -> List[jinja2.Template]:
+        filenames: list[str],
+        custom_template_directories: Iterable[str] | None = None,
+    ) -> list[jinja2.Template]:
         """Load a list of template files from disk using the given variables.
 
         This function will attempt to load the given templates from the default Synapse
@@ -402,7 +397,7 @@ class RootConfig:
     class, lower-cased and with "Config" removed.
     """
 
-    config_classes: List[Type[Config]] = []
+    config_classes: list[type[Config]] = []
 
     def __init__(self, config_files: StrSequence = ()):
         # Capture absolute paths here, so we can reload config after we daemonize.
@@ -469,11 +464,12 @@ class RootConfig:
         data_dir_path: str,
         server_name: str,
         generate_secrets: bool = False,
-        report_stats: Optional[bool] = None,
+        report_stats: bool | None = None,
         open_private_ports: bool = False,
-        listeners: Optional[List[dict]] = None,
-        tls_certificate_path: Optional[str] = None,
-        tls_private_key_path: Optional[str] = None,
+        enable_metrics: bool = False,
+        listeners: list[dict] | None = None,
+        tls_certificate_path: str | None = None,
+        tls_private_key_path: str | None = None,
     ) -> str:
         """
         Build a default configuration file
@@ -501,9 +497,15 @@ class RootConfig:
             open_private_ports: True to leave private ports (such as the non-TLS
                 HTTP listener) open to the internet.
 
+            enable_metrics: True to set `enable_metrics: true` and when using the
+                default set of listeners, will also add the metrics listener on port 19090.
+
             listeners: A list of descriptions of the listeners synapse should
-                start with each of which specifies a port (int), a list of
-                resources (list(str)), tls (bool) and type (str). For example:
+                start with each of which specifies a port (int), a list of resources
+                (list(str)), tls (bool) and type (str). There is a default set of
+                listeners when `None`.
+
+                Example usage:
                 [{
                     "port": 8448,
                     "resources": [{"names": ["federation"]}],
@@ -524,6 +526,35 @@ class RootConfig:
         Returns:
             The yaml config file
         """
+        _, bind_port = parse_and_validate_server_name(server_name)
+        if bind_port is not None:
+            unsecure_port = bind_port - 400
+        else:
+            bind_port = 8448
+            unsecure_port = 8008
+
+        # The default listeners
+        if listeners is None:
+            listeners = [
+                {
+                    "port": unsecure_port,
+                    "tls": False,
+                    "type": "http",
+                    "x_forwarded": True,
+                    "resources": [
+                        {"names": ["client", "federation"], "compress": False}
+                    ],
+                }
+            ]
+
+            if enable_metrics:
+                listeners.append(
+                    {
+                        "port": 19090,
+                        "tls": False,
+                        "type": "metrics",
+                    }
+                )
 
         conf = CONFIG_FILE_HEADER + "\n".join(
             dedent(conf)
@@ -535,6 +566,7 @@ class RootConfig:
                 generate_secrets=generate_secrets,
                 report_stats=report_stats,
                 open_private_ports=open_private_ports,
+                enable_metrics=enable_metrics,
                 listeners=listeners,
                 tls_certificate_path=tls_certificate_path,
                 tls_private_key_path=tls_private_key_path,
@@ -545,18 +577,22 @@ class RootConfig:
 
     @classmethod
     def load_config(
-        cls: Type[TRootConfig], description: str, argv: List[str]
+        cls: type[TRootConfig], description: str, argv_options: list[str]
     ) -> TRootConfig:
         """Parse the commandline and config files
 
         Doesn't support config-file-generation: used by the worker apps.
 
+        Args:
+            description: TODO
+            argv_options: The options passed to Synapse. Usually `sys.argv[1:]`.
+
         Returns:
             Config object.
         """
         config_parser = argparse.ArgumentParser(description=description)
         cls.add_arguments_to_parser(config_parser)
-        obj, _ = cls.load_config_with_parser(config_parser, argv)
+        obj, _ = cls.load_config_with_parser(config_parser, argv_options)
 
         return obj
 
@@ -601,24 +637,28 @@ class RootConfig:
 
     @classmethod
     def load_config_with_parser(
-        cls: Type[TRootConfig], parser: argparse.ArgumentParser, argv: List[str]
-    ) -> Tuple[TRootConfig, argparse.Namespace]:
+        cls: type[TRootConfig], parser: argparse.ArgumentParser, argv_options: list[str]
+    ) -> tuple[TRootConfig, argparse.Namespace]:
         """Parse the commandline and config files with the given parser
 
         Doesn't support config-file-generation: used by the worker apps.
 
         Used for workers where we want to add extra flags/subcommands.
 
+        Note: This is the common denominator for loading config and is also used by
+        `load_config` and `load_or_generate_config`. Which is why we call
+        `validate_config()` here.
+
         Args:
             parser
-            argv
+            argv_options: The options passed to Synapse. Usually `sys.argv[1:]`.
 
         Returns:
             Returns the parsed config object and the parsed argparse.Namespace
             object from parser.parse_args(..)`
         """
 
-        config_args = parser.parse_args(argv)
+        config_args = parser.parse_args(argv_options)
 
         config_files = find_config_files(search_paths=config_args.config_path)
         obj = cls(config_files)
@@ -642,16 +682,24 @@ class RootConfig:
 
         obj.invoke_all("read_arguments", config_args)
 
+        # Now that we finally have the full config sections parsed, allow subclasses to
+        # do some extra validation across the entire config.
+        obj.validate_config()
+
         return obj, config_args
 
     @classmethod
     def load_or_generate_config(
-        cls: Type[TRootConfig], description: str, argv: List[str]
-    ) -> Optional[TRootConfig]:
+        cls: type[TRootConfig], description: str, argv_options: list[str]
+    ) -> TRootConfig | None:
         """Parse the commandline and config files
 
         Supports generation of config files, so is used for the main homeserver app.
 
+        Args:
+            description: TODO
+            argv_options: The options passed to Synapse. Usually `sys.argv[1:]`.
+
         Returns:
             Config object, or None if --generate-config or --generate-keys was set
         """
@@ -662,7 +710,8 @@ class RootConfig:
             action="append",
             metavar="CONFIG_FILE",
             help="Specify config file. Can be given multiple times and"
-            " may specify directories containing *.yaml files.",
+            " may specify directories containing *.yaml files."
+            " Top-level keys in later files overwrite ones in earlier files.",
         )
         parser.add_argument(
             "--no-secrets-in-config",
@@ -745,9 +794,17 @@ class RootConfig:
                 " internet. Do not use this unless you know what you are doing."
             ),
         )
+        generate_group.add_argument(
+            "--enable-metrics",
+            action="store_true",
+            help=(
+                "Sets `enable_metrics: true` and when using the default set of listeners, "
+                "will also add the metrics listener on port 19090."
+            ),
+        )
 
         cls.invoke_all_static("add_arguments", parser)
-        config_args = parser.parse_args(argv)
+        config_args = parser.parse_args(argv_options)
 
         config_files = find_config_files(search_paths=config_args.config_path)
 
@@ -801,6 +858,7 @@ class RootConfig:
                     report_stats=(config_args.report_stats == "yes"),
                     generate_secrets=True,
                     open_private_ports=config_args.open_private_ports,
+                    enable_metrics=config_args.enable_metrics,
                 )
 
                 os.makedirs(config_dir_path, exist_ok=True)
@@ -838,19 +896,11 @@ class RootConfig:
         ):
             return None
 
-        obj.parse_config_dict(
-            config_dict,
-            config_dir_path=config_dir_path,
-            data_dir_path=data_dir_path,
-            allow_secrets_in_config=config_args.secrets_in_config,
-        )
-        obj.invoke_all("read_arguments", config_args)
-
-        return obj
+        return cls.load_config(description, argv_options)
 
     def parse_config_dict(
         self,
-        config_dict: Dict[str, Any],
+        config_dict: dict[str, Any],
         config_dir_path: str,
         data_dir_path: str,
         allow_secrets_in_config: bool = True,
@@ -875,7 +925,7 @@ class RootConfig:
         )
 
     def generate_missing_files(
-        self, config_dict: Dict[str, Any], config_dir_path: str
+        self, config_dict: dict[str, Any], config_dir_path: str
     ) -> None:
         self.invoke_all("generate_files", config_dict, config_dir_path)
 
@@ -894,7 +944,7 @@ class RootConfig:
         :returns: the previous config object, which no longer has a reference to this
             RootConfig.
         """
-        existing_config: Optional[Config] = getattr(self, section_name, None)
+        existing_config: Config | None = getattr(self, section_name, None)
         if existing_config is None:
             raise ValueError(f"Unknown config section '{section_name}'")
         logger.info("Reloading config section '%s'", section_name)
@@ -907,8 +957,22 @@ class RootConfig:
         existing_config.root = None
         return existing_config
 
+    def validate_config(self) -> None:
+        """
+        Additional config validation across all config sections.
 
-def read_config_files(config_files: Iterable[str]) -> Dict[str, Any]:
+        Override this in subclasses to add extra validation. This is called once all
+        config option values have been populated.
+
+        XXX: This should only validate, not modify the configuration, as the final
+        config state is required for proper validation across all config sections.
+
+        Raises:
+            ConfigError: if the config is invalid.
+        """
+
+
+def read_config_files(config_files: Iterable[str]) -> dict[str, Any]:
     """Read the config files and shallowly merge them into a dict.
 
     Successive configurations are shallowly merged into ones provided earlier,
@@ -942,7 +1006,7 @@ def read_config_files(config_files: Iterable[str]) -> Dict[str, Any]:
     return specified_config
 
 
-def find_config_files(search_paths: List[str]) -> List[str]:
+def find_config_files(search_paths: list[str]) -> list[str]:
     """Finds config files using a list of search paths. If a path is a file
     then that file path is added to the list. If a search path is a directory
     then all the "*.yaml" files in that directory are added to the list in
@@ -996,7 +1060,7 @@ class ShardedWorkerHandlingConfig:
     below).
     """
 
-    instances: List[str]
+    instances: list[str]
 
     def should_handle(self, instance_name: str, key: str) -> bool:
         """Whether this instance is responsible for handling the given key."""
diff --git a/synapse/config/_base.pyi b/synapse/config/_base.pyi
index 5e03635206..7c371d161c 100644
--- a/synapse/config/_base.pyi
+++ b/synapse/config/_base.pyi
@@ -2,17 +2,11 @@ import argparse
 from typing import (
     Any,
     Collection,
-    Dict,
     Iterable,
     Iterator,
-    List,
     Literal,
     MutableMapping,
-    Optional,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     overload,
 )
 
@@ -37,6 +31,7 @@ from synapse.config import (  # noqa: F401
     key,
     logger,
     mas,
+    matrixrtc,
     metrics,
     modules,
     oembed,
@@ -67,7 +62,7 @@ from synapse.config import (  # noqa: F401
 from synapse.types import StrSequence
 
 class ConfigError(Exception):
-    def __init__(self, msg: str, path: Optional[StrSequence] = None):
+    def __init__(self, msg: str, path: StrSequence | None = None):
         self.msg = msg
         self.path = path
 
@@ -126,9 +121,10 @@ class RootConfig:
     auto_accept_invites: auto_accept_invites.AutoAcceptInvitesConfig
     user_types: user_types.UserTypesConfig
     mas: mas.MasConfig
+    matrix_rtc: matrixrtc.MatrixRtcConfig
 
-    config_classes: List[Type["Config"]] = ...
-    config_files: List[str]
+    config_classes: list[type["Config"]] = ...
+    config_files: list[str]
     def __init__(self, config_files: Collection[str] = ...) -> None: ...
     def invoke_all(
         self, func_name: str, *args: Any, **kwargs: Any
@@ -137,7 +133,7 @@ class RootConfig:
     def invoke_all_static(cls, func_name: str, *args: Any, **kwargs: Any) -> None: ...
     def parse_config_dict(
         self,
-        config_dict: Dict[str, Any],
+        config_dict: dict[str, Any],
         config_dir_path: str,
         data_dir_path: str,
         allow_secrets_in_config: bool = ...,
@@ -148,19 +144,20 @@ class RootConfig:
         data_dir_path: str,
         server_name: str,
         generate_secrets: bool = ...,
-        report_stats: Optional[bool] = ...,
+        report_stats: bool | None = ...,
         open_private_ports: bool = ...,
-        listeners: Optional[Any] = ...,
-        tls_certificate_path: Optional[str] = ...,
-        tls_private_key_path: Optional[str] = ...,
+        enable_metrics: bool = ...,
+        listeners: Any | None = ...,
+        tls_certificate_path: str | None = ...,
+        tls_private_key_path: str | None = ...,
     ) -> str: ...
     @classmethod
     def load_or_generate_config(
-        cls: Type[TRootConfig], description: str, argv: List[str]
-    ) -> Optional[TRootConfig]: ...
+        cls: type[TRootConfig], description: str, argv_options: list[str]
+    ) -> TRootConfig | None: ...
     @classmethod
     def load_config(
-        cls: Type[TRootConfig], description: str, argv: List[str]
+        cls: type[TRootConfig], description: str, argv_options: list[str]
     ) -> TRootConfig: ...
     @classmethod
     def add_arguments_to_parser(
@@ -168,8 +165,8 @@ class RootConfig:
     ) -> None: ...
     @classmethod
     def load_config_with_parser(
-        cls: Type[TRootConfig], parser: argparse.ArgumentParser, argv: List[str]
-    ) -> Tuple[TRootConfig, argparse.Namespace]: ...
+        cls: type[TRootConfig], parser: argparse.ArgumentParser, argv_options: list[str]
+    ) -> tuple[TRootConfig, argparse.Namespace]: ...
     def generate_missing_files(
         self, config_dict: dict, config_dir_path: str
     ) -> None: ...
@@ -185,11 +182,11 @@ class Config:
     default_template_dir: str
     def __init__(self, root_config: RootConfig = ...) -> None: ...
     @staticmethod
-    def parse_size(value: Union[str, int]) -> int: ...
+    def parse_size(value: str | int) -> int: ...
     @staticmethod
-    def parse_duration(value: Union[str, int]) -> int: ...
+    def parse_duration(value: str | int) -> int: ...
     @staticmethod
-    def abspath(file_path: Optional[str]) -> str: ...
+    def abspath(file_path: str | None) -> str: ...
     @classmethod
     def path_exists(cls, file_path: str) -> bool: ...
     @classmethod
@@ -201,16 +198,16 @@ class Config:
     def read_template(self, filenames: str) -> jinja2.Template: ...
     def read_templates(
         self,
-        filenames: List[str],
-        custom_template_directories: Optional[Iterable[str]] = None,
-    ) -> List[jinja2.Template]: ...
+        filenames: list[str],
+        custom_template_directories: Iterable[str] | None = None,
+    ) -> list[jinja2.Template]: ...
 
-def read_config_files(config_files: Iterable[str]) -> Dict[str, Any]: ...
-def find_config_files(search_paths: List[str]) -> List[str]: ...
+def read_config_files(config_files: Iterable[str]) -> dict[str, Any]: ...
+def find_config_files(search_paths: list[str]) -> list[str]: ...
 
 class ShardedWorkerHandlingConfig:
-    instances: List[str]
-    def __init__(self, instances: List[str]) -> None: ...
+    instances: list[str]
+    def __init__(self, instances: list[str]) -> None: ...
     def should_handle(self, instance_name: str, key: str) -> bool: ...  # noqa: F811
 
 class RoutableShardedWorkerHandlingConfig(ShardedWorkerHandlingConfig):
diff --git a/synapse/config/_util.py b/synapse/config/_util.py
index 731b60a840..e09c68ebd4 100644
--- a/synapse/config/_util.py
+++ b/synapse/config/_util.py
@@ -18,11 +18,11 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict, Type, TypeVar
+from typing import Any, TypeVar
 
 import jsonschema
+from pydantic import BaseModel, TypeAdapter, ValidationError
 
-from synapse._pydantic_compat import BaseModel, ValidationError, parse_obj_as
 from synapse.config._base import ConfigError
 from synapse.types import JsonDict, StrSequence
 
@@ -79,8 +79,8 @@ Model = TypeVar("Model", bound=BaseModel)
 
 def parse_and_validate_mapping(
     config: Any,
-    model_type: Type[Model],
-) -> Dict[str, Model]:
+    model_type: type[Model],
+) -> dict[str, Model]:
     """Parse `config` as a mapping from strings to a given `Model` type.
     Args:
         config: The configuration data to check
@@ -93,7 +93,7 @@ def parse_and_validate_mapping(
     try:
         # type-ignore: mypy doesn't like constructing `Dict[str, model_type]` because
         # `model_type` is a runtime variable. Pydantic is fine with this.
-        instances = parse_obj_as(Dict[str, model_type], config)  # type: ignore[valid-type]
+        instances = TypeAdapter(dict[str, model_type]).validate_python(config)  # type: ignore[valid-type]
     except ValidationError as e:
         raise ConfigError(str(e)) from e
     return instances
diff --git a/synapse/config/api.py b/synapse/config/api.py
index 0bb99d4228..03b92249a9 100644
--- a/synapse/config/api.py
+++ b/synapse/config/api.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import Any, Iterable, Optional, Tuple
+from typing import Any, Iterable
 
 from synapse.api.constants import EventTypes
 from synapse.config._base import Config, ConfigError
@@ -46,7 +46,7 @@ class ApiConfig(Config):
 
     def _get_prejoin_state_entries(
         self, config: JsonDict
-    ) -> Iterable[Tuple[str, Optional[str]]]:
+    ) -> Iterable[tuple[str, str | None]]:
         """Get the event types and state keys to include in the prejoin state."""
         room_prejoin_state_config = config.get("room_prejoin_state") or {}
 
diff --git a/synapse/config/appservice.py b/synapse/config/appservice.py
index 81dbd330cc..b9ed1a702c 100644
--- a/synapse/config/appservice.py
+++ b/synapse/config/appservice.py
@@ -21,7 +21,7 @@
 #
 
 import logging
-from typing import Any, Dict, List
+from typing import Any
 from urllib import parse as urlparse
 
 import yaml
@@ -61,13 +61,13 @@ class AppServiceConfig(Config):
 
 
 def load_appservices(
-    hostname: str, config_files: List[str]
-) -> List[ApplicationService]:
+    hostname: str, config_files: list[str]
+) -> list[ApplicationService]:
     """Returns a list of Application Services from the config files."""
 
     # Dicts of value -> filename
-    seen_as_tokens: Dict[str, str] = {}
-    seen_ids: Dict[str, str] = {}
+    seen_as_tokens: dict[str, str] = {}
+    seen_ids: dict[str, str] = {}
 
     appservices = []
 
diff --git a/synapse/config/cache.py b/synapse/config/cache.py
index 35a052b254..ac94b17ff6 100644
--- a/synapse/config/cache.py
+++ b/synapse/config/cache.py
@@ -23,12 +23,13 @@ import logging
 import os
 import re
 import threading
-from typing import Any, Callable, Dict, Mapping, Optional
+from typing import Any, Callable, Mapping
 
 import attr
 
 from synapse.types import JsonDict
 from synapse.util.check_dependencies import check_requirements
+from synapse.util.duration import Duration
 
 from ._base import Config, ConfigError
 
@@ -38,7 +39,7 @@ logger = logging.getLogger(__name__)
 _CACHE_PREFIX = "SYNAPSE_CACHE_FACTOR"
 
 # Map from canonicalised cache name to cache.
-_CACHES: Dict[str, Callable[[float], None]] = {}
+_CACHES: dict[str, Callable[[float], None]] = {}
 
 # a lock on the contents of _CACHES
 _CACHES_LOCK = threading.Lock()
@@ -53,7 +54,7 @@ class CacheProperties:
     default_factor_size: float = float(
         os.environ.get(_CACHE_PREFIX, _DEFAULT_FACTOR_SIZE)
     )
-    resize_all_caches_func: Optional[Callable[[], None]] = None
+    resize_all_caches_func: Callable[[], None] | None = None
 
 
 properties = CacheProperties()
@@ -104,11 +105,11 @@ class CacheConfig(Config):
     _environ: Mapping[str, str] = os.environ
 
     event_cache_size: int
-    cache_factors: Dict[str, float]
+    cache_factors: dict[str, float]
     global_factor: float
     track_memory_usage: bool
-    expiry_time_msec: Optional[int]
-    sync_response_cache_duration: int
+    expiry_time_msec: int | None
+    sync_response_cache_duration: Duration
 
     @staticmethod
     def reset() -> None:
@@ -207,10 +208,14 @@ class CacheConfig(Config):
             min_cache_ttl = self.cache_autotuning.get("min_cache_ttl")
             self.cache_autotuning["min_cache_ttl"] = self.parse_duration(min_cache_ttl)
 
-        self.sync_response_cache_duration = self.parse_duration(
+        sync_response_cache_duration_ms = self.parse_duration(
             cache_config.get("sync_response_cache_duration", "2m")
         )
 
+        self.sync_response_cache_duration = Duration(
+            milliseconds=sync_response_cache_duration_ms
+        )
+
     def resize_all_caches(self) -> None:
         """Ensure all cache sizes are up-to-date.
 
diff --git a/synapse/config/cas.py b/synapse/config/cas.py
index 60d66d7019..dc5be7ccf1 100644
--- a/synapse/config/cas.py
+++ b/synapse/config/cas.py
@@ -20,7 +20,7 @@
 #
 #
 
-from typing import Any, List, Optional
+from typing import Any
 
 from synapse.config.sso import SsoAttributeRequirement
 from synapse.types import JsonDict
@@ -49,7 +49,7 @@ class CasConfig(Config):
 
             # TODO Update this to a _synapse URL.
             public_baseurl = self.root.server.public_baseurl
-            self.cas_service_url: Optional[str] = (
+            self.cas_service_url: str | None = (
                 public_baseurl + "_matrix/client/r0/login/cas/ticket"
             )
 
@@ -107,7 +107,7 @@ REQUIRED_ATTRIBUTES_SCHEMA = {
 
 def _parsed_required_attributes_def(
     required_attributes: Any,
-) -> List[SsoAttributeRequirement]:
+) -> list[SsoAttributeRequirement]:
     validate_config(
         REQUIRED_ATTRIBUTES_SCHEMA,
         required_attributes,
diff --git a/synapse/config/consent.py b/synapse/config/consent.py
index 7dc80d4cf8..35484ee033 100644
--- a/synapse/config/consent.py
+++ b/synapse/config/consent.py
@@ -19,7 +19,7 @@
 #
 
 from os import path
-from typing import Any, Optional
+from typing import Any
 
 from synapse.config import ConfigError
 from synapse.types import JsonDict
@@ -33,11 +33,11 @@ class ConsentConfig(Config):
     def __init__(self, *args: Any):
         super().__init__(*args)
 
-        self.user_consent_version: Optional[str] = None
-        self.user_consent_template_dir: Optional[str] = None
-        self.user_consent_server_notice_content: Optional[JsonDict] = None
+        self.user_consent_version: str | None = None
+        self.user_consent_template_dir: str | None = None
+        self.user_consent_server_notice_content: JsonDict | None = None
         self.user_consent_server_notice_to_guests = False
-        self.block_events_without_consent_error: Optional[str] = None
+        self.block_events_without_consent_error: str | None = None
         self.user_consent_at_registration = False
         self.user_consent_policy_name = "Privacy Policy"
 
diff --git a/synapse/config/database.py b/synapse/config/database.py
index c4ca63a1fa..8e9d253820 100644
--- a/synapse/config/database.py
+++ b/synapse/config/database.py
@@ -22,7 +22,7 @@
 import argparse
 import logging
 import os
-from typing import Any, List
+from typing import Any
 
 from synapse.config._base import Config, ConfigError
 from synapse.types import JsonDict
@@ -83,7 +83,7 @@ class DatabaseConfig(Config):
     def __init__(self, *args: Any):
         super().__init__(*args)
 
-        self.databases: List[DatabaseConnectionConfig] = []
+        self.databases: list[DatabaseConnectionConfig] = []
 
     def read_config(self, config: JsonDict, **kwargs: Any) -> None:
         # We *experimentally* support specifying multiple databases via the
diff --git a/synapse/config/experimental.py b/synapse/config/experimental.py
index c1631f39e3..e77412a797 100644
--- a/synapse/config/experimental.py
+++ b/synapse/config/experimental.py
@@ -3,6 +3,7 @@
 #
 # Copyright 2021 The Matrix.org Foundation C.I.C.
 # Copyright (C) 2023 New Vector, Ltd
+# Copyright (C) 2025 Element Creations Ltd
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@@ -59,7 +60,7 @@ class ClientAuthMethod(enum.Enum):
     PRIVATE_KEY_JWT = "private_key_jwt"
 
 
-def _parse_jwks(jwks: Optional[JsonDict]) -> Optional["JsonWebKey"]:
+def _parse_jwks(jwks: JsonDict | None) -> Optional["JsonWebKey"]:
     """A helper function to parse a JWK dict into a JsonWebKey."""
 
     if jwks is None:
@@ -71,7 +72,7 @@ def _parse_jwks(jwks: Optional[JsonDict]) -> Optional["JsonWebKey"]:
 
 
 def _check_client_secret(
-    instance: "MSC3861", _attribute: attr.Attribute, _value: Optional[str]
+    instance: "MSC3861", _attribute: attr.Attribute, _value: str | None
 ) -> None:
     if instance._client_secret and instance._client_secret_path:
         raise ConfigError(
@@ -88,7 +89,7 @@ def _check_client_secret(
 
 
 def _check_admin_token(
-    instance: "MSC3861", _attribute: attr.Attribute, _value: Optional[str]
+    instance: "MSC3861", _attribute: attr.Attribute, _value: str | None
 ) -> None:
     if instance._admin_token and instance._admin_token_path:
         raise ConfigError(
@@ -124,7 +125,7 @@ class MSC3861:
     issuer: str = attr.ib(default="", validator=attr.validators.instance_of(str))
     """The URL of the OIDC Provider."""
 
-    issuer_metadata: Optional[JsonDict] = attr.ib(default=None)
+    issuer_metadata: JsonDict | None = attr.ib(default=None)
     """The issuer metadata to use, otherwise discovered from /.well-known/openid-configuration as per MSC2965."""
 
     client_id: str = attr.ib(
@@ -138,7 +139,7 @@ class MSC3861:
     )
     """The auth method used when calling the introspection endpoint."""
 
-    _client_secret: Optional[str] = attr.ib(
+    _client_secret: str | None = attr.ib(
         default=None,
         validator=[
             attr.validators.optional(attr.validators.instance_of(str)),
@@ -150,7 +151,7 @@ class MSC3861:
     when using any of the client_secret_* client auth methods.
     """
 
-    _client_secret_path: Optional[str] = attr.ib(
+    _client_secret_path: str | None = attr.ib(
         default=None,
         validator=[
             attr.validators.optional(attr.validators.instance_of(str)),
@@ -196,19 +197,19 @@ class MSC3861:
                 ("experimental", "msc3861", "client_auth_method"),
             )
 
-    introspection_endpoint: Optional[str] = attr.ib(
+    introspection_endpoint: str | None = attr.ib(
         default=None,
         validator=attr.validators.optional(attr.validators.instance_of(str)),
     )
     """The URL of the introspection endpoint used to validate access tokens."""
 
-    account_management_url: Optional[str] = attr.ib(
+    account_management_url: str | None = attr.ib(
         default=None,
         validator=attr.validators.optional(attr.validators.instance_of(str)),
     )
     """The URL of the My Account page on the OIDC Provider as per MSC2965."""
 
-    _admin_token: Optional[str] = attr.ib(
+    _admin_token: str | None = attr.ib(
         default=None,
         validator=[
             attr.validators.optional(attr.validators.instance_of(str)),
@@ -220,7 +221,7 @@ class MSC3861:
     This is used by the OIDC provider, to make admin calls to Synapse.
     """
 
-    _admin_token_path: Optional[str] = attr.ib(
+    _admin_token_path: str | None = attr.ib(
         default=None,
         validator=[
             attr.validators.optional(attr.validators.instance_of(str)),
@@ -232,7 +233,7 @@ class MSC3861:
     external file.
     """
 
-    def client_secret(self) -> Optional[str]:
+    def client_secret(self) -> str | None:
         """Returns the secret given via `client_secret` or `client_secret_path`."""
         if self._client_secret_path:
             return read_secret_from_file_once(
@@ -241,7 +242,7 @@ class MSC3861:
             )
         return self._client_secret
 
-    def admin_token(self) -> Optional[str]:
+    def admin_token(self) -> str | None:
         """Returns the admin token given via `admin_token` or `admin_token_path`."""
         if self._admin_token_path:
             return read_secret_from_file_once(
@@ -366,7 +367,11 @@ class MSC3866Config:
 
 
 class ExperimentalConfig(Config):
-    """Config section for enabling experimental features"""
+    """Config section for enabling experimental features
+
+    All new experimental features should have a tracking issue with the
+    `T-ExperimentalFeatures` label, kept open as long as the experimental
+    feature is present in Synapse."""
 
     section = "experimental"
 
@@ -378,30 +383,9 @@ class ExperimentalConfig(Config):
         # MSC3026 (busy presence state)
         self.msc3026_enabled: bool = experimental.get("msc3026_enabled", False)
 
-        # MSC2697 (device dehydration)
-        # Enabled by default since this option was added after adding the feature.
-        # It is not recommended that both MSC2697 and MSC3814 both be enabled at
-        # once.
-        self.msc2697_enabled: bool = experimental.get("msc2697_enabled", True)
-
         # MSC3814 (dehydrated devices with SSSS)
-        # This is an alternative method to achieve the same goals as MSC2697.
-        # It is not recommended that both MSC2697 and MSC3814 both be enabled at
-        # once.
         self.msc3814_enabled: bool = experimental.get("msc3814_enabled", False)
 
-        if self.msc2697_enabled and self.msc3814_enabled:
-            raise ConfigError(
-                "MSC2697 and MSC3814 should not both be enabled.",
-                (
-                    "experimental_features",
-                    "msc3814_enabled",
-                ),
-            )
-
-        # MSC3244 (room version capabilities)
-        self.msc3244_enabled: bool = experimental.get("msc3244_enabled", True)
-
         # MSC3266 (room summary api)
         self.msc3266_enabled: bool = experimental.get("msc3266_enabled", False)
 
@@ -412,11 +396,6 @@ class ExperimentalConfig(Config):
             "msc2409_to_device_messages_enabled", False
         )
 
-        # The portion of MSC3202 which is related to device masquerading.
-        self.msc3202_device_masquerading_enabled: bool = experimental.get(
-            "msc3202_device_masquerading", False
-        )
-
         # The portion of MSC3202 related to transaction extensions:
         # sending device list changes, one-time key counts and fallback key
         # usage to application services.
@@ -463,9 +442,6 @@ class ExperimentalConfig(Config):
         # MSC3848: Introduce errcodes for specific event sending failures
         self.msc3848_enabled: bool = experimental.get("msc3848_enabled", False)
 
-        # MSC3852: Expose last seen user agent field on /_matrix/client/v3/devices.
-        self.msc3852_enabled: bool = experimental.get("msc3852_enabled", False)
-
         # MSC3866: M_USER_AWAITING_APPROVAL error code
         raw_msc3866_config = experimental.get("msc3866", {})
         self.msc3866 = MSC3866Config(**raw_msc3866_config)
@@ -501,8 +477,7 @@ class ExperimentalConfig(Config):
         self.msc1767_enabled: bool = experimental.get("msc1767_enabled", False)
         if self.msc1767_enabled:
             # Enable room version (and thus applicable push rules from MSC3931/3932)
-            version_id = RoomVersions.MSC1767v10.identifier
-            KNOWN_ROOM_VERSIONS[version_id] = RoomVersions.MSC1767v10
+            KNOWN_ROOM_VERSIONS.add_room_version(RoomVersions.MSC1767v10)
 
         # MSC3391: Removing account data.
         self.msc3391_enabled = experimental.get("msc3391_enabled", False)
@@ -528,13 +503,18 @@ class ExperimentalConfig(Config):
             "msc4069_profile_inhibit_propagation", False
         )
 
-        # MSC4108: Mechanism to allow OIDC sign in and E2EE set up via QR code
+        # MSC4108: Mechanism to allow OIDC sign in and E2EE set up via QR code - 2024 version:
+        # See: https://github.com/element-hq/synapse/issues/19434
         self.msc4108_enabled = experimental.get("msc4108_enabled", False)
 
-        self.msc4108_delegation_endpoint: Optional[str] = experimental.get(
+        self.msc4108_delegation_endpoint: str | None = experimental.get(
             "msc4108_delegation_endpoint", None
         )
 
+        # MSC4370: Get extremities federation endpoint
+        # See https://github.com/element-hq/synapse/issues/19524
+        self.msc4370_enabled = experimental.get("msc4370_enabled", False)
+
         auth_delegated = self.msc3861.enabled or (
             config.get("matrix_authentication_service") or {}
         ).get("enabled", False)
@@ -553,9 +533,35 @@ class ExperimentalConfig(Config):
                 ("experimental", "msc4108_delegation_endpoint"),
             )
 
+        # MSC4388: Secure out-of-band channel for sign in with QR:
+        # See: https://github.com/element-hq/synapse/issues/19433
+        msc4388_mode = experimental.get("msc4388_mode", "off")
+
+        if msc4388_mode not in ["off", "open", "authenticated"]:
+            raise ConfigError(
+                "msc4388_mode must be one of 'off', 'open' or 'authenticated'",
+                ("experimental", "msc4388_mode"),
+            )
+        self.msc4388_enabled: bool = msc4388_mode != "off"
+        self.msc4388_requires_authentication: bool = msc4388_mode == "authenticated"
+
+        if self.msc4388_enabled and not (
+            config.get("matrix_authentication_service") or {}
+        ).get("enabled", False):
+            raise ConfigError(
+                "MSC4388 requires matrix_authentication_service to be enabled",
+                ("experimental", "msc4388_enabled"),
+            )
+
         # MSC4133: Custom profile fields
         self.msc4133_enabled: bool = experimental.get("msc4133_enabled", False)
 
+        # MSC4143: Matrix RTC Transport using Livekit Backend
+        self.msc4143_enabled: bool = experimental.get("msc4143_enabled", False)
+
+        # MSC4169: Backwards-compatible redaction sending using `/send`
+        self.msc4169_enabled: bool = experimental.get("msc4169_enabled", False)
+
         # MSC4210: Remove legacy mentions
         self.msc4210_enabled: bool = experimental.get("msc4210_enabled", False)
 
@@ -590,5 +596,11 @@ class ExperimentalConfig(Config):
         self.msc4293_enabled: bool = experimental.get("msc4293_enabled", False)
 
         # MSC4306: Thread Subscriptions
-        # (and MSC4308: sliding sync extension for thread subscriptions)
+        # (and MSC4308: Thread Subscriptions extension to Sliding Sync)
         self.msc4306_enabled: bool = experimental.get("msc4306_enabled", False)
+
+        # MSC4354: Sticky Events
+        # Tracked in: https://github.com/element-hq/synapse/issues/19409
+        # Note that sticky events persisted before this feature is enabled will not be
+        # considered sticky by the local homeserver.
+        self.msc4354_enabled: bool = experimental.get("msc4354_enabled", False)
diff --git a/synapse/config/federation.py b/synapse/config/federation.py
index 31f46e420d..ad0bd56a80 100644
--- a/synapse/config/federation.py
+++ b/synapse/config/federation.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Optional
+from typing import Any
 
 from synapse.config._base import Config
 from synapse.config._util import validate_config
@@ -32,7 +32,7 @@ class FederationConfig(Config):
         federation_config = config.setdefault("federation", {})
 
         # FIXME: federation_domain_whitelist needs sytests
-        self.federation_domain_whitelist: Optional[dict] = None
+        self.federation_domain_whitelist: dict | None = None
         federation_domain_whitelist = config.get("federation_domain_whitelist", None)
 
         if federation_domain_whitelist is not None:
diff --git a/synapse/config/homeserver.py b/synapse/config/homeserver.py
index 5d7089c2e6..94ebe583a4 100644
--- a/synapse/config/homeserver.py
+++ b/synapse/config/homeserver.py
@@ -18,7 +18,8 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from ._base import RootConfig
+
+from ._base import ConfigError, RootConfig
 from .account_validity import AccountValidityConfig
 from .api import ApiConfig
 from .appservice import AppServiceConfig
@@ -37,6 +38,7 @@ from .jwt import JWTConfig
 from .key import KeyConfig
 from .logger import LoggingConfig
 from .mas import MasConfig
+from .matrixrtc import MatrixRtcConfig
 from .metrics import MetricsConfig
 from .modules import ModulesConfig
 from .oembed import OembedConfig
@@ -66,6 +68,10 @@ from .workers import WorkerConfig
 
 
 class HomeServerConfig(RootConfig):
+    """
+    Top-level config object for Synapse homeserver (main process and workers).
+    """
+
     config_classes = [
         ModulesConfig,
         ServerConfig,
@@ -80,6 +86,7 @@ class HomeServerConfig(RootConfig):
         OembedConfig,
         CaptchaConfig,
         VoipConfig,
+        MatrixRtcConfig,
         RegistrationConfig,
         AccountValidityConfig,
         MetricsConfig,
@@ -113,3 +120,22 @@ class HomeServerConfig(RootConfig):
         # This must be last, as it checks for conflicts with other config options.
         MasConfig,
     ]
+
+    def validate_config(
+        self,
+    ) -> None:
+        if (
+            self.registration.enable_registration
+            and not self.registration.enable_registration_without_verification
+        ):
+            if (
+                not self.captcha.enable_registration_captcha
+                and not self.registration.registrations_require_3pid
+                and not self.registration.registration_requires_token
+            ):
+                raise ConfigError(
+                    "You have enabled open registration without any verification. This is a known vector for "
+                    "spam and abuse. If you would like to allow public registration, please consider adding email, "
+                    "captcha, or token-based verification. Otherwise this check can be removed by setting the "
+                    "`enable_registration_without_verification` config option to `true`."
+                )
diff --git a/synapse/config/key.py b/synapse/config/key.py
index f78ff5114f..bfeeac5e30 100644
--- a/synapse/config/key.py
+++ b/synapse/config/key.py
@@ -23,7 +23,7 @@
 import hashlib
 import logging
 import os
-from typing import TYPE_CHECKING, Any, Dict, Iterator, List, Optional
+from typing import TYPE_CHECKING, Any, Iterator
 
 import attr
 import jsonschema
@@ -110,7 +110,7 @@ class TrustedKeyServer:
     server_name: str
 
     # map from key id to key object, or None to disable signature verification.
-    verify_keys: Optional[Dict[str, VerifyKey]] = None
+    verify_keys: dict[str, VerifyKey] | None = None
 
 
 class KeyConfig(Config):
@@ -219,7 +219,7 @@ class KeyConfig(Config):
         if form_secret_path:
             if form_secret:
                 raise ConfigError(CONFLICTING_FORM_SECRET_OPTS_ERROR)
-            self.form_secret: Optional[str] = read_file(
+            self.form_secret: str | None = read_file(
                 form_secret_path, ("form_secret_path",)
             ).strip()
         else:
@@ -250,7 +250,7 @@ class KeyConfig(Config):
           - server_name: "matrix.org"
         """ % locals()
 
-    def read_signing_keys(self, signing_key_path: str, name: str) -> List[SigningKey]:
+    def read_signing_keys(self, signing_key_path: str, name: str) -> list[SigningKey]:
         """Read the signing keys in the given path.
 
         Args:
@@ -279,8 +279,8 @@ class KeyConfig(Config):
             raise ConfigError("Error reading %s: %s" % (name, str(e)))
 
     def read_old_signing_keys(
-        self, old_signing_keys: Optional[JsonDict]
-    ) -> Dict[str, "VerifyKeyWithExpiry"]:
+        self, old_signing_keys: JsonDict | None
+    ) -> dict[str, "VerifyKeyWithExpiry"]:
         if old_signing_keys is None:
             return {}
         keys = {}
@@ -299,7 +299,7 @@ class KeyConfig(Config):
                 )
         return keys
 
-    def generate_files(self, config: Dict[str, Any], config_dir_path: str) -> None:
+    def generate_files(self, config: dict[str, Any], config_dir_path: str) -> None:
         if "signing_key" in config:
             return
 
@@ -393,7 +393,7 @@ TRUSTED_KEY_SERVERS_SCHEMA = {
 
 
 def _parse_key_servers(
-    key_servers: List[Any], federation_verify_certificates: bool
+    key_servers: list[Any], federation_verify_certificates: bool
 ) -> Iterator[TrustedKeyServer]:
     try:
         jsonschema.validate(key_servers, TRUSTED_KEY_SERVERS_SCHEMA)
@@ -408,7 +408,7 @@ def _parse_key_servers(
         server_name = server["server_name"]
         result = TrustedKeyServer(server_name=server_name)
 
-        verify_keys: Optional[Dict[str, str]] = server.get("verify_keys")
+        verify_keys: dict[str, str] | None = server.get("verify_keys")
         if verify_keys is not None:
             result.verify_keys = {}
             for key_id, key_base64 in verify_keys.items():
diff --git a/synapse/config/logger.py b/synapse/config/logger.py
index 3f86ec1169..4af73627be 100644
--- a/synapse/config/logger.py
+++ b/synapse/config/logger.py
@@ -26,7 +26,7 @@ import os
 import sys
 import threading
 from string import Template
-from typing import TYPE_CHECKING, Any, Dict, Optional
+from typing import TYPE_CHECKING, Any
 
 import yaml
 from zope.interface import implementer
@@ -40,7 +40,6 @@ from twisted.logger import (
 )
 
 from synapse.logging.context import LoggingContextFilter
-from synapse.logging.filter import MetadataFilter
 from synapse.synapse_rust import reset_logging_config
 from synapse.types import JsonDict
 
@@ -187,7 +186,7 @@ class LoggingConfig(Config):
             help=argparse.SUPPRESS,
         )
 
-    def generate_files(self, config: Dict[str, Any], config_dir_path: str) -> None:
+    def generate_files(self, config: dict[str, Any], config_dir_path: str) -> None:
         log_config = config.get("log_config")
         if log_config and not os.path.exists(log_config):
             log_file = self.abspath("homeserver.log")
@@ -199,12 +198,27 @@ class LoggingConfig(Config):
                 log_config_file.write(DEFAULT_LOG_CONFIG.substitute(log_file=log_file))
 
 
-def _setup_stdlib_logging(
-    config: "HomeServerConfig", log_config_path: Optional[str], logBeginner: LogBeginner
-) -> None:
+_already_performed_one_time_logging_setup: bool = False
+"""
+Marks whether we've already successfully ran `one_time_logging_setup()`.
+"""
+
+
+def one_time_logging_setup(*, logBeginner: LogBeginner = globalLogBeginner) -> None:
     """
-    Set up Python standard library logging.
+    Perform one-time logging configuration for the Python process.
+
+    For example, we don't need to have multiple log record factories. Once we've
+    configured it once, we don't need to do it again.
+
+    This matters because multiple Synapse instances can be run in the same Python
+    process (c.f. Synapse Pro for small hosts)
     """
+    global _already_performed_one_time_logging_setup
+
+    # We only need to set things up once.
+    if _already_performed_one_time_logging_setup:
+        return
 
     # We add a log record factory that runs all messages through the
     # LoggingContextFilter so that we get the context *at the time we log*
@@ -213,37 +227,15 @@ def _setup_stdlib_logging(
     # writes.
 
     log_context_filter = LoggingContextFilter()
-    log_metadata_filter = MetadataFilter({"server_name": config.server.server_name})
     old_factory = logging.getLogRecordFactory()
 
     def factory(*args: Any, **kwargs: Any) -> logging.LogRecord:
         record = old_factory(*args, **kwargs)
         log_context_filter.filter(record)
-        log_metadata_filter.filter(record)
         return record
 
     logging.setLogRecordFactory(factory)
 
-    # Configure the logger with the initial configuration.
-    if log_config_path is None:
-        log_format = (
-            "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s"
-            " - %(message)s"
-        )
-
-        logger = logging.getLogger("")
-        logger.setLevel(logging.INFO)
-        logging.getLogger("synapse.storage.SQL").setLevel(logging.INFO)
-
-        formatter = logging.Formatter(log_format)
-
-        handler = logging.StreamHandler()
-        handler.setFormatter(formatter)
-        logger.addHandler(handler)
-    else:
-        # Load the logging configuration.
-        _load_logging_config(log_config_path)
-
     # Route Twisted's native logging through to the standard library logging
     # system.
     observer = STDLibLogObserver()
@@ -284,6 +276,36 @@ def _setup_stdlib_logging(
 
     logBeginner.beginLoggingTo([_log], redirectStandardIO=False)
 
+    _already_performed_one_time_logging_setup = True
+
+
+def _setup_stdlib_logging(
+    config: "HomeServerConfig", log_config_path: str | None
+) -> None:
+    """
+    Set up Python standard library logging.
+    """
+
+    # Configure the logger with the initial configuration.
+    if log_config_path is None:
+        log_format = (
+            "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s"
+            " - %(message)s"
+        )
+
+        logger = logging.getLogger("")
+        logger.setLevel(logging.INFO)
+        logging.getLogger("synapse.storage.SQL").setLevel(logging.INFO)
+
+        formatter = logging.Formatter(log_format)
+
+        handler = logging.StreamHandler()
+        handler.setFormatter(formatter)
+        logger.addHandler(handler)
+    else:
+        # Load the logging configuration.
+        _load_logging_config(log_config_path)
+
 
 def _load_logging_config(log_config_path: str) -> None:
     """
@@ -305,7 +327,7 @@ def _load_logging_config(log_config_path: str) -> None:
     reset_logging_config()
 
 
-def _reload_logging_config(log_config_path: Optional[str]) -> None:
+def _reload_logging_config(log_config_path: str | None) -> None:
     """
     Reload the log configuration from the file and apply it.
     """
@@ -321,19 +343,14 @@ def setup_logging(
     hs: "HomeServer",
     config: "HomeServerConfig",
     use_worker_options: bool = False,
-    logBeginner: LogBeginner = globalLogBeginner,
 ) -> None:
     """
     Set up the logging subsystem.
 
     Args:
         config: configuration data
-
         use_worker_options: True to use the 'worker_log_config' option
             instead of 'log_config'.
-
-        logBeginner: The Twisted logBeginner to use.
-
     """
     from twisted.internet import reactor
 
@@ -344,11 +361,17 @@ def setup_logging(
     )
 
     # Perform one-time logging configuration.
-    _setup_stdlib_logging(config, log_config_path, logBeginner=logBeginner)
+    one_time_logging_setup()
+
+    # Configure logging.
+    _setup_stdlib_logging(config, log_config_path)
     # Add a SIGHUP handler to reload the logging configuration, if one is available.
     from synapse.app import _base as appbase
 
-    appbase.register_sighup(_reload_logging_config, log_config_path)
+    # We only need to reload the config if there is a log config file path provided to
+    # reload from.
+    if log_config_path:
+        appbase.register_sighup(hs, _reload_logging_config, log_config_path)
 
     # Log immediately so we can grep backwards.
     logger.warning("***** STARTING SERVER *****")
diff --git a/synapse/config/mas.py b/synapse/config/mas.py
index fe0d326f7a..6973e9ae58 100644
--- a/synapse/config/mas.py
+++ b/synapse/config/mas.py
@@ -13,17 +13,19 @@
 #
 #
 
-from typing import Any, Optional
+from typing import Any
 
-from synapse._pydantic_compat import (
+from pydantic import (
     AnyHttpUrl,
     Field,
     FilePath,
     StrictBool,
     StrictStr,
     ValidationError,
-    validator,
+    model_validator,
 )
+from typing_extensions import Self
+
 from synapse.config.experimental import read_secret_from_file_once
 from synapse.types import JsonDict
 from synapse.util.pydantic_models import ParseModel
@@ -33,27 +35,26 @@ from ._base import Config, ConfigError, RootConfig
 
 class MasConfigModel(ParseModel):
     enabled: StrictBool = False
-    endpoint: AnyHttpUrl = Field(default="http://localhost:8080")
-    secret: Optional[StrictStr] = Field(default=None)
-    secret_path: Optional[FilePath] = Field(default=None)
+    endpoint: AnyHttpUrl = AnyHttpUrl("http://localhost:8080")
+    force_http2: StrictBool = False
+    secret: StrictStr | None = Field(default=None)
+    # We set `strict=False` to allow `str` instances.
+    secret_path: FilePath | None = Field(default=None, strict=False)
 
-    @validator("secret")
-    def validate_secret_is_set_if_enabled(cls, v: Any, values: dict) -> Any:
-        if values.get("enabled", False) and not values.get("secret_path") and not v:
+    @model_validator(mode="after")
+    def verify_secret(self) -> Self:
+        if not self.enabled:
+            return self
+        if not self.secret and not self.secret_path:
             raise ValueError(
-                "You must set a `secret` or `secret_path` when enabling Matrix Authentication Service integration."
+                "You must set a `secret` or `secret_path` when enabling the Matrix "
+                "Authentication Service integration."
             )
-
-        return v
-
-    @validator("secret_path")
-    def validate_secret_path_is_set_if_enabled(cls, v: Any, values: dict) -> Any:
-        if values.get("secret"):
+        if self.secret and self.secret_path:
             raise ValueError(
                 "`secret` and `secret_path` cannot be set at the same time."
             )
-
-        return v
+        return self
 
 
 class MasConfig(Config):
@@ -82,6 +83,7 @@ class MasConfig(Config):
 
         self.enabled = parsed.enabled
         self.endpoint = parsed.endpoint
+        self.force_http2 = parsed.force_http2
         self._secret = parsed.secret
         self._secret_path = parsed.secret_path
 
diff --git a/synapse/config/matrixrtc.py b/synapse/config/matrixrtc.py
new file mode 100644
index 0000000000..84c245e286
--- /dev/null
+++ b/synapse/config/matrixrtc.py
@@ -0,0 +1,66 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+# [This file includes modifications made by New Vector Limited]
+#
+#
+
+from typing import Any
+
+from pydantic import Field, StrictStr, ValidationError, model_validator
+from typing_extensions import Self
+
+from synapse.types import JsonDict
+from synapse.util.pydantic_models import ParseModel
+
+from ._base import Config, ConfigError
+
+
+class TransportConfigModel(ParseModel):
+    type: StrictStr
+
+    livekit_service_url: StrictStr | None = Field(default=None)
+    """An optional livekit service URL. Only required if type is "livekit"."""
+
+    @model_validator(mode="after")
+    def validate_livekit_service_url(self) -> Self:
+        if self.type == "livekit" and not self.livekit_service_url:
+            raise ValueError(
+                "You must set a `livekit_service_url` when using the 'livekit' transport."
+            )
+        return self
+
+
+class MatrixRtcConfigModel(ParseModel):
+    transports: list = []
+
+
+class MatrixRtcConfig(Config):
+    section = "matrix_rtc"
+
+    def read_config(
+        self, config: JsonDict, allow_secrets_in_config: bool, **kwargs: Any
+    ) -> None:
+        matrix_rtc = config.get("matrix_rtc", {})
+        if matrix_rtc is None:
+            matrix_rtc = {}
+
+        try:
+            parsed = MatrixRtcConfigModel(**matrix_rtc)
+        except ValidationError as e:
+            raise ConfigError(
+                "Could not validate matrix_rtc config",
+                ("matrix_rtc",),
+            ) from e
+
+        self.transports = parsed.transports
diff --git a/synapse/config/metrics.py b/synapse/config/metrics.py
index 8a4ded62ef..d8cddb82ed 100644
--- a/synapse/config/metrics.py
+++ b/synapse/config/metrics.py
@@ -20,7 +20,7 @@
 #
 #
 
-from typing import Any, Optional
+from typing import Any
 
 import attr
 
@@ -75,10 +75,19 @@ class MetricsConfig(Config):
                 )
 
     def generate_config_section(
-        self, report_stats: Optional[bool] = None, **kwargs: Any
+        self,
+        report_stats: bool | None = None,
+        enable_metrics: bool = False,
+        **kwargs: Any,
     ) -> str:
         if report_stats is not None:
             res = "report_stats: %s\n" % ("true" if report_stats else "false")
         else:
             res = "\n"
+
+        # We avoid adding anything if it's `False` since that's the default (less noise
+        # in the default generated config)
+        if enable_metrics:
+            res += "enable_metrics: true\n"
+
         return res
diff --git a/synapse/config/modules.py b/synapse/config/modules.py
index 37dc26e130..17319c9e37 100644
--- a/synapse/config/modules.py
+++ b/synapse/config/modules.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict, List, Tuple
+from typing import Any
 
 from synapse.config._base import Config, ConfigError
 from synapse.types import JsonDict
@@ -29,7 +29,7 @@ class ModulesConfig(Config):
     section = "modules"
 
     def read_config(self, config: JsonDict, **kwargs: Any) -> None:
-        self.loaded_modules: List[Tuple[Any, Dict]] = []
+        self.loaded_modules: list[tuple[Any, dict]] = []
 
         configured_modules = config.get("modules") or []
         for i, module in enumerate(configured_modules):
diff --git a/synapse/config/oembed.py b/synapse/config/oembed.py
index b177a75cf6..208f86374b 100644
--- a/synapse/config/oembed.py
+++ b/synapse/config/oembed.py
@@ -18,13 +18,13 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
+import importlib.resources as importlib_resources
 import json
 import re
-from typing import Any, Dict, Iterable, List, Optional, Pattern
+from typing import Any, Iterable, Pattern
 from urllib import parse as urlparse
 
 import attr
-import pkg_resources
 
 from synapse.types import JsonDict, StrSequence
 
@@ -37,9 +37,9 @@ class OEmbedEndpointConfig:
     # The API endpoint to fetch.
     api_endpoint: str
     # The patterns to match.
-    url_patterns: List[Pattern[str]]
+    url_patterns: list[Pattern[str]]
     # The supported formats.
-    formats: Optional[List[str]]
+    formats: list[str] | None
 
 
 class OembedConfig(Config):
@@ -48,10 +48,10 @@ class OembedConfig(Config):
     section = "oembed"
 
     def read_config(self, config: JsonDict, **kwargs: Any) -> None:
-        oembed_config: Dict[str, Any] = config.get("oembed") or {}
+        oembed_config: dict[str, Any] = config.get("oembed") or {}
 
         # A list of patterns which will be used.
-        self.oembed_patterns: List[OEmbedEndpointConfig] = list(
+        self.oembed_patterns: list[OEmbedEndpointConfig] = list(
             self._parse_and_validate_providers(oembed_config)
         )
 
@@ -64,7 +64,12 @@ class OembedConfig(Config):
         """
         # Whether to use the packaged providers.json file.
         if not oembed_config.get("disable_default_providers") or False:
-            with pkg_resources.resource_stream("synapse", "res/providers.json") as s:
+            path = (
+                importlib_resources.files("synapse")
+                .joinpath("res")
+                .joinpath("providers.json")
+            )
+            with path.open("r", encoding="utf-8") as s:
                 providers = json.load(s)
 
             yield from self._parse_and_validate_provider(
@@ -87,7 +92,7 @@ class OembedConfig(Config):
             )
 
     def _parse_and_validate_provider(
-        self, providers: List[JsonDict], config_path: StrSequence
+        self, providers: list[JsonDict], config_path: StrSequence
     ) -> Iterable[OEmbedEndpointConfig]:
         # Ensure it is the proper form.
         validate_config(
diff --git a/synapse/config/oidc.py b/synapse/config/oidc.py
index 3ddf65a3e9..73fe6891cd 100644
--- a/synapse/config/oidc.py
+++ b/synapse/config/oidc.py
@@ -21,7 +21,7 @@
 #
 
 from collections import Counter
-from typing import Any, Collection, Iterable, List, Mapping, Optional, Tuple, Type
+from typing import Any, Collection, Iterable, Mapping
 
 import attr
 
@@ -213,7 +213,7 @@ def _parse_oidc_provider_configs(config: JsonDict) -> Iterable["OidcProviderConf
 
 
 def _parse_oidc_config_dict(
-    oidc_config: JsonDict, config_path: Tuple[str, ...]
+    oidc_config: JsonDict, config_path: tuple[str, ...]
 ) -> "OidcProviderConfig":
     """Take the configuration dict and parse it into an OidcProviderConfig
 
@@ -276,7 +276,7 @@ def _parse_oidc_config_dict(
             ) from e
 
     client_secret_jwt_key_config = oidc_config.get("client_secret_jwt_key")
-    client_secret_jwt_key: Optional[OidcProviderClientSecretJwtKey] = None
+    client_secret_jwt_key: OidcProviderClientSecretJwtKey | None = None
     if client_secret_jwt_key_config is not None:
         keyfile = client_secret_jwt_key_config.get("key_file")
         if keyfile:
@@ -384,10 +384,10 @@ class OidcProviderConfig:
     idp_name: str
 
     # Optional MXC URI for icon for this IdP.
-    idp_icon: Optional[str]
+    idp_icon: str | None
 
     # Optional brand identifier for this IdP.
-    idp_brand: Optional[str]
+    idp_brand: str | None
 
     # whether the OIDC discovery mechanism is used to discover endpoints
     discover: bool
@@ -401,11 +401,11 @@ class OidcProviderConfig:
 
     # oauth2 client secret to use. if `None`, use client_secret_jwt_key to generate
     # a secret.
-    client_secret: Optional[str]
+    client_secret: str | None
 
     # key to use to construct a JWT to use as a client secret. May be `None` if
     # `client_secret` is set.
-    client_secret_jwt_key: Optional[OidcProviderClientSecretJwtKey]
+    client_secret_jwt_key: OidcProviderClientSecretJwtKey | None
 
     # auth method to use when exchanging the token.
     # Valid values are 'client_secret_basic', 'client_secret_post' and
@@ -416,7 +416,7 @@ class OidcProviderConfig:
     # Valid values are 'auto', 'always', and 'never'.
     pkce_method: str
 
-    id_token_signing_alg_values_supported: Optional[List[str]]
+    id_token_signing_alg_values_supported: list[str] | None
     """
     List of the JWS signing algorithms (`alg` values) that are supported for signing the
     `id_token`.
@@ -448,18 +448,18 @@ class OidcProviderConfig:
     scopes: Collection[str]
 
     # the oauth2 authorization endpoint. Required if discovery is disabled.
-    authorization_endpoint: Optional[str]
+    authorization_endpoint: str | None
 
     # the oauth2 token endpoint. Required if discovery is disabled.
-    token_endpoint: Optional[str]
+    token_endpoint: str | None
 
     # the OIDC userinfo endpoint. Required if discovery is disabled and the
     # "openid" scope is not requested.
-    userinfo_endpoint: Optional[str]
+    userinfo_endpoint: str | None
 
     # URI where to fetch the JWKS. Required if discovery is disabled and the
     # "openid" scope is used.
-    jwks_uri: Optional[str]
+    jwks_uri: str | None
 
     # Whether Synapse should react to backchannel logouts
     backchannel_logout_enabled: bool
@@ -474,7 +474,7 @@ class OidcProviderConfig:
     # values are: "auto" or "userinfo_endpoint".
     user_profile_method: str
 
-    redirect_uri: Optional[str]
+    redirect_uri: str | None
     """
     An optional replacement for Synapse's hardcoded `redirect_uri` URL
     (`<public_baseurl>/_synapse/client/oidc/callback`). This can be used to send
@@ -491,13 +491,13 @@ class OidcProviderConfig:
     allow_existing_users: bool
 
     # the class of the user mapping provider
-    user_mapping_provider_class: Type
+    user_mapping_provider_class: type
 
     # the config of the user mapping provider
     user_mapping_provider_config: Any
 
     # required attributes to require in userinfo to allow login/registration
-    attribute_requirements: List[SsoAttributeRequirement]
+    attribute_requirements: list[SsoAttributeRequirement]
 
     # Whether automatic registrations are enabled in the ODIC flow. Defaults to True
     enable_registration: bool
diff --git a/synapse/config/password_auth_providers.py b/synapse/config/password_auth_providers.py
index b2b624aea2..c2894f58dc 100644
--- a/synapse/config/password_auth_providers.py
+++ b/synapse/config/password_auth_providers.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, List, Tuple, Type
+from typing import Any
 
 from synapse.types import JsonDict
 from synapse.util.module_loader import load_module
@@ -56,7 +56,7 @@ class PasswordAuthProviderConfig(Config):
         for backwards compatibility.
         """
 
-        self.password_providers: List[Tuple[Type, Any]] = []
+        self.password_providers: list[tuple[type, Any]] = []
         providers = []
 
         # We want to be backwards compatible with the old `ldap_config`
diff --git a/synapse/config/ratelimiting.py b/synapse/config/ratelimiting.py
index b082daa8f7..13c9c4dba0 100644
--- a/synapse/config/ratelimiting.py
+++ b/synapse/config/ratelimiting.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, Dict, Optional, cast
+from typing import Any, cast
 
 import attr
 
@@ -37,9 +37,9 @@ class RatelimitSettings:
     @classmethod
     def parse(
         cls,
-        config: Dict[str, Any],
+        config: dict[str, Any],
         key: str,
-        defaults: Optional[Dict[str, float]] = None,
+        defaults: dict[str, float] | None = None,
     ) -> "RatelimitSettings":
         """Parse config[key] as a new-style rate limiter config.
 
@@ -62,7 +62,7 @@ class RatelimitSettings:
 
         # By this point we should have hit the rate limiter parameters.
         # We don't actually check this though!
-        rl_config = cast(Dict[str, float], rl_config)
+        rl_config = cast(dict[str, float], rl_config)
 
         return cls(
             key=key,
@@ -252,3 +252,9 @@ class RatelimitConfig(Config):
             "rc_reports",
             defaults={"per_second": 1, "burst_count": 5},
         )
+
+        self.rc_user_directory = RatelimitSettings.parse(
+            config,
+            "rc_user_directory",
+            defaults={"per_second": 0.016, "burst_count": 200},
+        )
diff --git a/synapse/config/registration.py b/synapse/config/registration.py
index 283199aa11..7f7a224e02 100644
--- a/synapse/config/registration.py
+++ b/synapse/config/registration.py
@@ -20,7 +20,7 @@
 #
 #
 import argparse
-from typing import Any, Dict, Optional
+from typing import Any
 
 from synapse.api.constants import RoomCreationPreset
 from synapse.config._base import Config, ConfigError, read_file
@@ -181,7 +181,7 @@ class RegistrationConfig(Config):
             refreshable_access_token_lifetime = self.parse_duration(
                 refreshable_access_token_lifetime
             )
-        self.refreshable_access_token_lifetime: Optional[int] = (
+        self.refreshable_access_token_lifetime: int | None = (
             refreshable_access_token_lifetime
         )
 
@@ -226,7 +226,7 @@ class RegistrationConfig(Config):
         refresh_token_lifetime = config.get("refresh_token_lifetime")
         if refresh_token_lifetime is not None:
             refresh_token_lifetime = self.parse_duration(refresh_token_lifetime)
-        self.refresh_token_lifetime: Optional[int] = refresh_token_lifetime
+        self.refresh_token_lifetime: int | None = refresh_token_lifetime
 
         if (
             self.session_lifetime is not None
@@ -266,7 +266,7 @@ class RegistrationConfig(Config):
         else:
             return ""
 
-    def generate_files(self, config: Dict[str, Any], config_dir_path: str) -> None:
+    def generate_files(self, config: dict[str, Any], config_dir_path: str) -> None:
         # if 'registration_shared_secret_path' is specified, and the target file
         # does not exist, generate it.
         registration_shared_secret_path = config.get("registration_shared_secret_path")
diff --git a/synapse/config/repository.py b/synapse/config/repository.py
index efdc505659..c87442aace 100644
--- a/synapse/config/repository.py
+++ b/synapse/config/repository.py
@@ -21,7 +21,7 @@
 
 import logging
 import os
-from typing import Any, Dict, List, Tuple
+from typing import Any
 
 import attr
 
@@ -80,8 +80,8 @@ class MediaStorageProviderConfig:
 
 
 def parse_thumbnail_requirements(
-    thumbnail_sizes: List[JsonDict],
-) -> Dict[str, Tuple[ThumbnailRequirement, ...]]:
+    thumbnail_sizes: list[JsonDict],
+) -> dict[str, tuple[ThumbnailRequirement, ...]]:
     """Takes a list of dictionaries with "width", "height", and "method" keys
     and creates a map from image media types to the thumbnail size, thumbnailing
     method, and thumbnail media type to precalculate
@@ -92,7 +92,7 @@ def parse_thumbnail_requirements(
     Returns:
         Dictionary mapping from media type string to list of ThumbnailRequirement.
     """
-    requirements: Dict[str, List[ThumbnailRequirement]] = {}
+    requirements: dict[str, list[ThumbnailRequirement]] = {}
     for size in thumbnail_sizes:
         width = size["width"]
         height = size["height"]
@@ -120,11 +120,19 @@ def parse_thumbnail_requirements(
 
 @attr.s(auto_attribs=True, slots=True, frozen=True)
 class MediaUploadLimit:
-    """A limit on the amount of data a user can upload in a given time
-    period."""
+    """
+    Represents a limit on the amount of data a user can upload in a given time
+    period.
+
+    These can be configured through the `media_upload_limits` [config option](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#media_upload_limits)
+    or via the `get_media_upload_limits_for_user` module API [callback](https://element-hq.github.io/synapse/latest/modules/media_repository_callbacks.html#get_media_upload_limits_for_user).
+    """
 
     max_bytes: int
+    """The maximum number of bytes that can be uploaded in the given time period."""
+
     time_period_ms: int
+    """The time period in milliseconds."""
 
 
 class ContentRepositoryConfig(Config):
@@ -166,6 +174,11 @@ class ContentRepositoryConfig(Config):
             config.get("media_store_path", "media_store")
         )
 
+        # Whether to enable the local media storage provider. When disabled,
+        # media will only be stored in configured storage providers and temp
+        # files will be used for processing.
+        self.enable_local_media_storage = config.get("enable_local_media_storage", True)
+
         backup_media_store_path = config.get("backup_media_store_path")
 
         synchronous_backup_media_store = config.get(
@@ -198,7 +211,7 @@ class ContentRepositoryConfig(Config):
         #
         # We don't create the storage providers here as not all workers need
         # them to be started.
-        self.media_storage_providers: List[tuple] = []
+        self.media_storage_providers: list[tuple] = []
 
         for i, provider_config in enumerate(storage_providers):
             # We special case the module "file_system" so as not to need to
@@ -290,7 +303,7 @@ class ContentRepositoryConfig(Config):
 
         self.enable_authenticated_media = config.get("enable_authenticated_media", True)
 
-        self.media_upload_limits: List[MediaUploadLimit] = []
+        self.media_upload_limits: list[MediaUploadLimit] = []
         for limit_config in config.get("media_upload_limits", []):
             time_period_ms = self.parse_duration(limit_config["time_period"])
             max_bytes = self.parse_size(limit_config["max_size"])
diff --git a/synapse/config/retention.py b/synapse/config/retention.py
index 7e329c7f42..ab80ac214d 100644
--- a/synapse/config/retention.py
+++ b/synapse/config/retention.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import Any, List, Optional
+from typing import Any
 
 import attr
 
@@ -35,8 +35,8 @@ class RetentionPurgeJob:
     """Object describing the configuration of the manhole"""
 
     interval: int
-    shortest_max_lifetime: Optional[int]
-    longest_max_lifetime: Optional[int]
+    shortest_max_lifetime: int | None
+    longest_max_lifetime: int | None
 
 
 class RetentionConfig(Config):
@@ -119,7 +119,7 @@ class RetentionConfig(Config):
                 " greater than 'allowed_lifetime_max'"
             )
 
-        self.retention_purge_jobs: List[RetentionPurgeJob] = []
+        self.retention_purge_jobs: list[RetentionPurgeJob] = []
         for purge_job_config in retention_config.get("purge_jobs", []):
             interval_config = purge_job_config.get("interval")
 
diff --git a/synapse/config/saml2.py b/synapse/config/saml2.py
index 9d7ef94507..acba63ee9b 100644
--- a/synapse/config/saml2.py
+++ b/synapse/config/saml2.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import Any, List, Set
+from typing import Any
 
 from synapse.config.sso import SsoAttributeRequirement
 from synapse.types import JsonDict
@@ -160,8 +160,11 @@ class SAML2Config(Config):
             )
 
         # Get the desired saml auth response attributes from the module
+        # type-ignore: the provider class was already checked for having the method being called
+        # with the runtime checks above, which mypy is not aware of, and treats as an error
+        # ever since the typehint of provider class was changed from "typing.Type" to "type"
         saml2_config_dict = self._default_saml_config_dict(
-            *self.saml2_user_mapping_provider_class.get_saml_attributes(
+            *self.saml2_user_mapping_provider_class.get_saml_attributes(  # type: ignore[attr-defined]
                 self.saml2_user_mapping_provider_config
             )
         )
@@ -191,7 +194,7 @@ class SAML2Config(Config):
         )
 
     def _default_saml_config_dict(
-        self, required_attributes: Set[str], optional_attributes: Set[str]
+        self, required_attributes: set[str], optional_attributes: set[str]
     ) -> JsonDict:
         """Generate a configuration dictionary with required and optional attributes that
         will be needed to process new user registration
@@ -239,7 +242,7 @@ ATTRIBUTE_REQUIREMENTS_SCHEMA = {
 
 def _parse_attribute_requirements_def(
     attribute_requirements: Any,
-) -> List[SsoAttributeRequirement]:
+) -> list[SsoAttributeRequirement]:
     validate_config(
         ATTRIBUTE_REQUIREMENTS_SCHEMA,
         attribute_requirements,
diff --git a/synapse/config/server.py b/synapse/config/server.py
index e15bceb296..ca94c224ea 100644
--- a/synapse/config/server.py
+++ b/synapse/config/server.py
@@ -25,7 +25,7 @@ import logging
 import os.path
 import urllib.parse
 from textwrap import indent
-from typing import Any, Dict, Iterable, List, Optional, Set, Tuple, TypedDict, Union
+from typing import Any, Iterable, TypedDict
 from urllib.request import getproxies_environment
 
 import attr
@@ -95,9 +95,9 @@ def _6to4(network: IPNetwork) -> IPNetwork:
 
 
 def generate_ip_set(
-    ip_addresses: Optional[Iterable[str]],
-    extra_addresses: Optional[Iterable[str]] = None,
-    config_path: Optional[StrSequence] = None,
+    ip_addresses: Iterable[str] | None,
+    extra_addresses: Iterable[str] | None = None,
+    config_path: StrSequence | None = None,
 ) -> IPSet:
     """
     Generate an IPSet from a list of IP addresses or CIDRs.
@@ -213,7 +213,7 @@ KNOWN_RESOURCES = {
 
 @attr.s(frozen=True)
 class HttpResourceConfig:
-    names: List[str] = attr.ib(
+    names: list[str] = attr.ib(
         factory=list,
         validator=attr.validators.deep_iterable(attr.validators.in_(KNOWN_RESOURCES)),
     )
@@ -228,10 +228,10 @@ class HttpListenerConfig:
     """Object describing the http-specific parts of the config of a listener"""
 
     x_forwarded: bool = False
-    resources: List[HttpResourceConfig] = attr.Factory(list)
-    additional_resources: Dict[str, dict] = attr.Factory(dict)
-    tag: Optional[str] = None
-    request_id_header: Optional[str] = None
+    resources: list[HttpResourceConfig] = attr.Factory(list)
+    additional_resources: dict[str, dict] = attr.Factory(dict)
+    tag: str | None = None
+    request_id_header: str | None = None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -239,12 +239,12 @@ class TCPListenerConfig:
     """Object describing the configuration of a single TCP listener."""
 
     port: int = attr.ib(validator=attr.validators.instance_of(int))
-    bind_addresses: List[str] = attr.ib(validator=attr.validators.instance_of(List))
+    bind_addresses: list[str] = attr.ib(validator=attr.validators.instance_of(list))
     type: str = attr.ib(validator=attr.validators.in_(KNOWN_LISTENER_TYPES))
     tls: bool = False
 
     # http_options is only populated if type=http
-    http_options: Optional[HttpListenerConfig] = None
+    http_options: HttpListenerConfig | None = None
 
     def get_site_tag(self) -> str:
         """Retrieves http_options.tag if it exists, otherwise the port number."""
@@ -269,7 +269,7 @@ class UnixListenerConfig:
     type: str = attr.ib(validator=attr.validators.in_(KNOWN_LISTENER_TYPES))
 
     # http_options is only populated if type=http
-    http_options: Optional[HttpListenerConfig] = None
+    http_options: HttpListenerConfig | None = None
 
     def get_site_tag(self) -> str:
         return "unix"
@@ -279,7 +279,7 @@ class UnixListenerConfig:
         return False
 
 
-ListenerConfig = Union[TCPListenerConfig, UnixListenerConfig]
+ListenerConfig = TCPListenerConfig | UnixListenerConfig
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -288,14 +288,14 @@ class ManholeConfig:
 
     username: str = attr.ib(validator=attr.validators.instance_of(str))
     password: str = attr.ib(validator=attr.validators.instance_of(str))
-    priv_key: Optional[Key]
-    pub_key: Optional[Key]
+    priv_key: Key | None
+    pub_key: Key | None
 
 
 @attr.s(frozen=True)
 class LimitRemoteRoomsConfig:
     enabled: bool = attr.ib(validator=attr.validators.instance_of(bool), default=False)
-    complexity: Union[float, int] = attr.ib(
+    complexity: float | int = attr.ib(
         validator=attr.validators.instance_of((float, int)),  # noqa
         default=1.0,
     )
@@ -313,11 +313,11 @@ class ProxyConfigDictionary(TypedDict):
     Dictionary of proxy settings suitable for interacting with `urllib.request` API's
     """
 
-    http: Optional[str]
+    http: str | None
     """
     Proxy server to use for HTTP requests.
     """
-    https: Optional[str]
+    https: str | None
     """
     Proxy server to use for HTTPS requests.
     """
@@ -336,15 +336,15 @@ class ProxyConfig:
     Synapse configuration for HTTP proxy settings.
     """
 
-    http_proxy: Optional[str]
+    http_proxy: str | None
     """
     Proxy server to use for HTTP requests.
     """
-    https_proxy: Optional[str]
+    https_proxy: str | None
     """
     Proxy server to use for HTTPS requests.
     """
-    no_proxy_hosts: Optional[List[str]]
+    no_proxy_hosts: list[str] | None
     """
     List of hosts, IP addresses, or IP ranges in CIDR format which should not use the
     proxy. Synapse will directly connect to these hosts.
@@ -607,7 +607,7 @@ class ServerConfig(Config):
         # before redacting them.
         redaction_retention_period = config.get("redaction_retention_period", "7d")
         if redaction_retention_period is not None:
-            self.redaction_retention_period: Optional[int] = self.parse_duration(
+            self.redaction_retention_period: int | None = self.parse_duration(
                 redaction_retention_period
             )
         else:
@@ -618,7 +618,7 @@ class ServerConfig(Config):
             "forgotten_room_retention_period", None
         )
         if forgotten_room_retention_period is not None:
-            self.forgotten_room_retention_period: Optional[int] = self.parse_duration(
+            self.forgotten_room_retention_period: int | None = self.parse_duration(
                 forgotten_room_retention_period
             )
         else:
@@ -627,7 +627,7 @@ class ServerConfig(Config):
         # How long to keep entries in the `users_ips` table.
         user_ips_max_age = config.get("user_ips_max_age", "28d")
         if user_ips_max_age is not None:
-            self.user_ips_max_age: Optional[int] = self.parse_duration(user_ips_max_age)
+            self.user_ips_max_age: int | None = self.parse_duration(user_ips_max_age)
         else:
             self.user_ips_max_age = None
 
@@ -864,11 +864,11 @@ class ServerConfig(Config):
         )
 
         # Whitelist of domain names that given next_link parameters must have
-        next_link_domain_whitelist: Optional[List[str]] = config.get(
+        next_link_domain_whitelist: list[str] | None = config.get(
             "next_link_domain_whitelist"
         )
 
-        self.next_link_domain_whitelist: Optional[Set[str]] = None
+        self.next_link_domain_whitelist: set[str] | None = None
         if next_link_domain_whitelist is not None:
             if not isinstance(next_link_domain_whitelist, list):
                 raise ConfigError("'next_link_domain_whitelist' must be a list")
@@ -880,7 +880,7 @@ class ServerConfig(Config):
         if not isinstance(templates_config, dict):
             raise ConfigError("The 'templates' section must be a dictionary")
 
-        self.custom_template_directory: Optional[str] = templates_config.get(
+        self.custom_template_directory: str | None = templates_config.get(
             "custom_template_directory"
         )
         if self.custom_template_directory is not None and not isinstance(
@@ -892,16 +892,16 @@ class ServerConfig(Config):
             config.get("use_account_validity_in_account_status") or False
         )
 
-        self.rooms_to_exclude_from_sync: List[str] = (
+        self.rooms_to_exclude_from_sync: list[str] = (
             config.get("exclude_rooms_from_sync") or []
         )
 
-        delete_stale_devices_after: Optional[str] = (
+        delete_stale_devices_after: str | None = (
             config.get("delete_stale_devices_after") or None
         )
 
         if delete_stale_devices_after is not None:
-            self.delete_stale_devices_after: Optional[int] = self.parse_duration(
+            self.delete_stale_devices_after: int | None = self.parse_duration(
                 delete_stale_devices_after
             )
         else:
@@ -910,7 +910,7 @@ class ServerConfig(Config):
         # The maximum allowed delay duration for delayed events (MSC4140).
         max_event_delay_duration = config.get("max_event_delay_duration")
         if max_event_delay_duration is not None:
-            self.max_event_delay_ms: Optional[int] = self.parse_duration(
+            self.max_event_delay_ms: int | None = self.parse_duration(
                 max_event_delay_duration
             )
             if self.max_event_delay_ms <= 0:
@@ -923,26 +923,21 @@ class ServerConfig(Config):
 
     def generate_config_section(
         self,
+        *,
         config_dir_path: str,
         data_dir_path: str,
         server_name: str,
-        open_private_ports: bool,
-        listeners: Optional[List[dict]],
+        open_private_ports: bool = False,
+        listeners: list[dict] | None = None,
         **kwargs: Any,
     ) -> str:
-        _, bind_port = parse_and_validate_server_name(server_name)
-        if bind_port is not None:
-            unsecure_port = bind_port - 400
-        else:
-            bind_port = 8448
-            unsecure_port = 8008
-
         pid_file = os.path.join(data_dir_path, "homeserver.pid")
 
-        secure_listeners = []
-        unsecure_listeners = []
+        http_bindings = "[]"
         private_addresses = ["::1", "127.0.0.1"]
         if listeners:
+            secure_listeners = []
+            unsecure_listeners = []
             for listener in listeners:
                 if listener["tls"]:
                     secure_listeners.append(listener)
@@ -957,43 +952,17 @@ class ServerConfig(Config):
 
                     unsecure_listeners.append(listener)
 
-            secure_http_bindings = indent(
-                yaml.dump(secure_listeners), " " * 10
+            # `lstrip` is used because the first line already has whitespace in the
+            # template below
+            http_bindings = indent(
+                yaml.dump(secure_listeners + unsecure_listeners), " " * 10
             ).lstrip()
 
-            unsecure_http_bindings = indent(
-                yaml.dump(unsecure_listeners), " " * 10
-            ).lstrip()
-
-        if not unsecure_listeners:
-            unsecure_http_bindings = """- port: %(unsecure_port)s
-            tls: false
-            type: http
-            x_forwarded: true""" % locals()
-
-            if not open_private_ports:
-                unsecure_http_bindings += (
-                    "\n            bind_addresses: ['::1', '127.0.0.1']"
-                )
-
-            unsecure_http_bindings += """
-
-            resources:
-              - names: [client, federation]
-                compress: false"""
-
-            if listeners:
-                unsecure_http_bindings = ""
-
-        if not secure_listeners:
-            secure_http_bindings = ""
-
         return """\
         server_name: "%(server_name)s"
         pid_file: %(pid_file)s
         listeners:
-          %(secure_http_bindings)s
-          %(unsecure_http_bindings)s
+          %(http_bindings)s
         """ % locals()
 
     def read_arguments(self, args: argparse.Namespace) -> None:
@@ -1028,7 +997,7 @@ class ServerConfig(Config):
             help="Turn on the twisted telnet manhole service on the given port.",
         )
 
-    def read_gc_intervals(self, durations: Any) -> Optional[Tuple[float, float, float]]:
+    def read_gc_intervals(self, durations: Any) -> tuple[float, float, float] | None:
         """Reads the three durations for the GC min interval option, returning seconds."""
         if durations is None:
             return None
@@ -1048,7 +1017,7 @@ class ServerConfig(Config):
 
 
 def is_threepid_reserved(
-    reserved_threepids: List[JsonDict], threepid: JsonDict
+    reserved_threepids: list[JsonDict], threepid: JsonDict
 ) -> bool:
     """Check the threepid against the reserved threepid config
     Args:
@@ -1066,8 +1035,8 @@ def is_threepid_reserved(
 
 
 def read_gc_thresholds(
-    thresholds: Optional[List[Any]],
-) -> Optional[Tuple[int, int, int]]:
+    thresholds: list[Any] | None,
+) -> tuple[int, int, int] | None:
     """Reads the three integer thresholds for garbage collection. Ensures that
     the thresholds are integers if thresholds are supplied.
     """
diff --git a/synapse/config/server_notices.py b/synapse/config/server_notices.py
index 4de2d62b54..d19e2569a1 100644
--- a/synapse/config/server_notices.py
+++ b/synapse/config/server_notices.py
@@ -18,7 +18,7 @@
 #
 #
 
-from typing import Any, Optional
+from typing import Any
 
 from synapse.types import JsonDict, UserID
 
@@ -58,12 +58,12 @@ class ServerNoticesConfig(Config):
 
     def __init__(self, *args: Any):
         super().__init__(*args)
-        self.server_notices_mxid: Optional[str] = None
-        self.server_notices_mxid_display_name: Optional[str] = None
-        self.server_notices_mxid_avatar_url: Optional[str] = None
-        self.server_notices_room_name: Optional[str] = None
-        self.server_notices_room_avatar_url: Optional[str] = None
-        self.server_notices_room_topic: Optional[str] = None
+        self.server_notices_mxid: str | None = None
+        self.server_notices_mxid_display_name: str | None = None
+        self.server_notices_mxid_avatar_url: str | None = None
+        self.server_notices_room_name: str | None = None
+        self.server_notices_room_avatar_url: str | None = None
+        self.server_notices_room_topic: str | None = None
         self.server_notices_auto_join: bool = False
 
     def read_config(self, config: JsonDict, **kwargs: Any) -> None:
diff --git a/synapse/config/spam_checker.py b/synapse/config/spam_checker.py
index 014c55d702..02d7cee88f 100644
--- a/synapse/config/spam_checker.py
+++ b/synapse/config/spam_checker.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import Any, Dict, List, Tuple
+from typing import Any
 
 from synapse.config import ConfigError
 from synapse.types import JsonDict
@@ -41,7 +41,7 @@ class SpamCheckerConfig(Config):
     section = "spamchecker"
 
     def read_config(self, config: JsonDict, **kwargs: Any) -> None:
-        self.spam_checkers: List[Tuple[Any, Dict]] = []
+        self.spam_checkers: list[tuple[Any, dict]] = []
 
         spam_checkers = config.get("spam_checker") or []
         if isinstance(spam_checkers, dict):
diff --git a/synapse/config/sso.py b/synapse/config/sso.py
index cf27a7ee13..1d08bef868 100644
--- a/synapse/config/sso.py
+++ b/synapse/config/sso.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import Any, Dict, List, Optional
+from typing import Any
 
 import attr
 
@@ -44,8 +44,8 @@ class SsoAttributeRequirement:
 
     attribute: str
     # If neither `value` nor `one_of` is given, the attribute must simply exist.
-    value: Optional[str] = None
-    one_of: Optional[List[str]] = None
+    value: str | None = None
+    one_of: list[str] | None = None
 
     JSON_SCHEMA = {
         "type": "object",
@@ -64,7 +64,7 @@ class SSOConfig(Config):
     section = "sso"
 
     def read_config(self, config: JsonDict, **kwargs: Any) -> None:
-        sso_config: Dict[str, Any] = config.get("sso") or {}
+        sso_config: dict[str, Any] = config.get("sso") or {}
 
         # The sso-specific template_dir
         self.sso_template_dir = sso_config.get("template_dir")
diff --git a/synapse/config/tls.py b/synapse/config/tls.py
index a48d81fdc3..de4d676e08 100644
--- a/synapse/config/tls.py
+++ b/synapse/config/tls.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import Any, List, Optional, Pattern
+from typing import Any, Pattern
 
 from matrix_common.regex import glob_to_regex
 
@@ -84,7 +84,7 @@ class TlsConfig(Config):
             fed_whitelist_entries = []
 
         # Support globs (*) in whitelist values
-        self.federation_certificate_verification_whitelist: List[Pattern] = []
+        self.federation_certificate_verification_whitelist: list[Pattern] = []
         for entry in fed_whitelist_entries:
             try:
                 entry_regex = glob_to_regex(entry.encode("ascii").decode("ascii"))
@@ -135,8 +135,8 @@ class TlsConfig(Config):
             "use_insecure_ssl_client_just_for_testing_do_not_use"
         )
 
-        self.tls_certificate: Optional[crypto.X509] = None
-        self.tls_private_key: Optional[crypto.PKey] = None
+        self.tls_certificate: crypto.X509 | None = None
+        self.tls_private_key: crypto.PKey | None = None
 
     def read_certificate_from_disk(self) -> None:
         """
@@ -147,8 +147,8 @@ class TlsConfig(Config):
 
     def generate_config_section(
         self,
-        tls_certificate_path: Optional[str],
-        tls_private_key_path: Optional[str],
+        tls_certificate_path: str | None,
+        tls_private_key_path: str | None,
         **kwargs: Any,
     ) -> str:
         """If the TLS paths are not specified the default will be certs in the
diff --git a/synapse/config/tracer.py b/synapse/config/tracer.py
index d31fd41082..ccfeed4d07 100644
--- a/synapse/config/tracer.py
+++ b/synapse/config/tracer.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, List, Set
+from typing import Any
 
 from synapse.types import JsonDict
 from synapse.util.check_dependencies import check_requirements
@@ -42,7 +42,7 @@ class TracerConfig(Config):
             {"sampler": {"type": "const", "param": 1}, "logging": False},
         )
 
-        self.force_tracing_for_users: Set[str] = set()
+        self.force_tracing_for_users: set[str] = set()
 
         if not self.opentracer_enabled:
             return
@@ -51,7 +51,7 @@ class TracerConfig(Config):
 
         # The tracer is enabled so sanitize the config
 
-        self.opentracer_whitelist: List[str] = opentracing_config.get(
+        self.opentracer_whitelist: list[str] = opentracing_config.get(
             "homeserver_whitelist", []
         )
         if not isinstance(self.opentracer_whitelist, list):
diff --git a/synapse/config/user_types.py b/synapse/config/user_types.py
index 2d9c9f7afb..e47713b7f4 100644
--- a/synapse/config/user_types.py
+++ b/synapse/config/user_types.py
@@ -12,7 +12,7 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 
-from typing import Any, List, Optional
+from typing import Any
 
 from synapse.api.constants import UserTypes
 from synapse.types import JsonDict
@@ -26,12 +26,10 @@ class UserTypesConfig(Config):
     def read_config(self, config: JsonDict, **kwargs: Any) -> None:
         user_types: JsonDict = config.get("user_types", {})
 
-        self.default_user_type: Optional[str] = user_types.get(
-            "default_user_type", None
-        )
-        self.extra_user_types: List[str] = user_types.get("extra_user_types", [])
+        self.default_user_type: str | None = user_types.get("default_user_type", None)
+        self.extra_user_types: list[str] = user_types.get("extra_user_types", [])
 
-        all_user_types: List[str] = []
+        all_user_types: list[str] = []
         all_user_types.extend(UserTypes.ALL_BUILTIN_USER_TYPES)
         all_user_types.extend(self.extra_user_types)
 
diff --git a/synapse/config/workers.py b/synapse/config/workers.py
index 825ba78482..996be88cb2 100644
--- a/synapse/config/workers.py
+++ b/synapse/config/workers.py
@@ -22,15 +22,15 @@
 
 import argparse
 import logging
-from typing import Any, Dict, List, Optional, Union
+from typing import Any
 
 import attr
-
-from synapse._pydantic_compat import (
+from pydantic import (
     StrictBool,
     StrictInt,
     StrictStr,
 )
+
 from synapse.config._base import (
     Config,
     ConfigError,
@@ -79,7 +79,7 @@ MAIN_PROCESS_INSTANCE_MAP_NAME = "main"
 logger = logging.getLogger(__name__)
 
 
-def _instance_to_list_converter(obj: Union[str, List[str]]) -> List[str]:
+def _instance_to_list_converter(obj: str | list[str]) -> list[str]:
     """Helper for allowing parsing a string or list of strings to a config
     option expecting a list of strings.
     """
@@ -119,7 +119,7 @@ class InstanceUnixLocationConfig(ParseModel):
         return f"{self.path}"
 
 
-InstanceLocationConfig = Union[InstanceTcpLocationConfig, InstanceUnixLocationConfig]
+InstanceLocationConfig = InstanceTcpLocationConfig | InstanceUnixLocationConfig
 
 
 @attr.s
@@ -127,7 +127,9 @@ class WriterLocations:
     """Specifies the instances that write various streams.
 
     Attributes:
-        events: The instances that write to the event and backfill streams.
+        events: The instances that write to the event, backfill and `sticky_events` streams.
+            (`sticky_events` is written to during event persistence so must be handled by the
+            same stream writers.)
         typing: The instances that write to the typing stream. Currently
             can only be a single instance.
         to_device: The instances that write to the to_device stream. Currently
@@ -142,39 +144,39 @@ class WriterLocations:
         device_lists: The instances that write to the device list stream.
     """
 
-    events: List[str] = attr.ib(
+    events: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    typing: List[str] = attr.ib(
+    typing: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    to_device: List[str] = attr.ib(
+    to_device: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    account_data: List[str] = attr.ib(
+    account_data: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    receipts: List[str] = attr.ib(
+    receipts: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    presence: List[str] = attr.ib(
+    presence: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    push_rules: List[str] = attr.ib(
+    push_rules: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    device_lists: List[str] = attr.ib(
+    device_lists: list[str] = attr.ib(
         default=[MAIN_PROCESS_INSTANCE_NAME],
         converter=_instance_to_list_converter,
     )
-    thread_subscriptions: List[str] = attr.ib(
+    thread_subscriptions: list[str] = attr.ib(
         default=["master"],
         converter=_instance_to_list_converter,
     )
@@ -190,8 +192,8 @@ class OutboundFederationRestrictedTo:
         locations: list of instance locations to connect to proxy via.
     """
 
-    instances: Optional[List[str]]
-    locations: List[InstanceLocationConfig] = attr.Factory(list)
+    instances: list[str] | None
+    locations: list[InstanceLocationConfig] = attr.Factory(list)
 
     def __contains__(self, instance: str) -> bool:
         # It feels a bit dirty to return `True` if `instances` is `None`, but it makes
@@ -246,7 +248,7 @@ class WorkerConfig(Config):
         if worker_replication_secret_path:
             if worker_replication_secret:
                 raise ConfigError(CONFLICTING_WORKER_REPLICATION_SECRET_OPTS_ERROR)
-            self.worker_replication_secret: Optional[str] = read_file(
+            self.worker_replication_secret: str | None = read_file(
                 worker_replication_secret_path, ("worker_replication_secret_path",)
             ).strip()
         else:
@@ -295,7 +297,7 @@ class WorkerConfig(Config):
         # A map from instance name to host/port of their HTTP replication endpoint.
         # Check if the main process is declared. The main process itself doesn't need
         # this data as it would never have to talk to itself.
-        instance_map: Dict[str, Any] = config.get("instance_map", {})
+        instance_map: dict[str, Any] = config.get("instance_map", {})
 
         if self.instance_name is not MAIN_PROCESS_INSTANCE_NAME:
             # TODO: The next 3 condition blocks can be deleted after some time has
@@ -341,8 +343,8 @@ class WorkerConfig(Config):
                     % MAIN_PROCESS_INSTANCE_MAP_NAME
                 )
 
-        # type-ignore: the expression `Union[A, B]` is not a Type[Union[A, B]] currently
-        self.instance_map: Dict[str, InstanceLocationConfig] = (
+        # type-ignore: the expression `A | B` is not a `type[A | B]` currently
+        self.instance_map: dict[str, InstanceLocationConfig] = (
             parse_and_validate_mapping(
                 instance_map,
                 InstanceLocationConfig,  # type: ignore[arg-type]
@@ -481,7 +483,7 @@ class WorkerConfig(Config):
 
     def _should_this_worker_perform_duty(
         self,
-        config: Dict[str, Any],
+        config: dict[str, Any],
         legacy_master_option_name: str,
         legacy_worker_app_name: str,
         new_option_name: str,
@@ -574,11 +576,11 @@ class WorkerConfig(Config):
 
     def _worker_names_performing_this_duty(
         self,
-        config: Dict[str, Any],
+        config: dict[str, Any],
         legacy_option_name: str,
         legacy_app_name: str,
         modern_instance_list_name: str,
-    ) -> List[str]:
+    ) -> list[str]:
         """
         Retrieves the names of the workers handling a given duty, by either legacy
         option or instance list.
diff --git a/synapse/crypto/event_signing.py b/synapse/crypto/event_signing.py
index c36398cec0..d13d5d04c3 100644
--- a/synapse/crypto/event_signing.py
+++ b/synapse/crypto/event_signing.py
@@ -23,7 +23,7 @@
 import collections.abc
 import hashlib
 import logging
-from typing import Any, Callable, Dict, Tuple
+from typing import Any, Callable
 
 from canonicaljson import encode_canonical_json
 from signedjson.sign import sign_json
@@ -80,8 +80,8 @@ def check_event_content_hash(
 
 
 def compute_content_hash(
-    event_dict: Dict[str, Any], hash_algorithm: Hasher
-) -> Tuple[str, bytes]:
+    event_dict: dict[str, Any], hash_algorithm: Hasher
+) -> tuple[str, bytes]:
     """Compute the content hash of an event, which is the hash of the
     unredacted event.
 
@@ -112,7 +112,7 @@ def compute_content_hash(
 
 def compute_event_reference_hash(
     event: EventBase, hash_algorithm: Hasher = hashlib.sha256
-) -> Tuple[str, bytes]:
+) -> tuple[str, bytes]:
     """Computes the event reference hash. This is the hash of the redacted
     event.
 
@@ -139,7 +139,7 @@ def compute_event_signature(
     event_dict: JsonDict,
     signature_name: str,
     signing_key: SigningKey,
-) -> Dict[str, Dict[str, str]]:
+) -> dict[str, dict[str, str]]:
     """Compute the signature of the event for the given name and key.
 
     Args:
diff --git a/synapse/crypto/keyring.py b/synapse/crypto/keyring.py
index 8c59772e56..0d4d5e0e17 100644
--- a/synapse/crypto/keyring.py
+++ b/synapse/crypto/keyring.py
@@ -21,7 +21,9 @@
 
 import abc
 import logging
-from typing import TYPE_CHECKING, Callable, Dict, Iterable, List, Optional, Tuple
+from contextlib import ExitStack
+from http import HTTPStatus
+from typing import TYPE_CHECKING, Callable, Iterable
 
 import attr
 from signedjson.key import (
@@ -59,6 +61,15 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+# List of Unpadded Base64 server signing keys that are known to be vulnerable to attack.
+# Incoming requests from homeservers using any of these keys should be refused.
+# Events containing signatures using any of these keys should be refused.
+BANNED_SERVER_SIGNING_KEYS = (
+    # ELEMENTSEC-2025-1670
+    "l/O9hxMVKB6Lg+3Hqf0FQQZhVESQcMzbPN1Cz2nM3og=",
+)
+
+
 @attr.s(slots=True, frozen=True, cmp=False, auto_attribs=True)
 class VerifyJsonRequest:
     """
@@ -82,7 +93,7 @@ class VerifyJsonRequest:
     server_name: str
     get_json_object: Callable[[], JsonDict]
     minimum_valid_until_ts: int
-    key_ids: List[str]
+    key_ids: list[str]
 
     @staticmethod
     def from_json_object(
@@ -141,7 +152,7 @@ class _FetchKeyRequest:
 
     server_name: str
     minimum_valid_until_ts: int
-    key_ids: List[str]
+    key_ids: list[str]
 
 
 class Keyring:
@@ -150,49 +161,81 @@ class Keyring:
     """
 
     def __init__(
-        self, hs: "HomeServer", key_fetchers: "Optional[Iterable[KeyFetcher]]" = None
+        self,
+        hs: "HomeServer",
+        test_only_key_fetchers: "list[KeyFetcher] | None" = None,
     ):
-        self.server_name = hs.hostname
+        """
+        Args:
+            hs: The HomeServer instance
+            test_only_key_fetchers: Dependency injection for tests only. If provided,
+                these key fetchers will be used instead of the default ones.
+        """
+        # Clean-up to avoid partial initialization leaving behind references.
+        with ExitStack() as exit:
+            self.server_name = hs.hostname
 
-        if key_fetchers is None:
-            # Always fetch keys from the database.
-            mutable_key_fetchers: List[KeyFetcher] = [StoreKeyFetcher(hs)]
-            # Fetch keys from configured trusted key servers, if any exist.
-            key_servers = hs.config.key.key_servers
-            if key_servers:
-                mutable_key_fetchers.append(PerspectivesKeyFetcher(hs))
-            # Finally, fetch keys from the origin server directly.
-            mutable_key_fetchers.append(ServerKeyFetcher(hs))
+            self._key_fetchers: list[KeyFetcher] = []
+            if test_only_key_fetchers is None:
+                # Always fetch keys from the database.
+                store_key_fetcher = StoreKeyFetcher(hs)
+                exit.callback(store_key_fetcher.shutdown)
+                self._key_fetchers.append(store_key_fetcher)
 
-            self._key_fetchers: Iterable[KeyFetcher] = tuple(mutable_key_fetchers)
-        else:
-            self._key_fetchers = key_fetchers
+                # Fetch keys from configured trusted key servers, if any exist.
+                key_servers = hs.config.key.key_servers
+                if key_servers:
+                    perspectives_key_fetcher = PerspectivesKeyFetcher(hs)
+                    exit.callback(perspectives_key_fetcher.shutdown)
+                    self._key_fetchers.append(perspectives_key_fetcher)
 
-        self._fetch_keys_queue: BatchingQueue[
-            _FetchKeyRequest, Dict[str, Dict[str, FetchKeyResult]]
-        ] = BatchingQueue(
-            name="keyring_server",
-            server_name=self.server_name,
-            clock=hs.get_clock(),
-            # The method called to fetch each key
-            process_batch_callback=self._inner_fetch_key_requests,
-        )
+                # Finally, fetch keys from the origin server directly.
+                server_key_fetcher = ServerKeyFetcher(hs)
+                exit.callback(server_key_fetcher.shutdown)
+                self._key_fetchers.append(server_key_fetcher)
+            else:
+                self._key_fetchers = test_only_key_fetchers
 
-        self._is_mine_server_name = hs.is_mine_server_name
+            self._fetch_keys_queue: BatchingQueue[
+                _FetchKeyRequest, dict[str, dict[str, FetchKeyResult]]
+            ] = BatchingQueue(
+                name="keyring_server",
+                hs=hs,
+                clock=hs.get_clock(),
+                # The method called to fetch each key
+                process_batch_callback=self._inner_fetch_key_requests,
+            )
+            exit.callback(self._fetch_keys_queue.shutdown)
 
-        # build a FetchKeyResult for each of our own keys, to shortcircuit the
-        # fetcher.
-        self._local_verify_keys: Dict[str, FetchKeyResult] = {}
-        for key_id, key in hs.config.key.old_signing_keys.items():
-            self._local_verify_keys[key_id] = FetchKeyResult(
-                verify_key=key, valid_until_ts=key.expired
+            self._is_mine_server_name = hs.is_mine_server_name
+
+            # build a FetchKeyResult for each of our own keys, to shortcircuit the
+            # fetcher.
+            self._local_verify_keys: dict[str, FetchKeyResult] = {}
+            for key_id, key in hs.config.key.old_signing_keys.items():
+                self._local_verify_keys[key_id] = FetchKeyResult(
+                    verify_key=key, valid_until_ts=key.expired
+                )
+
+            vk = get_verify_key(hs.signing_key)
+            self._local_verify_keys[f"{vk.alg}:{vk.version}"] = FetchKeyResult(
+                verify_key=vk,
+                valid_until_ts=2**63,  # fake future timestamp
             )
 
-        vk = get_verify_key(hs.signing_key)
-        self._local_verify_keys[f"{vk.alg}:{vk.version}"] = FetchKeyResult(
-            verify_key=vk,
-            valid_until_ts=2**63,  # fake future timestamp
-        )
+            # We reached the end of the block which means everything was successful, so
+            # no exit handlers are needed (remove them all).
+            exit.pop_all()
+
+    def shutdown(self) -> None:
+        """
+        Prepares the KeyRing for garbage collection by shutting down it's queues.
+        """
+        self._fetch_keys_queue.shutdown()
+
+        for key_fetcher in self._key_fetchers:
+            key_fetcher.shutdown()
+        self._key_fetchers.clear()
 
     async def verify_json_for_server(
         self,
@@ -221,8 +264,8 @@ class Keyring:
         return await self.process_request(request)
 
     def verify_json_objects_for_server(
-        self, server_and_json: Iterable[Tuple[str, dict, int]]
-    ) -> List["defer.Deferred[None]"]:
+        self, server_and_json: Iterable[tuple[str, dict, int]]
+    ) -> list["defer.Deferred[None]"]:
         """Bulk verifies signatures of json objects, bulk fetching keys as
         necessary.
 
@@ -278,7 +321,7 @@ class Keyring:
                 Codes.UNAUTHORIZED,
             )
 
-        found_keys: Dict[str, FetchKeyResult] = {}
+        found_keys: dict[str, FetchKeyResult] = {}
 
         # If we are the originating server, short-circuit the key-fetch for any keys
         # we already have
@@ -316,7 +359,20 @@ class Keyring:
             if key_result.valid_until_ts < verify_request.minimum_valid_until_ts:
                 continue
 
-            await self._process_json(key_result.verify_key, verify_request)
+            key = encode_verify_key_base64(key_result.verify_key)
+            if key in BANNED_SERVER_SIGNING_KEYS:
+                raise SynapseError(
+                    HTTPStatus.UNAUTHORIZED,
+                    "Server signing key %s:%s for server %s has been banned by this server"
+                    % (
+                        key_result.verify_key.alg,
+                        key_result.verify_key.version,
+                        verify_request.server_name,
+                    ),
+                    Codes.UNAUTHORIZED,
+                )
+
+            await self.process_json(key_result.verify_key, verify_request)
             verified = True
 
         if not verified:
@@ -326,7 +382,7 @@ class Keyring:
                 Codes.UNAUTHORIZED,
             )
 
-    async def _process_json(
+    async def process_json(
         self, verify_key: VerifyKey, verify_request: VerifyJsonRequest
     ) -> None:
         """Processes the `VerifyJsonRequest`. Raises if the signature can't be
@@ -360,8 +416,8 @@ class Keyring:
             )
 
     async def _inner_fetch_key_requests(
-        self, requests: List[_FetchKeyRequest]
-    ) -> Dict[str, Dict[str, FetchKeyResult]]:
+        self, requests: list[_FetchKeyRequest]
+    ) -> dict[str, dict[str, FetchKeyResult]]:
         """Processing function for the queue of `_FetchKeyRequest`.
 
         Takes a list of key fetch requests, de-duplicates them and then carries out
@@ -379,7 +435,7 @@ class Keyring:
         # First we need to deduplicate requests for the same key. We do this by
         # taking the *maximum* requested `minimum_valid_until_ts` for each pair
         # of server name/key ID.
-        server_to_key_to_ts: Dict[str, Dict[str, int]] = {}
+        server_to_key_to_ts: dict[str, dict[str, int]] = {}
         for request in requests:
             by_server = server_to_key_to_ts.setdefault(request.server_name, {})
             for key_id in request.key_ids:
@@ -404,7 +460,7 @@ class Keyring:
 
         # We now convert the returned list of results into a map from server
         # name to key ID to FetchKeyResult, to return.
-        to_return: Dict[str, Dict[str, FetchKeyResult]] = {}
+        to_return: dict[str, dict[str, FetchKeyResult]] = {}
         for request, results in zip(deduped_requests, results_per_request):
             to_return_by_server = to_return.setdefault(request.server_name, {})
             for key_id, key_result in results.items():
@@ -416,7 +472,7 @@ class Keyring:
 
     async def _inner_fetch_key_request(
         self, verify_request: _FetchKeyRequest
-    ) -> Dict[str, FetchKeyResult]:
+    ) -> dict[str, FetchKeyResult]:
         """Attempt to fetch the given key by calling each key fetcher one by one.
 
         If a key is found, check whether its `valid_until_ts` attribute satisfies the
@@ -437,7 +493,7 @@ class Keyring:
         """
         logger.debug("Starting fetch for %s", verify_request)
 
-        found_keys: Dict[str, FetchKeyResult] = {}
+        found_keys: dict[str, FetchKeyResult] = {}
         missing_key_ids = set(verify_request.key_ids)
 
         for fetcher in self._key_fetchers:
@@ -479,14 +535,20 @@ class KeyFetcher(metaclass=abc.ABCMeta):
         self.server_name = hs.hostname
         self._queue = BatchingQueue(
             name=self.__class__.__name__,
-            server_name=self.server_name,
+            hs=hs,
             clock=hs.get_clock(),
             process_batch_callback=self._fetch_keys,
         )
 
+    def shutdown(self) -> None:
+        """
+        Prepares the KeyFetcher for garbage collection by shutting down it's queue.
+        """
+        self._queue.shutdown()
+
     async def get_keys(
-        self, server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-    ) -> Dict[str, FetchKeyResult]:
+        self, server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+    ) -> dict[str, FetchKeyResult]:
         results = await self._queue.add_to_queue(
             _FetchKeyRequest(
                 server_name=server_name,
@@ -498,8 +560,8 @@ class KeyFetcher(metaclass=abc.ABCMeta):
 
     @abc.abstractmethod
     async def _fetch_keys(
-        self, keys_to_fetch: List[_FetchKeyRequest]
-    ) -> Dict[str, Dict[str, FetchKeyResult]]:
+        self, keys_to_fetch: list[_FetchKeyRequest]
+    ) -> dict[str, dict[str, FetchKeyResult]]:
         pass
 
 
@@ -507,13 +569,25 @@ class StoreKeyFetcher(KeyFetcher):
     """KeyFetcher impl which fetches keys from our data store"""
 
     def __init__(self, hs: "HomeServer"):
-        super().__init__(hs)
+        # Clean-up to avoid partial initialization leaving behind references.
+        with ExitStack() as exit:
+            super().__init__(hs)
+            # `KeyFetcher` keeps a reference to `hs` which we need to clean up if
+            # something goes wrong so we can cleanly shutdown the homeserver.
+            exit.callback(super().shutdown)
 
-        self.store = hs.get_datastores().main
+            # An error can be raised here if someone tried to create a `StoreKeyFetcher`
+            # before the homeserver is fully set up (`HomeServerNotSetupException:
+            # HomeServer.setup must be called before getting datastores`).
+            self.store = hs.get_datastores().main
+
+            # We reached the end of the block which means everything was successful, so
+            # no exit handlers are needed (remove them all).
+            exit.pop_all()
 
     async def _fetch_keys(
-        self, keys_to_fetch: List[_FetchKeyRequest]
-    ) -> Dict[str, Dict[str, FetchKeyResult]]:
+        self, keys_to_fetch: list[_FetchKeyRequest]
+    ) -> dict[str, dict[str, FetchKeyResult]]:
         key_ids_to_fetch = (
             (queue_value.server_name, key_id)
             for queue_value in keys_to_fetch
@@ -521,7 +595,7 @@ class StoreKeyFetcher(KeyFetcher):
         )
 
         res = await self.store.get_server_keys_json(key_ids_to_fetch)
-        keys: Dict[str, Dict[str, FetchKeyResult]] = {}
+        keys: dict[str, dict[str, FetchKeyResult]] = {}
         for (server_name, key_id), key in res.items():
             keys.setdefault(server_name, {})[key_id] = key
         return keys
@@ -529,13 +603,25 @@ class StoreKeyFetcher(KeyFetcher):
 
 class BaseV2KeyFetcher(KeyFetcher):
     def __init__(self, hs: "HomeServer"):
-        super().__init__(hs)
+        # Clean-up to avoid partial initialization leaving behind references.
+        with ExitStack() as exit:
+            super().__init__(hs)
+            # `KeyFetcher` keeps a reference to `hs` which we need to clean up if
+            # something goes wrong so we can cleanly shutdown the homeserver.
+            exit.callback(super().shutdown)
 
-        self.store = hs.get_datastores().main
+            # An error can be raised here if someone tried to create a `StoreKeyFetcher`
+            # before the homeserver is fully set up (`HomeServerNotSetupException:
+            # HomeServer.setup must be called before getting datastores`).
+            self.store = hs.get_datastores().main
+
+            # We reached the end of the block which means everything was successful, so
+            # no exit handlers are needed (remove them all).
+            exit.pop_all()
 
     async def process_v2_response(
         self, from_server: str, response_json: JsonDict, time_added_ms: int
-    ) -> Dict[str, FetchKeyResult]:
+    ) -> dict[str, FetchKeyResult]:
         """Parse a 'Server Keys' structure from the result of a /key request
 
         This is used to parse either the entirety of the response from
@@ -626,11 +712,11 @@ class PerspectivesKeyFetcher(BaseV2KeyFetcher):
         self.key_servers = hs.config.key.key_servers
 
     async def _fetch_keys(
-        self, keys_to_fetch: List[_FetchKeyRequest]
-    ) -> Dict[str, Dict[str, FetchKeyResult]]:
+        self, keys_to_fetch: list[_FetchKeyRequest]
+    ) -> dict[str, dict[str, FetchKeyResult]]:
         """see KeyFetcher._fetch_keys"""
 
-        async def get_key(key_server: TrustedKeyServer) -> Dict:
+        async def get_key(key_server: TrustedKeyServer) -> dict:
             try:
                 return await self.get_server_verify_key_v2_indirect(
                     keys_to_fetch, key_server
@@ -656,7 +742,7 @@ class PerspectivesKeyFetcher(BaseV2KeyFetcher):
             ).addErrback(unwrapFirstError)
         )
 
-        union_of_keys: Dict[str, Dict[str, FetchKeyResult]] = {}
+        union_of_keys: dict[str, dict[str, FetchKeyResult]] = {}
         for result in results:
             for server_name, keys in result.items():
                 union_of_keys.setdefault(server_name, {}).update(keys)
@@ -664,8 +750,8 @@ class PerspectivesKeyFetcher(BaseV2KeyFetcher):
         return union_of_keys
 
     async def get_server_verify_key_v2_indirect(
-        self, keys_to_fetch: List[_FetchKeyRequest], key_server: TrustedKeyServer
-    ) -> Dict[str, Dict[str, FetchKeyResult]]:
+        self, keys_to_fetch: list[_FetchKeyRequest], key_server: TrustedKeyServer
+    ) -> dict[str, dict[str, FetchKeyResult]]:
         """
         Args:
             keys_to_fetch:
@@ -717,8 +803,8 @@ class PerspectivesKeyFetcher(BaseV2KeyFetcher):
             "Response from notary server %s: %s", perspective_name, query_response
         )
 
-        keys: Dict[str, Dict[str, FetchKeyResult]] = {}
-        added_keys: Dict[Tuple[str, str], FetchKeyResult] = {}
+        keys: dict[str, dict[str, FetchKeyResult]] = {}
+        added_keys: dict[tuple[str, str], FetchKeyResult] = {}
 
         time_now_ms = self.clock.time_msec()
 
@@ -822,8 +908,8 @@ class ServerKeyFetcher(BaseV2KeyFetcher):
         self.client = hs.get_federation_http_client()
 
     async def get_keys(
-        self, server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-    ) -> Dict[str, FetchKeyResult]:
+        self, server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+    ) -> dict[str, FetchKeyResult]:
         results = await self._queue.add_to_queue(
             _FetchKeyRequest(
                 server_name=server_name,
@@ -835,8 +921,8 @@ class ServerKeyFetcher(BaseV2KeyFetcher):
         return results.get(server_name, {})
 
     async def _fetch_keys(
-        self, keys_to_fetch: List[_FetchKeyRequest]
-    ) -> Dict[str, Dict[str, FetchKeyResult]]:
+        self, keys_to_fetch: list[_FetchKeyRequest]
+    ) -> dict[str, dict[str, FetchKeyResult]]:
         """
         Args:
             keys_to_fetch:
@@ -865,7 +951,7 @@ class ServerKeyFetcher(BaseV2KeyFetcher):
 
     async def get_server_verify_keys_v2_direct(
         self, server_name: str
-    ) -> Dict[str, FetchKeyResult]:
+    ) -> dict[str, FetchKeyResult]:
         """
 
         Args:
diff --git a/synapse/event_auth.py b/synapse/event_auth.py
index 64de3f7ef8..f39f55b472 100644
--- a/synapse/event_auth.py
+++ b/synapse/event_auth.py
@@ -20,21 +20,18 @@
 #
 #
 
+import collections
 import collections.abc
 import logging
 import typing
+from collections import ChainMap
 from typing import (
     Any,
-    ChainMap,
-    Dict,
     Iterable,
-    List,
     Mapping,
     MutableMapping,
     Optional,
     Protocol,
-    Set,
-    Tuple,
     Union,
     cast,
 )
@@ -63,13 +60,13 @@ from synapse.api.room_versions import (
     KNOWN_ROOM_VERSIONS,
     EventFormatVersions,
     RoomVersion,
-    RoomVersions,
 )
 from synapse.events import is_creator
 from synapse.state import CREATE_KEY
 from synapse.storage.databases.main.events_worker import EventRedactBehaviour
 from synapse.types import (
     MutableStateMap,
+    StateKey,
     StateMap,
     StrCollection,
     UserID,
@@ -91,7 +88,7 @@ class _EventSourceStore(Protocol):
         redact_behaviour: EventRedactBehaviour,
         get_prev_content: bool = False,
         allow_rejected: bool = False,
-    ) -> Dict[str, "EventBase"]: ...
+    ) -> dict[str, "EventBase"]: ...
 
 
 def validate_event_for_room_version(event: "EventBase") -> None:
@@ -164,7 +161,7 @@ def validate_event_for_room_version(event: "EventBase") -> None:
 async def check_state_independent_auth_rules(
     store: _EventSourceStore,
     event: "EventBase",
-    batched_auth_events: Optional[Mapping[str, "EventBase"]] = None,
+    batched_auth_events: Mapping[str, "EventBase"] | None = None,
 ) -> None:
     """Check that an event complies with auth rules that are independent of room state
 
@@ -385,25 +382,6 @@ def check_state_dependent_auth_rules(
     logger.debug("Allowing! %s", event)
 
 
-# Set of room versions where Synapse did not apply event key size limits
-# in bytes, but rather in codepoints.
-# In these room versions, we are more lenient with event size validation.
-LENIENT_EVENT_BYTE_LIMITS_ROOM_VERSIONS = {
-    RoomVersions.V1,
-    RoomVersions.V2,
-    RoomVersions.V3,
-    RoomVersions.V4,
-    RoomVersions.V5,
-    RoomVersions.V6,
-    RoomVersions.V7,
-    RoomVersions.V8,
-    RoomVersions.V9,
-    RoomVersions.V10,
-    RoomVersions.MSC1767v10,
-    RoomVersions.MSC3757v10,
-}
-
-
 def _check_size_limits(event: "EventBase") -> None:
     """
     Checks the size limits in a PDU.
@@ -442,9 +420,7 @@ def _check_size_limits(event: "EventBase") -> None:
     if len(event.event_id) > 255:
         raise EventSizeError("'event_id' too large", unpersistable=True)
 
-    strict_byte_limits = (
-        event.room_version not in LENIENT_EVENT_BYTE_LIMITS_ROOM_VERSIONS
-    )
+    strict_byte_limits = event.room_version.strict_event_byte_limits_room_versions
 
     # Byte size check: if these fail, then be lenient to avoid breaking rooms.
     if len(event.user_id.encode("utf-8")) > 255:
@@ -792,7 +768,7 @@ def _check_joined_room(
 
 
 def get_send_level(
-    etype: str, state_key: Optional[str], power_levels_event: Optional["EventBase"]
+    etype: str, state_key: str | None, power_levels_event: Optional["EventBase"]
 ) -> int:
     """Get the power level required to send an event of a given type
 
@@ -993,7 +969,7 @@ def _check_power_levels(
     user_level = get_user_power_level(event.user_id, auth_events)
 
     # Check other levels:
-    levels_to_check: List[Tuple[str, Optional[str]]] = [
+    levels_to_check: list[tuple[str, str | None]] = [
         ("users_default", None),
         ("events_default", None),
         ("state_default", None),
@@ -1031,12 +1007,12 @@ def _check_power_levels(
             new_loc = new_loc.get(dir, {})
 
         if level_to_check in old_loc:
-            old_level: Optional[int] = int(old_loc[level_to_check])
+            old_level: int | None = int(old_loc[level_to_check])
         else:
             old_level = None
 
         if level_to_check in new_loc:
-            new_level: Optional[int] = int(new_loc[level_to_check])
+            new_level: int | None = int(new_loc[level_to_check])
         else:
             new_level = None
 
@@ -1191,7 +1167,7 @@ def _verify_third_party_invite(
     return False
 
 
-def get_public_keys(invite_event: "EventBase") -> List[Dict[str, Any]]:
+def get_public_keys(invite_event: "EventBase") -> list[dict[str, Any]]:
     public_keys = []
     if "public_key" in invite_event.content:
         o = {"public_key": invite_event.content["public_key"]}
@@ -1204,8 +1180,8 @@ def get_public_keys(invite_event: "EventBase") -> List[Dict[str, Any]]:
 
 def auth_types_for_event(
     room_version: RoomVersion, event: Union["EventBase", "EventBuilder"]
-) -> Set[Tuple[str, str]]:
-    """Given an event, return a list of (EventType, StateKey) that may be
+) -> set[StateKey]:
+    """Given an event, return a list of (state event type, state key) that may be
     needed to auth the event. The returned list may be a superset of what
     would actually be required depending on the full state of the room.
 
diff --git a/synapse/events/__init__.py b/synapse/events/__init__.py
index db38754280..e6162997dd 100644
--- a/synapse/events/__init__.py
+++ b/synapse/events/__init__.py
@@ -25,14 +25,9 @@ import collections.abc
 from typing import (
     TYPE_CHECKING,
     Any,
-    Dict,
     Generic,
     Iterable,
-    List,
     Literal,
-    Optional,
-    Tuple,
-    Type,
     TypeVar,
     Union,
     overload,
@@ -41,7 +36,12 @@ from typing import (
 import attr
 from unpaddedbase64 import encode_base64
 
-from synapse.api.constants import EventContentFields, EventTypes, RelationTypes
+from synapse.api.constants import (
+    EventContentFields,
+    EventTypes,
+    RelationTypes,
+    StickyEvent,
+)
 from synapse.api.room_versions import EventFormatVersions, RoomVersion, RoomVersions
 from synapse.synapse_rust.events import EventInternalMetadata
 from synapse.types import (
@@ -49,6 +49,7 @@ from synapse.types import (
     StrCollection,
 )
 from synapse.util.caches import intern_dict
+from synapse.util.duration import Duration
 from synapse.util.frozenutils import freeze
 
 if TYPE_CHECKING:
@@ -94,21 +95,21 @@ class DictProperty(Generic[T]):
     def __get__(
         self,
         instance: Literal[None],
-        owner: Optional[Type[_DictPropertyInstance]] = None,
+        owner: type[_DictPropertyInstance] | None = None,
     ) -> "DictProperty": ...
 
     @overload
     def __get__(
         self,
         instance: _DictPropertyInstance,
-        owner: Optional[Type[_DictPropertyInstance]] = None,
+        owner: type[_DictPropertyInstance] | None = None,
     ) -> T: ...
 
     def __get__(
         self,
-        instance: Optional[_DictPropertyInstance],
-        owner: Optional[Type[_DictPropertyInstance]] = None,
-    ) -> Union[T, "DictProperty"]:
+        instance: _DictPropertyInstance | None,
+        owner: type[_DictPropertyInstance] | None = None,
+    ) -> T | "DictProperty":
         # if the property is accessed as a class property rather than an instance
         # property, return the property itself rather than the value
         if instance is None:
@@ -160,21 +161,21 @@ class DefaultDictProperty(DictProperty, Generic[T]):
     def __get__(
         self,
         instance: Literal[None],
-        owner: Optional[Type[_DictPropertyInstance]] = None,
+        owner: type[_DictPropertyInstance] | None = None,
     ) -> "DefaultDictProperty": ...
 
     @overload
     def __get__(
         self,
         instance: _DictPropertyInstance,
-        owner: Optional[Type[_DictPropertyInstance]] = None,
+        owner: type[_DictPropertyInstance] | None = None,
     ) -> T: ...
 
     def __get__(
         self,
-        instance: Optional[_DictPropertyInstance],
-        owner: Optional[Type[_DictPropertyInstance]] = None,
-    ) -> Union[T, "DefaultDictProperty"]:
+        instance: _DictPropertyInstance | None,
+        owner: type[_DictPropertyInstance] | None = None,
+    ) -> T | "DefaultDictProperty":
         if instance is None:
             return self
         assert isinstance(instance, EventBase)
@@ -192,10 +193,10 @@ class EventBase(metaclass=abc.ABCMeta):
         self,
         event_dict: JsonDict,
         room_version: RoomVersion,
-        signatures: Dict[str, Dict[str, str]],
+        signatures: dict[str, dict[str, str]],
         unsigned: JsonDict,
         internal_metadata_dict: JsonDict,
-        rejected_reason: Optional[str],
+        rejected_reason: str | None,
     ):
         assert room_version.event_format == self.format_version
 
@@ -210,10 +211,10 @@ class EventBase(metaclass=abc.ABCMeta):
 
     depth: DictProperty[int] = DictProperty("depth")
     content: DictProperty[JsonDict] = DictProperty("content")
-    hashes: DictProperty[Dict[str, str]] = DictProperty("hashes")
+    hashes: DictProperty[dict[str, str]] = DictProperty("hashes")
     origin_server_ts: DictProperty[int] = DictProperty("origin_server_ts")
     sender: DictProperty[str] = DictProperty("sender")
-    # TODO state_key should be Optional[str]. This is generally asserted in Synapse
+    # TODO state_key should be str | None. This is generally asserted in Synapse
     # by calling is_state() first (which ensures it is not None), but it is hard (not possible?)
     # to properly annotate that calling is_state() asserts that state_key exists
     # and is non-None. It would be better to replace such direct references with
@@ -235,7 +236,7 @@ class EventBase(metaclass=abc.ABCMeta):
         return self.content["membership"]
 
     @property
-    def redacts(self) -> Optional[str]:
+    def redacts(self) -> str | None:
         """MSC2176 moved the redacts field into the content."""
         if self.room_version.updated_redaction_rules:
             return self.content.get("redacts")
@@ -244,7 +245,7 @@ class EventBase(metaclass=abc.ABCMeta):
     def is_state(self) -> bool:
         return self.get_state_key() is not None
 
-    def get_state_key(self) -> Optional[str]:
+    def get_state_key(self) -> str | None:
         """Get the state key of this event, or None if it's not a state event"""
         return self._dict.get("state_key")
 
@@ -254,13 +255,13 @@ class EventBase(metaclass=abc.ABCMeta):
 
         return d
 
-    def get(self, key: str, default: Optional[Any] = None) -> Any:
+    def get(self, key: str, default: Any | None = None) -> Any:
         return self._dict.get(key, default)
 
     def get_internal_metadata_dict(self) -> JsonDict:
         return self.internal_metadata.get_dict()
 
-    def get_pdu_json(self, time_now: Optional[int] = None) -> JsonDict:
+    def get_pdu_json(self, time_now: int | None = None) -> JsonDict:
         pdu_json = self.get_dict()
 
         if time_now is not None and "age_ts" in pdu_json["unsigned"]:
@@ -287,19 +288,19 @@ class EventBase(metaclass=abc.ABCMeta):
 
         return template_json
 
-    def __getitem__(self, field: str) -> Optional[Any]:
+    def __getitem__(self, field: str) -> Any | None:
         return self._dict[field]
 
     def __contains__(self, field: str) -> bool:
         return field in self._dict
 
-    def items(self) -> List[Tuple[str, Optional[Any]]]:
+    def items(self) -> list[tuple[str, Any | None]]:
         return list(self._dict.items())
 
     def keys(self) -> Iterable[str]:
         return self._dict.keys()
 
-    def prev_event_ids(self) -> List[str]:
+    def prev_event_ids(self) -> list[str]:
         """Returns the list of prev event IDs. The order matches the order
         specified in the event, though there is no meaning to it.
 
@@ -323,6 +324,28 @@ class EventBase(metaclass=abc.ABCMeta):
         # this will be a no-op if the event dict is already frozen.
         self._dict = freeze(self._dict)
 
+    def sticky_duration(self) -> Duration | None:
+        """
+        Returns the effective sticky duration of this event, or None
+        if the event does not have a sticky duration.
+        (Sticky Events are a MSC4354 feature.)
+
+        Clamps the sticky duration to the maximum allowed duration.
+        """
+        sticky_obj = self.get_dict().get(StickyEvent.EVENT_FIELD_NAME, None)
+        if type(sticky_obj) is not dict:
+            return None
+        sticky_duration_ms = sticky_obj.get("duration_ms", None)
+        # MSC: Clamp to 0 and MAX_DURATION (1 hour)
+        # We use `type(...) is int` to avoid accepting bools as `isinstance(True, int)`
+        # (bool is a subclass of int)
+        if type(sticky_duration_ms) is int and sticky_duration_ms >= 0:
+            return min(
+                Duration(milliseconds=sticky_duration_ms),
+                StickyEvent.MAX_DURATION,
+            )
+        return None
+
     def __str__(self) -> str:
         return self.__repr__()
 
@@ -352,8 +375,8 @@ class FrozenEvent(EventBase):
         self,
         event_dict: JsonDict,
         room_version: RoomVersion,
-        internal_metadata_dict: Optional[JsonDict] = None,
-        rejected_reason: Optional[str] = None,
+        internal_metadata_dict: JsonDict | None = None,
+        rejected_reason: str | None = None,
     ):
         internal_metadata_dict = internal_metadata_dict or {}
 
@@ -404,8 +427,8 @@ class FrozenEventV2(EventBase):
         self,
         event_dict: JsonDict,
         room_version: RoomVersion,
-        internal_metadata_dict: Optional[JsonDict] = None,
-        rejected_reason: Optional[str] = None,
+        internal_metadata_dict: JsonDict | None = None,
+        rejected_reason: str | None = None,
     ):
         internal_metadata_dict = internal_metadata_dict or {}
 
@@ -431,7 +454,7 @@ class FrozenEventV2(EventBase):
         else:
             frozen_dict = event_dict
 
-        self._event_id: Optional[str] = None
+        self._event_id: str | None = None
 
         super().__init__(
             frozen_dict,
@@ -457,7 +480,7 @@ class FrozenEventV2(EventBase):
     def room_id(self) -> str:
         return self._dict["room_id"]
 
-    def prev_event_ids(self) -> List[str]:
+    def prev_event_ids(self) -> list[str]:
         """Returns the list of prev event IDs. The order matches the order
         specified in the event, though there is no meaning to it.
 
@@ -506,8 +529,8 @@ class FrozenEventV4(FrozenEventV3):
         self,
         event_dict: JsonDict,
         room_version: RoomVersion,
-        internal_metadata_dict: Optional[JsonDict] = None,
-        rejected_reason: Optional[str] = None,
+        internal_metadata_dict: JsonDict | None = None,
+        rejected_reason: str | None = None,
     ):
         super().__init__(
             event_dict=event_dict,
@@ -515,7 +538,7 @@ class FrozenEventV4(FrozenEventV3):
             internal_metadata_dict=internal_metadata_dict,
             rejected_reason=rejected_reason,
         )
-        self._room_id: Optional[str] = None
+        self._room_id: str | None = None
 
     @property
     def room_id(self) -> str:
@@ -553,12 +576,12 @@ class FrozenEventV4(FrozenEventV3):
         assert create_event_id not in self._dict["auth_events"]
         if self.type == EventTypes.Create and self.get_state_key() == "":
             return self._dict["auth_events"]  # should be []
-        return self._dict["auth_events"] + [create_event_id]
+        return [*self._dict["auth_events"], create_event_id]
 
 
 def _event_type_from_format_version(
     format_version: int,
-) -> Type[Union[FrozenEvent, FrozenEventV2, FrozenEventV3]]:
+) -> type[FrozenEvent | FrozenEventV2 | FrozenEventV3]:
     """Returns the python type to use to construct an Event object for the
     given event format version.
 
@@ -584,8 +607,8 @@ def _event_type_from_format_version(
 def make_event_from_dict(
     event_dict: JsonDict,
     room_version: RoomVersion = RoomVersions.V1,
-    internal_metadata_dict: Optional[JsonDict] = None,
-    rejected_reason: Optional[str] = None,
+    internal_metadata_dict: JsonDict | None = None,
+    rejected_reason: str | None = None,
 ) -> EventBase:
     """Construct an EventBase from the given event dict"""
     event_type = _event_type_from_format_version(room_version.event_format)
@@ -602,10 +625,10 @@ class _EventRelation:
     rel_type: str
     # The aggregation key. Will be None if the rel_type is not m.annotation or is
     # not a string.
-    aggregation_key: Optional[str]
+    aggregation_key: str | None
 
 
-def relation_from_event(event: EventBase) -> Optional[_EventRelation]:
+def relation_from_event(event: EventBase) -> _EventRelation | None:
     """
     Attempt to parse relation information an event.
 
@@ -669,4 +692,4 @@ class StrippedStateEvent:
     type: str
     state_key: str
     sender: str
-    content: Dict[str, Any]
+    content: dict[str, Any]
diff --git a/synapse/events/auto_accept_invites.py b/synapse/events/auto_accept_invites.py
index 6873ee9d31..4c59f0dffe 100644
--- a/synapse/events/auto_accept_invites.py
+++ b/synapse/events/auto_accept_invites.py
@@ -20,7 +20,7 @@
 #
 import logging
 from http import HTTPStatus
-from typing import Any, Dict, Tuple
+from typing import Any
 
 from synapse.api.constants import AccountDataTypes, EventTypes, Membership
 from synapse.api.errors import SynapseError
@@ -119,7 +119,6 @@ class InviteAutoAccepter:
             event.state_key,
             event.room_id,
             "join",
-            bg_start_span=False,
         )
 
         if is_direct_message:
@@ -147,7 +146,7 @@ class InviteAutoAccepter:
         # Be careful: we convert the outer frozendict into a dict here,
         # but the contents of the dict are still frozen (tuples in lieu of lists,
         # etc.)
-        dm_map: Dict[str, Tuple[str, ...]] = dict(
+        dm_map: dict[str, tuple[str, ...]] = dict(
             await self._api.account_data_manager.get_global(
                 user_id, AccountDataTypes.DIRECT
             )
diff --git a/synapse/events/builder.py b/synapse/events/builder.py
index 5e1913d389..2cd1bf6106 100644
--- a/synapse/events/builder.py
+++ b/synapse/events/builder.py
@@ -19,12 +19,12 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+from typing import TYPE_CHECKING, Any
 
 import attr
 from signedjson.types import SigningKey
 
-from synapse.api.constants import MAX_DEPTH, EventTypes
+from synapse.api.constants import MAX_DEPTH, EventTypes, StickyEvent, StickyEventField
 from synapse.api.room_versions import (
     KNOWN_EVENT_FORMAT_VERSIONS,
     EventFormatVersions,
@@ -38,7 +38,7 @@ from synapse.storage.databases.main import DataStore
 from synapse.synapse_rust.events import EventInternalMetadata
 from synapse.types import EventID, JsonDict, StrCollection
 from synapse.types.state import StateFilter
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 if TYPE_CHECKING:
@@ -83,18 +83,22 @@ class EventBuilder:
     room_version: RoomVersion
 
     # MSC4291 makes the room ID == the create event ID. This means the create event has no room_id.
-    room_id: Optional[str]
+    room_id: str | None
     type: str
     sender: str
 
     content: JsonDict = attr.Factory(dict)
     unsigned: JsonDict = attr.Factory(dict)
+    sticky: StickyEventField | None = None
+    """
+    Fields for MSC4354: Sticky Events
+    """
 
     # These only exist on a subset of events, so they raise AttributeError if
     # someone tries to get them when they don't exist.
-    _state_key: Optional[str] = None
-    _redacts: Optional[str] = None
-    _origin_server_ts: Optional[int] = None
+    _state_key: str | None = None
+    _redacts: str | None = None
+    _origin_server_ts: int | None = None
 
     internal_metadata: EventInternalMetadata = attr.Factory(
         lambda: EventInternalMetadata({})
@@ -125,9 +129,9 @@ class EventBuilder:
 
     async def build(
         self,
-        prev_event_ids: List[str],
-        auth_event_ids: Optional[List[str]],
-        depth: Optional[int] = None,
+        prev_event_ids: list[str],
+        auth_event_ids: list[str] | None,
+        depth: int | None = None,
     ) -> EventBase:
         """Transform into a fully signed and hashed event
 
@@ -205,8 +209,8 @@ class EventBuilder:
 
         format_version = self.room_version.event_format
         # The types of auth/prev events changes between event versions.
-        prev_events: Union[StrCollection, List[Tuple[str, Dict[str, str]]]]
-        auth_events: Union[List[str], List[Tuple[str, Dict[str, str]]]]
+        prev_events: StrCollection | list[tuple[str, dict[str, str]]]
+        auth_events: list[str] | list[tuple[str, dict[str, str]]]
         if format_version == EventFormatVersions.ROOM_V1_V2:
             auth_events = await self._store.add_event_hashes(auth_event_ids)
             prev_events = await self._store.add_event_hashes(prev_event_ids)
@@ -228,7 +232,7 @@ class EventBuilder:
         # the db)
         depth = min(depth, MAX_DEPTH)
 
-        event_dict: Dict[str, Any] = {
+        event_dict: dict[str, Any] = {
             "auth_events": auth_events,
             "prev_events": prev_events,
             "type": self.type,
@@ -269,6 +273,9 @@ class EventBuilder:
         if self._origin_server_ts is not None:
             event_dict["origin_server_ts"] = self._origin_server_ts
 
+        if self.sticky is not None:
+            event_dict[StickyEvent.EVENT_FIELD_NAME] = self.sticky
+
         return create_local_event_from_event_dict(
             clock=self._clock,
             hostname=self._hostname,
@@ -318,6 +325,7 @@ class EventBuilderFactory:
             unsigned=key_values.get("unsigned", {}),
             redacts=key_values.get("redacts", None),
             origin_server_ts=key_values.get("origin_server_ts", None),
+            sticky=key_values.get(StickyEvent.EVENT_FIELD_NAME, None),
         )
 
 
@@ -327,7 +335,7 @@ def create_local_event_from_event_dict(
     signing_key: SigningKey,
     room_version: RoomVersion,
     event_dict: JsonDict,
-    internal_metadata_dict: Optional[JsonDict] = None,
+    internal_metadata_dict: JsonDict | None = None,
 ) -> EventBase:
     """Takes a fully formed event dict, ensuring that fields like
     `origin_server_ts` have correct values for a locally produced event,
diff --git a/synapse/events/presence_router.py b/synapse/events/presence_router.py
index 9713b141bc..d71d3f8feb 100644
--- a/synapse/events/presence_router.py
+++ b/synapse/events/presence_router.py
@@ -24,13 +24,8 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
     Iterable,
-    List,
-    Optional,
-    Set,
     TypeVar,
-    Union,
 )
 
 from typing_extensions import ParamSpec
@@ -44,10 +39,10 @@ if TYPE_CHECKING:
     from synapse.server import HomeServer
 
 GET_USERS_FOR_STATES_CALLBACK = Callable[
-    [Iterable[UserPresenceState]], Awaitable[Dict[str, Set[UserPresenceState]]]
+    [Iterable[UserPresenceState]], Awaitable[dict[str, set[UserPresenceState]]]
 ]
 # This must either return a set of strings or the constant PresenceRouter.ALL_USERS.
-GET_INTERESTED_USERS_CALLBACK = Callable[[str], Awaitable[Union[Set[str], str]]]
+GET_INTERESTED_USERS_CALLBACK = Callable[[str], Awaitable[set[str] | str]]
 
 logger = logging.getLogger(__name__)
 
@@ -80,8 +75,8 @@ def load_legacy_presence_router(hs: "HomeServer") -> None:
     # All methods that the module provides should be async, but this wasn't enforced
     # in the old module system, so we wrap them if needed
     def async_wrapper(
-        f: Optional[Callable[P, R]],
-    ) -> Optional[Callable[P, Awaitable[R]]]:
+        f: Callable[P, R] | None,
+    ) -> Callable[P, Awaitable[R]] | None:
         # f might be None if the callback isn't implemented by the module. In this
         # case we don't want to register a callback at all so we return None.
         if f is None:
@@ -98,7 +93,7 @@ def load_legacy_presence_router(hs: "HomeServer") -> None:
         return run
 
     # Register the hooks through the module API.
-    hooks: Dict[str, Optional[Callable[..., Any]]] = {
+    hooks: dict[str, Callable[..., Any] | None] = {
         hook: async_wrapper(getattr(presence_router, hook, None))
         for hook in presence_router_methods
     }
@@ -116,13 +111,13 @@ class PresenceRouter:
 
     def __init__(self, hs: "HomeServer"):
         # Initially there are no callbacks
-        self._get_users_for_states_callbacks: List[GET_USERS_FOR_STATES_CALLBACK] = []
-        self._get_interested_users_callbacks: List[GET_INTERESTED_USERS_CALLBACK] = []
+        self._get_users_for_states_callbacks: list[GET_USERS_FOR_STATES_CALLBACK] = []
+        self._get_interested_users_callbacks: list[GET_INTERESTED_USERS_CALLBACK] = []
 
     def register_presence_router_callbacks(
         self,
-        get_users_for_states: Optional[GET_USERS_FOR_STATES_CALLBACK] = None,
-        get_interested_users: Optional[GET_INTERESTED_USERS_CALLBACK] = None,
+        get_users_for_states: GET_USERS_FOR_STATES_CALLBACK | None = None,
+        get_interested_users: GET_INTERESTED_USERS_CALLBACK | None = None,
     ) -> None:
         # PresenceRouter modules are required to implement both of these methods
         # or neither of them as they are assumed to act in a complementary manner
@@ -143,7 +138,7 @@ class PresenceRouter:
     async def get_users_for_states(
         self,
         state_updates: Iterable[UserPresenceState],
-    ) -> Dict[str, Set[UserPresenceState]]:
+    ) -> dict[str, set[UserPresenceState]]:
         """
         Given an iterable of user presence updates, determine where each one
         needs to go.
@@ -161,7 +156,7 @@ class PresenceRouter:
             # Don't include any extra destinations for presence updates
             return {}
 
-        users_for_states: Dict[str, Set[UserPresenceState]] = {}
+        users_for_states: dict[str, set[UserPresenceState]] = {}
         # run all the callbacks for get_users_for_states and combine the results
         for callback in self._get_users_for_states_callbacks:
             try:
@@ -174,7 +169,7 @@ class PresenceRouter:
                 logger.warning("Failed to run module API callback %s: %s", callback, e)
                 continue
 
-            if not isinstance(result, Dict):
+            if not isinstance(result, dict):
                 logger.warning(
                     "Wrong type returned by module API callback %s: %s, expected Dict",
                     callback,
@@ -183,7 +178,7 @@ class PresenceRouter:
                 continue
 
             for key, new_entries in result.items():
-                if not isinstance(new_entries, Set):
+                if not isinstance(new_entries, set):
                     logger.warning(
                         "Wrong type returned by module API callback %s: %s, expected Set",
                         callback,
@@ -194,7 +189,7 @@ class PresenceRouter:
 
         return users_for_states
 
-    async def get_interested_users(self, user_id: str) -> Union[Set[str], str]:
+    async def get_interested_users(self, user_id: str) -> set[str] | str:
         """
         Retrieve a list of users that `user_id` is interested in receiving the
         presence of. This will be in addition to those they share a room with.
@@ -234,7 +229,7 @@ class PresenceRouter:
             if result == PresenceRouter.ALL_USERS:
                 return PresenceRouter.ALL_USERS
 
-            if not isinstance(result, Set):
+            if not isinstance(result, set):
                 logger.warning(
                     "Wrong type returned by module API callback %s: %s, expected set",
                     callback,
diff --git a/synapse/events/snapshot.py b/synapse/events/snapshot.py
index 63551143d8..d7a987d52f 100644
--- a/synapse/events/snapshot.py
+++ b/synapse/events/snapshot.py
@@ -19,7 +19,7 @@
 #
 #
 from abc import ABC, abstractmethod
-from typing import TYPE_CHECKING, Dict, List, Optional, Tuple
+from typing import TYPE_CHECKING, Optional
 
 import attr
 from immutabledict import immutabledict
@@ -51,7 +51,7 @@ class UnpersistedEventContextBase(ABC):
 
     def __init__(self, storage_controller: "StorageControllers"):
         self._storage: "StorageControllers" = storage_controller
-        self.app_service: Optional[ApplicationService] = None
+        self.app_service: ApplicationService | None = None
 
     @abstractmethod
     async def persist(
@@ -133,23 +133,23 @@ class EventContext(UnpersistedEventContextBase):
     """
 
     _storage: "StorageControllers"
-    state_group_deltas: Dict[Tuple[int, int], StateMap[str]]
-    rejected: Optional[str] = None
-    _state_group: Optional[int] = None
-    state_group_before_event: Optional[int] = None
-    _state_delta_due_to_event: Optional[StateMap[str]] = None
-    app_service: Optional[ApplicationService] = None
+    state_group_deltas: dict[tuple[int, int], StateMap[str]]
+    rejected: str | None = None
+    _state_group: int | None = None
+    state_group_before_event: int | None = None
+    _state_delta_due_to_event: StateMap[str] | None = None
+    app_service: ApplicationService | None = None
 
     partial_state: bool = False
 
     @staticmethod
     def with_state(
         storage: "StorageControllers",
-        state_group: Optional[int],
-        state_group_before_event: Optional[int],
-        state_delta_due_to_event: Optional[StateMap[str]],
+        state_group: int | None,
+        state_group_before_event: int | None,
+        state_delta_due_to_event: StateMap[str] | None,
         partial_state: bool,
-        state_group_deltas: Dict[Tuple[int, int], StateMap[str]],
+        state_group_deltas: dict[tuple[int, int], StateMap[str]],
     ) -> "EventContext":
         return EventContext(
             storage=storage,
@@ -227,7 +227,7 @@ class EventContext(UnpersistedEventContextBase):
         return context
 
     @property
-    def state_group(self) -> Optional[int]:
+    def state_group(self) -> int | None:
         """The ID of the state group for this event.
 
         Note that state events are persisted with a state group which includes the new
@@ -306,7 +306,7 @@ class EventContext(UnpersistedEventContextBase):
         )
 
 
-EventPersistencePair = Tuple[EventBase, EventContext]
+EventPersistencePair = tuple[EventBase, EventContext]
 """
 The combination of an event to be persisted and its context.
 """
@@ -354,22 +354,22 @@ class UnpersistedEventContext(UnpersistedEventContextBase):
     """
 
     _storage: "StorageControllers"
-    state_group_before_event: Optional[int]
-    state_group_after_event: Optional[int]
-    state_delta_due_to_event: Optional[StateMap[str]]
-    prev_group_for_state_group_before_event: Optional[int]
-    delta_ids_to_state_group_before_event: Optional[StateMap[str]]
+    state_group_before_event: int | None
+    state_group_after_event: int | None
+    state_delta_due_to_event: StateMap[str] | None
+    prev_group_for_state_group_before_event: int | None
+    delta_ids_to_state_group_before_event: StateMap[str] | None
     partial_state: bool
-    state_map_before_event: Optional[StateMap[str]] = None
+    state_map_before_event: StateMap[str] | None = None
 
     @classmethod
     async def batch_persist_unpersisted_contexts(
         cls,
-        events_and_context: List[Tuple[EventBase, "UnpersistedEventContextBase"]],
+        events_and_context: list[tuple[EventBase, "UnpersistedEventContextBase"]],
         room_id: str,
         last_known_state_group: int,
         datastore: "StateGroupDataStore",
-    ) -> List[EventPersistencePair]:
+    ) -> list[EventPersistencePair]:
         """
         Takes a list of events and their associated unpersisted contexts and persists
         the unpersisted contexts, returning a list of events and persisted contexts.
@@ -472,7 +472,7 @@ class UnpersistedEventContext(UnpersistedEventContextBase):
             partial_state=self.partial_state,
         )
 
-    def _build_state_group_deltas(self) -> Dict[Tuple[int, int], StateMap]:
+    def _build_state_group_deltas(self) -> dict[tuple[int, int], StateMap]:
         """
         Collect deltas between the state groups associated with this context
         """
@@ -510,8 +510,8 @@ class UnpersistedEventContext(UnpersistedEventContextBase):
 
 
 def _encode_state_group_delta(
-    state_group_delta: Dict[Tuple[int, int], StateMap[str]],
-) -> List[Tuple[int, int, Optional[List[Tuple[str, str, str]]]]]:
+    state_group_delta: dict[tuple[int, int], StateMap[str]],
+) -> list[tuple[int, int, list[tuple[str, str, str]] | None]]:
     if not state_group_delta:
         return []
 
@@ -523,8 +523,8 @@ def _encode_state_group_delta(
 
 
 def _decode_state_group_delta(
-    input: List[Tuple[int, int, List[Tuple[str, str, str]]]],
-) -> Dict[Tuple[int, int], StateMap[str]]:
+    input: list[tuple[int, int, list[tuple[str, str, str]]]],
+) -> dict[tuple[int, int], StateMap[str]]:
     if not input:
         return {}
 
@@ -538,8 +538,8 @@ def _decode_state_group_delta(
 
 
 def _encode_state_dict(
-    state_dict: Optional[StateMap[str]],
-) -> Optional[List[Tuple[str, str, str]]]:
+    state_dict: StateMap[str] | None,
+) -> list[tuple[str, str, str]] | None:
     """Since dicts of (type, state_key) -> event_id cannot be serialized in
     JSON we need to convert them to a form that can.
     """
@@ -550,8 +550,8 @@ def _encode_state_dict(
 
 
 def _decode_state_dict(
-    input: Optional[List[Tuple[str, str, str]]],
-) -> Optional[StateMap[str]]:
+    input: list[tuple[str, str, str]] | None,
+) -> StateMap[str] | None:
     """Decodes a state dict encoded using `_encode_state_dict` above"""
     if input is None:
         return None
diff --git a/synapse/events/utils.py b/synapse/events/utils.py
index 942072cf84..76ebac8b17 100644
--- a/synapse/events/utils.py
+++ b/synapse/events/utils.py
@@ -27,13 +27,9 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
-    List,
     Mapping,
     Match,
     MutableMapping,
-    Optional,
-    Union,
 )
 
 import attr
@@ -52,7 +48,7 @@ from synapse.api.room_versions import RoomVersion
 from synapse.logging.opentracing import SynapseTags, set_tag, trace
 from synapse.types import JsonDict, Requester
 
-from . import EventBase, StrippedStateEvent, make_event_from_dict
+from . import EventBase, FrozenEventV2, StrippedStateEvent, make_event_from_dict
 
 if TYPE_CHECKING:
     from synapse.handlers.relations import BundledAggregations
@@ -92,6 +88,7 @@ def prune_event(event: EventBase) -> EventBase:
     )
     pruned_event.internal_metadata.instance_name = event.internal_metadata.instance_name
     pruned_event.internal_metadata.outlier = event.internal_metadata.outlier
+    pruned_event.internal_metadata.redacted_by = event.internal_metadata.redacted_by
 
     # Mark the event as redacted
     pruned_event.internal_metadata.redacted = True
@@ -113,12 +110,21 @@ def clone_event(event: EventBase) -> EventBase:
         event.get_dict(), event.room_version, event.internal_metadata.get_dict()
     )
 
+    # Starting FrozenEventV2, the event ID is an (expensive) hash of the event. This is
+    # lazily computed when we get the FrozenEventV2.event_id property, then cached in
+    # _event_id field. Later FrozenEvent formats all inherit from FrozenEventV2, so we
+    # can use the same logic here.
+    if isinstance(event, FrozenEventV2) and isinstance(new_event, FrozenEventV2):
+        # If we already pre-computed the event ID, use it.
+        new_event._event_id = event._event_id
+
     # Copy the bits of `internal_metadata` that aren't returned by `get_dict`.
     new_event.internal_metadata.stream_ordering = (
         event.internal_metadata.stream_ordering
     )
     new_event.internal_metadata.instance_name = event.internal_metadata.instance_name
     new_event.internal_metadata.outlier = event.internal_metadata.outlier
+    new_event.internal_metadata.redacted_by = event.internal_metadata.redacted_by
 
     return new_event
 
@@ -239,7 +245,7 @@ def prune_event_dict(room_version: RoomVersion, event_dict: JsonDict) -> JsonDic
     return allowed_fields
 
 
-def _copy_field(src: JsonDict, dst: JsonDict, field: List[str]) -> None:
+def _copy_field(src: JsonDict, dst: JsonDict, field: list[str]) -> None:
     """Copy the field in 'src' to 'dst'.
 
     For example, if src={"foo":{"bar":5}} and dst={}, and field=["foo","bar"]
@@ -292,7 +298,7 @@ def _escape_slash(m: Match[str]) -> str:
     return m.group(0)
 
 
-def _split_field(field: str) -> List[str]:
+def _split_field(field: str) -> list[str]:
     """
     Splits strings on unescaped dots and removes escaping.
 
@@ -333,7 +339,7 @@ def _split_field(field: str) -> List[str]:
     return result
 
 
-def only_fields(dictionary: JsonDict, fields: List[str]) -> JsonDict:
+def only_fields(dictionary: JsonDict, fields: list[str]) -> JsonDict:
     """Return a new dict with only the fields in 'dictionary' which are present
     in 'fields'.
 
@@ -416,10 +422,10 @@ class SerializeEventConfig:
     # Function to convert from federation format to client format
     event_format: Callable[[JsonDict], JsonDict] = format_event_for_client_v1
     # The entity that requested the event. This is used to determine whether to include
-    # the transaction_id in the unsigned section of the event.
-    requester: Optional[Requester] = None
+    # the transaction_id and delay_id in the unsigned section of the event.
+    requester: Requester | None = None
     # List of event fields to include. If empty, all fields will be returned.
-    only_event_fields: Optional[List[str]] = None
+    only_event_fields: list[str] | None = attr.ib(default=None)
     # Some events can have stripped room state stored in the `unsigned` field.
     # This is required for invite and knock functionality. If this option is
     # False, that state will be removed from the event before it is returned.
@@ -430,6 +436,16 @@ class SerializeEventConfig:
     # whether an event was soft failed by the server.
     include_admin_metadata: bool = False
 
+    @only_event_fields.validator
+    def _validate_only_event_fields(
+        self, attribute: attr.Attribute, value: Any
+    ) -> None:
+        if value is None:
+            return
+
+        if not isinstance(value, list) or not all(isinstance(f, str) for f in value):
+            raise TypeError("only_event_fields must be a list of strings")
+
 
 _DEFAULT_SERIALIZE_EVENT_CONFIG = SerializeEventConfig()
 
@@ -440,8 +456,8 @@ def make_config_for_admin(existing: SerializeEventConfig) -> SerializeEventConfi
     return attr.evolve(existing, include_admin_metadata=True)
 
 
-def serialize_event(
-    e: Union[JsonDict, EventBase],
+def _serialize_event(
+    e: JsonDict | EventBase,
     time_now_ms: int,
     *,
     config: SerializeEventConfig = _DEFAULT_SERIALIZE_EVENT_CONFIG,
@@ -472,53 +488,49 @@ def serialize_event(
         d["unsigned"]["age"] = time_now_ms - d["unsigned"]["age_ts"]
         del d["unsigned"]["age_ts"]
 
-    if "redacted_because" in e.unsigned:
-        d["unsigned"]["redacted_because"] = serialize_event(
-            e.unsigned["redacted_because"],
-            time_now_ms,
-            config=config,
-        )
-
-    # If we have a txn_id saved in the internal_metadata, we should include it in the
-    # unsigned section of the event if it was sent by the same session as the one
-    # requesting the event.
-    txn_id: Optional[str] = getattr(e.internal_metadata, "txn_id", None)
-    if (
-        txn_id is not None
-        and config.requester is not None
-        and config.requester.user.to_string() == e.sender
-    ):
-        # Some events do not have the device ID stored in the internal metadata,
-        # this includes old events as well as those created by appservice, guests,
-        # or with tokens minted with the admin API. For those events, fallback
-        # to using the access token instead.
-        event_device_id: Optional[str] = getattr(e.internal_metadata, "device_id", None)
-        if event_device_id is not None:
-            if event_device_id == config.requester.device_id:
-                d["unsigned"]["transaction_id"] = txn_id
-
-        else:
-            # Fallback behaviour: only include the transaction ID if the event
-            # was sent from the same access token.
-            #
-            # For regular users, the access token ID can be used to determine this.
-            # This includes access tokens minted with the admin API.
-            #
-            # For guests and appservice users, we can't check the access token ID
-            # so assume it is the same session.
-            event_token_id: Optional[int] = getattr(
-                e.internal_metadata, "token_id", None
+    # If we have applicable fields saved in the internal_metadata, include them in the
+    # unsigned section of the event if the event was sent by the same session (or when
+    # appropriate, just the same sender) as the one requesting the event.
+    if config.requester is not None and config.requester.user.to_string() == e.sender:
+        txn_id: str | None = getattr(e.internal_metadata, "txn_id", None)
+        if txn_id is not None:
+            # Some events do not have the device ID stored in the internal metadata,
+            # this includes old events as well as those created by appservice, guests,
+            # or with tokens minted with the admin API. For those events, fallback
+            # to using the access token instead.
+            event_device_id: str | None = getattr(
+                e.internal_metadata, "device_id", None
             )
-            if (
-                (
-                    event_token_id is not None
-                    and config.requester.access_token_id is not None
-                    and event_token_id == config.requester.access_token_id
+            if event_device_id is not None:
+                if event_device_id == config.requester.device_id:
+                    d["unsigned"]["transaction_id"] = txn_id
+
+            else:
+                # Fallback behaviour: only include the transaction ID if the event
+                # was sent from the same access token.
+                #
+                # For regular users, the access token ID can be used to determine this.
+                # This includes access tokens minted with the admin API.
+                #
+                # For guests and appservice users, we can't check the access token ID
+                # so assume it is the same session.
+                event_token_id: int | None = getattr(
+                    e.internal_metadata, "token_id", None
                 )
-                or config.requester.is_guest
-                or config.requester.app_service
-            ):
-                d["unsigned"]["transaction_id"] = txn_id
+                if (
+                    (
+                        event_token_id is not None
+                        and config.requester.access_token_id is not None
+                        and event_token_id == config.requester.access_token_id
+                    )
+                    or config.requester.is_guest
+                    or config.requester.app_service
+                ):
+                    d["unsigned"]["transaction_id"] = txn_id
+
+        delay_id: str | None = getattr(e.internal_metadata, "delay_id", None)
+        if delay_id is not None:
+            d["unsigned"]["org.matrix.msc4140.delay_id"] = delay_id
 
     # invite_room_state and knock_room_state are a list of stripped room state events
     # that are meant to provide metadata about a room to an invitee/knocker. They are
@@ -552,14 +564,6 @@ def serialize_event(
         if e.internal_metadata.policy_server_spammy:
             d["unsigned"]["io.element.synapse.policy_server_spammy"] = True
 
-    only_event_fields = config.only_event_fields
-    if only_event_fields:
-        if not isinstance(only_event_fields, list) or not all(
-            isinstance(f, str) for f in only_event_fields
-        ):
-            raise TypeError("only_event_fields must be a list of strings")
-        d = only_fields(d, only_event_fields)
-
     return d
 
 
@@ -573,17 +577,18 @@ class EventClientSerializer:
     def __init__(self, hs: "HomeServer") -> None:
         self._store = hs.get_datastores().main
         self._auth = hs.get_auth()
-        self._add_extra_fields_to_unsigned_client_event_callbacks: List[
+        self._add_extra_fields_to_unsigned_client_event_callbacks: list[
             ADD_EXTRA_FIELDS_TO_UNSIGNED_CLIENT_EVENT_CALLBACK
         ] = []
 
     async def serialize_event(
         self,
-        event: Union[JsonDict, EventBase],
+        event: JsonDict | EventBase,
         time_now: int,
         *,
         config: SerializeEventConfig = _DEFAULT_SERIALIZE_EVENT_CONFIG,
-        bundle_aggregations: Optional[Dict[str, "BundledAggregations"]] = None,
+        bundle_aggregations: dict[str, "BundledAggregations"] | None = None,
+        redaction_map: Mapping[str, "EventBase"] | None = None,
     ) -> JsonDict:
         """Serializes a single event.
 
@@ -593,6 +598,8 @@ class EventClientSerializer:
             config: Event serialization config
             bundle_aggregations: A map from event_id to the aggregations to be bundled
                into the event.
+            redaction_map: Optional pre-fetched map from redaction event_id to event,
+               used to avoid per-event DB lookups when serializing many events.
 
         Returns:
             The serialized event
@@ -610,7 +617,34 @@ class EventClientSerializer:
         ):
             config = make_config_for_admin(config)
 
-        serialized_event = serialize_event(event, time_now, config=config)
+        serialized_event = _serialize_event(event, time_now, config=config)
+
+        # If the event was redacted, fetch the redaction event from the database
+        # and include it in the serialized event's unsigned section.
+        redacted_by: str | None = event.internal_metadata.redacted_by
+        if redacted_by is not None:
+            serialized_event.setdefault("unsigned", {})["redacted_by"] = redacted_by
+            if redaction_map is not None:
+                redaction_event: EventBase | None = redaction_map.get(redacted_by)
+            else:
+                redaction_event = await self._store.get_event(
+                    redacted_by,
+                    allow_none=True,
+                )
+            if redaction_event is not None:
+                serialized_redaction = _serialize_event(
+                    redaction_event, time_now, config=config
+                )
+                serialized_event.setdefault("unsigned", {})["redacted_because"] = (
+                    serialized_redaction
+                )
+                # format_event_for_client_v1 copies redacted_because to the
+                # top level, but since we add it after that runs, do it here.
+                if (
+                    config.as_client_event
+                    and config.event_format is format_event_for_client_v1
+                ):
+                    serialized_event["redacted_because"] = serialized_redaction
 
         new_unsigned = {}
         for callback in self._add_extra_fields_to_unsigned_client_event_callbacks:
@@ -623,6 +657,13 @@ class EventClientSerializer:
             new_unsigned.update(serialized_event["unsigned"])
             serialized_event["unsigned"] = new_unsigned
 
+        # Only include fields that the client has requested.
+        #
+        # Note: we always return bundled aggregations, though it is unclear why.
+        only_event_fields = config.only_event_fields
+        if only_event_fields:
+            serialized_event = only_fields(serialized_event, only_event_fields)
+
         # Check if there are any bundled aggregations to include with the event.
         if bundle_aggregations:
             if event.event_id in bundle_aggregations:
@@ -641,7 +682,7 @@ class EventClientSerializer:
         event: EventBase,
         time_now: int,
         config: SerializeEventConfig,
-        bundled_aggregations: Dict[str, "BundledAggregations"],
+        bundled_aggregations: dict[str, "BundledAggregations"],
         serialized_event: JsonDict,
     ) -> None:
         """Potentially injects bundled aggregations into the unsigned portion of the serialized event.
@@ -714,12 +755,12 @@ class EventClientSerializer:
     @trace
     async def serialize_events(
         self,
-        events: Collection[Union[JsonDict, EventBase]],
+        events: Collection[JsonDict | EventBase],
         time_now: int,
         *,
         config: SerializeEventConfig = _DEFAULT_SERIALIZE_EVENT_CONFIG,
-        bundle_aggregations: Optional[Dict[str, "BundledAggregations"]] = None,
-    ) -> List[JsonDict]:
+        bundle_aggregations: dict[str, "BundledAggregations"] | None = None,
+    ) -> list[JsonDict]:
         """Serializes multiple events.
 
         Args:
@@ -738,12 +779,23 @@ class EventClientSerializer:
             str(len(events)),
         )
 
+        # Batch-fetch all redaction events in one go rather than one per event.
+        redaction_ids = {
+            e.internal_metadata.redacted_by
+            for e in events
+            if isinstance(e, EventBase) and e.internal_metadata.redacted_by is not None
+        }
+        redaction_map = (
+            await self._store.get_events(redaction_ids) if redaction_ids else {}
+        )
+
         return [
             await self.serialize_event(
                 event,
                 time_now,
                 config=config,
                 bundle_aggregations=bundle_aggregations,
+                redaction_map=redaction_map,
             )
             for event in events
         ]
@@ -757,13 +809,13 @@ class EventClientSerializer:
         self._add_extra_fields_to_unsigned_client_event_callbacks.append(callback)
 
 
-_PowerLevel = Union[str, int]
-PowerLevelsContent = Mapping[str, Union[_PowerLevel, Mapping[str, _PowerLevel]]]
+_PowerLevel = str | int
+PowerLevelsContent = Mapping[str, _PowerLevel | Mapping[str, _PowerLevel]]
 
 
 def copy_and_fixup_power_levels_contents(
     old_power_levels: PowerLevelsContent,
-) -> Dict[str, Union[int, Dict[str, int]]]:
+) -> dict[str, int | dict[str, int]]:
     """Copy the content of a power_levels event, unfreezing immutabledicts along the way.
 
     We accept as input power level values which are strings, provided they represent an
@@ -779,11 +831,11 @@ def copy_and_fixup_power_levels_contents(
     if not isinstance(old_power_levels, collections.abc.Mapping):
         raise TypeError("Not a valid power-levels content: %r" % (old_power_levels,))
 
-    power_levels: Dict[str, Union[int, Dict[str, int]]] = {}
+    power_levels: dict[str, int | dict[str, int]] = {}
 
     for k, v in old_power_levels.items():
         if isinstance(v, collections.abc.Mapping):
-            h: Dict[str, int] = {}
+            h: dict[str, int] = {}
             power_levels[k] = h
             for k1, v1 in v.items():
                 _copy_power_level_value_as_integer(v1, h, k1)
@@ -903,7 +955,7 @@ def strip_event(event: EventBase) -> JsonDict:
     }
 
 
-def parse_stripped_state_event(raw_stripped_event: Any) -> Optional[StrippedStateEvent]:
+def parse_stripped_state_event(raw_stripped_event: Any) -> StrippedStateEvent | None:
     """
     Given a raw value from an event's `unsigned` field, attempt to parse it into a
     `StrippedStateEvent`.
diff --git a/synapse/events/validator.py b/synapse/events/validator.py
index 4d9ba15829..b27f8a942a 100644
--- a/synapse/events/validator.py
+++ b/synapse/events/validator.py
@@ -19,11 +19,11 @@
 #
 #
 import collections.abc
-from typing import List, Type, Union, cast
+from typing import cast
 
 import jsonschema
+from pydantic import Field, StrictBool, StrictStr
 
-from synapse._pydantic_compat import Field, StrictBool, StrictStr
 from synapse.api.constants import (
     MAX_ALIAS_LENGTH,
     EventContentFields,
@@ -177,7 +177,7 @@ class EventValidator:
                 errcode=Codes.BAD_JSON,
             )
 
-    def validate_builder(self, event: Union[EventBase, EventBuilder]) -> None:
+    def validate_builder(self, event: EventBase | EventBuilder) -> None:
         """Validates that the builder/event has roughly the right format. Only
         checks values that we expect a proto event to have, rather than all the
         fields an event would have
@@ -249,7 +249,7 @@ class EventValidator:
             if not isinstance(d[s], str):
                 raise SynapseError(400, "'%s' not a string type" % (s,))
 
-    def _ensure_state_event(self, event: Union[EventBase, EventBuilder]) -> None:
+    def _ensure_state_event(self, event: EventBase | EventBuilder) -> None:
         if not event.is_state():
             raise SynapseError(400, "'%s' must be state events" % (event.type,))
 
@@ -283,13 +283,13 @@ POWER_LEVELS_SCHEMA = {
 
 
 class Mentions(RequestBodyModel):
-    user_ids: List[StrictStr] = Field(default_factory=list)
+    user_ids: list[StrictStr] = Field(default_factory=list)
     room: StrictBool = False
 
 
 # This could return something newer than Draft 7, but that's the current "latest"
 # validator.
-def _create_validator(schema: JsonDict) -> Type[jsonschema.Draft7Validator]:
+def _create_validator(schema: JsonDict) -> type[jsonschema.Draft7Validator]:
     validator = jsonschema.validators.validator_for(schema)
 
     # by default jsonschema does not consider a immutabledict to be an object so
diff --git a/synapse/federation/federation_base.py b/synapse/federation/federation_base.py
index a1c9c286ac..04ba5b86db 100644
--- a/synapse/federation/federation_base.py
+++ b/synapse/federation/federation_base.py
@@ -20,7 +20,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Awaitable, Callable, List, Optional, Sequence
+from typing import TYPE_CHECKING, Awaitable, Callable, Sequence
 
 from synapse.api.constants import MAX_DEPTH, EventContentFields, EventTypes, Membership
 from synapse.api.errors import Codes, SynapseError
@@ -67,7 +67,7 @@ class FederationBase:
 
         # We need to define this lazily otherwise we get a cyclic dependency.
         # self._policy_handler = hs.get_room_policy_handler()
-        self._policy_handler: Optional[RoomPolicyHandler] = None
+        self._policy_handler: RoomPolicyHandler | None = None
 
     def _lazily_get_policy_handler(self) -> RoomPolicyHandler:
         """Lazily get the room policy handler.
@@ -88,9 +88,8 @@ class FederationBase:
         self,
         room_version: RoomVersion,
         pdu: EventBase,
-        record_failure_callback: Optional[
-            Callable[[EventBase, str], Awaitable[None]]
-        ] = None,
+        record_failure_callback: Callable[[EventBase, str], Awaitable[None]]
+        | None = None,
     ) -> EventBase:
         """Checks that event is correctly signed by the sending server.
 
@@ -305,7 +304,7 @@ def _is_invite_via_3pid(event: EventBase) -> bool:
 
 def parse_events_from_pdu_json(
     pdus_json: Sequence[JsonDict], room_version: RoomVersion
-) -> List[EventBase]:
+) -> list[EventBase]:
     return [
         event_from_pdu_json(pdu_json, room_version)
         for pdu_json in filter_pdus_for_valid_depth(pdus_json)
diff --git a/synapse/federation/federation_client.py b/synapse/federation/federation_client.py
index 542d9650d4..55151ca549 100644
--- a/synapse/federation/federation_client.py
+++ b/synapse/federation/federation_client.py
@@ -32,15 +32,11 @@ from typing import (
     Callable,
     Collection,
     Container,
-    Dict,
     Iterable,
-    List,
     Mapping,
     Optional,
     Sequence,
-    Tuple,
     TypeVar,
-    Union,
 )
 
 import attr
@@ -76,9 +72,9 @@ from synapse.http.types import QueryParams
 from synapse.logging.opentracing import SynapseTags, log_kv, set_tag, tag_args, trace
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.types import JsonDict, StrCollection, UserID, get_domain_from_id
-from synapse.types.handlers.policy_server import RECOMMENDATION_OK, RECOMMENDATION_SPAM
 from synapse.util.async_helpers import concurrently_execute
 from synapse.util.caches.expiringcache import ExpiringCache
+from synapse.util.duration import Duration
 from synapse.util.retryutils import NotRetryingDestination
 
 if TYPE_CHECKING:
@@ -120,8 +116,8 @@ class SendJoinResult:
     event: EventBase
     # A string giving the server the event was sent to.
     origin: str
-    state: List[EventBase]
-    auth_chain: List[EventBase]
+    state: list[EventBase]
+    auth_chain: list[EventBase]
 
     # True if 'state' elides non-critical membership events
     partial_state: bool
@@ -135,8 +131,8 @@ class FederationClient(FederationBase):
     def __init__(self, hs: "HomeServer"):
         super().__init__(hs)
 
-        self.pdu_destination_tried: Dict[str, Dict[str, int]] = {}
-        self._clock.looping_call(self._clear_tried_cache, 60 * 1000)
+        self.pdu_destination_tried: dict[str, dict[str, int]] = {}
+        self._clock.looping_call(self._clear_tried_cache, Duration(minutes=1))
         self.state = hs.get_state_handler()
         self.transport_layer = hs.get_federation_transport_client()
 
@@ -145,9 +141,10 @@ class FederationClient(FederationBase):
 
         # Cache mapping `event_id` to a tuple of the event itself and the `pull_origin`
         # (which server we pulled the event from)
-        self._get_pdu_cache: ExpiringCache[str, Tuple[EventBase, str]] = ExpiringCache(
+        self._get_pdu_cache: ExpiringCache[str, tuple[EventBase, str]] = ExpiringCache(
             cache_name="get_pdu_cache",
             server_name=self.server_name,
+            hs=self.hs,
             clock=self._clock,
             max_len=1000,
             expiry_ms=120 * 1000,
@@ -162,11 +159,12 @@ class FederationClient(FederationBase):
         # It is a map of (room ID, suggested-only) -> the response of
         # get_room_hierarchy.
         self._get_room_hierarchy_cache: ExpiringCache[
-            Tuple[str, bool],
-            Tuple[JsonDict, Sequence[JsonDict], Sequence[JsonDict], Sequence[str]],
+            tuple[str, bool],
+            tuple[JsonDict, Sequence[JsonDict], Sequence[JsonDict], Sequence[str]],
         ] = ExpiringCache(
             cache_name="get_room_hierarchy_cache",
             server_name=self.server_name,
+            hs=self.hs,
             clock=self._clock,
             max_len=1000,
             expiry_ms=5 * 60 * 1000,
@@ -263,8 +261,8 @@ class FederationClient(FederationBase):
         self,
         user: UserID,
         destination: str,
-        query: Dict[str, Dict[str, Dict[str, int]]],
-        timeout: Optional[int],
+        query: dict[str, dict[str, dict[str, int]]],
+        timeout: int | None,
     ) -> JsonDict:
         """Claims one-time keys for a device hosted on a remote server.
 
@@ -283,8 +281,8 @@ class FederationClient(FederationBase):
 
         # Convert the query with counts into a stable and unstable query and check
         # if attempting to claim more than 1 OTK.
-        content: Dict[str, Dict[str, str]] = {}
-        unstable_content: Dict[str, Dict[str, List[str]]] = {}
+        content: dict[str, dict[str, str]] = {}
+        unstable_content: dict[str, dict[str, list[str]]] = {}
         use_unstable = False
         for user_id, one_time_keys in query.items():
             for device_id, algorithms in one_time_keys.items():
@@ -335,7 +333,7 @@ class FederationClient(FederationBase):
     @tag_args
     async def backfill(
         self, dest: str, room_id: str, limit: int, extremities: Collection[str]
-    ) -> Optional[List[EventBase]]:
+    ) -> list[EventBase] | None:
         """Requests some more historic PDUs for the given room from the
         given destination server.
 
@@ -382,8 +380,8 @@ class FederationClient(FederationBase):
         destination: str,
         event_id: str,
         room_version: RoomVersion,
-        timeout: Optional[int] = None,
-    ) -> Optional[EventBase]:
+        timeout: int | None = None,
+    ) -> EventBase | None:
         """Requests the PDU with given origin and ID from the remote home
         server. Does not have any caching or rate limiting!
 
@@ -441,59 +439,32 @@ class FederationClient(FederationBase):
 
     @trace
     @tag_args
-    async def get_pdu_policy_recommendation(
-        self, destination: str, pdu: EventBase, timeout: Optional[int] = None
-    ) -> str:
+    async def ask_policy_server_to_sign_event(
+        self, destination: str, pdu: EventBase, timeout: int | None = None
+    ) -> JsonDict:
         """Requests that the destination server (typically a policy server)
-        check the event and return its recommendation on how to handle the
-        event.
+        sign the event as not spam.
 
         If the policy server could not be contacted or the policy server
-        returned an unknown recommendation, this returns an OK recommendation.
-        This type fixing behaviour is done because the typical caller will be
-        in a critical call path and would generally interpret a `None` or similar
-        response as "weird value; don't care; move on without taking action". We
-        just frontload that logic here.
-
+        returned an error, that error is raised.
 
         Args:
             destination: The remote homeserver to ask (a policy server)
-            pdu: The event to check
+            pdu: The event to sign
             timeout: How long to try (in ms) the destination for before
                 giving up. None indicates no timeout.
-
         Returns:
-            The policy recommendation, or RECOMMENDATION_OK if the policy server was
-            uncontactable or returned an unknown recommendation.
+            The signature from the policy server, structured in the same was as the 'signatures'
+            JSON in the event e.g { "$policy_server_via_domain" : { "ed25519:policy_server": "signature_base64" }}
         """
-
         logger.debug(
-            "get_pdu_policy_recommendation for event_id=%s from %s",
+            "ask_policy_server_to_sign_event for event_id=%s from %s",
             pdu.event_id,
             destination,
         )
-
-        try:
-            res = await self.transport_layer.get_policy_recommendation_for_pdu(
-                destination, pdu, timeout=timeout
-            )
-            recommendation = res.get("recommendation")
-            if not isinstance(recommendation, str):
-                raise InvalidResponseError("recommendation is not a string")
-            if recommendation not in (RECOMMENDATION_OK, RECOMMENDATION_SPAM):
-                logger.warning(
-                    "get_pdu_policy_recommendation: unknown recommendation: %s",
-                    recommendation,
-                )
-                return RECOMMENDATION_OK
-            return recommendation
-        except Exception as e:
-            logger.warning(
-                "get_pdu_policy_recommendation: server %s responded with error, assuming OK recommendation: %s",
-                destination,
-                e,
-            )
-            return RECOMMENDATION_OK
+        return await self.transport_layer.ask_policy_server_to_sign_event(
+            destination, pdu, timeout=timeout
+        )
 
     @trace
     @tag_args
@@ -502,8 +473,8 @@ class FederationClient(FederationBase):
         destinations: Collection[str],
         event_id: str,
         room_version: RoomVersion,
-        timeout: Optional[int] = None,
-    ) -> Optional[PulledPduInfo]:
+        timeout: int | None = None,
+    ) -> PulledPduInfo | None:
         """Requests the PDU with given origin and ID from the remote home
         servers.
 
@@ -623,7 +594,7 @@ class FederationClient(FederationBase):
     @tag_args
     async def get_room_state_ids(
         self, destination: str, room_id: str, event_id: str
-    ) -> Tuple[List[str], List[str]]:
+    ) -> tuple[list[str], list[str]]:
         """Calls the /state_ids endpoint to fetch the state at a particular point
         in the room, and the auth events for the given event
 
@@ -672,7 +643,7 @@ class FederationClient(FederationBase):
         room_id: str,
         event_id: str,
         room_version: RoomVersion,
-    ) -> Tuple[List[EventBase], List[EventBase]]:
+    ) -> tuple[list[EventBase], list[EventBase]]:
         """Calls the /state endpoint to fetch the state at a particular point
         in the room.
 
@@ -733,7 +704,7 @@ class FederationClient(FederationBase):
         origin: str,
         pdus: Collection[EventBase],
         room_version: RoomVersion,
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         """
         Checks the signatures and hashes of a list of pulled events we got from
         federation and records any signature failures as failed pull attempts.
@@ -767,7 +738,7 @@ class FederationClient(FederationBase):
         # We limit how many PDUs we check at once, as if we try to do hundreds
         # of thousands of PDUs at once we see large memory spikes.
 
-        valid_pdus: List[EventBase] = []
+        valid_pdus: list[EventBase] = []
 
         async def _record_failure_callback(event: EventBase, cause: str) -> None:
             await self.store.record_event_failed_pull_attempt(
@@ -796,10 +767,9 @@ class FederationClient(FederationBase):
         pdu: EventBase,
         origin: str,
         room_version: RoomVersion,
-        record_failure_callback: Optional[
-            Callable[[EventBase, str], Awaitable[None]]
-        ] = None,
-    ) -> Optional[EventBase]:
+        record_failure_callback: Callable[[EventBase, str], Awaitable[None]]
+        | None = None,
+    ) -> EventBase | None:
         """Takes a PDU and checks its signatures and hashes.
 
         If the PDU fails its signature check then we check if we have it in the
@@ -877,7 +847,7 @@ class FederationClient(FederationBase):
 
     async def get_event_auth(
         self, destination: str, room_id: str, event_id: str
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         res = await self.transport_layer.get_event_auth(destination, room_id, event_id)
 
         room_version = await self.store.get_room_version(room_id)
@@ -895,7 +865,7 @@ class FederationClient(FederationBase):
         description: str,
         destinations: Iterable[str],
         callback: Callable[[str], Awaitable[T]],
-        failover_errcodes: Optional[Container[str]] = None,
+        failover_errcodes: Container[str] | None = None,
         failover_on_unknown_endpoint: bool = False,
     ) -> T:
         """Try an operation on a series of servers, until it succeeds
@@ -1010,8 +980,8 @@ class FederationClient(FederationBase):
         user_id: str,
         membership: str,
         content: dict,
-        params: Optional[Mapping[str, Union[str, Iterable[str]]]],
-    ) -> Tuple[str, EventBase, RoomVersion]:
+        params: Mapping[str, str | Iterable[str]] | None,
+    ) -> tuple[str, EventBase, RoomVersion]:
         """
         Creates an m.room.member event, with context, without participating in the room.
 
@@ -1053,7 +1023,7 @@ class FederationClient(FederationBase):
                 % (membership, ",".join(valid_memberships))
             )
 
-        async def send_request(destination: str) -> Tuple[str, EventBase, RoomVersion]:
+        async def send_request(destination: str) -> tuple[str, EventBase, RoomVersion]:
             ret = await self.transport_layer.make_membership_event(
                 destination, room_id, user_id, membership, params
             )
@@ -1198,7 +1168,7 @@ class FederationClient(FederationBase):
             # We now go and check the signatures and hashes for the event. Note
             # that we limit how many events we process at a time to keep the
             # memory overhead from exploding.
-            valid_pdus_map: Dict[str, EventBase] = {}
+            valid_pdus_map: dict[str, EventBase] = {}
 
             async def _execute(pdu: EventBase) -> None:
                 valid_pdu = await self._check_sigs_and_hash_and_fetch_one(
@@ -1468,7 +1438,7 @@ class FederationClient(FederationBase):
         # content.
         return resp[1]
 
-    async def send_knock(self, destinations: List[str], pdu: EventBase) -> JsonDict:
+    async def send_knock(self, destinations: list[str], pdu: EventBase) -> JsonDict:
         """Attempts to send a knock event to a given list of servers. Iterates
         through the list until one attempt succeeds.
 
@@ -1527,11 +1497,11 @@ class FederationClient(FederationBase):
     async def get_public_rooms(
         self,
         remote_server: str,
-        limit: Optional[int] = None,
-        since_token: Optional[str] = None,
-        search_filter: Optional[Dict] = None,
+        limit: int | None = None,
+        since_token: str | None = None,
+        search_filter: dict | None = None,
         include_all_networks: bool = False,
-        third_party_instance_id: Optional[str] = None,
+        third_party_instance_id: str | None = None,
     ) -> JsonDict:
         """Get the list of public rooms from a remote homeserver
 
@@ -1573,7 +1543,7 @@ class FederationClient(FederationBase):
         limit: int,
         min_depth: int,
         timeout: int,
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         """Tries to fetch events we are missing. This is called when we receive
         an event without having received all of its ancestors.
 
@@ -1640,7 +1610,7 @@ class FederationClient(FederationBase):
 
     async def get_room_complexity(
         self, destination: str, room_id: str
-    ) -> Optional[JsonDict]:
+    ) -> JsonDict | None:
         """
         Fetch the complexity of a remote room from another server.
 
@@ -1679,7 +1649,7 @@ class FederationClient(FederationBase):
         destinations: Iterable[str],
         room_id: str,
         suggested_only: bool,
-    ) -> Tuple[JsonDict, Sequence[JsonDict], Sequence[JsonDict], Sequence[str]]:
+    ) -> tuple[JsonDict, Sequence[JsonDict], Sequence[JsonDict], Sequence[str]]:
         """
         Call other servers to get a hierarchy of the given room.
 
@@ -1710,7 +1680,7 @@ class FederationClient(FederationBase):
 
         async def send_request(
             destination: str,
-        ) -> Tuple[JsonDict, Sequence[JsonDict], Sequence[JsonDict], Sequence[str]]:
+        ) -> tuple[JsonDict, Sequence[JsonDict], Sequence[JsonDict], Sequence[str]]:
             try:
                 res = await self.transport_layer.get_room_hierarchy(
                     destination=destination,
@@ -1885,8 +1855,8 @@ class FederationClient(FederationBase):
             raise InvalidResponseError(str(e))
 
     async def get_account_status(
-        self, destination: str, user_ids: List[str]
-    ) -> Tuple[JsonDict, List[str]]:
+        self, destination: str, user_ids: list[str]
+    ) -> tuple[JsonDict, list[str]]:
         """Retrieves account statuses for a given list of users on a given remote
         homeserver.
 
@@ -1951,10 +1921,10 @@ class FederationClient(FederationBase):
         max_timeout_ms: int,
         download_ratelimiter: Ratelimiter,
         ip_address: str,
-    ) -> Union[
-        Tuple[int, Dict[bytes, List[bytes]], bytes],
-        Tuple[int, Dict[bytes, List[bytes]]],
-    ]:
+    ) -> (
+        tuple[int, dict[bytes, list[bytes]], bytes]
+        | tuple[int, dict[bytes, list[bytes]]]
+    ):
         try:
             return await self.transport_layer.federation_download_media(
                 destination,
@@ -1997,7 +1967,7 @@ class FederationClient(FederationBase):
         max_timeout_ms: int,
         download_ratelimiter: Ratelimiter,
         ip_address: str,
-    ) -> Tuple[int, Dict[bytes, List[bytes]]]:
+    ) -> tuple[int, dict[bytes, list[bytes]]]:
         try:
             return await self.transport_layer.download_media_v3(
                 destination,
diff --git a/synapse/federation/federation_server.py b/synapse/federation/federation_server.py
index a8d5c3c280..eff6d63789 100644
--- a/synapse/federation/federation_server.py
+++ b/synapse/federation/federation_server.py
@@ -4,6 +4,7 @@
 # Copyright 2019-2021 Matrix.org Federation C.I.C
 # Copyright 2015, 2016 OpenMarket Ltd
 # Copyright (C) 2023 New Vector, Ltd
+# Copyright (C) 2025 Element Creations Ltd
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@@ -27,12 +28,7 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Union,
 )
 
 from prometheus_client import Counter, Gauge, Histogram
@@ -94,6 +90,7 @@ from synapse.types import JsonDict, StateMap, UserID, get_domain_from_id
 from synapse.util import unwrapFirstError
 from synapse.util.async_helpers import Linearizer, concurrently_execute, gather_results
 from synapse.util.caches.response_cache import ResponseCache
+from synapse.util.duration import Duration
 from synapse.util.stringutils import parse_server_name
 
 if TYPE_CHECKING:
@@ -159,18 +156,18 @@ class FederationServer(FederationBase):
         # with FederationHandlerRegistry.
         hs.get_directory_handler()
 
-        self._server_linearizer = Linearizer("fed_server")
+        self._server_linearizer = Linearizer(name="fed_server", clock=hs.get_clock())
 
         # origins that we are currently processing a transaction from.
         # a dict from origin to txn id.
-        self._active_transactions: Dict[str, str] = {}
+        self._active_transactions: dict[str, str] = {}
 
         # We cache results for transaction with the same ID
-        self._transaction_resp_cache: ResponseCache[Tuple[str, str]] = ResponseCache(
+        self._transaction_resp_cache: ResponseCache[tuple[str, str]] = ResponseCache(
             clock=hs.get_clock(),
             name="fed_txn_handler",
             server_name=self.server_name,
-            timeout_ms=30000,
+            timeout=Duration(seconds=30),
         )
 
         self.transaction_actions = TransactionActions(self.store)
@@ -179,19 +176,17 @@ class FederationServer(FederationBase):
 
         # We cache responses to state queries, as they take a while and often
         # come in waves.
-        self._state_resp_cache: ResponseCache[Tuple[str, Optional[str]]] = (
-            ResponseCache(
-                clock=hs.get_clock(),
-                name="state_resp",
-                server_name=self.server_name,
-                timeout_ms=30000,
-            )
+        self._state_resp_cache: ResponseCache[tuple[str, str | None]] = ResponseCache(
+            clock=hs.get_clock(),
+            name="state_resp",
+            server_name=self.server_name,
+            timeout=Duration(seconds=30),
         )
-        self._state_ids_resp_cache: ResponseCache[Tuple[str, str]] = ResponseCache(
+        self._state_ids_resp_cache: ResponseCache[tuple[str, str]] = ResponseCache(
             clock=hs.get_clock(),
             name="state_ids_resp",
             server_name=self.server_name,
-            timeout_ms=30000,
+            timeout=Duration(seconds=30),
         )
 
         self._federation_metrics_domains = (
@@ -233,11 +228,11 @@ class FederationServer(FederationBase):
                 )
 
             # We pause a bit so that we don't start handling all rooms at once.
-            await self._clock.sleep(random.uniform(0, 0.1))
+            await self._clock.sleep(Duration(seconds=random.uniform(0, 0.1)))
 
     async def on_backfill_request(
-        self, origin: str, room_id: str, versions: List[str], limit: int
-    ) -> Tuple[int, Dict[str, Any]]:
+        self, origin: str, room_id: str, versions: list[str], limit: int
+    ) -> tuple[int, dict[str, Any]]:
         async with self._server_linearizer.queue((origin, room_id)):
             origin_host, _ = parse_server_name(origin)
             await self.check_server_matches_acl(origin_host, room_id)
@@ -252,7 +247,7 @@ class FederationServer(FederationBase):
 
     async def on_timestamp_to_event_request(
         self, origin: str, room_id: str, timestamp: int, direction: Direction
-    ) -> Tuple[int, Dict[str, Any]]:
+    ) -> tuple[int, dict[str, Any]]:
         """When we receive a federated `/timestamp_to_event` request,
         handle all of the logic for validating and fetching the event.
 
@@ -298,7 +293,7 @@ class FederationServer(FederationBase):
         transaction_id: str,
         destination: str,
         transaction_data: JsonDict,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # If we receive a transaction we should make sure that kick off handling
         # any old events in the staging area.
         if not self._started_handling_of_staged_events:
@@ -308,7 +303,9 @@ class FederationServer(FederationBase):
             # Start a periodic check for old staged events. This is to handle
             # the case where locks time out, e.g. if another process gets killed
             # without dropping its locks.
-            self._clock.looping_call(self._handle_old_staged_events, 60 * 1000)
+            self._clock.looping_call(
+                self._handle_old_staged_events, Duration(minutes=1)
+            )
 
         # keep this as early as possible to make the calculated origin ts as
         # accurate as possible.
@@ -365,7 +362,7 @@ class FederationServer(FederationBase):
 
     async def _on_incoming_transaction_inner(
         self, origin: str, transaction: Transaction, request_time: int
-    ) -> Tuple[int, Dict[str, Any]]:
+    ) -> tuple[int, dict[str, Any]]:
         # CRITICAL SECTION: the first thing we must do (before awaiting) is
         # add an entry to _active_transactions.
         assert origin not in self._active_transactions
@@ -381,7 +378,7 @@ class FederationServer(FederationBase):
 
     async def _handle_incoming_transaction(
         self, origin: str, transaction: Transaction, request_time: int
-    ) -> Tuple[int, Dict[str, Any]]:
+    ) -> tuple[int, dict[str, Any]]:
         """Process an incoming transaction and return the HTTP response
 
         Args:
@@ -429,7 +426,7 @@ class FederationServer(FederationBase):
 
     async def _handle_pdus_in_txn(
         self, origin: str, transaction: Transaction, request_time: int
-    ) -> Dict[str, dict]:
+    ) -> dict[str, dict]:
         """Process the PDUs in a received transaction.
 
         Args:
@@ -448,7 +445,7 @@ class FederationServer(FederationBase):
 
         origin_host, _ = parse_server_name(origin)
 
-        pdus_by_room: Dict[str, List[EventBase]] = {}
+        pdus_by_room: dict[str, list[EventBase]] = {}
 
         newest_pdu_ts = 0
 
@@ -601,7 +598,7 @@ class FederationServer(FederationBase):
 
     async def on_room_state_request(
         self, origin: str, room_id: str, event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self._event_auth_handler.assert_host_in_room(room_id, origin)
         origin_host, _ = parse_server_name(origin)
         await self.check_server_matches_acl(origin_host, room_id)
@@ -625,7 +622,7 @@ class FederationServer(FederationBase):
     @tag_args
     async def on_state_ids_request(
         self, origin: str, room_id: str, event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         if not event_id:
             raise NotImplementedError("Specify an event")
 
@@ -653,7 +650,7 @@ class FederationServer(FederationBase):
 
     async def _on_context_state_request_compute(
         self, room_id: str, event_id: str
-    ) -> Dict[str, list]:
+    ) -> dict[str, list]:
         pdus: Collection[EventBase]
         event_ids = await self.handler.get_state_ids_for_pdu(room_id, event_id)
         pdus = await self.store.get_events_as_list(event_ids)
@@ -669,7 +666,7 @@ class FederationServer(FederationBase):
 
     async def on_pdu_request(
         self, origin: str, event_id: str
-    ) -> Tuple[int, Union[JsonDict, str]]:
+    ) -> tuple[int, JsonDict | str]:
         pdu = await self.handler.get_persisted_pdu(origin, event_id)
 
         if pdu:
@@ -678,8 +675,8 @@ class FederationServer(FederationBase):
             return 404, ""
 
     async def on_query_request(
-        self, query_type: str, args: Dict[str, str]
-    ) -> Tuple[int, Dict[str, Any]]:
+        self, query_type: str, args: dict[str, str]
+    ) -> tuple[int, dict[str, Any]]:
         received_queries_counter.labels(
             type=query_type,
             **{SERVER_NAME_LABEL: self.server_name},
@@ -687,9 +684,21 @@ class FederationServer(FederationBase):
         resp = await self.registry.on_query(query_type, args)
         return 200, resp
 
+    async def on_get_extremities_request(self, origin: str, room_id: str) -> JsonDict:
+        # Assert host in room first to hide contents of the ACL from the caller
+        await self._event_auth_handler.assert_host_in_room(room_id, origin)
+        origin_host, _ = parse_server_name(origin)
+        await self.check_server_matches_acl(origin_host, room_id)
+
+        extremities = await self.store.get_forward_extremities_for_room(room_id)
+        prev_event_ids = [event_id for event_id, _, _, _ in extremities]
+        if len(prev_event_ids) == 0:
+            raise SynapseError(500, "Room has no forward extremities")
+        return {"prev_events": prev_event_ids}
+
     async def on_make_join_request(
-        self, origin: str, room_id: str, user_id: str, supported_versions: List[str]
-    ) -> Dict[str, Any]:
+        self, origin: str, room_id: str, user_id: str, supported_versions: list[str]
+    ) -> dict[str, Any]:
         origin_host, _ = parse_server_name(origin)
         await self.check_server_matches_acl(origin_host, room_id)
 
@@ -714,7 +723,7 @@ class FederationServer(FederationBase):
 
     async def on_invite_request(
         self, origin: str, content: JsonDict, room_version_id: str
-    ) -> Dict[str, Any]:
+    ) -> dict[str, Any]:
         room_version = KNOWN_ROOM_VERSIONS.get(room_version_id)
         if not room_version:
             raise SynapseError(
@@ -748,7 +757,7 @@ class FederationServer(FederationBase):
         content: JsonDict,
         room_id: str,
         caller_supports_partial_state: bool = False,
-    ) -> Dict[str, Any]:
+    ) -> dict[str, Any]:
         set_tag(
             SynapseTags.SEND_JOIN_RESPONSE_IS_PARTIAL_STATE,
             caller_supports_partial_state,
@@ -766,7 +775,7 @@ class FederationServer(FederationBase):
         prev_state_ids = await context.get_prev_state_ids()
 
         state_event_ids: Collection[str]
-        servers_in_room: Optional[Collection[str]]
+        servers_in_room: Collection[str] | None
         if caller_supports_partial_state:
             summary = await self.store.get_room_summary(room_id)
             state_event_ids = _get_event_ids_for_partial_state_join(
@@ -809,7 +818,7 @@ class FederationServer(FederationBase):
 
     async def on_make_leave_request(
         self, origin: str, room_id: str, user_id: str
-    ) -> Dict[str, Any]:
+    ) -> dict[str, Any]:
         origin_host, _ = parse_server_name(origin)
         await self.check_server_matches_acl(origin_host, room_id)
         pdu = await self.handler.on_make_leave_request(origin, room_id, user_id)
@@ -826,7 +835,7 @@ class FederationServer(FederationBase):
         return {}
 
     async def on_make_knock_request(
-        self, origin: str, room_id: str, user_id: str, supported_versions: List[str]
+        self, origin: str, room_id: str, user_id: str, supported_versions: list[str]
     ) -> JsonDict:
         """We've received a /make_knock/ request, so we create a partial knock
         event for the room and hand that back, along with the room version, to the knocking
@@ -884,7 +893,7 @@ class FederationServer(FederationBase):
         origin: str,
         content: JsonDict,
         room_id: str,
-    ) -> Dict[str, List[JsonDict]]:
+    ) -> dict[str, list[JsonDict]]:
         """
         We have received a knock event for a room. Verify and send the event into the room
         on the knocking homeserver's behalf. Then reply with some stripped state from the
@@ -1034,7 +1043,7 @@ class FederationServer(FederationBase):
 
     async def on_event_auth(
         self, origin: str, room_id: str, event_id: str
-    ) -> Tuple[int, Dict[str, Any]]:
+    ) -> tuple[int, dict[str, Any]]:
         async with self._server_linearizer.queue((origin, room_id)):
             await self._event_auth_handler.assert_host_in_room(room_id, origin)
             origin_host, _ = parse_server_name(origin)
@@ -1046,20 +1055,20 @@ class FederationServer(FederationBase):
         return 200, res
 
     async def on_query_client_keys(
-        self, origin: str, content: Dict[str, str]
-    ) -> Tuple[int, Dict[str, Any]]:
+        self, origin: str, content: dict[str, str]
+    ) -> tuple[int, dict[str, Any]]:
         return await self.on_query_request("client_keys", content)
 
     async def on_query_user_devices(
         self, origin: str, user_id: str
-    ) -> Tuple[int, Dict[str, Any]]:
+    ) -> tuple[int, dict[str, Any]]:
         keys = await self.device_handler.on_federation_query_user_devices(user_id)
         return 200, keys
 
     @trace
     async def on_claim_client_keys(
-        self, query: List[Tuple[str, str, str, int]], always_include_fallback_keys: bool
-    ) -> Dict[str, Any]:
+        self, query: list[tuple[str, str, str, int]], always_include_fallback_keys: bool
+    ) -> dict[str, Any]:
         if any(
             not self.hs.is_mine(UserID.from_string(user_id))
             for user_id, _, _, _ in query
@@ -1071,7 +1080,7 @@ class FederationServer(FederationBase):
             query, always_include_fallback_keys=always_include_fallback_keys
         )
 
-        json_result: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
+        json_result: dict[str, dict[str, dict[str, JsonDict]]] = {}
         for result in results:
             for user_id, device_keys in result.items():
                 for device_id, keys in device_keys.items():
@@ -1098,10 +1107,10 @@ class FederationServer(FederationBase):
         self,
         origin: str,
         room_id: str,
-        earliest_events: List[str],
-        latest_events: List[str],
+        earliest_events: list[str],
+        latest_events: list[str],
         limit: int,
-    ) -> Dict[str, list]:
+    ) -> dict[str, list]:
         async with self._server_linearizer.queue((origin, room_id)):
             origin_host, _ = parse_server_name(origin)
             await self.check_server_matches_acl(origin_host, room_id)
@@ -1129,11 +1138,11 @@ class FederationServer(FederationBase):
 
         return {"events": serialize_and_filter_pdus(missing_events, time_now)}
 
-    async def on_openid_userinfo(self, token: str) -> Optional[str]:
+    async def on_openid_userinfo(self, token: str) -> str | None:
         ts_now_ms = self._clock.time_msec()
         return await self.store.get_user_id_for_open_id_token(token, ts_now_ms)
 
-    def _transaction_dict_from_pdus(self, pdu_list: List[EventBase]) -> JsonDict:
+    def _transaction_dict_from_pdus(self, pdu_list: list[EventBase]) -> JsonDict:
         """Returns a new Transaction containing the given PDUs suitable for
         transmission.
         """
@@ -1208,7 +1217,7 @@ class FederationServer(FederationBase):
 
     async def _get_next_nonspam_staged_event_for_room(
         self, room_id: str, room_version: RoomVersion
-    ) -> Optional[Tuple[str, EventBase]]:
+    ) -> tuple[str, EventBase] | None:
         """Fetch the first non-spam event from staging queue.
 
         Args:
@@ -1249,8 +1258,8 @@ class FederationServer(FederationBase):
         room_id: str,
         room_version: RoomVersion,
         lock: Lock,
-        latest_origin: Optional[str] = None,
-        latest_event: Optional[EventBase] = None,
+        latest_origin: str | None = None,
+        latest_event: EventBase | None = None,
     ) -> None:
         """Process events in the staging area for the given room.
 
@@ -1363,13 +1372,13 @@ class FederationServer(FederationBase):
             lock = new_lock
 
     async def exchange_third_party_invite(
-        self, sender_user_id: str, target_user_id: str, room_id: str, signed: Dict
+        self, sender_user_id: str, target_user_id: str, room_id: str, signed: dict
     ) -> None:
         await self.handler.exchange_third_party_invite(
             sender_user_id, target_user_id, room_id, signed
         )
 
-    async def on_exchange_third_party_invite_request(self, event_dict: Dict) -> None:
+    async def on_exchange_third_party_invite_request(self, event_dict: dict) -> None:
         await self.handler.on_exchange_third_party_invite_request(event_dict)
 
     async def check_server_matches_acl(self, server_name: str, room_id: str) -> None:
@@ -1407,13 +1416,13 @@ class FederationHandlerRegistry:
         # the case.
         self._send_edu = ReplicationFederationSendEduRestServlet.make_client(hs)
 
-        self.edu_handlers: Dict[str, Callable[[str, dict], Awaitable[None]]] = {}
-        self.query_handlers: Dict[str, Callable[[dict], Awaitable[JsonDict]]] = {}
+        self.edu_handlers: dict[str, Callable[[str, dict], Awaitable[None]]] = {}
+        self.query_handlers: dict[str, Callable[[dict], Awaitable[JsonDict]]] = {}
 
         # Map from type to instance names that we should route EDU handling to.
         # We randomly choose one instance from the list to route to for each new
         # EDU received.
-        self._edu_type_to_instance: Dict[str, List[str]] = {}
+        self._edu_type_to_instance: dict[str, list[str]] = {}
 
     def register_edu_handler(
         self, edu_type: str, handler: Callable[[str, JsonDict], Awaitable[None]]
@@ -1455,7 +1464,7 @@ class FederationHandlerRegistry:
         self.query_handlers[query_type] = handler
 
     def register_instances_for_edu(
-        self, edu_type: str, instance_names: List[str]
+        self, edu_type: str, instance_names: list[str]
     ) -> None:
         """Register that the EDU handler is on multiple instances."""
         self._edu_type_to_instance[edu_type] = instance_names
diff --git a/synapse/federation/persistence.py b/synapse/federation/persistence.py
index 8340b48503..dca13191fc 100644
--- a/synapse/federation/persistence.py
+++ b/synapse/federation/persistence.py
@@ -27,7 +27,6 @@ These actions are mostly only used by the :py:mod:`.replication` module.
 """
 
 import logging
-from typing import Optional, Tuple
 
 from synapse.federation.units import Transaction
 from synapse.storage.databases.main import DataStore
@@ -44,7 +43,7 @@ class TransactionActions:
 
     async def have_responded(
         self, origin: str, transaction: Transaction
-    ) -> Optional[Tuple[int, JsonDict]]:
+    ) -> tuple[int, JsonDict] | None:
         """Have we already responded to a transaction with the same id and
         origin?
 
diff --git a/synapse/federation/send_queue.py b/synapse/federation/send_queue.py
index 7f511d570c..4a6d155217 100644
--- a/synapse/federation/send_queue.py
+++ b/synapse/federation/send_queue.py
@@ -37,16 +37,12 @@ Events are replicated via a separate events stream.
 """
 
 import logging
+from enum import Enum
 from typing import (
     TYPE_CHECKING,
-    Dict,
     Hashable,
     Iterable,
-    List,
-    Optional,
     Sized,
-    Tuple,
-    Type,
 )
 
 import attr
@@ -57,6 +53,7 @@ from synapse.federation.sender import AbstractFederationSender, FederationSender
 from synapse.metrics import SERVER_NAME_LABEL, LaterGauge
 from synapse.replication.tcp.streams.federation import FederationStream
 from synapse.types import JsonDict, ReadReceipt, RoomStreamToken, StrCollection
+from synapse.util.duration import Duration
 from synapse.util.metrics import Measure
 
 from .units import Edu
@@ -67,6 +64,25 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+class QueueNames(str, Enum):
+    PRESENCE_MAP = "presence_map"
+    KEYED_EDU = "keyed_edu"
+    KEYED_EDU_CHANGED = "keyed_edu_changed"
+    EDUS = "edus"
+    POS_TIME = "pos_time"
+    PRESENCE_DESTINATIONS = "presence_destinations"
+
+
+queue_name_to_gauge_map: dict[QueueNames, LaterGauge] = {}
+
+for queue_name in QueueNames:
+    queue_name_to_gauge_map[queue_name] = LaterGauge(
+        name=f"synapse_federation_send_queue_{queue_name.value}_size",
+        desc="",
+        labelnames=[SERVER_NAME_LABEL],
+    )
+
+
 class FederationRemoteSendQueue(AbstractFederationSender):
     """A drop in replacement for FederationSender"""
 
@@ -80,23 +96,23 @@ class FederationRemoteSendQueue(AbstractFederationSender):
         # We may have multiple federation sender instances, so we need to track
         # their positions separately.
         self._sender_instances = hs.config.worker.federation_shard_config.instances
-        self._sender_positions: Dict[str, int] = {}
+        self._sender_positions: dict[str, int] = {}
 
         # Pending presence map user_id -> UserPresenceState
-        self.presence_map: Dict[str, UserPresenceState] = {}
+        self.presence_map: dict[str, UserPresenceState] = {}
 
         # Stores the destinations we need to explicitly send presence to about a
         # given user.
         # Stream position -> (user_id, destinations)
-        self.presence_destinations: SortedDict[int, Tuple[str, Iterable[str]]] = (
+        self.presence_destinations: SortedDict[int, tuple[str, Iterable[str]]] = (
             SortedDict()
         )
 
         # (destination, key) -> EDU
-        self.keyed_edu: Dict[Tuple[str, tuple], Edu] = {}
+        self.keyed_edu: dict[tuple[str, tuple], Edu] = {}
 
         # stream position -> (destination, key)
-        self.keyed_edu_changed: SortedDict[int, Tuple[str, tuple]] = SortedDict()
+        self.keyed_edu_changed: SortedDict[int, tuple[str, tuple]] = SortedDict()
 
         self.edus: SortedDict[int, Edu] = SortedDict()
 
@@ -111,25 +127,21 @@ class FederationRemoteSendQueue(AbstractFederationSender):
         # we make a new function, so we need to make a new function so the inner
         # lambda binds to the queue rather than to the name of the queue which
         # changes. ARGH.
-        def register(name: str, queue: Sized) -> None:
-            LaterGauge(
-                name="synapse_federation_send_queue_%s_size" % (queue_name,),
-                desc="",
-                labelnames=[SERVER_NAME_LABEL],
-                caller=lambda: {(self.server_name,): len(queue)},
+        def register(queue_name: QueueNames, queue: Sized) -> None:
+            queue_name_to_gauge_map[queue_name].register_hook(
+                homeserver_instance_id=hs.get_instance_id(),
+                hook=lambda: {(self.server_name,): len(queue)},
             )
 
-        for queue_name in [
-            "presence_map",
-            "keyed_edu",
-            "keyed_edu_changed",
-            "edus",
-            "pos_time",
-            "presence_destinations",
-        ]:
-            register(queue_name, getattr(self, queue_name))
+        for queue_name in QueueNames:
+            queue = getattr(self, queue_name.value)
+            assert isinstance(queue, Sized)
+            register(queue_name, queue=queue)
 
-        self.clock.looping_call(self._clear_queue, 30 * 1000)
+        self.clock.looping_call(self._clear_queue, Duration(seconds=30))
+
+    def shutdown(self) -> None:
+        """Stops this federation sender instance from sending further transactions."""
 
     def _next_pos(self) -> int:
         pos = self.pos
@@ -205,7 +217,7 @@ class FederationRemoteSendQueue(AbstractFederationSender):
         destination: str,
         edu_type: str,
         content: JsonDict,
-        key: Optional[Hashable] = None,
+        key: Hashable | None = None,
     ) -> None:
         """As per FederationSender"""
         if self.is_mine_server_name(destination):
@@ -279,7 +291,7 @@ class FederationRemoteSendQueue(AbstractFederationSender):
 
     async def get_replication_rows(
         self, instance_name: str, from_token: int, to_token: int, target_row_count: int
-    ) -> Tuple[List[Tuple[int, Tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         """Get rows to be sent over federation between the two tokens
 
         Args:
@@ -302,7 +314,7 @@ class FederationRemoteSendQueue(AbstractFederationSender):
 
         # list of tuple(int, BaseFederationRow), where the first is the position
         # of the federation stream.
-        rows: List[Tuple[int, BaseFederationRow]] = []
+        rows: list[tuple[int, BaseFederationRow]] = []
 
         # Fetch presence to send to destinations
         i = self.presence_destinations.bisect_right(from_token)
@@ -397,7 +409,7 @@ class BaseFederationRow:
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class PresenceDestinationsRow(BaseFederationRow):
     state: UserPresenceState
-    destinations: List[str]
+    destinations: list[str]
 
     TypeId = "pd"
 
@@ -420,7 +432,7 @@ class KeyedEduRow(BaseFederationRow):
     typing EDUs clobber based on room_id.
     """
 
-    key: Tuple[str, ...]  # the edu key passed to send_edu
+    key: tuple[str, ...]  # the edu key passed to send_edu
     edu: Edu
 
     TypeId = "k"
@@ -455,7 +467,7 @@ class EduRow(BaseFederationRow):
         buff.edus.setdefault(self.edu.destination, []).append(self.edu)
 
 
-_rowtypes: Tuple[Type[BaseFederationRow], ...] = (
+_rowtypes: tuple[type[BaseFederationRow], ...] = (
     PresenceDestinationsRow,
     KeyedEduRow,
     EduRow,
@@ -467,16 +479,16 @@ TypeToRow = {Row.TypeId: Row for Row in _rowtypes}
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class ParsedFederationStreamData:
     # list of tuples of UserPresenceState and destinations
-    presence_destinations: List[Tuple[UserPresenceState, List[str]]]
+    presence_destinations: list[tuple[UserPresenceState, list[str]]]
     # dict of destination -> { key -> Edu }
-    keyed_edus: Dict[str, Dict[Tuple[str, ...], Edu]]
+    keyed_edus: dict[str, dict[tuple[str, ...], Edu]]
     # dict of destination -> [Edu]
-    edus: Dict[str, List[Edu]]
+    edus: dict[str, list[Edu]]
 
 
 async def process_rows_for_federation(
     transaction_queue: FederationSender,
-    rows: List[FederationStream.FederationStreamRow],
+    rows: list[FederationStream.FederationStreamRow],
 ) -> None:
     """Parse a list of rows from the federation stream and put them in the
     transaction queue ready for sending to the relevant homeservers.
diff --git a/synapse/federation/sender/__init__.py b/synapse/federation/sender/__init__.py
index 8befbe3722..f7240c2f7f 100644
--- a/synapse/federation/sender/__init__.py
+++ b/synapse/federation/sender/__init__.py
@@ -135,13 +135,9 @@ from collections import OrderedDict
 from typing import (
     TYPE_CHECKING,
     Collection,
-    Dict,
     Hashable,
     Iterable,
-    List,
     Literal,
-    Optional,
-    Tuple,
 )
 
 import attr
@@ -150,6 +146,7 @@ from prometheus_client import Counter
 from twisted.internet import defer
 
 import synapse.metrics
+from synapse.api.constants import EventTypes, Membership
 from synapse.api.presence import UserPresenceState
 from synapse.events import EventBase
 from synapse.federation.sender.per_destination_queue import (
@@ -167,7 +164,6 @@ from synapse.metrics import (
     events_processed_counter,
 )
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.types import (
@@ -177,7 +173,8 @@ from synapse.types import (
     StrCollection,
     get_domain_from_id,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.metrics import Measure
 from synapse.util.retryutils import filter_destinations_by_retry_limiter
 
@@ -199,20 +196,43 @@ sent_pdus_destination_dist_total = Counter(
     labelnames=[SERVER_NAME_LABEL],
 )
 
+transaction_queue_pending_destinations_gauge = LaterGauge(
+    name="synapse_federation_transaction_queue_pending_destinations",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
+transaction_queue_pending_pdus_gauge = LaterGauge(
+    name="synapse_federation_transaction_queue_pending_pdus",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
+transaction_queue_pending_edus_gauge = LaterGauge(
+    name="synapse_federation_transaction_queue_pending_edus",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
 # Time (in s) to wait before trying to wake up destinations that have
 # catch-up outstanding.
 # Please note that rate limiting still applies, so while the loop is
 # executed every X seconds the destinations may not be woken up because
 # they are being rate limited following previous attempt failures.
-WAKEUP_RETRY_PERIOD_SEC = 60
+WAKEUP_RETRY_PERIOD = Duration(minutes=1)
 
-# Time (in s) to wait in between waking up each destination, i.e. one destination
+# Time to wait in between waking up each destination, i.e. one destination
 # will be woken up every <x> seconds until we have woken every destination
 # has outstanding catch-up.
-WAKEUP_INTERVAL_BETWEEN_DESTINATIONS_SEC = 5
+WAKEUP_INTERVAL_BETWEEN_DESTINATIONS = Duration(seconds=5)
 
 
 class AbstractFederationSender(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def shutdown(self) -> None:
+        """Stops this federation sender instance from sending further transactions."""
+        raise NotImplementedError()
+
     @abc.abstractmethod
     def notify_new_events(self, max_token: RoomStreamToken) -> None:
         """This gets called when we have some new events we might want to
@@ -246,7 +266,7 @@ class AbstractFederationSender(metaclass=abc.ABCMeta):
         destination: str,
         edu_type: str,
         content: JsonDict,
-        key: Optional[Hashable] = None,
+        key: Hashable | None = None,
     ) -> None:
         """Construct an Edu object, and queue it for sending
 
@@ -289,7 +309,7 @@ class AbstractFederationSender(metaclass=abc.ABCMeta):
     @abc.abstractmethod
     async def get_replication_rows(
         self, instance_name: str, from_token: int, to_token: int, target_row_count: int
-    ) -> Tuple[List[Tuple[int, Tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         raise NotImplementedError()
 
 
@@ -307,6 +327,7 @@ class _DestinationWakeupQueue:
     _MAX_TIME_IN_QUEUE = 30.0
 
     sender: "FederationSender" = attr.ib()
+    hs: "HomeServer" = attr.ib()
     server_name: str = attr.ib()
     """
     Our homeserver name (used to label metrics) (`hs.hostname`).
@@ -359,7 +380,7 @@ class _DestinationWakeupQueue:
 
                 queue.attempt_new_transaction()
 
-                await self.clock.sleep(current_sleep_seconds)
+                await self.clock.sleep(Duration(seconds=current_sleep_seconds))
 
                 if not self.queue:
                     break
@@ -389,20 +410,18 @@ class FederationSender(AbstractFederationSender):
         self.is_mine_id = hs.is_mine_id
         self.is_mine_server_name = hs.is_mine_server_name
 
-        self._presence_router: Optional["PresenceRouter"] = None
+        self._presence_router: "PresenceRouter" | None = None
         self._transaction_manager = TransactionManager(hs)
 
         self._instance_name = hs.get_instance_name()
         self._federation_shard_config = hs.config.worker.federation_shard_config
 
         # map from destination to PerDestinationQueue
-        self._per_destination_queues: Dict[str, PerDestinationQueue] = {}
+        self._per_destination_queues: dict[str, PerDestinationQueue] = {}
 
-        LaterGauge(
-            name="synapse_federation_transaction_queue_pending_destinations",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {
+        transaction_queue_pending_destinations_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {
                 (self.server_name,): sum(
                     1
                     for d in self._per_destination_queues.values()
@@ -410,22 +429,17 @@ class FederationSender(AbstractFederationSender):
                 )
             },
         )
-
-        LaterGauge(
-            name="synapse_federation_transaction_queue_pending_pdus",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {
+        transaction_queue_pending_pdus_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {
                 (self.server_name,): sum(
                     d.pending_pdu_count() for d in self._per_destination_queues.values()
                 )
             },
         )
-        LaterGauge(
-            name="synapse_federation_transaction_queue_pending_edus",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {
+        transaction_queue_pending_edus_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {
                 (self.server_name,): sum(
                     d.pending_edu_count() for d in self._per_destination_queues.values()
                 )
@@ -441,21 +455,33 @@ class FederationSender(AbstractFederationSender):
             1.0 / hs.config.ratelimiting.federation_rr_transactions_per_room_per_second
         )
         self._destination_wakeup_queue = _DestinationWakeupQueue(
-            self, self.server_name, self.clock, max_delay_s=rr_txn_interval_per_room_s
+            self,
+            hs,
+            self.server_name,
+            self.clock,
+            max_delay_s=rr_txn_interval_per_room_s,
         )
 
+        # It is important for `_is_shutdown` to be instantiated before the looping call
+        # for `wake_destinations_needing_catchup`.
+        self._is_shutdown = False
+
         # Regularly wake up destinations that have outstanding PDUs to be caught up
         self.clock.looping_call_now(
-            run_as_background_process,
-            WAKEUP_RETRY_PERIOD_SEC * 1000.0,
+            self.hs.run_as_background_process,
+            WAKEUP_RETRY_PERIOD,
             "wake_destinations_needing_catchup",
-            self.server_name,
             self._wake_destinations_needing_catchup,
         )
 
+    def shutdown(self) -> None:
+        self._is_shutdown = True
+        for queue in self._per_destination_queues.values():
+            queue.shutdown()
+
     def _get_per_destination_queue(
         self, destination: str
-    ) -> Optional[PerDestinationQueue]:
+    ) -> PerDestinationQueue | None:
         """Get or create a PerDestinationQueue for the given destination
 
         Args:
@@ -491,16 +517,15 @@ class FederationSender(AbstractFederationSender):
             return
 
         # fire off a processing loop in the background
-        run_as_background_process(
+        self.hs.run_as_background_process(
             "process_event_queue_for_federation",
-            self.server_name,
             self._process_event_queue_loop,
         )
 
     async def _process_event_queue_loop(self) -> None:
         try:
             self._is_processing = True
-            while True:
+            while not self._is_shutdown:
                 last_token = await self.store.get_federation_out_pos("events")
                 (
                     next_token,
@@ -580,7 +605,7 @@ class FederationSender(AbstractFederationSender):
                         )
                         return
 
-                    destinations: Optional[Collection[str]] = None
+                    destinations: Collection[str] | None = None
                     if not event.prev_event_ids():
                         # If there are no prev event IDs then the state is empty
                         # and so no remote servers in the room
@@ -644,6 +669,31 @@ class FederationSender(AbstractFederationSender):
                             )
                             return
 
+                    # If we've rescinded an invite then we want to tell the
+                    # other server.
+                    if (
+                        event.type == EventTypes.Member
+                        and event.membership == Membership.LEAVE
+                        and event.sender != event.state_key
+                    ):
+                        # We check if this leave event is rescinding an invite
+                        # by looking if there is an invite event for the user in
+                        # the auth events. It could otherwise be a kick or
+                        # unban, which we don't want to send (if the user wasn't
+                        # already in the room).
+                        auth_events = await self.store.get_events_as_list(
+                            event.auth_event_ids()
+                        )
+                        for auth_event in auth_events:
+                            if (
+                                auth_event.type == EventTypes.Member
+                                and auth_event.state_key == event.state_key
+                                and auth_event.membership == Membership.INVITE
+                            ):
+                                destinations = set(destinations)
+                                destinations.add(get_domain_from_id(event.state_key))
+                                break
+
                     sharded_destinations = {
                         d
                         for d in destinations
@@ -671,7 +721,7 @@ class FederationSender(AbstractFederationSender):
                             **{SERVER_NAME_LABEL: self.server_name},
                         ).observe((now - ts) / 1000)
 
-                async def handle_room_events(events: List[EventBase]) -> None:
+                async def handle_room_events(events: list[EventBase]) -> None:
                     logger.debug(
                         "Handling %i events in room %s", len(events), events[0].room_id
                     )
@@ -683,7 +733,7 @@ class FederationSender(AbstractFederationSender):
                         for event in events:
                             await handle_event(event)
 
-                events_by_room: Dict[str, List[EventBase]] = {}
+                events_by_room: dict[str, list[EventBase]] = {}
 
                 for event_id in event_ids:
                     # `event_entries` is unsorted, so we have to iterate over `event_ids`
@@ -960,7 +1010,7 @@ class FederationSender(AbstractFederationSender):
         destination: str,
         edu_type: str,
         content: JsonDict,
-        key: Optional[Hashable] = None,
+        key: Hashable | None = None,
     ) -> None:
         """Construct an Edu object, and queue it for sending
 
@@ -988,7 +1038,7 @@ class FederationSender(AbstractFederationSender):
 
         self.send_edu(edu, key)
 
-    def send_edu(self, edu: Edu, key: Optional[Hashable]) -> None:
+    def send_edu(self, edu: Edu, key: Hashable | None) -> None:
         """Queue an EDU for sending
 
         Args:
@@ -1071,7 +1121,7 @@ class FederationSender(AbstractFederationSender):
     @staticmethod
     async def get_replication_rows(
         instance_name: str, from_token: int, to_token: int, target_row_count: int
-    ) -> Tuple[List[Tuple[int, Tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         # Dummy implementation for case where federation sender isn't offloaded
         # to a worker.
         return [], 0, False
@@ -1084,9 +1134,9 @@ class FederationSender(AbstractFederationSender):
         In order to reduce load spikes, adds a delay between each destination.
         """
 
-        last_processed: Optional[str] = None
+        last_processed: str | None = None
 
-        while True:
+        while not self._is_shutdown:
             destinations_to_wake = (
                 await self.store.get_catch_up_outstanding_destinations(last_processed)
             )
@@ -1112,4 +1162,4 @@ class FederationSender(AbstractFederationSender):
                     last_processed,
                 )
                 self.wake_destination(destination)
-                await self.clock.sleep(WAKEUP_INTERVAL_BETWEEN_DESTINATIONS_SEC)
+                await self.clock.sleep(WAKEUP_INTERVAL_BETWEEN_DESTINATIONS)
diff --git a/synapse/federation/sender/per_destination_queue.py b/synapse/federation/sender/per_destination_queue.py
index 4c844d403a..cdacf16d72 100644
--- a/synapse/federation/sender/per_destination_queue.py
+++ b/synapse/federation/sender/per_destination_queue.py
@@ -23,11 +23,13 @@ import datetime
 import logging
 from collections import OrderedDict
 from types import TracebackType
-from typing import TYPE_CHECKING, Dict, Hashable, Iterable, List, Optional, Tuple, Type
+from typing import TYPE_CHECKING, Hashable, Iterable
 
 import attr
 from prometheus_client import Counter
 
+from twisted.internet import defer
+
 from synapse.api.constants import EduTypes
 from synapse.api.errors import (
     FederationDeniedError,
@@ -39,9 +41,9 @@ from synapse.events import EventBase
 from synapse.federation.units import Edu
 from synapse.handlers.presence import format_user_presence_state
 from synapse.logging import issue9533_logger
+from synapse.logging.context import PreserveLoggingContext
 from synapse.logging.opentracing import SynapseTags, set_tag
 from synapse.metrics import SERVER_NAME_LABEL, sent_transactions_counter
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.types import JsonDict, ReadReceipt
 from synapse.util.retryutils import NotRetryingDestination, get_retry_limiter
 from synapse.visibility import filter_events_for_server
@@ -79,6 +81,7 @@ MAX_PRESENCE_STATES_PER_EDU = 50
 class PerDestinationQueue:
     """
     Manages the per-destination transmission queues.
+    Runs until `shutdown()` is called on the queue.
 
     Args:
         hs
@@ -94,6 +97,7 @@ class PerDestinationQueue:
         destination: str,
     ):
         self.server_name = hs.hostname
+        self._hs = hs
         self._clock = hs.get_clock()
         self._storage_controllers = hs.get_storage_controllers()
         self._store = hs.get_datastores().main
@@ -117,6 +121,8 @@ class PerDestinationQueue:
 
         self._destination = destination
         self.transmission_loop_running = False
+        self._transmission_loop_enabled = True
+        self.active_transmission_loop: defer.Deferred | None = None
 
         # Flag to signal to any running transmission loop that there is new data
         # queued up to be sent.
@@ -137,19 +143,19 @@ class PerDestinationQueue:
 
         # Cache of the last successfully-transmitted stream ordering for this
         # destination (we are the only updater so this is safe)
-        self._last_successful_stream_ordering: Optional[int] = None
+        self._last_successful_stream_ordering: int | None = None
 
         # a queue of pending PDUs
-        self._pending_pdus: List[EventBase] = []
+        self._pending_pdus: list[EventBase] = []
 
         # XXX this is never actually used: see
         # https://github.com/matrix-org/synapse/issues/7549
-        self._pending_edus: List[Edu] = []
+        self._pending_edus: list[Edu] = []
 
         # Pending EDUs by their "key". Keyed EDUs are EDUs that get clobbered
         # based on their key (e.g. typing events by room_id)
         # Map of (edu_type, key) -> Edu
-        self._pending_edus_keyed: Dict[Tuple[str, Hashable], Edu] = {}
+        self._pending_edus_keyed: dict[tuple[str, Hashable], Edu] = {}
 
         # Map of user_id -> UserPresenceState of pending presence to be sent to this
         # destination
@@ -159,7 +165,7 @@ class PerDestinationQueue:
         #
         # Each receipt can only have a single receipt per
         # (room ID, receipt type, user ID, thread ID) tuple.
-        self._pending_receipt_edus: List[Dict[str, Dict[str, Dict[str, dict]]]] = []
+        self._pending_receipt_edus: list[dict[str, dict[str, dict[str, dict]]]] = []
 
         # stream_id of last successfully sent to-device message.
         # NB: may be a long or an int.
@@ -171,6 +177,21 @@ class PerDestinationQueue:
     def __str__(self) -> str:
         return "PerDestinationQueue[%s]" % self._destination
 
+    def shutdown(self) -> None:
+        """Instruct the queue to stop processing any further requests"""
+        self._transmission_loop_enabled = False
+        # The transaction manager must be shutdown before cancelling the active
+        # transmission loop. Otherwise the transmission loop can enter a new cycle of
+        # sleeping before retrying since the shutdown flag of the _transaction_manager
+        # hasn't been set yet.
+        self._transaction_manager.shutdown()
+        try:
+            if self.active_transmission_loop is not None:
+                with PreserveLoggingContext():
+                    self.active_transmission_loop.cancel()
+        except Exception:
+            pass
+
     def pending_pdu_count(self) -> int:
         return len(self._pending_pdus)
 
@@ -309,25 +330,28 @@ class PerDestinationQueue:
             )
             return
 
+        if not self._transmission_loop_enabled:
+            logger.warning("Shutdown has been requested. Not sending transaction")
+            return
+
         logger.debug("TX [%s] Starting transaction loop", self._destination)
 
-        run_as_background_process(
+        self.active_transmission_loop = self._hs.run_as_background_process(
             "federation_transaction_transmission_loop",
-            self.server_name,
             self._transaction_transmission_loop,
         )
 
     async def _transaction_transmission_loop(self) -> None:
-        pending_pdus: List[EventBase] = []
+        pending_pdus: list[EventBase] = []
         try:
             self.transmission_loop_running = True
-
             # This will throw if we wouldn't retry. We do this here so we fail
             # quickly, but we will later check this again in the http client,
             # hence why we throw the result away.
             await get_retry_limiter(
                 destination=self._destination,
                 our_server_name=self.server_name,
+                hs=self._hs,
                 clock=self._clock,
                 store=self._store,
             )
@@ -339,7 +363,7 @@ class PerDestinationQueue:
                     # not caught up yet
                     return
 
-            while True:
+            while self._transmission_loop_enabled:
                 self._new_data_to_send = False
 
                 async with _TransactionQueueManager(self) as (
@@ -352,8 +376,8 @@ class PerDestinationQueue:
                         # If we've gotten told about new things to send during
                         # checking for things to send, we try looking again.
                         # Otherwise new PDUs or EDUs might arrive in the meantime,
-                        # but not get sent because we hold the
-                        # `transmission_loop_running` flag.
+                        # but not get sent because we currently have an
+                        # `_active_transmission_loop` running.
                         if self._new_data_to_send:
                             continue
                         else:
@@ -442,6 +466,7 @@ class PerDestinationQueue:
                 )
         finally:
             # We want to be *very* sure we clear this after we stop processing
+            self.active_transmission_loop = None
             self.transmission_loop_running = False
 
     async def _catch_up_transmission_loop(self) -> None:
@@ -469,7 +494,7 @@ class PerDestinationQueue:
         last_successful_stream_ordering: int = _tmp_last_successful_stream_ordering
 
         # get at most 50 catchup room/PDUs
-        while True:
+        while self._transmission_loop_enabled:
             event_ids = await self._store.get_catch_up_room_event_ids(
                 self._destination, last_successful_stream_ordering
             )
@@ -642,12 +667,12 @@ class PerDestinationQueue:
         if not self._pending_receipt_edus:
             self._rrs_pending_flush = False
 
-    def _pop_pending_edus(self, limit: int) -> List[Edu]:
+    def _pop_pending_edus(self, limit: int) -> list[Edu]:
         pending_edus = self._pending_edus
         pending_edus, self._pending_edus = pending_edus[:limit], pending_edus[limit:]
         return pending_edus
 
-    async def _get_device_update_edus(self, limit: int) -> Tuple[List[Edu], int]:
+    async def _get_device_update_edus(self, limit: int) -> tuple[list[Edu], int]:
         last_device_list = self._last_device_list_stream_id
 
         # Retrieve list of new device updates to send to the destination
@@ -668,7 +693,7 @@ class PerDestinationQueue:
 
         return edus, now_stream_id
 
-    async def _get_to_device_message_edus(self, limit: int) -> Tuple[List[Edu], int]:
+    async def _get_to_device_message_edus(self, limit: int) -> tuple[list[Edu], int]:
         last_device_stream_id = self._last_device_stream_id
         to_device_stream_id = self._store.get_to_device_stream_token()
         contents, stream_id = await self._store.get_new_device_msgs_for_remote(
@@ -719,12 +744,12 @@ class _TransactionQueueManager:
 
     queue: PerDestinationQueue
 
-    _device_stream_id: Optional[int] = None
-    _device_list_id: Optional[int] = None
-    _last_stream_ordering: Optional[int] = None
-    _pdus: List[EventBase] = attr.Factory(list)
+    _device_stream_id: int | None = None
+    _device_list_id: int | None = None
+    _last_stream_ordering: int | None = None
+    _pdus: list[EventBase] = attr.Factory(list)
 
-    async def __aenter__(self) -> Tuple[List[EventBase], List[Edu]]:
+    async def __aenter__(self) -> tuple[list[EventBase], list[Edu]]:
         # First we calculate the EDUs we want to send, if any.
 
         # There's a maximum number of EDUs that can be sent with a transaction,
@@ -744,7 +769,7 @@ class _TransactionQueueManager:
         if self.queue._pending_presence:
             # Only send max 50 presence entries in the EDU, to bound the amount
             # of data we're sending.
-            presence_to_add: List[JsonDict] = []
+            presence_to_add: list[JsonDict] = []
             while (
                 self.queue._pending_presence
                 and len(presence_to_add) < MAX_PRESENCE_STATES_PER_EDU
@@ -822,9 +847,9 @@ class _TransactionQueueManager:
 
     async def __aexit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc: Optional[BaseException],
-        tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        tb: TracebackType | None,
     ) -> None:
         if exc_type is not None:
             # Failed to send transaction, so we bail out.
diff --git a/synapse/federation/sender/transaction_manager.py b/synapse/federation/sender/transaction_manager.py
index 63ed13c6fa..99aa05ebd6 100644
--- a/synapse/federation/sender/transaction_manager.py
+++ b/synapse/federation/sender/transaction_manager.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, List
+from typing import TYPE_CHECKING
 
 from prometheus_client import Gauge
 
@@ -26,7 +26,7 @@ from synapse.api.constants import EduTypes
 from synapse.api.errors import HttpResponseException
 from synapse.events import EventBase
 from synapse.federation.persistence import TransactionActions
-from synapse.federation.units import Edu, Transaction
+from synapse.federation.units import Edu, Transaction, serialize_and_filter_pdus
 from synapse.logging.opentracing import (
     extract_text_map,
     set_tag,
@@ -36,7 +36,7 @@ from synapse.logging.opentracing import (
 )
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.types import JsonDict
-from synapse.util import json_decoder
+from synapse.util.json import json_decoder
 from synapse.util.metrics import measure_func
 
 if TYPE_CHECKING:
@@ -72,12 +72,18 @@ class TransactionManager:
         # HACK to get unique tx id
         self._next_txn_id = int(self.clock.time_msec())
 
+        self._is_shutdown = False
+
+    def shutdown(self) -> None:
+        self._is_shutdown = True
+        self._transport_layer.shutdown()
+
     @measure_func("_send_new_transaction")
     async def send_new_transaction(
         self,
         destination: str,
-        pdus: List[EventBase],
-        edus: List[Edu],
+        pdus: list[EventBase],
+        edus: list[Edu],
     ) -> None:
         """
         Args:
@@ -86,6 +92,12 @@ class TransactionManager:
             edus: List of EDUs to send
         """
 
+        if self._is_shutdown:
+            logger.warning(
+                "TransactionManager has been shutdown, not sending transaction"
+            )
+            return
+
         # Make a transaction-sending opentracing span. This span follows on from
         # all the edus in that transaction. This needs to be done since there is
         # no active span here, so if the edus were not received by the remote the
@@ -119,7 +131,7 @@ class TransactionManager:
                 transaction_id=txn_id,
                 origin=self.server_name,
                 destination=destination,
-                pdus=[p.get_pdu_json() for p in pdus],
+                pdus=serialize_and_filter_pdus(pdus),
                 edus=[edu.get_dict() for edu in edus],
             )
 
diff --git a/synapse/federation/transport/client.py b/synapse/federation/transport/client.py
index 62bf96ce91..5d5212ef96 100644
--- a/synapse/federation/transport/client.py
+++ b/synapse/federation/transport/client.py
@@ -28,14 +28,9 @@ from typing import (
     BinaryIO,
     Callable,
     Collection,
-    Dict,
     Generator,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Union,
 )
 
 import attr
@@ -52,6 +47,7 @@ from synapse.api.urls import (
 )
 from synapse.events import EventBase, make_event_from_dict
 from synapse.federation.units import Transaction
+from synapse.http.client import is_unknown_endpoint
 from synapse.http.matrixfederationclient import ByteParser, LegacyJsonSendParser
 from synapse.http.types import QueryParams
 from synapse.types import JsonDict, UserID
@@ -70,6 +66,9 @@ class TransportLayerClient:
         self.client = hs.get_federation_http_client()
         self._is_mine_server_name = hs.is_mine_server_name
 
+    def shutdown(self) -> None:
+        self.client.shutdown()
+
     async def get_room_state_ids(
         self, destination: str, room_id: str, event_id: str
     ) -> JsonDict:
@@ -122,7 +121,7 @@ class TransportLayerClient:
         )
 
     async def get_event(
-        self, destination: str, event_id: str, timeout: Optional[int] = None
+        self, destination: str, event_id: str, timeout: int | None = None
     ) -> JsonDict:
         """Requests the pdu with give id and origin from the given server.
 
@@ -143,36 +142,50 @@ class TransportLayerClient:
             destination, path=path, timeout=timeout, try_trailing_slash_on_400=True
         )
 
-    async def get_policy_recommendation_for_pdu(
-        self, destination: str, event: EventBase, timeout: Optional[int] = None
+    async def ask_policy_server_to_sign_event(
+        self, destination: str, event: EventBase, timeout: int | None = None
     ) -> JsonDict:
-        """Requests the policy recommendation for the given pdu from the given policy server.
+        """Requests that the destination server (typically a policy server)
+        sign the event as not spam.
+
+        If the policy server could not be contacted or the policy server
+        returned an error, this raises that error.
 
         Args:
-            destination: The host name of the remote homeserver checking the event.
-            event: The event to check.
+            destination: The host name of the policy server / homeserver.
+            event: The event to sign.
             timeout: How long to try (in ms) the destination for before giving up.
                 None indicates no timeout.
-
         Returns:
-            The full recommendation object from the remote server.
+            The signature from the policy server, structured in the same was as the 'signatures'
+            JSON in the event e.g { "$policy_server_via_domain" : { "ed25519:policy_server": "signature_base64" }}
         """
-        logger.debug(
-            "get_policy_recommendation_for_pdu dest=%s, event_id=%s",
-            destination,
-            event.event_id,
-        )
-        return await self.client.post_json(
-            destination=destination,
-            path=f"/_matrix/policy/unstable/org.matrix.msc4284/event/{event.event_id}/check",
-            data=event.get_pdu_json(),
-            ignore_backoff=True,
-            timeout=timeout,
-        )
+        # Try stable first, then fall back to unstable if unsupported. All other errors
+        # are just errors.
+        try:
+            return await self.client.post_json(
+                destination=destination,
+                path="/_matrix/policy/v1/sign",
+                data=event.get_pdu_json(),
+                ignore_backoff=True,
+                timeout=timeout,
+            )
+        except HttpResponseException as ex:
+            if is_unknown_endpoint(ex):
+                # TODO: Remove unstable MSC4284 support
+                # https://github.com/element-hq/synapse/issues/19502
+                return await self.client.post_json(
+                    destination=destination,
+                    path="/_matrix/policy/unstable/org.matrix.msc4284/sign",
+                    data=event.get_pdu_json(),
+                    ignore_backoff=True,
+                    timeout=timeout,
+                )
+            raise
 
     async def backfill(
         self, destination: str, room_id: str, event_tuples: Collection[str], limit: int
-    ) -> Optional[Union[JsonDict, list]]:
+    ) -> JsonDict | list | None:
         """Requests `limit` previous PDUs in a given context before list of
         PDUs.
 
@@ -209,7 +222,7 @@ class TransportLayerClient:
 
     async def timestamp_to_event(
         self, destination: str, room_id: str, timestamp: int, direction: Direction
-    ) -> Union[JsonDict, List]:
+    ) -> JsonDict | list:
         """
         Calls a remote federating server at `destination` asking for their
         closest event to the given timestamp in the given direction.
@@ -244,7 +257,7 @@ class TransportLayerClient:
     async def send_transaction(
         self,
         transaction: Transaction,
-        json_data_callback: Optional[Callable[[], JsonDict]] = None,
+        json_data_callback: Callable[[], JsonDict] | None = None,
     ) -> JsonDict:
         """Sends the given Transaction to its destination
 
@@ -317,7 +330,7 @@ class TransportLayerClient:
         room_id: str,
         user_id: str,
         membership: str,
-        params: Optional[Mapping[str, Union[str, Iterable[str]]]],
+        params: Mapping[str, str | Iterable[str]] | None,
     ) -> JsonDict:
         """Asks a remote server to build and sign us a membership event
 
@@ -399,7 +412,7 @@ class TransportLayerClient:
         omit_members: bool,
     ) -> "SendJoinResponse":
         path = _create_v2_path("/send_join/%s/%s", room_id, event_id)
-        query_params: Dict[str, str] = {}
+        query_params: dict[str, str] = {}
         # lazy-load state on join
         query_params["omit_members"] = "true" if omit_members else "false"
 
@@ -413,7 +426,7 @@ class TransportLayerClient:
 
     async def send_leave_v1(
         self, destination: str, room_id: str, event_id: str, content: JsonDict
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         path = _create_v1_path("/send_leave/%s/%s", room_id, event_id)
 
         return await self.client.put_json(
@@ -479,7 +492,7 @@ class TransportLayerClient:
 
     async def send_invite_v1(
         self, destination: str, room_id: str, event_id: str, content: JsonDict
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         path = _create_v1_path("/invite/%s/%s", room_id, event_id)
 
         return await self.client.put_json(
@@ -502,11 +515,11 @@ class TransportLayerClient:
     async def get_public_rooms(
         self,
         remote_server: str,
-        limit: Optional[int] = None,
-        since_token: Optional[str] = None,
-        search_filter: Optional[Dict] = None,
+        limit: int | None = None,
+        since_token: str | None = None,
+        search_filter: dict | None = None,
         include_all_networks: bool = False,
-        third_party_instance_id: Optional[str] = None,
+        third_party_instance_id: str | None = None,
     ) -> JsonDict:
         """Get the list of public rooms from a remote homeserver
 
@@ -517,7 +530,7 @@ class TransportLayerClient:
 
         if search_filter:
             # this uses MSC2197 (Search Filtering over Federation)
-            data: Dict[str, Any] = {"include_all_networks": include_all_networks}
+            data: dict[str, Any] = {"include_all_networks": include_all_networks}
             if third_party_instance_id:
                 data["third_party_instance_id"] = third_party_instance_id
             if limit:
@@ -541,7 +554,7 @@ class TransportLayerClient:
                     )
                 raise
         else:
-            args: Dict[str, Union[str, Iterable[str]]] = {
+            args: dict[str, str | Iterable[str]] = {
                 "include_all_networks": "true" if include_all_networks else "false"
             }
             if third_party_instance_id:
@@ -668,7 +681,7 @@ class TransportLayerClient:
         user: UserID,
         destination: str,
         query_content: JsonDict,
-        timeout: Optional[int],
+        timeout: int | None,
     ) -> JsonDict:
         """Claim one-time keys for a list of devices hosted on a remote server.
 
@@ -714,7 +727,7 @@ class TransportLayerClient:
         user: UserID,
         destination: str,
         query_content: JsonDict,
-        timeout: Optional[int],
+        timeout: int | None,
     ) -> JsonDict:
         """Claim one-time keys for a list of devices hosted on a remote server.
 
@@ -825,7 +838,7 @@ class TransportLayerClient:
         )
 
     async def get_account_status(
-        self, destination: str, user_ids: List[str]
+        self, destination: str, user_ids: list[str]
     ) -> JsonDict:
         """
         Args:
@@ -849,7 +862,7 @@ class TransportLayerClient:
         max_timeout_ms: int,
         download_ratelimiter: Ratelimiter,
         ip_address: str,
-    ) -> Tuple[int, Dict[bytes, List[bytes]]]:
+    ) -> tuple[int, dict[bytes, list[bytes]]]:
         path = f"/_matrix/media/r0/download/{destination}/{media_id}"
         return await self.client.get_file(
             destination,
@@ -876,7 +889,7 @@ class TransportLayerClient:
         max_timeout_ms: int,
         download_ratelimiter: Ratelimiter,
         ip_address: str,
-    ) -> Tuple[int, Dict[bytes, List[bytes]]]:
+    ) -> tuple[int, dict[bytes, list[bytes]]]:
         path = f"/_matrix/media/v3/download/{destination}/{media_id}"
         return await self.client.get_file(
             destination,
@@ -907,7 +920,7 @@ class TransportLayerClient:
         max_timeout_ms: int,
         download_ratelimiter: Ratelimiter,
         ip_address: str,
-    ) -> Tuple[int, Dict[bytes, List[bytes]], bytes]:
+    ) -> tuple[int, dict[bytes, list[bytes]], bytes]:
         path = f"/_matrix/federation/v1/media/download/{media_id}"
         return await self.client.federation_get_file(
             destination,
@@ -964,32 +977,32 @@ class SendJoinResponse:
     """The parsed response of a `/send_join` request."""
 
     # The list of auth events from the /send_join response.
-    auth_events: List[EventBase]
+    auth_events: list[EventBase]
     # The list of state from the /send_join response.
-    state: List[EventBase]
+    state: list[EventBase]
     # The raw join event from the /send_join response.
     event_dict: JsonDict
     # The parsed join event from the /send_join response. This will be None if
     # "event" is not included in the response.
-    event: Optional[EventBase] = None
+    event: EventBase | None = None
 
     # The room state is incomplete
     members_omitted: bool = False
 
     # List of servers in the room
-    servers_in_room: Optional[List[str]] = None
+    servers_in_room: list[str] | None = None
 
 
 @attr.s(slots=True, auto_attribs=True)
 class StateRequestResponse:
     """The parsed response of a `/state` request."""
 
-    auth_events: List[EventBase]
-    state: List[EventBase]
+    auth_events: list[EventBase]
+    state: list[EventBase]
 
 
 @ijson.coroutine
-def _event_parser(event_dict: JsonDict) -> Generator[None, Tuple[str, Any], None]:
+def _event_parser(event_dict: JsonDict) -> Generator[None, tuple[str, Any], None]:
     """Helper function for use with `ijson.kvitems_coro` to parse key-value pairs
     to add them to a given dictionary.
     """
@@ -1001,7 +1014,7 @@ def _event_parser(event_dict: JsonDict) -> Generator[None, Tuple[str, Any], None
 
 @ijson.coroutine
 def _event_list_parser(
-    room_version: RoomVersion, events: List[EventBase]
+    room_version: RoomVersion, events: list[EventBase]
 ) -> Generator[None, JsonDict, None]:
     """Helper function for use with `ijson.items_coro` to parse an array of
     events and add them to the given list.
@@ -1057,7 +1070,7 @@ class SendJoinParser(ByteParser[SendJoinResponse]):
     def __init__(self, room_version: RoomVersion, v1_api: bool):
         self._response = SendJoinResponse([], [], event_dict={})
         self._room_version = room_version
-        self._coros: List[Generator[None, bytes, None]] = []
+        self._coros: list[Generator[None, bytes, None]] = []
 
         # The V1 API has the shape of `[200, {...}]`, which we handle by
         # prefixing with `item.*`.
@@ -1130,7 +1143,7 @@ class _StateParser(ByteParser[StateRequestResponse]):
     def __init__(self, room_version: RoomVersion):
         self._response = StateRequestResponse([], [])
         self._room_version = room_version
-        self._coros: List[Generator[None, bytes, None]] = [
+        self._coros: list[Generator[None, bytes, None]] = [
             ijson.items_coro(
                 _event_list_parser(room_version, self._response.state),
                 "pdus.item",
diff --git a/synapse/federation/transport/server/__init__.py b/synapse/federation/transport/server/__init__.py
index 174d02ab6b..0eff49cf73 100644
--- a/synapse/federation/transport/server/__init__.py
+++ b/synapse/federation/transport/server/__init__.py
@@ -4,6 +4,7 @@
 # Copyright 2020 Sorunome
 # Copyright 2014-2021 The Matrix.org Foundation C.I.C.
 # Copyright (C) 2023 New Vector, Ltd
+# Copyright (C) 2025 Element Creations Ltd
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@@ -20,7 +21,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Dict, Iterable, List, Literal, Optional, Tuple, Type
+from typing import TYPE_CHECKING, Iterable, Literal
 
 from synapse.api.errors import FederationDeniedError, SynapseError
 from synapse.federation.transport.server._base import (
@@ -33,6 +34,7 @@ from synapse.federation.transport.server.federation import (
     FederationMediaDownloadServlet,
     FederationMediaThumbnailServlet,
     FederationUnstableClientKeysClaimServlet,
+    FederationUnstableGetExtremitiesServlet,
 )
 from synapse.http.server import HttpServer, JsonResource
 from synapse.http.servlet import (
@@ -52,7 +54,7 @@ logger = logging.getLogger(__name__)
 class TransportLayerServer(JsonResource):
     """Handles incoming federation HTTP requests"""
 
-    def __init__(self, hs: "HomeServer", servlet_groups: Optional[List[str]] = None):
+    def __init__(self, hs: "HomeServer", servlet_groups: list[str] | None = None):
         """Initialize the TransportLayerServer
 
         Will by default register all servlets. For custom behaviour, pass in
@@ -130,12 +132,12 @@ class PublicRoomList(BaseFederationServlet):
         self.allow_access = hs.config.server.allow_public_rooms_over_federation
 
     async def on_GET(
-        self, origin: str, content: Literal[None], query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
+        self, origin: str, content: Literal[None], query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
         if not self.allow_access:
             raise FederationDeniedError(origin)
 
-        limit = parse_integer_from_args(query, "limit", 0)
+        limit: int | None = parse_integer_from_args(query, "limit", 0)
         since_token = parse_string_from_args(query, "since", None)
         include_all_networks = parse_boolean_from_args(
             query, "include_all_networks", default=False
@@ -164,13 +166,13 @@ class PublicRoomList(BaseFederationServlet):
         return 200, data
 
     async def on_POST(
-        self, origin: str, content: JsonDict, query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
+        self, origin: str, content: JsonDict, query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
         # This implements MSC2197 (Search Filtering over Federation)
         if not self.allow_access:
             raise FederationDeniedError(origin)
 
-        limit: Optional[int] = int(content.get("limit", 100))
+        limit: int | None = int(content.get("limit", 100))
         since_token = content.get("since", None)
         search_filter = content.get("filter", None)
 
@@ -240,10 +242,10 @@ class OpenIdUserInfo(BaseFederationServlet):
 
     async def on_GET(
         self,
-        origin: Optional[str],
+        origin: str | None,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
-    ) -> Tuple[int, JsonDict]:
+        query: dict[bytes, list[bytes]],
+    ) -> tuple[int, JsonDict]:
         token = parse_string_from_args(query, "access_token")
         if token is None:
             return (
@@ -265,7 +267,7 @@ class OpenIdUserInfo(BaseFederationServlet):
         return 200, {"sub": user_id}
 
 
-SERVLET_GROUPS: Dict[str, Iterable[Type[BaseFederationServlet]]] = {
+SERVLET_GROUPS: dict[str, Iterable[type[BaseFederationServlet]]] = {
     "federation": FEDERATION_SERVLET_CLASSES,
     "room_list": (PublicRoomList,),
     "openid": (OpenIdUserInfo,),
@@ -281,7 +283,7 @@ def register_servlets(
     resource: HttpServer,
     authenticator: Authenticator,
     ratelimiter: FederationRateLimiter,
-    servlet_groups: Optional[Iterable[str]] = None,
+    servlet_groups: Iterable[str] | None = None,
 ) -> None:
     """Initialize and register servlet classes.
 
@@ -326,6 +328,12 @@ def register_servlets(
                 if not hs.config.media.can_load_media_repo:
                     continue
 
+            if (
+                servletclass == FederationUnstableGetExtremitiesServlet
+                and not hs.config.experimental.msc4370_enabled
+            ):
+                continue
+
             servletclass(
                 hs=hs,
                 authenticator=authenticator,
diff --git a/synapse/federation/transport/server/_base.py b/synapse/federation/transport/server/_base.py
index cba309635b..52c0c96a3f 100644
--- a/synapse/federation/transport/server/_base.py
+++ b/synapse/federation/transport/server/_base.py
@@ -24,7 +24,7 @@ import logging
 import re
 import time
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Any, Awaitable, Callable, Dict, Optional, Tuple, cast
+from typing import TYPE_CHECKING, Any, Awaitable, Callable, cast
 
 from synapse.api.errors import Codes, FederationDeniedError, SynapseError
 from synapse.api.urls import FEDERATION_V1_PREFIX
@@ -77,7 +77,7 @@ class Authenticator:
 
     # A method just so we can pass 'self' as the authenticator to the Servlets
     async def authenticate_request(
-        self, request: SynapseRequest, content: Optional[JsonDict]
+        self, request: SynapseRequest, content: JsonDict | None
     ) -> str:
         now = self._clock.time_msec()
         json_request: JsonDict = {
@@ -165,7 +165,7 @@ class Authenticator:
             logger.exception("Error resetting retry timings on %s", origin)
 
 
-def _parse_auth_header(header_bytes: bytes) -> Tuple[str, str, str, Optional[str]]:
+def _parse_auth_header(header_bytes: bytes) -> tuple[str, str, str, str | None]:
     """Parse an X-Matrix auth header
 
     Args:
@@ -185,7 +185,7 @@ def _parse_auth_header(header_bytes: bytes) -> Tuple[str, str, str, Optional[str
             rf"{space_or_tab}*,{space_or_tab}*",
             re.split(r"^X-Matrix +", header_str, maxsplit=1)[1],
         )
-        param_dict: Dict[str, str] = {
+        param_dict: dict[str, str] = {
             k.lower(): v for k, v in [param.split("=", maxsplit=1) for param in params]
         }
 
@@ -252,7 +252,7 @@ class BaseFederationServlet:
                 components as specified in the path match regexp.
 
         Returns:
-            Optional[Tuple[int, object]]: either (response code, response object) to
+            tuple[int, object] | None: either (response code, response object) to
                  return a JSON response, or None if the request has already been handled.
 
         Raises:
@@ -282,14 +282,14 @@ class BaseFederationServlet:
         self.ratelimiter = ratelimiter
         self.server_name = server_name
 
-    def _wrap(self, func: Callable[..., Awaitable[Tuple[int, Any]]]) -> ServletCallback:
+    def _wrap(self, func: Callable[..., Awaitable[tuple[int, Any]]]) -> ServletCallback:
         authenticator = self.authenticator
         ratelimiter = self.ratelimiter
 
         @functools.wraps(func)
         async def new_func(
             request: SynapseRequest, *args: Any, **kwargs: str
-        ) -> Optional[Tuple[int, Any]]:
+        ) -> tuple[int, Any] | None:
             """A callback which can be passed to HttpServer.RegisterPaths
 
             Args:
@@ -309,7 +309,7 @@ class BaseFederationServlet:
 
             try:
                 with start_active_span("authenticate_request"):
-                    origin: Optional[str] = await authenticator.authenticate_request(
+                    origin: str | None = await authenticator.authenticate_request(
                         request, content
                     )
             except NoAuthenticationError:
diff --git a/synapse/federation/transport/server/federation.py b/synapse/federation/transport/server/federation.py
index eb96ff27f9..d783e6da51 100644
--- a/synapse/federation/transport/server/federation.py
+++ b/synapse/federation/transport/server/federation.py
@@ -1,8 +1,9 @@
 #
 # This file is licensed under the Affero General Public License (AGPL) version 3.
 #
-#  Copyright 2021 The Matrix.org Foundation C.I.C.
+# Copyright 2021 The Matrix.org Foundation C.I.C.
 # Copyright (C) 2023 New Vector, Ltd
+# Copyright (C) 2025 Element Creations Ltd
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@@ -22,15 +23,9 @@ import logging
 from collections import Counter
 from typing import (
     TYPE_CHECKING,
-    Dict,
-    List,
     Literal,
     Mapping,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
-    Union,
 )
 
 from synapse.api.constants import Direction, EduTypes
@@ -93,9 +88,9 @@ class FederationSendServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         transaction_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """Called on PUT /send/<transaction_id>/
 
         Args:
@@ -158,9 +153,9 @@ class FederationEventServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         event_id: str,
-    ) -> Tuple[int, Union[JsonDict, str]]:
+    ) -> tuple[int, JsonDict | str]:
         return await self.handler.on_pdu_request(origin, event_id)
 
 
@@ -173,9 +168,9 @@ class FederationStateV1Servlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         return await self.handler.on_room_state_request(
             origin,
             room_id,
@@ -191,9 +186,9 @@ class FederationStateIdsServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         return await self.handler.on_state_ids_request(
             origin,
             room_id,
@@ -209,9 +204,9 @@ class FederationBackfillServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         versions = [x.decode("ascii") for x in query[b"v"]]
         limit = parse_integer_from_args(query, "limit", None)
 
@@ -248,9 +243,9 @@ class FederationTimestampLookupServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         timestamp = parse_integer_from_args(query, "ts", required=True)
         direction_str = parse_string_from_args(
             query, "dir", allowed_values=["f", "b"], required=True
@@ -271,14 +266,30 @@ class FederationQueryServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         query_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         args = {k.decode("utf8"): v[0].decode("utf-8") for k, v in query.items()}
         args["origin"] = origin
         return await self.handler.on_query_request(query_type, args)
 
 
+class FederationUnstableGetExtremitiesServlet(BaseFederationServerServlet):
+    PREFIX = FEDERATION_UNSTABLE_PREFIX + "/org.matrix.msc4370"
+    PATH = "/extremities/(?P<room_id>[^/]*)"
+    CATEGORY = "Federation requests"
+
+    async def on_GET(
+        self,
+        origin: str,
+        content: Literal[None],
+        query: dict[bytes, list[bytes]],
+        room_id: str,
+    ) -> tuple[int, JsonDict]:
+        result = await self.handler.on_get_extremities_request(origin, room_id)
+        return 200, result
+
+
 class FederationMakeJoinServlet(BaseFederationServerServlet):
     PATH = "/make_join/(?P<room_id>[^/]*)/(?P<user_id>[^/]*)"
     CATEGORY = "Federation requests"
@@ -287,10 +298,10 @@ class FederationMakeJoinServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         user_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """
         Args:
             origin: The authenticated server_name of the calling server
@@ -323,10 +334,10 @@ class FederationMakeLeaveServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         user_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         result = await self.handler.on_make_leave_request(origin, room_id, user_id)
         return 200, result
 
@@ -339,10 +350,10 @@ class FederationV1SendLeaveServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, Tuple[int, JsonDict]]:
+    ) -> tuple[int, tuple[int, JsonDict]]:
         result = await self.handler.on_send_leave_request(origin, content, room_id)
         return 200, (200, result)
 
@@ -357,10 +368,10 @@ class FederationV2SendLeaveServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         result = await self.handler.on_send_leave_request(origin, content, room_id)
         return 200, result
 
@@ -373,10 +384,10 @@ class FederationMakeKnockServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         user_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # Retrieve the room versions the remote homeserver claims to support
         supported_versions = parse_strings_from_args(
             query, "ver", required=True, encoding="utf-8"
@@ -396,10 +407,10 @@ class FederationV1SendKnockServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         result = await self.handler.on_send_knock_request(origin, content, room_id)
         return 200, result
 
@@ -412,10 +423,10 @@ class FederationEventAuthServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         return await self.handler.on_event_auth(origin, room_id, event_id)
 
 
@@ -427,10 +438,10 @@ class FederationV1SendJoinServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, Tuple[int, JsonDict]]:
+    ) -> tuple[int, tuple[int, JsonDict]]:
         # TODO(paul): assert that event_id parsed from path actually
         #   match those given in content
         result = await self.handler.on_send_join_request(origin, content, room_id)
@@ -447,10 +458,10 @@ class FederationV2SendJoinServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # TODO(paul): assert that event_id parsed from path actually
         #   match those given in content
 
@@ -470,10 +481,10 @@ class FederationV1InviteServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, Tuple[int, JsonDict]]:
+    ) -> tuple[int, tuple[int, JsonDict]]:
         # We don't get a room version, so we have to assume its EITHER v1 or
         # v2. This is "fine" as the only difference between V1 and V2 is the
         # state resolution algorithm, and we don't use that for processing
@@ -497,10 +508,10 @@ class FederationV2InviteServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # TODO(paul): assert that room_id/event_id parsed from path actually
         #   match those given in content
 
@@ -535,9 +546,9 @@ class FederationThirdPartyInviteExchangeServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self.handler.on_exchange_third_party_invite_request(content)
         return 200, {}
 
@@ -547,8 +558,8 @@ class FederationClientKeysQueryServlet(BaseFederationServerServlet):
     CATEGORY = "Federation requests"
 
     async def on_POST(
-        self, origin: str, content: JsonDict, query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
+        self, origin: str, content: JsonDict, query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
         return await self.handler.on_query_client_keys(origin, content)
 
 
@@ -560,9 +571,9 @@ class FederationUserDevicesQueryServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         user_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         return await self.handler.on_query_user_devices(origin, user_id)
 
 
@@ -571,10 +582,10 @@ class FederationClientKeysClaimServlet(BaseFederationServerServlet):
     CATEGORY = "Federation requests"
 
     async def on_POST(
-        self, origin: str, content: JsonDict, query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
+        self, origin: str, content: JsonDict, query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
         # Generate a count for each algorithm, which is hard-coded to 1.
-        key_query: List[Tuple[str, str, str, int]] = []
+        key_query: list[tuple[str, str, str, int]] = []
         for user_id, device_keys in content.get("one_time_keys", {}).items():
             for device_id, algorithm in device_keys.items():
                 key_query.append((user_id, device_id, algorithm, 1))
@@ -597,10 +608,10 @@ class FederationUnstableClientKeysClaimServlet(BaseFederationServerServlet):
     CATEGORY = "Federation requests"
 
     async def on_POST(
-        self, origin: str, content: JsonDict, query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
+        self, origin: str, content: JsonDict, query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
         # Generate a count for each algorithm.
-        key_query: List[Tuple[str, str, str, int]] = []
+        key_query: list[tuple[str, str, str, int]] = []
         for user_id, device_keys in content.get("one_time_keys", {}).items():
             for device_id, algorithms in device_keys.items():
                 counts = Counter(algorithms)
@@ -621,9 +632,9 @@ class FederationGetMissingEventsServlet(BaseFederationServerServlet):
         self,
         origin: str,
         content: JsonDict,
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         limit = int(content.get("limit", 10))
         earliest_events = content.get("earliest_events", [])
         latest_events = content.get("latest_events", [])
@@ -646,8 +657,8 @@ class On3pidBindServlet(BaseFederationServerServlet):
     REQUIRE_AUTH = False
 
     async def on_POST(
-        self, origin: Optional[str], content: JsonDict, query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
+        self, origin: str | None, content: JsonDict, query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
         if "invites" in content:
             last_exception = None
             for invite in content["invites"]:
@@ -680,10 +691,10 @@ class FederationVersionServlet(BaseFederationServlet):
 
     async def on_GET(
         self,
-        origin: Optional[str],
+        origin: str | None,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
-    ) -> Tuple[int, JsonDict]:
+        query: dict[bytes, list[bytes]],
+    ) -> tuple[int, JsonDict]:
         return (
             200,
             {
@@ -715,7 +726,7 @@ class FederationRoomHierarchyServlet(BaseFederationServlet):
         content: Literal[None],
         query: Mapping[bytes, Sequence[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         suggested_only = parse_boolean_from_args(query, "suggested_only", default=False)
         return 200, await self.handler.get_federation_hierarchy(
             origin, room_id, suggested_only
@@ -746,9 +757,9 @@ class RoomComplexityServlet(BaseFederationServlet):
         self,
         origin: str,
         content: Literal[None],
-        query: Dict[bytes, List[bytes]],
+        query: dict[bytes, list[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         is_public = await self._store.is_room_world_readable_or_publicly_joinable(
             room_id
         )
@@ -780,7 +791,7 @@ class FederationAccountStatusServlet(BaseFederationServerServlet):
         content: JsonDict,
         query: Mapping[bytes, Sequence[bytes]],
         room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         if "user_ids" not in content:
             raise SynapseError(
                 400, "Required parameter 'user_ids' is missing", Codes.MISSING_PARAM
@@ -816,7 +827,7 @@ class FederationMediaDownloadServlet(BaseFederationServerServlet):
 
     async def on_GET(
         self,
-        origin: Optional[str],
+        origin: str | None,
         content: Literal[None],
         request: SynapseRequest,
         media_id: str,
@@ -856,7 +867,7 @@ class FederationMediaThumbnailServlet(BaseFederationServerServlet):
 
     async def on_GET(
         self,
-        origin: Optional[str],
+        origin: str | None,
         content: Literal[None],
         request: SynapseRequest,
         media_id: str,
@@ -882,7 +893,7 @@ class FederationMediaThumbnailServlet(BaseFederationServerServlet):
         self.media_repo.mark_recently_accessed(None, media_id)
 
 
-FEDERATION_SERVLET_CLASSES: Tuple[Type[BaseFederationServlet], ...] = (
+FEDERATION_SERVLET_CLASSES: tuple[type[BaseFederationServlet], ...] = (
     FederationSendServlet,
     FederationEventServlet,
     FederationStateV1Servlet,
@@ -890,6 +901,7 @@ FEDERATION_SERVLET_CLASSES: Tuple[Type[BaseFederationServlet], ...] = (
     FederationBackfillServlet,
     FederationTimestampLookupServlet,
     FederationQueryServlet,
+    FederationUnstableGetExtremitiesServlet,
     FederationMakeJoinServlet,
     FederationMakeLeaveServlet,
     FederationEventServlet,
diff --git a/synapse/federation/units.py b/synapse/federation/units.py
index 3bb5f824b7..547db9a394 100644
--- a/synapse/federation/units.py
+++ b/synapse/federation/units.py
@@ -24,7 +24,7 @@ server protocol.
 """
 
 import logging
-from typing import List, Optional, Sequence
+from typing import Sequence
 
 import attr
 
@@ -70,7 +70,7 @@ class Edu:
         getattr(self, "content", {})["org.matrix.opentracing_context"] = "{}"
 
 
-def _none_to_list(edus: Optional[List[JsonDict]]) -> List[JsonDict]:
+def _none_to_list(edus: list[JsonDict] | None) -> list[JsonDict]:
     if edus is None:
         return []
     return edus
@@ -98,8 +98,8 @@ class Transaction:
     origin: str
     destination: str
     origin_server_ts: int
-    pdus: List[JsonDict] = attr.ib(factory=list, converter=_none_to_list)
-    edus: List[JsonDict] = attr.ib(factory=list, converter=_none_to_list)
+    pdus: list[JsonDict] = attr.ib(factory=list, converter=_none_to_list)
+    edus: list[JsonDict] = attr.ib(factory=list, converter=_none_to_list)
 
     def get_dict(self) -> JsonDict:
         """A JSON-ready dictionary of valid keys which aren't internal."""
@@ -113,7 +113,7 @@ class Transaction:
         return result
 
 
-def filter_pdus_for_valid_depth(pdus: Sequence[JsonDict]) -> List[JsonDict]:
+def filter_pdus_for_valid_depth(pdus: Sequence[JsonDict]) -> list[JsonDict]:
     filtered_pdus = []
     for pdu in pdus:
         # Drop PDUs that have a depth that is outside of the range allowed
@@ -128,6 +128,6 @@ def filter_pdus_for_valid_depth(pdus: Sequence[JsonDict]) -> List[JsonDict]:
 
 
 def serialize_and_filter_pdus(
-    pdus: Sequence[EventBase], time_now: Optional[int] = None
-) -> List[JsonDict]:
+    pdus: Sequence[EventBase], time_now: int | None = None
+) -> list[JsonDict]:
     return filter_pdus_for_valid_depth([pdu.get_pdu_json(time_now) for pdu in pdus])
diff --git a/synapse/handlers/account.py b/synapse/handlers/account.py
index 37cc3d3ff5..855027f08e 100644
--- a/synapse/handlers/account.py
+++ b/synapse/handlers/account.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import TYPE_CHECKING, Dict, List, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import Codes, SynapseError
 from synapse.types import JsonDict, UserID
@@ -40,9 +40,9 @@ class AccountHandler:
 
     async def get_account_statuses(
         self,
-        user_ids: List[str],
+        user_ids: list[str],
         allow_remote: bool,
-    ) -> Tuple[JsonDict, List[str]]:
+    ) -> tuple[JsonDict, list[str]]:
         """Get account statuses for a list of user IDs.
 
         If one or more account(s) belong to remote homeservers, retrieve their status(es)
@@ -63,7 +63,7 @@ class AccountHandler:
         """
         statuses = {}
         failures = []
-        remote_users: List[UserID] = []
+        remote_users: list[UserID] = []
 
         for raw_user_id in user_ids:
             try:
@@ -127,8 +127,8 @@ class AccountHandler:
         return status
 
     async def _get_remote_account_statuses(
-        self, remote_users: List[UserID]
-    ) -> Tuple[JsonDict, List[str]]:
+        self, remote_users: list[UserID]
+    ) -> tuple[JsonDict, list[str]]:
         """Send out federation requests to retrieve the statuses of remote accounts.
 
         Args:
@@ -140,7 +140,7 @@ class AccountHandler:
         """
         # Group remote users by destination, so we only send one request per remote
         # homeserver.
-        by_destination: Dict[str, List[str]] = {}
+        by_destination: dict[str, list[str]] = {}
         for user in remote_users:
             if user.domain not in by_destination:
                 by_destination[user.domain] = []
@@ -149,7 +149,7 @@ class AccountHandler:
 
         # Retrieve the statuses and failures for remote accounts.
         final_statuses: JsonDict = {}
-        final_failures: List[str] = []
+        final_failures: list[str] = []
         for destination, users in by_destination.items():
             statuses, failures = await self._federation_client.get_account_status(
                 destination,
diff --git a/synapse/handlers/account_data.py b/synapse/handlers/account_data.py
index 228132db48..c6168377ee 100644
--- a/synapse/handlers/account_data.py
+++ b/synapse/handlers/account_data.py
@@ -21,7 +21,7 @@
 #
 import logging
 import random
-from typing import TYPE_CHECKING, Awaitable, Callable, List, Optional, Tuple
+from typing import TYPE_CHECKING, Awaitable, Callable
 
 from synapse.api.constants import AccountDataTypes
 from synapse.replication.http.account_data import (
@@ -40,9 +40,7 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
-ON_ACCOUNT_DATA_UPDATED_CALLBACK = Callable[
-    [str, Optional[str], str, JsonDict], Awaitable
-]
+ON_ACCOUNT_DATA_UPDATED_CALLBACK = Callable[[str, str | None, str, JsonDict], Awaitable]
 
 
 class AccountDataHandler:
@@ -67,12 +65,12 @@ class AccountDataHandler:
         self._remove_tag_client = ReplicationRemoveTagRestServlet.make_client(hs)
         self._account_data_writers = hs.config.worker.writers.account_data
 
-        self._on_account_data_updated_callbacks: List[
+        self._on_account_data_updated_callbacks: list[
             ON_ACCOUNT_DATA_UPDATED_CALLBACK
         ] = []
 
     def register_module_callbacks(
-        self, on_account_data_updated: Optional[ON_ACCOUNT_DATA_UPDATED_CALLBACK] = None
+        self, on_account_data_updated: ON_ACCOUNT_DATA_UPDATED_CALLBACK | None = None
     ) -> None:
         """Register callbacks from modules."""
         if on_account_data_updated is not None:
@@ -81,7 +79,7 @@ class AccountDataHandler:
     async def _notify_modules(
         self,
         user_id: str,
-        room_id: Optional[str],
+        room_id: str | None,
         account_data_type: str,
         content: JsonDict,
     ) -> None:
@@ -143,7 +141,7 @@ class AccountDataHandler:
 
     async def remove_account_data_for_room(
         self, user_id: str, room_id: str, account_data_type: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """
         Deletes the room account data for the given user and account data type.
 
@@ -219,7 +217,7 @@ class AccountDataHandler:
 
     async def remove_account_data_for_user(
         self, user_id: str, account_data_type: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """Removes a piece of global account_data for a user.
 
         Args:
@@ -324,8 +322,8 @@ class AccountDataEventSource(EventSource[int, JsonDict]):
         limit: int,
         room_ids: StrCollection,
         is_guest: bool,
-        explicit_room_id: Optional[str] = None,
-    ) -> Tuple[List[JsonDict], int]:
+        explicit_room_id: str | None = None,
+    ) -> tuple[list[JsonDict], int]:
         user_id = user.to_string()
         last_stream_id = from_key
 
diff --git a/synapse/handlers/account_validity.py b/synapse/handlers/account_validity.py
index 39a22b8cbb..ba40d5763e 100644
--- a/synapse/handlers/account_validity.py
+++ b/synapse/handlers/account_validity.py
@@ -21,13 +21,14 @@
 import email.mime.multipart
 import email.utils
 import logging
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import AuthError, StoreError, SynapseError
 from synapse.metrics.background_process_metrics import wrap_as_background_process
 from synapse.types import UserID
 from synapse.util import stringutils
 from synapse.util.async_helpers import delay_cancellation
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -37,10 +38,8 @@ logger = logging.getLogger(__name__)
 
 class AccountValidityHandler:
     def __init__(self, hs: "HomeServer"):
-        self.hs = hs
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
         self.config = hs.config
         self.store = hs.get_datastores().main
         self.send_email_handler = hs.get_send_email_handler()
@@ -75,7 +74,7 @@ class AccountValidityHandler:
 
             # Check the renewal emails to send and send them every 30min.
             if hs.config.worker.run_background_tasks:
-                self.clock.looping_call(self._send_renewal_emails, 30 * 60 * 1000)
+                self.clock.looping_call(self._send_renewal_emails, Duration(minutes=30))
 
     async def is_user_expired(self, user_id: str) -> bool:
         """Checks if a user has expired against third-party modules.
@@ -110,8 +109,8 @@ class AccountValidityHandler:
     async def on_user_login(
         self,
         user_id: str,
-        auth_provider_type: Optional[str],
-        auth_provider_id: Optional[str],
+        auth_provider_type: str | None,
+        auth_provider_id: str | None,
     ) -> None:
         """Tell third-party modules about a user logins.
 
@@ -224,7 +223,7 @@ class AccountValidityHandler:
 
         await self.store.set_renewal_mail_status(user_id=user_id, email_sent=True)
 
-    async def _get_email_addresses_for_user(self, user_id: str) -> List[str]:
+    async def _get_email_addresses_for_user(self, user_id: str) -> list[str]:
         """Retrieve the list of email addresses attached to a user's account.
 
         Args:
@@ -265,7 +264,7 @@ class AccountValidityHandler:
                 attempts += 1
         raise StoreError(500, "Couldn't generate a unique string as refresh string.")
 
-    async def renew_account(self, renewal_token: str) -> Tuple[bool, bool, int]:
+    async def renew_account(self, renewal_token: str) -> tuple[bool, bool, int]:
         """Renews the account attached to a given renewal token by pushing back the
         expiration date by the current validity period in the server's configuration.
 
@@ -328,9 +327,9 @@ class AccountValidityHandler:
     async def renew_account_for_user(
         self,
         user_id: str,
-        expiration_ts: Optional[int] = None,
+        expiration_ts: int | None = None,
         email_sent: bool = False,
-        renewal_token: Optional[str] = None,
+        renewal_token: str | None = None,
     ) -> int:
         """Renews the account attached to a given user by pushing back the
         expiration date by the current validity period in the server's
diff --git a/synapse/handlers/admin.py b/synapse/handlers/admin.py
index e90d675b59..2fb0e5814f 100644
--- a/synapse/handlers/admin.py
+++ b/synapse/handlers/admin.py
@@ -24,13 +24,8 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Any,
-    Dict,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
 )
 
 import attr
@@ -49,7 +44,7 @@ from synapse.types import (
     UserInfo,
     create_requester,
 )
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -75,7 +70,7 @@ class AdminHandler:
 
         self.hs = hs
 
-    async def get_redact_task(self, redact_id: str) -> Optional[ScheduledTask]:
+    async def get_redact_task(self, redact_id: str) -> ScheduledTask | None:
         """Get the current status of an active redaction process
 
         Args:
@@ -103,11 +98,9 @@ class AdminHandler:
 
         return ret
 
-    async def get_user(self, user: UserID) -> Optional[JsonMapping]:
+    async def get_user(self, user: UserID) -> JsonMapping | None:
         """Function to get user details"""
-        user_info: Optional[UserInfo] = await self._store.get_user_by_id(
-            user.to_string()
-        )
+        user_info: UserInfo | None = await self._store.get_user_by_id(user.to_string())
         if user_info is None:
             return None
 
@@ -218,7 +211,7 @@ class AdminHandler:
             to_key = RoomStreamToken(stream=stream_ordering)
 
             # Events that we've processed in this room
-            written_events: Set[str] = set()
+            written_events: set[str] = set()
 
             # We need to track gaps in the events stream so that we can then
             # write out the state at those events. We do this by keeping track
@@ -231,7 +224,7 @@ class AdminHandler:
             # The reverse mapping to above, i.e. map from unseen event to events
             # that have the unseen event in their prev_events, i.e. the unseen
             # events "children".
-            unseen_to_child_events: Dict[str, Set[str]] = {}
+            unseen_to_child_events: dict[str, set[str]] = {}
 
             # We fetch events in the room the user could see by fetching *all*
             # events that we have and then filtering, this isn't the most
@@ -258,7 +251,7 @@ class AdminHandler:
                     topological=last_event.depth,
                 )
 
-                events = await filter_events_for_client(
+                events = await filter_and_transform_events_for_client(
                     self._storage_controllers,
                     user_id,
                     events,
@@ -359,8 +352,8 @@ class AdminHandler:
         rooms: list,
         requester: JsonMapping,
         use_admin: bool,
-        reason: Optional[str],
-        limit: Optional[int],
+        reason: str | None,
+        limit: int | None,
     ) -> str:
         """
         Start a task redacting the events of the given user in the given rooms
@@ -412,7 +405,7 @@ class AdminHandler:
 
     async def _redact_all_events(
         self, task: ScheduledTask
-    ) -> Tuple[TaskStatus, Optional[Mapping[str, Any]], Optional[str]]:
+    ) -> tuple[TaskStatus, Mapping[str, Any] | None, str | None]:
         """
         Task to redact all of a users events in the given rooms, tracking which, if any, events
         whose redaction failed
@@ -518,7 +511,7 @@ class ExfiltrationWriter(metaclass=abc.ABCMeta):
     """Interface used to specify how to write exported data."""
 
     @abc.abstractmethod
-    def write_events(self, room_id: str, events: List[EventBase]) -> None:
+    def write_events(self, room_id: str, events: list[EventBase]) -> None:
         """Write a batch of events for a room."""
         raise NotImplementedError()
 
diff --git a/synapse/handlers/appservice.py b/synapse/handlers/appservice.py
index 5bd239e5fe..c91d2adbe1 100644
--- a/synapse/handlers/appservice.py
+++ b/synapse/handlers/appservice.py
@@ -22,13 +22,8 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Collection,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Union,
 )
 
 from prometheus_client import Counter
@@ -47,7 +42,6 @@ from synapse.metrics import (
     event_processing_loop_room_count,
 )
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.storage.databases.main.directory import RoomAliasMapping
@@ -76,9 +70,8 @@ events_processed_counter = Counter(
 
 class ApplicationServicesHandler:
     def __init__(self, hs: "HomeServer"):
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
         self.store = hs.get_datastores().main
         self.is_mine_id = hs.is_mine_id
         self.appservice_api = hs.get_application_service_api()
@@ -98,7 +91,7 @@ class ApplicationServicesHandler:
         self.is_processing = False
 
         self._ephemeral_events_linearizer = Linearizer(
-            name="appservice_ephemeral_events"
+            name="appservice_ephemeral_events", clock=hs.get_clock()
         )
 
     def notify_interested_services(self, max_token: RoomStreamToken) -> None:
@@ -145,7 +138,7 @@ class ApplicationServicesHandler:
                         event_to_received_ts.keys(), get_prev_content=True
                     )
 
-                    events_by_room: Dict[str, List[EventBase]] = {}
+                    events_by_room: dict[str, list[EventBase]] = {}
                     for event in events:
                         events_by_room.setdefault(event.room_id, []).append(event)
 
@@ -171,8 +164,8 @@ class ApplicationServicesHandler:
                                 except Exception:
                                     logger.error("Application Services Failure")
 
-                            run_as_background_process(
-                                "as_scheduler", self.server_name, start_scheduler
+                            self.hs.run_as_background_process(
+                                "as_scheduler", start_scheduler
                             )
                             self.started_scheduler = True
 
@@ -245,8 +238,8 @@ class ApplicationServicesHandler:
     def notify_interested_services_ephemeral(
         self,
         stream_key: StreamKeyType,
-        new_token: Union[int, RoomStreamToken, MultiWriterStreamToken],
-        users: Collection[Union[str, UserID]],
+        new_token: int | RoomStreamToken | MultiWriterStreamToken,
+        users: Collection[str | UserID],
     ) -> None:
         """
         This is called by the notifier in the background when an ephemeral event is handled
@@ -343,10 +336,10 @@ class ApplicationServicesHandler:
     @wrap_as_background_process("notify_interested_services_ephemeral")
     async def _notify_interested_services_ephemeral(
         self,
-        services: List[ApplicationService],
+        services: list[ApplicationService],
         stream_key: StreamKeyType,
-        new_token: Union[int, MultiWriterStreamToken],
-        users: Collection[Union[str, UserID]],
+        new_token: int | MultiWriterStreamToken,
+        users: Collection[str | UserID],
     ) -> None:
         logger.debug("Checking interested services for %s", stream_key)
         with Measure(
@@ -431,7 +424,7 @@ class ApplicationServicesHandler:
 
     async def _handle_typing(
         self, service: ApplicationService, new_token: int
-    ) -> List[JsonMapping]:
+    ) -> list[JsonMapping]:
         """
         Return the typing events since the given stream token that the given application
         service should receive.
@@ -466,7 +459,7 @@ class ApplicationServicesHandler:
 
     async def _handle_receipts(
         self, service: ApplicationService, new_token: MultiWriterStreamToken
-    ) -> List[JsonMapping]:
+    ) -> list[JsonMapping]:
         """
         Return the latest read receipts that the given application service should receive.
 
@@ -503,9 +496,9 @@ class ApplicationServicesHandler:
     async def _handle_presence(
         self,
         service: ApplicationService,
-        users: Collection[Union[str, UserID]],
-        new_token: Optional[int],
-    ) -> List[JsonMapping]:
+        users: Collection[str | UserID],
+        new_token: int | None,
+    ) -> list[JsonMapping]:
         """
         Return the latest presence updates that the given application service should receive.
 
@@ -525,7 +518,7 @@ class ApplicationServicesHandler:
             A list of json dictionaries containing data derived from the presence events
             that should be sent to the given application service.
         """
-        events: List[JsonMapping] = []
+        events: list[JsonMapping] = []
         presence_source = self.event_sources.sources.presence
         from_key = await self.store.get_type_stream_id_for_appservice(
             service, "presence"
@@ -564,8 +557,8 @@ class ApplicationServicesHandler:
         self,
         service: ApplicationService,
         new_token: int,
-        users: Collection[Union[str, UserID]],
-    ) -> List[JsonDict]:
+        users: Collection[str | UserID],
+    ) -> list[JsonDict]:
         """
         Given an application service, determine which events it should receive
         from those between the last-recorded to-device message stream token for this
@@ -587,7 +580,7 @@ class ApplicationServicesHandler:
         )
 
         # Filter out users that this appservice is not interested in
-        users_appservice_is_interested_in: List[str] = []
+        users_appservice_is_interested_in: list[str] = []
         for user in users:
             # FIXME: We should do this farther up the call stack. We currently repeat
             #  this operation in _handle_presence.
@@ -614,7 +607,7 @@ class ApplicationServicesHandler:
         #
         # So we mangle this dict into a flat list of to-device messages with the relevant
         # user ID and device ID embedded inside each message dict.
-        message_payload: List[JsonDict] = []
+        message_payload: list[JsonDict] = []
         for (
             user_id,
             device_id,
@@ -738,7 +731,7 @@ class ApplicationServicesHandler:
 
     async def query_room_alias_exists(
         self, room_alias: RoomAlias
-    ) -> Optional[RoomAliasMapping]:
+    ) -> RoomAliasMapping | None:
         """Check if an application service knows this room alias exists.
 
         Args:
@@ -763,8 +756,8 @@ class ApplicationServicesHandler:
         return None
 
     async def query_3pe(
-        self, kind: str, protocol: str, fields: Dict[bytes, List[bytes]]
-    ) -> List[JsonDict]:
+        self, kind: str, protocol: str, fields: dict[bytes, list[bytes]]
+    ) -> list[JsonDict]:
         services = self._get_services_for_3pn(protocol)
 
         results = await make_deferred_yieldable(
@@ -787,10 +780,10 @@ class ApplicationServicesHandler:
         return ret
 
     async def get_3pe_protocols(
-        self, only_protocol: Optional[str] = None
-    ) -> Dict[str, JsonDict]:
+        self, only_protocol: str | None = None
+    ) -> dict[str, JsonDict]:
         services = self.store.get_app_services()
-        protocols: Dict[str, List[JsonDict]] = {}
+        protocols: dict[str, list[JsonDict]] = {}
 
         # Collect up all the individual protocol responses out of the ASes
         for s in services:
@@ -806,7 +799,7 @@ class ApplicationServicesHandler:
                 if info is not None:
                     protocols[p].append(info)
 
-        def _merge_instances(infos: List[JsonDict]) -> JsonDict:
+        def _merge_instances(infos: list[JsonDict]) -> JsonDict:
             # Merge the 'instances' lists of multiple results, but just take
             # the other fields from the first as they ought to be identical
             # copy the result so as not to corrupt the cached one
@@ -824,7 +817,7 @@ class ApplicationServicesHandler:
 
     async def _get_services_for_event(
         self, event: EventBase
-    ) -> List[ApplicationService]:
+    ) -> list[ApplicationService]:
         """Retrieve a list of application services interested in this event.
 
         Args:
@@ -844,11 +837,11 @@ class ApplicationServicesHandler:
 
         return interested_list
 
-    def _get_services_for_user(self, user_id: str) -> List[ApplicationService]:
+    def _get_services_for_user(self, user_id: str) -> list[ApplicationService]:
         services = self.store.get_app_services()
         return [s for s in services if (s.is_interested_in_user(user_id))]
 
-    def _get_services_for_3pn(self, protocol: str) -> List[ApplicationService]:
+    def _get_services_for_3pn(self, protocol: str) -> list[ApplicationService]:
         services = self.store.get_app_services()
         return [s for s in services if s.is_interested_in_protocol(protocol)]
 
@@ -874,9 +867,9 @@ class ApplicationServicesHandler:
         return True
 
     async def claim_e2e_one_time_keys(
-        self, query: Iterable[Tuple[str, str, str, int]]
-    ) -> Tuple[
-        Dict[str, Dict[str, Dict[str, JsonDict]]], List[Tuple[str, str, str, int]]
+        self, query: Iterable[tuple[str, str, str, int]]
+    ) -> tuple[
+        dict[str, dict[str, dict[str, JsonDict]]], list[tuple[str, str, str, int]]
     ]:
         """Claim one time keys from application services.
 
@@ -898,7 +891,7 @@ class ApplicationServicesHandler:
         services = self.store.get_app_services()
 
         # Partition the users by appservice.
-        query_by_appservice: Dict[str, List[Tuple[str, str, str, int]]] = {}
+        query_by_appservice: dict[str, list[tuple[str, str, str, int]]] = {}
         missing = []
         for user_id, device, algorithm, count in query:
             if not self.store.get_if_app_services_interested_in_user(user_id):
@@ -931,7 +924,7 @@ class ApplicationServicesHandler:
 
         # Patch together the results -- they are all independent (since they
         # require exclusive control over the users, which is the outermost key).
-        claimed_keys: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
+        claimed_keys: dict[str, dict[str, dict[str, JsonDict]]] = {}
         for success, result in results:
             if success:
                 claimed_keys.update(result[0])
@@ -940,8 +933,8 @@ class ApplicationServicesHandler:
         return claimed_keys, missing
 
     async def query_keys(
-        self, query: Mapping[str, Optional[List[str]]]
-    ) -> Dict[str, Dict[str, Dict[str, JsonDict]]]:
+        self, query: Mapping[str, list[str] | None]
+    ) -> dict[str, dict[str, dict[str, JsonDict]]]:
         """Query application services for device keys.
 
         Users which are exclusively owned by an application service are queried
@@ -956,7 +949,7 @@ class ApplicationServicesHandler:
         services = self.store.get_app_services()
 
         # Partition the users by appservice.
-        query_by_appservice: Dict[str, Dict[str, List[str]]] = {}
+        query_by_appservice: dict[str, dict[str, list[str]]] = {}
         for user_id, device_ids in query.items():
             if not self.store.get_if_app_services_interested_in_user(user_id):
                 continue
@@ -988,7 +981,7 @@ class ApplicationServicesHandler:
         # Patch together the results -- they are all independent (since they
         # require exclusive control over the users). They get returned as a single
         # dictionary.
-        key_queries: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
+        key_queries: dict[str, dict[str, dict[str, JsonDict]]] = {}
         for success, result in results:
             if success:
                 key_queries.update(result)
diff --git a/synapse/handlers/auth.py b/synapse/handlers/auth.py
index 2d1990cce5..b5c0cbdba2 100644
--- a/synapse/handlers/auth.py
+++ b/synapse/handlers/auth.py
@@ -31,14 +31,8 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Type,
-    Union,
     cast,
 )
 
@@ -80,6 +74,7 @@ from synapse.storage.databases.main.registration import (
 from synapse.types import JsonDict, Requester, StrCollection, UserID
 from synapse.util import stringutils as stringutils
 from synapse.util.async_helpers import delay_cancellation, maybe_awaitable
+from synapse.util.duration import Duration
 from synapse.util.msisdn import phone_number_to_msisdn
 from synapse.util.stringutils import base62_encode
 from synapse.util.threepids import canonicalise_email
@@ -102,7 +97,7 @@ invalid_login_token_counter = Counter(
 
 def convert_client_dict_legacy_fields_to_identifier(
     submission: JsonDict,
-) -> Dict[str, str]:
+) -> dict[str, str]:
     """
     Convert a legacy-formatted login submission to an identifier dict.
 
@@ -154,7 +149,7 @@ def convert_client_dict_legacy_fields_to_identifier(
     return identifier
 
 
-def login_id_phone_to_thirdparty(identifier: JsonDict) -> Dict[str, str]:
+def login_id_phone_to_thirdparty(identifier: JsonDict) -> dict[str, str]:
     """
     Convert a phone login identifier type to a generic threepid identifier.
 
@@ -205,7 +200,7 @@ class AuthHandler:
         self.auth = hs.get_auth()
         self.auth_blocking = hs.get_auth_blocking()
         self.clock = hs.get_clock()
-        self.checkers: Dict[str, UserInteractiveAuthChecker] = {}
+        self.checkers: dict[str, UserInteractiveAuthChecker] = {}
         for auth_checker_class in INTERACTIVE_AUTH_CHECKERS:
             inst = auth_checker_class(hs)
             if inst.is_enabled():
@@ -248,7 +243,7 @@ class AuthHandler:
         if hs.config.worker.run_background_tasks:
             self._clock.looping_call(
                 run_as_background_process,
-                5 * 60 * 1000,
+                Duration(minutes=5),
                 "expire_old_sessions",
                 self.server_name,
                 self._expire_old_sessions,
@@ -280,7 +275,7 @@ class AuthHandler:
 
         # A mapping of user ID to extra attributes to include in the login
         # response.
-        self._extra_attributes: Dict[str, SsoLoginExtraAttributes] = {}
+        self._extra_attributes: dict[str, SsoLoginExtraAttributes] = {}
 
         self._auth_delegation_enabled = (
             hs.config.mas.enabled or hs.config.experimental.msc3861.enabled
@@ -290,10 +285,10 @@ class AuthHandler:
         self,
         requester: Requester,
         request: SynapseRequest,
-        request_body: Dict[str, Any],
+        request_body: dict[str, Any],
         description: str,
         can_skip_ui_auth: bool = False,
-    ) -> Tuple[dict, Optional[str]]:
+    ) -> tuple[dict, str | None]:
         """
         Checks that the user is who they claim to be, via a UI auth.
 
@@ -440,12 +435,12 @@ class AuthHandler:
 
     async def check_ui_auth(
         self,
-        flows: List[List[str]],
+        flows: list[list[str]],
         request: SynapseRequest,
-        clientdict: Dict[str, Any],
+        clientdict: dict[str, Any],
         description: str,
-        get_new_session_data: Optional[Callable[[], JsonDict]] = None,
-    ) -> Tuple[dict, dict, str]:
+        get_new_session_data: Callable[[], JsonDict] | None = None,
+    ) -> tuple[dict, dict, str]:
         """
         Takes a dictionary sent by the client in the login / registration
         protocol and handles the User-Interactive Auth flow.
@@ -491,7 +486,7 @@ class AuthHandler:
                 all the stages in any of the permitted flows.
         """
 
-        sid: Optional[str] = None
+        sid: str | None = None
         authdict = clientdict.pop("auth", {})
         if "session" in authdict:
             sid = authdict["session"]
@@ -579,7 +574,7 @@ class AuthHandler:
             )
 
         # check auth type currently being presented
-        errordict: Dict[str, Any] = {}
+        errordict: dict[str, Any] = {}
         if "type" in authdict:
             login_type: str = authdict["type"]
             try:
@@ -617,7 +612,7 @@ class AuthHandler:
         raise InteractiveAuthIncompleteError(session.session_id, ret)
 
     async def add_oob_auth(
-        self, stagetype: str, authdict: Dict[str, Any], clientip: str
+        self, stagetype: str, authdict: dict[str, Any], clientip: str
     ) -> None:
         """
         Adds the result of out-of-band authentication into an existing auth
@@ -641,7 +636,7 @@ class AuthHandler:
             authdict["session"], stagetype, result
         )
 
-    def get_session_id(self, clientdict: Dict[str, Any]) -> Optional[str]:
+    def get_session_id(self, clientdict: dict[str, Any]) -> str | None:
         """
         Gets the session ID for a client given the client dictionary
 
@@ -677,7 +672,7 @@ class AuthHandler:
             raise SynapseError(400, "Unknown session ID: %s" % (session_id,))
 
     async def get_session_data(
-        self, session_id: str, key: str, default: Optional[Any] = None
+        self, session_id: str, key: str, default: Any | None = None
     ) -> Any:
         """
         Retrieve data stored with set_session_data
@@ -702,8 +697,8 @@ class AuthHandler:
         await self.store.delete_old_ui_auth_sessions(expiration_time)
 
     async def _check_auth_dict(
-        self, authdict: Dict[str, Any], clientip: str
-    ) -> Union[Dict[str, Any], str]:
+        self, authdict: dict[str, Any], clientip: str
+    ) -> dict[str, Any] | str:
         """Attempt to validate the auth dict provided by a client
 
         Args:
@@ -750,9 +745,9 @@ class AuthHandler:
 
     def _auth_dict_for_flows(
         self,
-        flows: List[List[str]],
+        flows: list[list[str]],
         session_id: str,
-    ) -> Dict[str, Any]:
+    ) -> dict[str, Any]:
         public_flows = []
         for f in flows:
             public_flows.append(f)
@@ -762,7 +757,7 @@ class AuthHandler:
             LoginType.TERMS: self._get_params_terms,
         }
 
-        params: Dict[str, Any] = {}
+        params: dict[str, Any] = {}
 
         for f in public_flows:
             for stage in f:
@@ -778,9 +773,9 @@ class AuthHandler:
     async def refresh_token(
         self,
         refresh_token: str,
-        access_token_valid_until_ms: Optional[int],
-        refresh_token_valid_until_ms: Optional[int],
-    ) -> Tuple[str, str, Optional[int]]:
+        access_token_valid_until_ms: int | None,
+        refresh_token_valid_until_ms: int | None,
+    ) -> tuple[str, str, int | None]:
         """
         Consumes a refresh token and generate both a new access token and a new refresh token from it.
 
@@ -913,8 +908,8 @@ class AuthHandler:
         self,
         user_id: str,
         duration_ms: int = (2 * 60 * 1000),
-        auth_provider_id: Optional[str] = None,
-        auth_provider_session_id: Optional[str] = None,
+        auth_provider_id: str | None = None,
+        auth_provider_session_id: str | None = None,
     ) -> str:
         login_token = self.generate_login_token()
         now = self._clock.time_msec()
@@ -932,9 +927,9 @@ class AuthHandler:
         self,
         user_id: str,
         device_id: str,
-        expiry_ts: Optional[int],
-        ultimate_session_expiry_ts: Optional[int],
-    ) -> Tuple[str, int]:
+        expiry_ts: int | None,
+        ultimate_session_expiry_ts: int | None,
+    ) -> tuple[str, int]:
         """
         Creates a new refresh token for the user with the given user ID.
 
@@ -965,11 +960,11 @@ class AuthHandler:
     async def create_access_token_for_user_id(
         self,
         user_id: str,
-        device_id: Optional[str],
-        valid_until_ms: Optional[int],
-        puppets_user_id: Optional[str] = None,
+        device_id: str | None,
+        valid_until_ms: int | None,
+        puppets_user_id: str | None = None,
         is_appservice_ghost: bool = False,
-        refresh_token_id: Optional[int] = None,
+        refresh_token_id: int | None = None,
     ) -> str:
         """
         Creates a new access token for the user with the given user ID.
@@ -1038,7 +1033,7 @@ class AuthHandler:
 
         return access_token
 
-    async def check_user_exists(self, user_id: str) -> Optional[str]:
+    async def check_user_exists(self, user_id: str) -> str | None:
         """
         Checks to see if a user with the given id exists. Will check case
         insensitively, but return None if there are multiple inexact matches.
@@ -1065,9 +1060,7 @@ class AuthHandler:
         """
         return await self.store.is_user_approved(user_id)
 
-    async def _find_user_id_and_pwd_hash(
-        self, user_id: str
-    ) -> Optional[Tuple[str, str]]:
+    async def _find_user_id_and_pwd_hash(self, user_id: str) -> tuple[str, str] | None:
         """Checks to see if a user with the given id exists. Will check case
         insensitively, but will return None if there are multiple inexact
         matches.
@@ -1142,10 +1135,10 @@ class AuthHandler:
 
     async def validate_login(
         self,
-        login_submission: Dict[str, Any],
+        login_submission: dict[str, Any],
         ratelimit: bool = False,
         is_reauth: bool = False,
-    ) -> Tuple[str, Optional[Callable[["LoginResponse"], Awaitable[None]]]]:
+    ) -> tuple[str, Callable[["LoginResponse"], Awaitable[None]] | None]:
         """Authenticates the user for the /login API
 
         Also used by the user-interactive auth flow to validate auth types which don't
@@ -1300,8 +1293,8 @@ class AuthHandler:
     async def _validate_userid_login(
         self,
         username: str,
-        login_submission: Dict[str, Any],
-    ) -> Tuple[str, Optional[Callable[["LoginResponse"], Awaitable[None]]]]:
+        login_submission: dict[str, Any],
+    ) -> tuple[str, Callable[["LoginResponse"], Awaitable[None]] | None]:
         """Helper for validate_login
 
         Handles login, once we've mapped 3pids onto userids
@@ -1390,7 +1383,7 @@ class AuthHandler:
 
     async def check_password_provider_3pid(
         self, medium: str, address: str, password: str
-    ) -> Tuple[Optional[str], Optional[Callable[["LoginResponse"], Awaitable[None]]]]:
+    ) -> tuple[str | None, Callable[["LoginResponse"], Awaitable[None]] | None]:
         """Check if a password provider is able to validate a thirdparty login
 
         Args:
@@ -1417,7 +1410,7 @@ class AuthHandler:
         # if result is None then return (None, None)
         return None, None
 
-    async def _check_local_password(self, user_id: str, password: str) -> Optional[str]:
+    async def _check_local_password(self, user_id: str, password: str) -> str | None:
         """Authenticate a user against the local password database.
 
         user_id is checked case insensitively, but will return None if there are
@@ -1532,8 +1525,8 @@ class AuthHandler:
     async def delete_access_tokens_for_user(
         self,
         user_id: str,
-        except_token_id: Optional[int] = None,
-        device_id: Optional[str] = None,
+        except_token_id: int | None = None,
+        device_id: str | None = None,
     ) -> None:
         """Invalidate access tokens belonging to a user
 
@@ -1683,16 +1676,28 @@ class AuthHandler:
             # Normalise the Unicode in the password
             pw = unicodedata.normalize("NFKC", password)
 
+            bytes_to_hash = pw.encode(
+                "utf8"
+            ) + self.hs.config.auth.password_pepper.encode("utf8")
+            if len(bytes_to_hash) > 72:
+                # bcrypt only looks at the first 72 bytes.
+                #
+                # Note: we explicitly DO NOT log the length of the user's password here.
+                logger.debug(
+                    "Password + pepper is too long; truncating to 72 bytes for bcrypt. "
+                    "This is expected behaviour and will not affect a user's ability to log in. 72 bytes is "
+                    "sufficient entropy for a password."
+                )
+                bytes_to_hash = bytes_to_hash[:72]
+
             return bcrypt.hashpw(
-                pw.encode("utf8") + self.hs.config.auth.password_pepper.encode("utf8"),
+                bytes_to_hash,
                 bcrypt.gensalt(self.bcrypt_rounds),
             ).decode("ascii")
 
         return await defer_to_thread(self.hs.get_reactor(), _do_hash)
 
-    async def validate_hash(
-        self, password: str, stored_hash: Union[bytes, str]
-    ) -> bool:
+    async def validate_hash(self, password: str, stored_hash: bytes | str) -> bool:
         """Validates that self.hash(password) == stored_hash.
 
         Args:
@@ -1706,9 +1711,20 @@ class AuthHandler:
         def _do_validate_hash(checked_hash: bytes) -> bool:
             # Normalise the Unicode in the password
             pw = unicodedata.normalize("NFKC", password)
+            password_pepper = self.hs.config.auth.password_pepper
+
+            bytes_to_hash = pw.encode("utf8") + password_pepper.encode("utf8")
+            if len(bytes_to_hash) > 72:
+                # bcrypt only looks at the first 72 bytes
+                logger.debug(
+                    "Password + pepper is too long; truncating to 72 bytes for bcrypt. "
+                    "This is expected behaviour and will not affect a user's ability to log in. 72 bytes is "
+                    "sufficient entropy for a password."
+                )
+                bytes_to_hash = bytes_to_hash[:72]
 
             return bcrypt.checkpw(
-                pw.encode("utf8") + self.hs.config.auth.password_pepper.encode("utf8"),
+                bytes_to_hash,
                 checked_hash,
             )
 
@@ -1778,9 +1794,9 @@ class AuthHandler:
         auth_provider_id: str,
         request: Request,
         client_redirect_url: str,
-        extra_attributes: Optional[JsonDict] = None,
+        extra_attributes: JsonDict | None = None,
         new_user: bool = False,
-        auth_provider_session_id: Optional[str] = None,
+        auth_provider_session_id: str | None = None,
     ) -> None:
         """Having figured out a mxid for this user, complete the HTTP request
 
@@ -1891,7 +1907,7 @@ class AuthHandler:
 
         extra_attributes = self._extra_attributes.get(login_result["user_id"])
         if extra_attributes:
-            login_result_dict = cast(Dict[str, Any], login_result)
+            login_result_dict = cast(dict[str, Any], login_result)
             login_result_dict.update(extra_attributes.extra_attributes)
 
     def _expire_sso_extra_attributes(self) -> None:
@@ -1927,7 +1943,7 @@ def load_legacy_password_auth_providers(hs: "HomeServer") -> None:
 
 
 def load_single_legacy_password_auth_provider(
-    module: Type,
+    module: type,
     config: JsonDict,
     api: "ModuleApi",
 ) -> None:
@@ -1939,7 +1955,7 @@ def load_single_legacy_password_auth_provider(
 
     # All methods that the module provides should be async, but this wasn't enforced
     # in the old module system, so we wrap them if needed
-    def async_wrapper(f: Optional[Callable]) -> Optional[Callable[..., Awaitable]]:
+    def async_wrapper(f: Callable | None) -> Callable[..., Awaitable] | None:
         # f might be None if the callback isn't implemented by the module. In this
         # case we don't want to register a callback at all so we return None.
         if f is None:
@@ -1952,7 +1968,7 @@ def load_single_legacy_password_auth_provider(
 
             async def wrapped_check_password(
                 username: str, login_type: str, login_dict: JsonDict
-            ) -> Optional[Tuple[str, Optional[Callable]]]:
+            ) -> tuple[str, Callable | None] | None:
                 # We've already made sure f is not None above, but mypy doesn't do well
                 # across function boundaries so we need to tell it f is definitely not
                 # None.
@@ -1971,12 +1987,12 @@ def load_single_legacy_password_auth_provider(
             return wrapped_check_password
 
         # We need to wrap check_auth as in the old form it could return
-        # just a str, but now it must return Optional[Tuple[str, Optional[Callable]]
+        # just a str, but now it must return tuple[str, Callable | None] | None
         if f.__name__ == "check_auth":
 
             async def wrapped_check_auth(
                 username: str, login_type: str, login_dict: JsonDict
-            ) -> Optional[Tuple[str, Optional[Callable]]]:
+            ) -> tuple[str, Callable | None] | None:
                 # We've already made sure f is not None above, but mypy doesn't do well
                 # across function boundaries so we need to tell it f is definitely not
                 # None.
@@ -1992,12 +2008,12 @@ def load_single_legacy_password_auth_provider(
             return wrapped_check_auth
 
         # We need to wrap check_3pid_auth as in the old form it could return
-        # just a str, but now it must return Optional[Tuple[str, Optional[Callable]]
+        # just a str, but now it must return tuple[str, Callable | None] | None
         if f.__name__ == "check_3pid_auth":
 
             async def wrapped_check_3pid_auth(
                 medium: str, address: str, password: str
-            ) -> Optional[Tuple[str, Optional[Callable]]]:
+            ) -> tuple[str, Callable | None] | None:
                 # We've already made sure f is not None above, but mypy doesn't do well
                 # across function boundaries so we need to tell it f is definitely not
                 # None.
@@ -2012,7 +2028,7 @@ def load_single_legacy_password_auth_provider(
 
             return wrapped_check_3pid_auth
 
-        def run(*args: Tuple, **kwargs: Dict) -> Awaitable:
+        def run(*args: tuple, **kwargs: dict) -> Awaitable:
             # mypy doesn't do well across function boundaries so we need to tell it
             # f is definitely not None.
             assert f is not None
@@ -2023,10 +2039,10 @@ def load_single_legacy_password_auth_provider(
 
     # If the module has these methods implemented, then we pull them out
     # and register them as hooks.
-    check_3pid_auth_hook: Optional[CHECK_3PID_AUTH_CALLBACK] = async_wrapper(
+    check_3pid_auth_hook: CHECK_3PID_AUTH_CALLBACK | None = async_wrapper(
         getattr(provider, "check_3pid_auth", None)
     )
-    on_logged_out_hook: Optional[ON_LOGGED_OUT_CALLBACK] = async_wrapper(
+    on_logged_out_hook: ON_LOGGED_OUT_CALLBACK | None = async_wrapper(
         getattr(provider, "on_logged_out", None)
     )
 
@@ -2064,24 +2080,20 @@ def load_single_legacy_password_auth_provider(
 
 CHECK_3PID_AUTH_CALLBACK = Callable[
     [str, str, str],
-    Awaitable[
-        Optional[Tuple[str, Optional[Callable[["LoginResponse"], Awaitable[None]]]]]
-    ],
+    Awaitable[tuple[str, Callable[["LoginResponse"], Awaitable[None]] | None] | None],
 ]
-ON_LOGGED_OUT_CALLBACK = Callable[[str, Optional[str], str], Awaitable]
+ON_LOGGED_OUT_CALLBACK = Callable[[str, str | None, str], Awaitable]
 CHECK_AUTH_CALLBACK = Callable[
     [str, str, JsonDict],
-    Awaitable[
-        Optional[Tuple[str, Optional[Callable[["LoginResponse"], Awaitable[None]]]]]
-    ],
+    Awaitable[tuple[str, Callable[["LoginResponse"], Awaitable[None]] | None] | None],
 ]
 GET_USERNAME_FOR_REGISTRATION_CALLBACK = Callable[
     [JsonDict, JsonDict],
-    Awaitable[Optional[str]],
+    Awaitable[str | None],
 ]
 GET_DISPLAYNAME_FOR_REGISTRATION_CALLBACK = Callable[
     [JsonDict, JsonDict],
-    Awaitable[Optional[str]],
+    Awaitable[str | None],
 ]
 IS_3PID_ALLOWED_CALLBACK = Callable[[str, str, bool], Awaitable[bool]]
 
@@ -2094,36 +2106,33 @@ class PasswordAuthProvider:
 
     def __init__(self) -> None:
         # lists of callbacks
-        self.check_3pid_auth_callbacks: List[CHECK_3PID_AUTH_CALLBACK] = []
-        self.on_logged_out_callbacks: List[ON_LOGGED_OUT_CALLBACK] = []
-        self.get_username_for_registration_callbacks: List[
+        self.check_3pid_auth_callbacks: list[CHECK_3PID_AUTH_CALLBACK] = []
+        self.on_logged_out_callbacks: list[ON_LOGGED_OUT_CALLBACK] = []
+        self.get_username_for_registration_callbacks: list[
             GET_USERNAME_FOR_REGISTRATION_CALLBACK
         ] = []
-        self.get_displayname_for_registration_callbacks: List[
+        self.get_displayname_for_registration_callbacks: list[
             GET_DISPLAYNAME_FOR_REGISTRATION_CALLBACK
         ] = []
-        self.is_3pid_allowed_callbacks: List[IS_3PID_ALLOWED_CALLBACK] = []
+        self.is_3pid_allowed_callbacks: list[IS_3PID_ALLOWED_CALLBACK] = []
 
         # Mapping from login type to login parameters
-        self._supported_login_types: Dict[str, Tuple[str, ...]] = {}
+        self._supported_login_types: dict[str, tuple[str, ...]] = {}
 
         # Mapping from login type to auth checker callbacks
-        self.auth_checker_callbacks: Dict[str, List[CHECK_AUTH_CALLBACK]] = {}
+        self.auth_checker_callbacks: dict[str, list[CHECK_AUTH_CALLBACK]] = {}
 
     def register_password_auth_provider_callbacks(
         self,
-        check_3pid_auth: Optional[CHECK_3PID_AUTH_CALLBACK] = None,
-        on_logged_out: Optional[ON_LOGGED_OUT_CALLBACK] = None,
-        is_3pid_allowed: Optional[IS_3PID_ALLOWED_CALLBACK] = None,
-        auth_checkers: Optional[
-            Dict[Tuple[str, Tuple[str, ...]], CHECK_AUTH_CALLBACK]
-        ] = None,
-        get_username_for_registration: Optional[
-            GET_USERNAME_FOR_REGISTRATION_CALLBACK
-        ] = None,
-        get_displayname_for_registration: Optional[
-            GET_DISPLAYNAME_FOR_REGISTRATION_CALLBACK
-        ] = None,
+        check_3pid_auth: CHECK_3PID_AUTH_CALLBACK | None = None,
+        on_logged_out: ON_LOGGED_OUT_CALLBACK | None = None,
+        is_3pid_allowed: IS_3PID_ALLOWED_CALLBACK | None = None,
+        auth_checkers: dict[tuple[str, tuple[str, ...]], CHECK_AUTH_CALLBACK]
+        | None = None,
+        get_username_for_registration: GET_USERNAME_FOR_REGISTRATION_CALLBACK
+        | None = None,
+        get_displayname_for_registration: GET_DISPLAYNAME_FOR_REGISTRATION_CALLBACK
+        | None = None,
     ) -> None:
         # Register check_3pid_auth callback
         if check_3pid_auth is not None:
@@ -2193,7 +2202,7 @@ class PasswordAuthProvider:
 
     async def check_auth(
         self, username: str, login_type: str, login_dict: JsonDict
-    ) -> Optional[Tuple[str, Optional[Callable[["LoginResponse"], Awaitable[None]]]]]:
+    ) -> tuple[str, Callable[["LoginResponse"], Awaitable[None]] | None] | None:
         """Check if the user has presented valid login credentials
 
         Args:
@@ -2224,14 +2233,14 @@ class PasswordAuthProvider:
                 continue
 
             if result is not None:
-                # Check that the callback returned a Tuple[str, Optional[Callable]]
+                # Check that the callback returned a tuple[str, Callable | None]
                 # "type: ignore[unreachable]" is used after some isinstance checks because mypy thinks
                 # result is always the right type, but as it is 3rd party code it might not be
 
                 if not isinstance(result, tuple) or len(result) != 2:
                     logger.warning(  # type: ignore[unreachable]
                         "Wrong type returned by module API callback %s: %s, expected"
-                        " Optional[Tuple[str, Optional[Callable]]]",
+                        " tuple[str, Callable | None] | None",
                         callback,
                         result,
                     )
@@ -2244,24 +2253,24 @@ class PasswordAuthProvider:
                 if not isinstance(str_result, str):
                     logger.warning(  # type: ignore[unreachable]
                         "Wrong type returned by module API callback %s: %s, expected"
-                        " Optional[Tuple[str, Optional[Callable]]]",
+                        " tuple[str, Callable | None] | None",
                         callback,
                         result,
                     )
                     continue
 
-                # the second should be Optional[Callable]
+                # the second should be Callable | None
                 if callback_result is not None:
                     if not callable(callback_result):
                         logger.warning(  # type: ignore[unreachable]
                             "Wrong type returned by module API callback %s: %s, expected"
-                            " Optional[Tuple[str, Optional[Callable]]]",
+                            " tuple[str, Callable | None] | None",
                             callback,
                             result,
                         )
                         continue
 
-                # The result is a (str, Optional[callback]) tuple so return the successful result
+                # The result is a (str, callback | None) tuple so return the successful result
                 return result
 
         # If this point has been reached then none of the callbacks successfully authenticated
@@ -2270,7 +2279,7 @@ class PasswordAuthProvider:
 
     async def check_3pid_auth(
         self, medium: str, address: str, password: str
-    ) -> Optional[Tuple[str, Optional[Callable[["LoginResponse"], Awaitable[None]]]]]:
+    ) -> tuple[str, Callable[["LoginResponse"], Awaitable[None]] | None] | None:
         # This function is able to return a deferred that either
         # resolves None, meaning authentication failure, or upon
         # success, to a str (which is the user_id) or a tuple of
@@ -2287,14 +2296,14 @@ class PasswordAuthProvider:
                 continue
 
             if result is not None:
-                # Check that the callback returned a Tuple[str, Optional[Callable]]
+                # Check that the callback returned a tuple[str, Callable | None]
                 # "type: ignore[unreachable]" is used after some isinstance checks because mypy thinks
                 # result is always the right type, but as it is 3rd party code it might not be
 
                 if not isinstance(result, tuple) or len(result) != 2:
                     logger.warning(  # type: ignore[unreachable]
                         "Wrong type returned by module API callback %s: %s, expected"
-                        " Optional[Tuple[str, Optional[Callable]]]",
+                        " tuple[str, Callable | None] | None",
                         callback,
                         result,
                     )
@@ -2307,24 +2316,24 @@ class PasswordAuthProvider:
                 if not isinstance(str_result, str):
                     logger.warning(  # type: ignore[unreachable]
                         "Wrong type returned by module API callback %s: %s, expected"
-                        " Optional[Tuple[str, Optional[Callable]]]",
+                        " tuple[str, Callable | None] | None",
                         callback,
                         result,
                     )
                     continue
 
-                # the second should be Optional[Callable]
+                # the second should be Callable | None
                 if callback_result is not None:
                     if not callable(callback_result):
                         logger.warning(  # type: ignore[unreachable]
                             "Wrong type returned by module API callback %s: %s, expected"
-                            " Optional[Tuple[str, Optional[Callable]]]",
+                            " tuple[str, Callable | None] | None",
                             callback,
                             result,
                         )
                         continue
 
-                # The result is a (str, Optional[callback]) tuple so return the successful result
+                # The result is a (str, callback | None) tuple so return the successful result
                 return result
 
         # If this point has been reached then none of the callbacks successfully authenticated
@@ -2332,7 +2341,7 @@ class PasswordAuthProvider:
         return None
 
     async def on_logged_out(
-        self, user_id: str, device_id: Optional[str], access_token: str
+        self, user_id: str, device_id: str | None, access_token: str
     ) -> None:
         # call all of the on_logged_out callbacks
         for callback in self.on_logged_out_callbacks:
@@ -2346,7 +2355,7 @@ class PasswordAuthProvider:
         self,
         uia_results: JsonDict,
         params: JsonDict,
-    ) -> Optional[str]:
+    ) -> str | None:
         """Defines the username to use when registering the user, using the credentials
         and parameters provided during the UIA flow.
 
@@ -2391,7 +2400,7 @@ class PasswordAuthProvider:
         self,
         uia_results: JsonDict,
         params: JsonDict,
-    ) -> Optional[str]:
+    ) -> str | None:
         """Defines the display name to use when registering the user, using the
         credentials and parameters provided during the UIA flow.
 
diff --git a/synapse/handlers/cas.py b/synapse/handlers/cas.py
index fbe79c2e4c..dbcf074d2b 100644
--- a/synapse/handlers/cas.py
+++ b/synapse/handlers/cas.py
@@ -20,7 +20,7 @@
 #
 import logging
 import urllib.parse
-from typing import TYPE_CHECKING, Dict, List, Optional
+from typing import TYPE_CHECKING
 from xml.etree import ElementTree as ET
 
 import attr
@@ -41,7 +41,7 @@ logger = logging.getLogger(__name__)
 class CasError(Exception):
     """Used to catch errors when validating the CAS ticket."""
 
-    def __init__(self, error: str, error_description: Optional[str] = None):
+    def __init__(self, error: str, error_description: str | None = None):
         self.error = error
         self.error_description = error_description
 
@@ -54,7 +54,7 @@ class CasError(Exception):
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class CasResponse:
     username: str
-    attributes: Dict[str, List[Optional[str]]]
+    attributes: dict[str, list[str | None]]
 
 
 class CasHandler:
@@ -99,7 +99,7 @@ class CasHandler:
 
         self._sso_handler.register_identity_provider(self)
 
-    def _build_service_param(self, args: Dict[str, str]) -> str:
+    def _build_service_param(self, args: dict[str, str]) -> str:
         """
         Generates a value to use as the "service" parameter when redirecting or
         querying the CAS service.
@@ -116,7 +116,7 @@ class CasHandler:
         )
 
     async def _validate_ticket(
-        self, ticket: str, service_args: Dict[str, str]
+        self, ticket: str, service_args: dict[str, str]
     ) -> CasResponse:
         """
         Validate a CAS ticket with the server, and return the parsed the response.
@@ -145,7 +145,7 @@ class CasHandler:
         except PartialDownloadError as pde:
             # Twisted raises this error if the connection is closed,
             # even if that's being used old-http style to signal end-of-data
-            # Assertion is for mypy's benefit. Error.response is Optional[bytes],
+            # Assertion is for mypy's benefit. Error.response is bytes | None,
             # but a PartialDownloadError should always have a non-None response.
             assert pde.response is not None
             body = pde.response
@@ -186,7 +186,7 @@ class CasHandler:
 
         # Iterate through the nodes and pull out the user and any extra attributes.
         user = None
-        attributes: Dict[str, List[Optional[str]]] = {}
+        attributes: dict[str, list[str | None]] = {}
         for child in root[0]:
             if child.tag.endswith("user"):
                 user = child.text
@@ -213,8 +213,8 @@ class CasHandler:
     async def handle_redirect_request(
         self,
         request: SynapseRequest,
-        client_redirect_url: Optional[bytes],
-        ui_auth_session_id: Optional[str] = None,
+        client_redirect_url: bytes | None,
+        ui_auth_session_id: str | None = None,
     ) -> str:
         """Generates a URL for the CAS server where the client should be redirected.
 
@@ -245,8 +245,8 @@ class CasHandler:
         self,
         request: SynapseRequest,
         ticket: str,
-        client_redirect_url: Optional[str],
-        session: Optional[str],
+        client_redirect_url: str | None,
+        session: str | None,
     ) -> None:
         """
         Called once the user has successfully authenticated with the SSO.
@@ -292,8 +292,8 @@ class CasHandler:
         self,
         request: SynapseRequest,
         cas_response: CasResponse,
-        client_redirect_url: Optional[str],
-        session: Optional[str],
+        client_redirect_url: str | None,
+        session: str | None,
     ) -> None:
         """Handle a CAS response to a ticket request.
 
@@ -384,7 +384,7 @@ class CasHandler:
 
             return UserAttributes(localpart=localpart, display_name=display_name)
 
-        async def grandfather_existing_users() -> Optional[str]:
+        async def grandfather_existing_users() -> str | None:
             # Since CAS did not always use the user_external_ids table, always
             # to attempt to map to existing users.
             user_id = UserID(localpart, self._hostname).to_string()
diff --git a/synapse/handlers/deactivate_account.py b/synapse/handlers/deactivate_account.py
index e4169321cc..538bdaaaf8 100644
--- a/synapse/handlers/deactivate_account.py
+++ b/synapse/handlers/deactivate_account.py
@@ -20,11 +20,10 @@
 #
 import itertools
 import logging
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import Membership
 from synapse.api.errors import SynapseError
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.http.deactivate_account import (
     ReplicationNotifyAccountDeactivatedServlet,
 )
@@ -62,7 +61,7 @@ class DeactivateAccountHandler:
         # Start the user parter loop so it can resume parting users from rooms where
         # it left off (if it has work left to do).
         if hs.config.worker.worker_app is None:
-            hs.get_reactor().callWhenRunning(self._start_user_parting)
+            hs.get_clock().call_when_running(self._start_user_parting)
         else:
             self._notify_account_deactivated_client = (
                 ReplicationNotifyAccountDeactivatedServlet.make_client(hs)
@@ -77,7 +76,7 @@ class DeactivateAccountHandler:
         user_id: str,
         erase_data: bool,
         requester: Requester,
-        id_server: Optional[str] = None,
+        id_server: str | None = None,
         by_admin: bool = False,
     ) -> bool:
         """Deactivate a user's account
@@ -168,13 +167,13 @@ class DeactivateAccountHandler:
         # Mark the user as erased, if they asked for that
         if erase_data:
             user = UserID.from_string(user_id)
-            # Remove avatar URL from this user
-            await self._profile_handler.set_avatar_url(
-                user, requester, "", by_admin, deactivation=True
-            )
-            # Remove displayname from this user
-            await self._profile_handler.set_displayname(
-                user, requester, "", by_admin, deactivation=True
+            # Remove displayname, avatar URL and custom profile fields from this user
+            #
+            # Note that displayname and avatar URL may persist as historical state events
+            # in rooms, but these cases behave like message history, following
+            # https://spec.matrix.org/v1.17/client-server-api/#post_matrixclientv3accountdeactivate
+            await self._profile_handler.delete_profile_upon_deactivation(
+                user, requester, by_admin
             )
 
             logger.info("Marking %s as erased", user_id)
@@ -272,8 +271,8 @@ class DeactivateAccountHandler:
         pending deactivation, if it isn't already running.
         """
         if not self._user_parter_running:
-            run_as_background_process(
-                "user_parter_loop", self.server_name, self._user_parter_loop
+            self.hs.run_as_background_process(
+                "user_parter_loop", self._user_parter_loop
             )
 
     async def _user_parter_loop(self) -> None:
diff --git a/synapse/handlers/delayed_events.py b/synapse/handlers/delayed_events.py
index a6749801a5..4a9f646d4d 100644
--- a/synapse/handlers/delayed_events.py
+++ b/synapse/handlers/delayed_events.py
@@ -13,27 +13,26 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Optional
 
 from twisted.internet.interfaces import IDelayedCall
 
-from synapse.api.constants import EventTypes
-from synapse.api.errors import ShadowBanError
+from synapse.api.constants import EventTypes, StickyEvent, StickyEventField
+from synapse.api.errors import ShadowBanError, SynapseError
 from synapse.api.ratelimiting import Ratelimiter
 from synapse.config.workers import MAIN_PROCESS_INSTANCE_NAME
+from synapse.http.site import SynapseRequest
+from synapse.logging.context import make_deferred_yieldable
 from synapse.logging.opentracing import set_tag
 from synapse.metrics import SERVER_NAME_LABEL, event_processing_positions
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.http.delayed_events import (
     ReplicationAddedDelayedEventRestServlet,
 )
 from synapse.storage.databases.main.delayed_events import (
     DelayedEventDetails,
-    DelayID,
     EventType,
     StateKey,
     Timestamp,
-    UserLocalpart,
 )
 from synapse.storage.databases.main.state_deltas import StateDelta
 from synapse.types import (
@@ -43,8 +42,10 @@ from synapse.types import (
     UserID,
     create_requester,
 )
+from synapse.util.duration import Duration
 from synapse.util.events import generate_fake_event_id
 from synapse.util.metrics import Measure
+from synapse.util.sentinel import Sentinel
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -54,6 +55,7 @@ logger = logging.getLogger(__name__)
 
 class DelayedEventsHandler:
     def __init__(self, hs: "HomeServer"):
+        self.hs = hs
         self.server_name = hs.hostname
         self._store = hs.get_datastores().main
         self._storage_controllers = hs.get_storage_controllers()
@@ -75,7 +77,7 @@ class DelayedEventsHandler:
         self._next_delayed_event_call: Optional[IDelayedCall] = None
 
         # The current position in the current_state_delta stream
-        self._event_pos: Optional[int] = None
+        self._event_pos: int | None = None
 
         # Guard to ensure we only process event deltas one at a time
         self._event_processing = False
@@ -90,33 +92,37 @@ class DelayedEventsHandler:
                 hs.get_notifier().add_replication_callback(self.notify_new_event)
                 # Kick off again (without blocking) to catch any missed notifications
                 # that may have fired before the callback was added.
-                self._clock.call_later(0, self.notify_new_event)
+                self._clock.call_later(
+                    Duration(seconds=0),
+                    self.notify_new_event,
+                )
 
-                # Delayed events that are already marked as processed on startup might not have been
-                # sent properly on the last run of the server, so unmark them to send them again.
+                # Now process any delayed events that are due to be sent.
+                #
+                # We set `reprocess_events` to True in case any events had been
+                # marked as processed, but had not yet actually been sent,
+                # before the homeserver stopped.
+                #
                 # Caveat: this will double-send delayed events that successfully persisted, but failed
                 # to be removed from the DB table of delayed events.
                 # TODO: To avoid double-sending, scan the timeline to find which of these events were
                 # already sent. To do so, must store delay_ids in sent events to retrieve them later.
-                await self._store.unprocess_delayed_events()
-
                 events, next_send_ts = await self._store.process_timeout_delayed_events(
-                    self._get_current_ts()
+                    self._get_current_ts(), reprocess_events=True
                 )
 
                 if next_send_ts:
                     self._schedule_next_at(next_send_ts)
 
                 # Can send the events in background after having awaited on marking them as processed
-                run_as_background_process(
+                self.hs.run_as_background_process(
                     "_send_events",
-                    self.server_name,
                     self._send_events,
                     events,
                 )
 
-            self._initialized_from_db = run_as_background_process(
-                "_schedule_db_events", self.server_name, _schedule_db_events
+            self._initialized_from_db = self.hs.run_as_background_process(
+                "_schedule_db_events", _schedule_db_events
             )
         else:
             self._repl_client = ReplicationAddedDelayedEventRestServlet.make_client(hs)
@@ -141,15 +147,40 @@ class DelayedEventsHandler:
             finally:
                 self._event_processing = False
 
-        run_as_background_process(
-            "delayed_events.notify_new_event", self.server_name, process
-        )
+        self.hs.run_as_background_process("delayed_events.notify_new_event", process)
 
     async def _unsafe_process_new_event(self) -> None:
+        # We purposefully fetch the current max room stream ordering before
+        # doing anything else, as it could increment duing processing of state
+        # deltas. We want to avoid updating `delayed_events_stream_pos` past
+        # the stream ordering of the state deltas we've processed. Otherwise
+        # we'll leave gaps in our processing.
+        room_max_stream_ordering = self._store.get_room_max_stream_ordering()
+
+        # Check that there are actually any delayed events to process. If not, bail early.
+        delayed_events_count = await self._store.get_count_of_delayed_events()
+        if delayed_events_count == 0:
+            # There are no delayed events to process. Update the
+            # `delayed_events_stream_pos` to the latest `events` stream pos and
+            # exit early.
+            self._event_pos = room_max_stream_ordering
+
+            logger.debug(
+                "No delayed events to process. Updating `delayed_events_stream_pos` to max stream ordering (%s)",
+                room_max_stream_ordering,
+            )
+
+            await self._store.update_delayed_events_stream_pos(room_max_stream_ordering)
+
+            event_processing_positions.labels(
+                name="delayed_events", **{SERVER_NAME_LABEL: self.server_name}
+            ).set(room_max_stream_ordering)
+
+            return
+
         # If self._event_pos is None then means we haven't fetched it from the DB yet
         if self._event_pos is None:
             self._event_pos = await self._store.get_delayed_events_stream_pos()
-            room_max_stream_ordering = self._store.get_room_max_stream_ordering()
             if self._event_pos > room_max_stream_ordering:
                 # apparently, we've processed more events than exist in the database!
                 # this can happen if events are removed with history purge or similar.
@@ -167,7 +198,7 @@ class DelayedEventsHandler:
                 self._clock, name="delayed_events_delta", server_name=self.server_name
             ):
                 room_max_stream_ordering = self._store.get_room_max_stream_ordering()
-                if self._event_pos == room_max_stream_ordering:
+                if self._event_pos >= room_max_stream_ordering:
                     return
 
                 logger.debug(
@@ -197,28 +228,86 @@ class DelayedEventsHandler:
 
                 await self._store.update_delayed_events_stream_pos(max_pos)
 
-    async def _handle_state_deltas(self, deltas: List[StateDelta]) -> None:
+    async def _handle_state_deltas(self, deltas: list[StateDelta]) -> None:
         """
         Process current state deltas to cancel other users' pending delayed events
         that target the same state.
         """
+        # Get the senders of each delta's state event (as sender information is
+        # not currently stored in the `current_state_deltas` table).
+        event_id_and_sender_dict = await self._store.get_senders_for_event_ids(
+            [delta.event_id for delta in deltas if delta.event_id is not None]
+        )
+
+        # Note: No need to batch as `get_current_state_deltas` will only ever
+        # return 100 rows at a time.
         for delta in deltas:
+            logger.debug(
+                "Handling: %r %r, %s", delta.event_type, delta.state_key, delta.event_id
+            )
+
+            # `delta.event_id` and `delta.sender` can be `None` in a few valid
+            # cases (see the docstring of
+            # `get_current_state_delta_membership_changes_for_user` for details).
             if delta.event_id is None:
-                logger.debug(
-                    "Not handling delta for deleted state: %r %r",
+                # TODO: Differentiate between this being caused by a state reset
+                # which removed a user from a room, or the homeserver
+                # purposefully having left the room. We can do so by checking
+                # whether there are any local memberships still left in the
+                # room. If so, then this is the result of a state reset.
+                #
+                # If it is a state reset, we should avoid cancelling new,
+                # delayed state events due to old state resurfacing. So we
+                # should skip and log a warning in this case.
+                #
+                # If the homeserver has left the room, then we should cancel all
+                # delayed state events intended for this room, as there is no
+                # need to try and send a delayed event into a room we've left.
+                logger.warning(
+                    "Skipping state delta (%r, %r) without corresponding event ID. "
+                    "This can happen if the homeserver has left the room (in which "
+                    "case this can be ignored), or if there has been a state reset "
+                    "which has caused the sender to be kicked out of the room",
                     delta.event_type,
                     delta.state_key,
                 )
                 continue
 
-            logger.debug(
-                "Handling: %r %r, %s", delta.event_type, delta.state_key, delta.event_id
+            sender_str = event_id_and_sender_dict.get(
+                delta.event_id, Sentinel.UNSET_SENTINEL
             )
-
-            event = await self._store.get_event(delta.event_id, allow_none=True)
-            if not event:
+            if sender_str is None:
+                # An event exists, but the `sender` field was "null" and Synapse
+                # incorrectly accepted the event. This is not expected.
+                logger.error(
+                    "Skipping state delta with event ID '%s' as 'sender' was None. "
+                    "This is unexpected - please report it as a bug!",
+                    delta.event_id,
+                )
+                continue
+            if sender_str is Sentinel.UNSET_SENTINEL:
+                # We have an event ID, but the event was not found in the
+                # datastore. This can happen if a room, or its history, is
+                # purged. State deltas related to the room are left behind, but
+                # the event no longer exists.
+                #
+                # As we cannot get the sender of this event, we can't calculate
+                # whether to cancel delayed events related to this one. So we skip.
+                logger.debug(
+                    "Skipping state delta with event ID '%s' - the room, or its history, may have been purged",
+                    delta.event_id,
+                )
+                continue
+
+            try:
+                sender = UserID.from_string(sender_str)
+            except SynapseError as e:
+                logger.error(
+                    "Skipping state delta with Matrix User ID '%s' that failed to parse: %s",
+                    sender_str,
+                    e,
+                )
                 continue
-            sender = UserID.from_string(event.sender)
 
             next_send_ts = await self._store.cancel_delayed_state_events(
                 room_id=delta.room_id,
@@ -240,10 +329,11 @@ class DelayedEventsHandler:
         *,
         room_id: str,
         event_type: str,
-        state_key: Optional[str],
-        origin_server_ts: Optional[int],
+        state_key: str | None,
+        origin_server_ts: int | None,
         content: JsonDict,
         delay: int,
+        sticky_duration_ms: int | None,
     ) -> str:
         """
         Creates a new delayed event and schedules its delivery.
@@ -257,7 +347,9 @@ class DelayedEventsHandler:
                 If None, the timestamp will be the actual time when the event is sent.
             content: The content of the event to be sent.
             delay: How long (in milliseconds) to wait before automatically sending the event.
-
+            sticky_duration_ms: If an MSC4354 sticky event: the sticky duration (in milliseconds).
+                The event will be attempted to be reliably delivered to clients and remote servers
+                during its sticky period.
         Returns: The ID of the added delayed event.
 
         Raises:
@@ -293,6 +385,7 @@ class DelayedEventsHandler:
             origin_server_ts=origin_server_ts,
             content=content,
             delay=delay,
+            sticky_duration_ms=sticky_duration_ms,
         )
 
         if self._repl_client is not None:
@@ -312,96 +405,68 @@ class DelayedEventsHandler:
         if self._next_send_ts_changed(next_send_ts):
             self._schedule_next_at(next_send_ts)
 
-    async def cancel(self, requester: Requester, delay_id: str) -> None:
+    async def cancel(self, request: SynapseRequest, delay_id: str) -> None:
         """
         Cancels the scheduled delivery of the matching delayed event.
 
-        Args:
-            requester: The owner of the delayed event to act on.
-            delay_id: The ID of the delayed event to act on.
-
         Raises:
             NotFoundError: if no matching delayed event could be found.
         """
         assert self._is_master
         await self._delayed_event_mgmt_ratelimiter.ratelimit(
-            requester,
-            (requester.user.to_string(), requester.device_id),
+            None, request.getClientAddress().host
         )
-        await self._initialized_from_db
+        await make_deferred_yieldable(self._initialized_from_db)
 
-        next_send_ts = await self._store.cancel_delayed_event(
-            delay_id=delay_id,
-            user_localpart=requester.user.localpart,
-        )
+        next_send_ts = await self._store.cancel_delayed_event(delay_id)
 
         if self._next_send_ts_changed(next_send_ts):
             self._schedule_next_at_or_none(next_send_ts)
 
-    async def restart(self, requester: Requester, delay_id: str) -> None:
+    async def restart(self, request: SynapseRequest, delay_id: str) -> None:
         """
         Restarts the scheduled delivery of the matching delayed event.
 
-        Args:
-            requester: The owner of the delayed event to act on.
-            delay_id: The ID of the delayed event to act on.
+        Raises:
+            NotFoundError: if no matching delayed event could be found.
+        """
+        await self._delayed_event_mgmt_ratelimiter.ratelimit(
+            None, request.getClientAddress().host
+        )
+
+        # Note: We don't need to wait on `self._initialized_from_db` here as the
+        # events that deals with are already marked as processed.
+        #
+        # `restart_delayed_events` will skip over such events entirely.
+
+        next_send_ts = await self._store.restart_delayed_event(
+            delay_id, self._get_current_ts()
+        )
+
+        # Only the main process handles sending delayed events.
+        if self._is_master:
+            if self._next_send_ts_changed(next_send_ts):
+                self._schedule_next_at(next_send_ts)
+
+    async def send(self, request: SynapseRequest, delay_id: str) -> None:
+        """
+        Immediately sends the matching delayed event, instead of waiting for its scheduled delivery.
 
         Raises:
             NotFoundError: if no matching delayed event could be found.
         """
         assert self._is_master
         await self._delayed_event_mgmt_ratelimiter.ratelimit(
-            requester,
-            (requester.user.to_string(), requester.device_id),
+            None, request.getClientAddress().host
         )
-        await self._initialized_from_db
+        await make_deferred_yieldable(self._initialized_from_db)
 
-        next_send_ts = await self._store.restart_delayed_event(
-            delay_id=delay_id,
-            user_localpart=requester.user.localpart,
-            current_ts=self._get_current_ts(),
-        )
-
-        if self._next_send_ts_changed(next_send_ts):
-            self._schedule_next_at(next_send_ts)
-
-    async def send(self, requester: Requester, delay_id: str) -> None:
-        """
-        Immediately sends the matching delayed event, instead of waiting for its scheduled delivery.
-
-        Args:
-            requester: The owner of the delayed event to act on.
-            delay_id: The ID of the delayed event to act on.
-
-        Raises:
-            NotFoundError: if no matching delayed event could be found.
-        """
-        assert self._is_master
-        # Use standard request limiter for sending delayed events on-demand,
-        # as an on-demand send is similar to sending a regular event.
-        await self._request_ratelimiter.ratelimit(requester)
-        await self._initialized_from_db
-
-        event, next_send_ts = await self._store.process_target_delayed_event(
-            delay_id=delay_id,
-            user_localpart=requester.user.localpart,
-        )
+        event, next_send_ts = await self._store.process_target_delayed_event(delay_id)
 
         if self._next_send_ts_changed(next_send_ts):
             self._schedule_next_at_or_none(next_send_ts)
 
-        await self._send_event(
-            DelayedEventDetails(
-                delay_id=DelayID(delay_id),
-                user_localpart=UserLocalpart(requester.user.localpart),
-                room_id=event.room_id,
-                type=event.type,
-                state_key=event.state_key,
-                origin_server_ts=event.origin_server_ts,
-                content=event.content,
-                device_id=event.device_id,
-            )
-        )
+        await self._send_event(event)
 
     async def _send_on_timeout(self) -> None:
         self._next_delayed_event_call = None
@@ -415,8 +480,8 @@ class DelayedEventsHandler:
 
         await self._send_events(events)
 
-    async def _send_events(self, events: List[DelayedEventDetails]) -> None:
-        sent_state: Set[Tuple[RoomID, EventType, StateKey]] = set()
+    async def _send_events(self, events: list[DelayedEventDetails]) -> None:
+        sent_state: set[tuple[RoomID, EventType, StateKey]] = set()
         for event in events:
             if event.state_key is not None:
                 state_info = (event.room_id, event.type, event.state_key)
@@ -439,7 +504,7 @@ class DelayedEventsHandler:
                     state_key=state_key,
                 )
 
-    def _schedule_next_at_or_none(self, next_send_ts: Optional[Timestamp]) -> None:
+    def _schedule_next_at_or_none(self, next_send_ts: Timestamp | None) -> None:
         if next_send_ts is not None:
             self._schedule_next_at(next_send_ts)
         elif self._next_delayed_event_call is not None:
@@ -448,20 +513,19 @@ class DelayedEventsHandler:
 
     def _schedule_next_at(self, next_send_ts: Timestamp) -> None:
         delay = next_send_ts - self._get_current_ts()
-        delay_sec = delay / 1000 if delay > 0 else 0
+        delay_duration = Duration(milliseconds=max(delay, 0))
 
         if self._next_delayed_event_call is None:
             self._next_delayed_event_call = self._clock.call_later(
-                delay_sec,
-                run_as_background_process,
+                delay_duration,
+                self.hs.run_as_background_process,
                 "_send_on_timeout",
-                self.server_name,
                 self._send_on_timeout,
             )
         else:
-            self._next_delayed_event_call.reset(delay_sec)
+            self._next_delayed_event_call.reset(delay_duration.as_secs())
 
-    async def get_all_for_user(self, requester: Requester) -> List[JsonDict]:
+    async def get_all_for_user(self, requester: Requester) -> list[JsonDict]:
         """Return all pending delayed events requested by the given user."""
         await self._delayed_event_mgmt_ratelimiter.ratelimit(
             requester,
@@ -474,7 +538,7 @@ class DelayedEventsHandler:
     async def _send_event(
         self,
         event: DelayedEventDetails,
-        txn_id: Optional[str] = None,
+        txn_id: str | None = None,
     ) -> None:
         user_id = UserID(event.user_localpart, self._config.server.server_name)
         user_id_str = user_id.to_string()
@@ -496,6 +560,7 @@ class DelayedEventsHandler:
                     action=membership,
                     content=event.content,
                     origin_server_ts=event.origin_server_ts,
+                    delay_id=event.delay_id,
                 )
             else:
                 event_dict: JsonDict = {
@@ -510,7 +575,10 @@ class DelayedEventsHandler:
 
                 if event.state_key is not None:
                     event_dict["state_key"] = event.state_key
-
+                if event.sticky_duration_ms is not None:
+                    event_dict[StickyEvent.EVENT_FIELD_NAME] = StickyEventField(
+                        duration_ms=event.sticky_duration_ms
+                    )
                 (
                     sent_event,
                     _,
@@ -518,6 +586,7 @@ class DelayedEventsHandler:
                     requester,
                     event_dict,
                     txn_id=txn_id,
+                    delay_id=event.delay_id,
                 )
                 event_id = sent_event.event_id
         except ShadowBanError:
@@ -525,9 +594,7 @@ class DelayedEventsHandler:
         finally:
             # TODO: If this is a temporary error, retry. Otherwise, consider notifying clients of the failure
             try:
-                await self._store.delete_processed_delayed_event(
-                    event.delay_id, event.user_localpart
-                )
+                await self._store.delete_processed_delayed_event(event.delay_id)
             except Exception:
                 logger.exception("Failed to delete processed delayed event")
 
@@ -536,7 +603,7 @@ class DelayedEventsHandler:
     def _get_current_ts(self) -> Timestamp:
         return Timestamp(self._clock.time_msec())
 
-    def _next_send_ts_changed(self, next_send_ts: Optional[Timestamp]) -> bool:
+    def _next_send_ts_changed(self, next_send_ts: Timestamp | None) -> bool:
         # The DB alone knows if the next send time changed after adding/modifying
         # a delayed event, but if we were to ever miss updating our delayed call's
         # firing time, we may miss other updates. So, keep track of changes to the
diff --git a/synapse/handlers/device.py b/synapse/handlers/device.py
index acae34e71f..9a371651fb 100644
--- a/synapse/handlers/device.py
+++ b/synapse/handlers/device.py
@@ -25,13 +25,8 @@ from threading import Lock
 from typing import (
     TYPE_CHECKING,
     AbstractSet,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
     cast,
 )
 
@@ -47,7 +42,6 @@ from synapse.api.errors import (
 )
 from synapse.logging.opentracing import log_kv, set_tag, trace
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.replication.http.devices import (
@@ -77,6 +71,7 @@ from synapse.util import stringutils
 from synapse.util.async_helpers import Linearizer
 from synapse.util.caches.expiringcache import ExpiringCache
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 from synapse.util.metrics import measure_func
 from synapse.util.retryutils import (
     NotRetryingDestination,
@@ -91,10 +86,10 @@ logger = logging.getLogger(__name__)
 
 DELETE_DEVICE_MSGS_TASK_NAME = "delete_device_messages"
 MAX_DEVICE_DISPLAY_NAME_LEN = 100
-DELETE_STALE_DEVICES_INTERVAL_MS = 24 * 60 * 60 * 1000
+DELETE_STALE_DEVICES_INTERVAL = Duration(days=1)
 
 
-def _check_device_name_length(name: Optional[str]) -> None:
+def _check_device_name_length(name: str | None) -> None:
     """
     Checks whether a device name is longer than the maximum allowed length.
 
@@ -125,7 +120,7 @@ class DeviceHandler:
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname  # nb must be called this for @measure_func
         self.clock = hs.get_clock()  # nb must be called this for @measure_func
-        self.hs = hs
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
         self.store = cast("GenericWorkerStore", hs.get_datastores().main)
         self.notifier = hs.get_notifier()
         self.state = hs.get_state_handler()
@@ -134,7 +129,6 @@ class DeviceHandler:
         self._auth_handler = hs.get_auth_handler()
         self._account_data_handler = hs.get_account_data_handler()
         self._event_sources = hs.get_event_sources()
-        self._msc3852_enabled = hs.config.experimental.msc3852_enabled
         self._query_appservices_for_keys = (
             hs.config.experimental.msc3984_appservice_key_query
         )
@@ -191,10 +185,9 @@ class DeviceHandler:
             and self._delete_stale_devices_after is not None
         ):
             self.clock.looping_call(
-                run_as_background_process,
-                DELETE_STALE_DEVICES_INTERVAL_MS,
+                self.hs.run_as_background_process,
+                DELETE_STALE_DEVICES_INTERVAL,
                 desc="delete_stale_devices",
-                server_name=self.server_name,
                 func=self._delete_stale_devices,
             )
 
@@ -214,10 +207,10 @@ class DeviceHandler:
     async def check_device_registered(
         self,
         user_id: str,
-        device_id: Optional[str],
-        initial_device_display_name: Optional[str] = None,
-        auth_provider_id: Optional[str] = None,
-        auth_provider_session_id: Optional[str] = None,
+        device_id: str | None,
+        initial_device_display_name: str | None = None,
+        auth_provider_id: str | None = None,
+        auth_provider_session_id: str | None = None,
     ) -> str:
         """
         If the given device has not been registered, register it with the
@@ -275,7 +268,7 @@ class DeviceHandler:
 
     @trace
     async def delete_all_devices_for_user(
-        self, user_id: str, except_device_id: Optional[str] = None
+        self, user_id: str, except_device_id: str | None = None
     ) -> None:
         """Delete all of the user's devices
 
@@ -296,6 +289,8 @@ class DeviceHandler:
             user_id: The user to delete devices from.
             device_ids: The list of device IDs to delete
         """
+        logger.info("Deleting devices %r for %r", list(device_ids), user_id)
+
         to_device_stream_id = self._event_sources.get_current_token().to_device_key
 
         try:
@@ -350,7 +345,7 @@ class DeviceHandler:
         await self.notify_device_update(user_id, device_ids)
 
     async def upsert_device(
-        self, user_id: str, device_id: str, display_name: Optional[str] = None
+        self, user_id: str, device_id: str, display_name: str | None = None
     ) -> bool:
         """Create or update a device
 
@@ -409,7 +404,7 @@ class DeviceHandler:
                 raise
 
     @trace
-    async def get_devices_by_user(self, user_id: str) -> List[JsonDict]:
+    async def get_devices_by_user(self, user_id: str) -> list[JsonDict]:
         """
         Retrieve the given user's devices
 
@@ -431,9 +426,7 @@ class DeviceHandler:
         log_kv(device_map)
         return devices
 
-    async def get_dehydrated_device(
-        self, user_id: str
-    ) -> Optional[Tuple[str, JsonDict]]:
+    async def get_dehydrated_device(self, user_id: str) -> tuple[str, JsonDict] | None:
         """Retrieve the information for a dehydrated device.
 
         Args:
@@ -447,10 +440,10 @@ class DeviceHandler:
     async def store_dehydrated_device(
         self,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         device_data: JsonDict,
-        initial_device_display_name: Optional[str] = None,
-        keys_for_device: Optional[JsonDict] = None,
+        initial_device_display_name: str | None,
+        keys_for_device: JsonDict,
     ) -> str:
         """Store a dehydrated device for a user, optionally storing the keys associated with
         it as well.  If the user had a previous dehydrated device, it is removed.
@@ -481,46 +474,6 @@ class DeviceHandler:
 
         return device_id
 
-    async def rehydrate_device(
-        self, user_id: str, access_token: str, device_id: str
-    ) -> dict:
-        """Process a rehydration request from the user.
-
-        Args:
-            user_id: the user who is rehydrating the device
-            access_token: the access token used for the request
-            device_id: the ID of the device that will be rehydrated
-        Returns:
-            a dict containing {"success": True}
-        """
-        success = await self.store.remove_dehydrated_device(user_id, device_id)
-
-        if not success:
-            raise errors.NotFoundError()
-
-        # If the dehydrated device was successfully deleted (the device ID
-        # matched the stored dehydrated device), then modify the access
-        # token and refresh token to use the dehydrated device's ID and
-        # copy the old device display name to the dehydrated device,
-        # and destroy the old device ID
-        old_device_id = await self.store.set_device_for_access_token(
-            access_token, device_id
-        )
-        await self.store.set_device_for_refresh_token(user_id, old_device_id, device_id)
-        old_device = await self.store.get_device(user_id, old_device_id)
-        if old_device is None:
-            raise errors.NotFoundError()
-        await self.store.update_device(user_id, device_id, old_device["display_name"])
-        # can't call self.delete_device because that will clobber the
-        # access token so call the storage layer directly
-        await self.store.delete_devices(user_id, [old_device_id])
-
-        # tell everyone that the old device is gone and that the dehydrated
-        # device has a new display name
-        await self.notify_device_update(user_id, [old_device_id, device_id])
-
-        return {"success": True}
-
     async def delete_dehydrated_device(self, user_id: str, device_id: str) -> None:
         """
         Delete a stored dehydrated device.
@@ -569,8 +522,8 @@ class DeviceHandler:
         user_id: str,
         room_ids: StrCollection,
         from_token: StreamToken,
-        now_token: Optional[StreamToken] = None,
-    ) -> Set[str]:
+        now_token: StreamToken | None = None,
+    ) -> set[str]:
         """Get the set of users whose devices have changed who share a room with
         the given user.
         """
@@ -646,8 +599,8 @@ class DeviceHandler:
         # Check for newly joined or left rooms. We need to make sure that we add
         # to newly joined in the case membership goes from join -> leave -> join
         # again.
-        newly_joined_rooms: Set[str] = set()
-        newly_left_rooms: Set[str] = set()
+        newly_joined_rooms: set[str] = set()
+        newly_left_rooms: set[str] = set()
         for change in membership_changes:
             # We check for changes in "joinedness", i.e. if the membership has
             # changed to or from JOIN.
@@ -663,10 +616,10 @@ class DeviceHandler:
         # the user is currently in.
 
         # List of membership changes per room
-        room_to_deltas: Dict[str, List[StateDelta]] = {}
+        room_to_deltas: dict[str, list[StateDelta]] = {}
         # The set of event IDs of membership events (so we can fetch their
         # associated membership).
-        memberships_to_fetch: Set[str] = set()
+        memberships_to_fetch: set[str] = set()
 
         # TODO: Only pull out membership events?
         state_changes = await self.store.get_current_state_deltas_for_rooms(
@@ -683,7 +636,7 @@ class DeviceHandler:
                 memberships_to_fetch.add(delta.prev_event_id)
 
         # Fetch all the memberships for the membership events
-        event_id_to_memberships: Mapping[str, Optional[EventIdMembership]] = {}
+        event_id_to_memberships: Mapping[str, EventIdMembership | None] = {}
         if memberships_to_fetch:
             event_id_to_memberships = await self.store.get_membership_from_event_ids(
                 memberships_to_fetch
@@ -697,8 +650,8 @@ class DeviceHandler:
 
         # We now want to find any user that have newly joined/invited/knocked,
         # or newly left, similarly to above.
-        newly_joined_or_invited_or_knocked_users: Set[str] = set()
-        newly_left_users: Set[str] = set()
+        newly_joined_or_invited_or_knocked_users: set[str] = set()
+        newly_left_users: set[str] = set()
         for _, deltas in room_to_deltas.items():
             for delta in deltas:
                 # Get the prev/new memberships for the delta
@@ -840,7 +793,7 @@ class DeviceHandler:
         # Check if the application services have any results.
         if self._query_appservices_for_keys:
             # Query the appservice for all devices for this user.
-            query: Dict[str, Optional[List[str]]] = {user_id: None}
+            query: dict[str, list[str] | None] = {user_id: None}
 
             # Query the appservices for any keys.
             appservice_results = await self._appservice_handler.query_keys(query)
@@ -900,7 +853,7 @@ class DeviceHandler:
     async def notify_user_signature_update(
         self,
         from_user_id: str,
-        user_ids: List[str],
+        user_ids: list[str],
     ) -> None:
         """Notify a device writer that a user have made new signatures of other users.
 
@@ -924,12 +877,12 @@ class DeviceHandler:
         )
 
     DEVICE_MSGS_DELETE_BATCH_LIMIT = 1000
-    DEVICE_MSGS_DELETE_SLEEP_MS = 100
+    DEVICE_MSGS_DELETE_SLEEP = Duration(milliseconds=100)
 
     async def _delete_device_messages(
         self,
         task: ScheduledTask,
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         """Scheduler task to delete device messages in batch of `DEVICE_MSGS_DELETE_BATCH_LIMIT`."""
         assert task.params is not None
         user_id = task.params["user_id"]
@@ -950,9 +903,7 @@ class DeviceHandler:
             if from_stream_id is None:
                 return TaskStatus.COMPLETE, None, None
 
-            await self.clock.sleep(
-                DeviceWriterHandler.DEVICE_MSGS_DELETE_SLEEP_MS / 1000.0
-            )
+            await self.clock.sleep(DeviceWriterHandler.DEVICE_MSGS_DELETE_SLEEP)
 
 
 class DeviceWriterHandler(DeviceHandler):
@@ -963,10 +914,9 @@ class DeviceWriterHandler(DeviceHandler):
 
     def __init__(self, hs: "HomeServer"):
         super().__init__(hs)
+        self.server_name = hs.hostname  # nb must be called this for @measure_func
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
 
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @measure_func and @wrap_as_background_process
         # We only need to poke the federation sender explicitly if its on the
         # same instance. Other federation sender instances will get notified by
         # `synapse.app.generic_worker.FederationSenderHandler` when it sees it
@@ -1002,7 +952,7 @@ class DeviceWriterHandler(DeviceHandler):
         # rolling-restarting Synapse.
         if self._is_main_device_list_writer:
             # On start up check if there are any updates pending.
-            hs.get_reactor().callWhenRunning(self._handle_new_device_update_async)
+            hs.get_clock().call_when_running(self._handle_new_device_update_async)
             self.device_list_updater = DeviceListUpdater(hs, self)
             hs.get_federation_registry().register_edu_handler(
                 EduTypes.DEVICE_LIST_UPDATE,
@@ -1054,7 +1004,7 @@ class DeviceWriterHandler(DeviceHandler):
             await self.handle_new_device_update()
 
     async def notify_user_signature_update(
-        self, from_user_id: str, user_ids: List[str]
+        self, from_user_id: str, user_ids: list[str]
     ) -> None:
         """Notify a user that they have made new signatures of other users.
 
@@ -1115,7 +1065,7 @@ class DeviceWriterHandler(DeviceHandler):
         # hosts we've already poked about for this update. This is so that we
         # don't poke the same remote server about the same update repeatedly.
         current_stream_id = None
-        hosts_already_sent_to: Set[str] = set()
+        hosts_already_sent_to: set[str] = set()
 
         try:
             stream_id, room_id = await self.store.get_device_change_last_converted_pos()
@@ -1314,7 +1264,7 @@ class DeviceWriterHandler(DeviceHandler):
 
 
 def _update_device_from_client_ips(
-    device: JsonDict, client_ips: Mapping[Tuple[str, str], DeviceLastConnectionInfo]
+    device: JsonDict, client_ips: Mapping[tuple[str, str], DeviceLastConnectionInfo]
 ) -> None:
     ip = client_ips.get((device["user_id"], device["device_id"]))
     device.update(
@@ -1341,8 +1291,8 @@ class DeviceListWorkerUpdater:
 
     async def multi_user_device_resync(
         self,
-        user_ids: List[str],
-    ) -> Dict[str, Optional[JsonMapping]]:
+        user_ids: list[str],
+    ) -> dict[str, JsonMapping | None]:
         """
         Like `user_device_resync` but operates on multiple users **from the same origin**
         at once.
@@ -1366,9 +1316,9 @@ class DeviceListWorkerUpdater:
     async def process_cross_signing_key_update(
         self,
         user_id: str,
-        master_key: Optional[JsonDict],
-        self_signing_key: Optional[JsonDict],
-    ) -> List[str]:
+        master_key: JsonDict | None,
+        self_signing_key: JsonDict | None,
+    ) -> list[str]:
         """Process the given new master and self-signing key for the given remote user.
 
         Args:
@@ -1444,26 +1394,31 @@ class DeviceListUpdater(DeviceListWorkerUpdater):
     def __init__(self, hs: "HomeServer", device_handler: DeviceWriterHandler):
         super().__init__(hs)
 
-        self.server_name = hs.hostname
+        self.hs = hs
         self.federation = hs.get_federation_client()
         self.server_name = hs.hostname  # nb must be called this for @measure_func
         self.clock = hs.get_clock()  # nb must be called this for @measure_func
         self.device_handler = device_handler
 
-        self._remote_edu_linearizer = Linearizer(name="remote_device_list")
-        self._resync_linearizer = Linearizer(name="remote_device_resync")
+        self._remote_edu_linearizer = Linearizer(
+            name="remote_device_list", clock=self.clock
+        )
+        self._resync_linearizer = Linearizer(
+            name="remote_device_resync", clock=self.clock
+        )
 
         # user_id -> list of updates waiting to be handled.
-        self._pending_updates: Dict[
-            str, List[Tuple[str, str, Iterable[str], JsonDict]]
+        self._pending_updates: dict[
+            str, list[tuple[str, str, Iterable[str], JsonDict]]
         ] = {}
 
         # Recently seen stream ids. We don't bother keeping these in the DB,
         # but they're useful to have them about to reduce the number of spurious
         # resyncs.
-        self._seen_updates: ExpiringCache[str, Set[str]] = ExpiringCache(
+        self._seen_updates: ExpiringCache[str, set[str]] = ExpiringCache(
             cache_name="device_update_edu",
             server_name=self.server_name,
+            hs=self.hs,
             clock=self.clock,
             max_len=10000,
             expiry_ms=30 * 60 * 1000,
@@ -1473,9 +1428,8 @@ class DeviceListUpdater(DeviceListWorkerUpdater):
         # Attempt to resync out of sync device lists every 30s.
         self._resync_retry_lock = Lock()
         self.clock.looping_call(
-            run_as_background_process,
-            30 * 1000,
-            server_name=self.server_name,
+            self.hs.run_as_background_process,
+            Duration(seconds=30),
             func=self._maybe_retry_device_resync,
             desc="_maybe_retry_device_resync",
         )
@@ -1595,9 +1549,8 @@ class DeviceListUpdater(DeviceListWorkerUpdater):
             if resync:
                 # We mark as stale up front in case we get restarted.
                 await self.store.mark_remote_users_device_caches_as_stale([user_id])
-                run_as_background_process(
+                self.hs.run_as_background_process(
                     "_maybe_retry_device_resync",
-                    self.server_name,
                     self.multi_user_device_resync,
                     [user_id],
                     False,
@@ -1619,12 +1572,12 @@ class DeviceListUpdater(DeviceListWorkerUpdater):
                 )
 
     async def _need_to_do_resync(
-        self, user_id: str, updates: Iterable[Tuple[str, str, Iterable[str], JsonDict]]
+        self, user_id: str, updates: Iterable[tuple[str, str, Iterable[str], JsonDict]]
     ) -> bool:
         """Given a list of updates for a user figure out if we need to do a full
         resync, or whether we have enough data that we can just apply the delta.
         """
-        seen_updates: Set[str] = self._seen_updates.get(user_id, set())
+        seen_updates: set[str] = self._seen_updates.get(user_id, set())
 
         extremity = await self.store.get_device_list_last_stream_id_for_remote(user_id)
 
@@ -1702,8 +1655,8 @@ class DeviceListUpdater(DeviceListWorkerUpdater):
             self._resync_retry_lock.release()
 
     async def multi_user_device_resync(
-        self, user_ids: List[str], mark_failed_as_stale: bool = True
-    ) -> Dict[str, Optional[JsonMapping]]:
+        self, user_ids: list[str], mark_failed_as_stale: bool = True
+    ) -> dict[str, JsonMapping | None]:
         """
         Like `user_device_resync` but operates on multiple users **from the same origin**
         at once.
@@ -1739,7 +1692,7 @@ class DeviceListUpdater(DeviceListWorkerUpdater):
 
     async def _user_device_resync_returning_failed(
         self, user_id: str
-    ) -> Tuple[Optional[JsonMapping], bool]:
+    ) -> tuple[JsonMapping | None, bool]:
         """Fetches all devices for a user and updates the device cache with them.
 
         Args:
diff --git a/synapse/handlers/devicemessage.py b/synapse/handlers/devicemessage.py
index b43cbd9c15..0ef14b31da 100644
--- a/synapse/handlers/devicemessage.py
+++ b/synapse/handlers/devicemessage.py
@@ -21,7 +21,7 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Any, Dict, Optional
+from typing import TYPE_CHECKING, Any
 
 from synapse.api.constants import EduTypes, EventContentFields, ToDeviceEventTypes
 from synapse.api.errors import Codes, SynapseError
@@ -34,7 +34,7 @@ from synapse.logging.opentracing import (
     set_tag,
 )
 from synapse.types import JsonDict, Requester, StreamKeyType, UserID, get_domain_from_id
-from synapse.util import json_encoder
+from synapse.util.json import json_encoder
 from synapse.util.stringutils import random_string
 
 if TYPE_CHECKING:
@@ -158,7 +158,7 @@ class DeviceMessageHandler:
         self,
         message_type: str,
         sender_user_id: str,
-        by_device: Dict[str, Dict[str, Any]],
+        by_device: dict[str, dict[str, Any]],
     ) -> None:
         """Checks inbound device messages for unknown remote devices, and if
         found marks the remote cache for the user as stale.
@@ -207,7 +207,7 @@ class DeviceMessageHandler:
         self,
         requester: Requester,
         message_type: str,
-        messages: Dict[str, Dict[str, JsonDict]],
+        messages: dict[str, dict[str, JsonDict]],
     ) -> None:
         """
         Handle a request from a user to send to-device message(s).
@@ -222,7 +222,7 @@ class DeviceMessageHandler:
         set_tag(SynapseTags.TO_DEVICE_TYPE, message_type)
         set_tag(SynapseTags.TO_DEVICE_SENDER, sender_user_id)
         local_messages = {}
-        remote_messages: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
+        remote_messages: dict[str, dict[str, dict[str, JsonDict]]] = {}
         for user_id, by_device in messages.items():
             if not UserID.is_valid(user_id):
                 logger.warning(
@@ -315,7 +315,7 @@ class DeviceMessageHandler:
         self,
         requester: Requester,
         device_id: str,
-        since_token: Optional[str],
+        since_token: str | None,
         limit: int,
     ) -> JsonDict:
         """Fetches up to `limit` events sent to `device_id` starting from `since_token`
diff --git a/synapse/handlers/directory.py b/synapse/handlers/directory.py
index 11284ccd0b..bdb7cba64b 100644
--- a/synapse/handlers/directory.py
+++ b/synapse/handlers/directory.py
@@ -21,7 +21,7 @@
 
 import logging
 import string
-from typing import TYPE_CHECKING, Iterable, List, Literal, Optional, Sequence
+from typing import TYPE_CHECKING, Iterable, Literal, Sequence
 
 from synapse.api.constants import MAX_ALIAS_LENGTH, EventTypes
 from synapse.api.errors import (
@@ -73,8 +73,8 @@ class DirectoryHandler:
         self,
         room_alias: RoomAlias,
         room_id: str,
-        servers: Optional[Iterable[str]] = None,
-        creator: Optional[str] = None,
+        servers: Iterable[str] | None = None,
+        creator: str | None = None,
     ) -> None:
         # general association creation for both human users and app services
 
@@ -108,7 +108,7 @@ class DirectoryHandler:
         requester: Requester,
         room_alias: RoomAlias,
         room_id: str,
-        servers: Optional[List[str]] = None,
+        servers: list[str] | None = None,
         check_membership: bool = True,
     ) -> None:
         """Attempt to create a new alias
@@ -252,7 +252,7 @@ class DirectoryHandler:
             )
         await self._delete_association(room_alias)
 
-    async def _delete_association(self, room_alias: RoomAlias) -> Optional[str]:
+    async def _delete_association(self, room_alias: RoomAlias) -> str | None:
         if not self.hs.is_mine(room_alias):
             raise SynapseError(400, "Room alias must be local")
 
@@ -263,16 +263,16 @@ class DirectoryHandler:
     async def get_association(self, room_alias: RoomAlias) -> JsonDict:
         room_id = None
         if self.hs.is_mine(room_alias):
-            result: Optional[
-                RoomAliasMapping
-            ] = await self.get_association_from_room_alias(room_alias)
+            result: (
+                RoomAliasMapping | None
+            ) = await self.get_association_from_room_alias(room_alias)
 
             if result:
                 room_id = result.room_id
                 servers = result.servers
         else:
             try:
-                fed_result: Optional[JsonDict] = await self.federation.make_query(
+                fed_result: JsonDict | None = await self.federation.make_query(
                     destination=room_alias.domain,
                     query_type="directory",
                     args={"room_alias": room_alias.to_string()},
@@ -321,16 +321,7 @@ class DirectoryHandler:
         if not self.hs.is_mine(room_alias):
             raise SynapseError(400, "Room Alias is not hosted on this homeserver")
 
-        result = await self.get_association_from_room_alias(room_alias)
-
-        if result is not None:
-            return {"room_id": result.room_id, "servers": result.servers}
-        else:
-            raise SynapseError(
-                404,
-                "Room alias %r not found" % (room_alias.to_string(),),
-                Codes.NOT_FOUND,
-            )
+        return await self.get_association(room_alias)
 
     async def _update_canonical_alias(
         self, requester: Requester, user_id: str, room_id: str, room_alias: RoomAlias
@@ -387,7 +378,7 @@ class DirectoryHandler:
 
     async def get_association_from_room_alias(
         self, room_alias: RoomAlias
-    ) -> Optional[RoomAliasMapping]:
+    ) -> RoomAliasMapping | None:
         result = await self.store.get_association_from_room_alias(room_alias)
         if not result:
             # Query AS to see if it exists
@@ -395,7 +386,7 @@ class DirectoryHandler:
             result = await as_handler.query_room_alias_exists(room_alias)
         return result
 
-    def can_modify_alias(self, alias: RoomAlias, user_id: Optional[str] = None) -> bool:
+    def can_modify_alias(self, alias: RoomAlias, user_id: str | None = None) -> bool:
         # Any application service "interested" in an alias they are regexing on
         # can modify the alias.
         # Users can only modify the alias if ALL the interested services have
diff --git a/synapse/handlers/e2e_keys.py b/synapse/handlers/e2e_keys.py
index b9abad2188..64f705a3da 100644
--- a/synapse/handlers/e2e_keys.py
+++ b/synapse/handlers/e2e_keys.py
@@ -20,7 +20,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Dict, Iterable, List, Mapping, Optional, Tuple
+from typing import TYPE_CHECKING, Iterable, Mapping
 
 import attr
 from canonicaljson import encode_canonical_json
@@ -44,9 +44,10 @@ from synapse.types import (
     get_domain_from_id,
     get_verify_key_from_cross_signing_key,
 )
-from synapse.util import json_decoder
 from synapse.util.async_helpers import Linearizer, concurrently_execute
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
+from synapse.util.json import json_decoder
 from synapse.util.retryutils import (
     NotRetryingDestination,
     filter_destinations_by_retry_limiter,
@@ -57,7 +58,6 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
-
 ONE_TIME_KEY_UPLOAD = "one_time_key_upload_lock"
 
 
@@ -112,8 +112,7 @@ class E2eKeysHandler:
 
         # Limit the number of in-flight requests from a single device.
         self._query_devices_linearizer = Linearizer(
-            name="query_devices",
-            max_count=10,
+            name="query_devices", max_count=10, clock=hs.get_clock()
         )
 
         self._query_appservices_for_otks = (
@@ -134,7 +133,7 @@ class E2eKeysHandler:
         query_body: JsonDict,
         timeout: int,
         from_user_id: str,
-        from_device_id: Optional[str],
+        from_device_id: str | None,
     ) -> JsonDict:
         """Handle a device key query from a client
 
@@ -164,8 +163,8 @@ class E2eKeysHandler:
         async with self._query_devices_linearizer.queue((from_user_id, from_device_id)):
 
             async def filter_device_key_query(
-                query: Dict[str, List[str]],
-            ) -> Dict[str, List[str]]:
+                query: dict[str, list[str]],
+            ) -> dict[str, list[str]]:
                 if not self.config.experimental.msc4263_limit_key_queries_to_users_who_share_rooms:
                     # Only ignore invalid user IDs, which is the same behaviour as if
                     # the user existed but had no keys.
@@ -190,7 +189,7 @@ class E2eKeysHandler:
                     if user_id in allowed_user_ids
                 }
 
-            device_keys_query: Dict[str, List[str]] = await filter_device_key_query(
+            device_keys_query: dict[str, list[str]] = await filter_device_key_query(
                 query_body.get("device_keys", {})
             )
 
@@ -211,7 +210,7 @@ class E2eKeysHandler:
 
             # First get local devices.
             # A map of destination -> failure response.
-            failures: Dict[str, JsonDict] = {}
+            failures: dict[str, JsonDict] = {}
             results = {}
             if local_query:
                 local_result = await self.query_local_devices(local_query)
@@ -226,10 +225,10 @@ class E2eKeysHandler:
 
             # Now attempt to get any remote devices from our local cache.
             # A map of destination -> user ID -> device IDs.
-            remote_queries_not_in_cache: Dict[str, Dict[str, Iterable[str]]] = {}
+            remote_queries_not_in_cache: dict[str, dict[str, Iterable[str]]] = {}
             if remote_queries:
                 user_ids = set()
-                user_and_device_ids: List[Tuple[str, str]] = []
+                user_and_device_ids: list[tuple[str, str]] = []
                 for user_id, device_ids in remote_queries.items():
                     if device_ids:
                         user_and_device_ids.extend(
@@ -357,9 +356,9 @@ class E2eKeysHandler:
         self,
         results: JsonDict,
         cross_signing_keys: JsonDict,
-        failures: Dict[str, JsonDict],
+        failures: dict[str, JsonDict],
         destination: str,
-        destination_query: Dict[str, Iterable[str]],
+        destination_query: dict[str, Iterable[str]],
         timeout: int,
     ) -> None:
         """This is called when we are querying the device list of a user on
@@ -481,8 +480,8 @@ class E2eKeysHandler:
 
     @cancellable
     async def get_cross_signing_keys_from_cache(
-        self, query: Iterable[str], from_user_id: Optional[str]
-    ) -> Dict[str, Dict[str, JsonMapping]]:
+        self, query: Iterable[str], from_user_id: str | None
+    ) -> dict[str, dict[str, JsonMapping]]:
         """Get cross-signing keys for users from the database
 
         Args:
@@ -529,9 +528,9 @@ class E2eKeysHandler:
     @cancellable
     async def query_local_devices(
         self,
-        query: Mapping[str, Optional[List[str]]],
+        query: Mapping[str, list[str] | None],
         include_displaynames: bool = True,
-    ) -> Dict[str, Dict[str, dict]]:
+    ) -> dict[str, dict[str, dict]]:
         """Get E2E device keys for local users
 
         Args:
@@ -544,9 +543,9 @@ class E2eKeysHandler:
             A map from user_id -> device_id -> device details
         """
         set_tag("local_query", str(query))
-        local_query: List[Tuple[str, Optional[str]]] = []
+        local_query: list[tuple[str, str | None]] = []
 
-        result_dict: Dict[str, Dict[str, dict]] = {}
+        result_dict: dict[str, dict[str, dict]] = {}
         for user_id, device_ids in query.items():
             # we use UserID.from_string to catch invalid user ids
             if not self.is_mine(UserID.from_string(user_id)):
@@ -596,7 +595,7 @@ class E2eKeysHandler:
         return result_dict
 
     async def on_federation_query_client_keys(
-        self, query_body: Dict[str, Dict[str, Optional[List[str]]]]
+        self, query_body: dict[str, dict[str, list[str] | None]]
     ) -> JsonDict:
         """Handle a device key query from a federated server:
 
@@ -616,7 +615,7 @@ class E2eKeysHandler:
                 - self_signing_key: An optional dictionary of user ID -> self-signing
                     key info.
         """
-        device_keys_query: Dict[str, Optional[List[str]]] = query_body.get(
+        device_keys_query: dict[str, list[str] | None] = query_body.get(
             "device_keys", {}
         )
         if any(
@@ -641,9 +640,9 @@ class E2eKeysHandler:
 
     async def claim_local_one_time_keys(
         self,
-        local_query: List[Tuple[str, str, str, int]],
+        local_query: list[tuple[str, str, str, int]],
         always_include_fallback_keys: bool,
-    ) -> Iterable[Dict[str, Dict[str, Dict[str, JsonDict]]]]:
+    ) -> Iterable[dict[str, dict[str, dict[str, JsonDict]]]]:
         """Claim one time keys for local users.
 
         1. Attempt to claim OTKs from the database.
@@ -737,9 +736,9 @@ class E2eKeysHandler:
     @trace
     async def claim_one_time_keys(
         self,
-        query: Dict[str, Dict[str, Dict[str, int]]],
+        query: dict[str, dict[str, dict[str, int]]],
         user: UserID,
-        timeout: Optional[int],
+        timeout: int | None,
         always_include_fallback_keys: bool,
     ) -> JsonDict:
         """
@@ -756,8 +755,8 @@ class E2eKeysHandler:
             one_time_keys: chain of maps user ID -> device ID -> key ID -> key.
             failures: map from remote destination to a JsonDict describing the error.
         """
-        local_query: List[Tuple[str, str, str, int]] = []
-        remote_queries: Dict[str, Dict[str, Dict[str, Dict[str, int]]]] = {}
+        local_query: list[tuple[str, str, str, int]] = []
+        remote_queries: dict[str, dict[str, dict[str, dict[str, int]]]] = {}
 
         for user_id, one_time_keys in query.items():
             # we use UserID.from_string to catch invalid user ids
@@ -777,7 +776,7 @@ class E2eKeysHandler:
         )
 
         # A map of user ID -> device ID -> key ID -> key.
-        json_result: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
+        json_result: dict[str, dict[str, dict[str, JsonDict]]] = {}
         for result in results:
             for user_id, device_keys in result.items():
                 for device_id, keys in device_keys.items():
@@ -787,7 +786,7 @@ class E2eKeysHandler:
                         ).update({key_id: key})
 
         # Remote failures.
-        failures: Dict[str, JsonDict] = {}
+        failures: dict[str, JsonDict] = {}
 
         @trace
         async def claim_client_keys(destination: str) -> None:
@@ -848,14 +847,22 @@ class E2eKeysHandler:
         """
         time_now = self.clock.time_msec()
 
-        # TODO: Validate the JSON to make sure it has the right keys.
         device_keys = keys.get("device_keys", None)
         if device_keys:
+            log_kv(
+                {
+                    "message": "Updating device_keys for user.",
+                    "user_id": user_id,
+                    "device_id": device_id,
+                }
+            )
             await self.upload_device_keys_for_user(
                 user_id=user_id,
                 device_id=device_id,
                 keys={"device_keys": device_keys},
             )
+        else:
+            log_kv({"message": "Did not update device_keys", "reason": "not a dict"})
 
         one_time_keys = keys.get("one_time_keys", None)
         if one_time_keys:
@@ -873,10 +880,9 @@ class E2eKeysHandler:
             log_kv(
                 {"message": "Did not update one_time_keys", "reason": "no keys given"}
             )
-        fallback_keys = keys.get("fallback_keys") or keys.get(
-            "org.matrix.msc2732.fallback_keys"
-        )
-        if fallback_keys and isinstance(fallback_keys, dict):
+
+        fallback_keys = keys.get("fallback_keys")
+        if fallback_keys:
             log_kv(
                 {
                     "message": "Updating fallback_keys for device.",
@@ -885,8 +891,6 @@ class E2eKeysHandler:
                 }
             )
             await self.store.set_e2e_fallback_keys(user_id, device_id, fallback_keys)
-        elif fallback_keys:
-            log_kv({"message": "Did not update fallback_keys", "reason": "not a dict"})
         else:
             log_kv(
                 {"message": "Did not update fallback_keys", "reason": "no keys given"}
@@ -1128,7 +1132,7 @@ class E2eKeysHandler:
 
     async def _process_self_signatures(
         self, user_id: str, signatures: JsonDict
-    ) -> Tuple[List["SignatureListItem"], Dict[str, Dict[str, dict]]]:
+    ) -> tuple[list["SignatureListItem"], dict[str, dict[str, dict]]]:
         """Process uploaded signatures of the user's own keys.
 
         Signatures of the user's own keys from this API come in two forms:
@@ -1146,8 +1150,8 @@ class E2eKeysHandler:
         Raises:
             SynapseError: if the input is malformed
         """
-        signature_list: List["SignatureListItem"] = []
-        failures: Dict[str, Dict[str, JsonDict]] = {}
+        signature_list: list["SignatureListItem"] = []
+        failures: dict[str, dict[str, JsonDict]] = {}
         if not signatures:
             return signature_list, failures
 
@@ -1247,8 +1251,8 @@ class E2eKeysHandler:
         master_key_id: str,
         signed_master_key: JsonDict,
         stored_master_key: JsonMapping,
-        devices: Dict[str, Dict[str, JsonDict]],
-    ) -> List["SignatureListItem"]:
+        devices: dict[str, dict[str, JsonDict]],
+    ) -> list["SignatureListItem"]:
         """Check signatures of a user's master key made by their devices.
 
         Args:
@@ -1291,8 +1295,8 @@ class E2eKeysHandler:
         return master_key_signature_list
 
     async def _process_other_signatures(
-        self, user_id: str, signatures: Dict[str, dict]
-    ) -> Tuple[List["SignatureListItem"], Dict[str, Dict[str, dict]]]:
+        self, user_id: str, signatures: dict[str, dict]
+    ) -> tuple[list["SignatureListItem"], dict[str, dict[str, dict]]]:
         """Process uploaded signatures of other users' keys.  These will be the
         target user's master keys, signed by the uploading user's user-signing
         key.
@@ -1308,8 +1312,8 @@ class E2eKeysHandler:
         Raises:
             SynapseError: if the input is malformed
         """
-        signature_list: List["SignatureListItem"] = []
-        failures: Dict[str, Dict[str, JsonDict]] = {}
+        signature_list: list["SignatureListItem"] = []
+        failures: dict[str, dict[str, JsonDict]] = {}
         if not signatures:
             return signature_list, failures
 
@@ -1392,8 +1396,8 @@ class E2eKeysHandler:
         return signature_list, failures
 
     async def _get_e2e_cross_signing_verify_key(
-        self, user_id: str, key_type: str, from_user_id: Optional[str] = None
-    ) -> Tuple[JsonMapping, str, VerifyKey]:
+        self, user_id: str, key_type: str, from_user_id: str | None = None
+    ) -> tuple[JsonMapping, str, VerifyKey]:
         """Fetch locally or remotely query for a cross-signing public key.
 
         First, attempt to fetch the cross-signing public key from storage.
@@ -1448,7 +1452,7 @@ class E2eKeysHandler:
         self,
         user: UserID,
         desired_key_type: str,
-    ) -> Optional[Tuple[JsonMapping, str, VerifyKey]]:
+    ) -> tuple[JsonMapping, str, VerifyKey] | None:
         """Queries cross-signing keys for a remote user and saves them to the database
 
         Only the key specified by `key_type` will be returned, while all retrieved keys
@@ -1538,7 +1542,7 @@ class E2eKeysHandler:
 
         return desired_key_data
 
-    async def check_cross_signing_setup(self, user_id: str) -> Tuple[bool, bool]:
+    async def check_cross_signing_setup(self, user_id: str) -> tuple[bool, bool]:
         """Checks if the user has cross-signing set up
 
         Args:
@@ -1596,7 +1600,7 @@ class E2eKeysHandler:
 
     async def _delete_old_one_time_keys_task(
         self, task: ScheduledTask
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         """Scheduler task to delete old one time keys.
 
         Until Synapse 1.119, Synapse used to issue one-time-keys in a random order, leading to the possibility
@@ -1631,11 +1635,11 @@ class E2eKeysHandler:
             # matrix.org has about 15M users in the e2e_one_time_keys_json table
             # (comprising 20M devices). We want this to take about a week, so we need
             # to do about one batch of 100 users every 4 seconds.
-            await self.clock.sleep(4)
+            await self.clock.sleep(Duration(seconds=4))
 
 
 def _check_cross_signing_key(
-    key: JsonDict, user_id: str, key_type: str, signing_key: Optional[VerifyKey] = None
+    key: JsonDict, user_id: str, key_type: str, signing_key: VerifyKey | None = None
 ) -> None:
     """Check a cross-signing key uploaded by a user.  Performs some basic sanity
     checking, and ensures that it is signed, if a signature is required.
@@ -1765,10 +1769,12 @@ class SigningKeyEduUpdater:
         assert isinstance(device_handler, DeviceWriterHandler)
         self._device_handler = device_handler
 
-        self._remote_edu_linearizer = Linearizer(name="remote_signing_key")
+        self._remote_edu_linearizer = Linearizer(
+            name="remote_signing_key", clock=self.clock
+        )
 
         # user_id -> list of updates waiting to be handled.
-        self._pending_updates: Dict[str, List[Tuple[JsonDict, JsonDict]]] = {}
+        self._pending_updates: dict[str, list[tuple[JsonDict, JsonDict]]] = {}
 
     async def incoming_signing_key_update(
         self, origin: str, edu_content: JsonDict
@@ -1814,7 +1820,7 @@ class SigningKeyEduUpdater:
                 # This can happen since we batch updates
                 return
 
-            device_ids: List[str] = []
+            device_ids: list[str] = []
 
             logger.info("pending updates: %r", pending_updates)
 
diff --git a/synapse/handlers/e2e_room_keys.py b/synapse/handlers/e2e_room_keys.py
index 623fd33f13..017fbcf8b3 100644
--- a/synapse/handlers/e2e_room_keys.py
+++ b/synapse/handlers/e2e_room_keys.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Dict, Literal, Optional, cast
+from typing import TYPE_CHECKING, Literal, cast
 
 from synapse.api.errors import (
     Codes,
@@ -63,10 +63,10 @@ class E2eRoomKeysHandler:
         self,
         user_id: str,
         version: str,
-        room_id: Optional[str] = None,
-        session_id: Optional[str] = None,
-    ) -> Dict[
-        Literal["rooms"], Dict[str, Dict[Literal["sessions"], Dict[str, RoomKey]]]
+        room_id: str | None = None,
+        session_id: str | None = None,
+    ) -> dict[
+        Literal["rooms"], dict[str, dict[Literal["sessions"], dict[str, RoomKey]]]
     ]:
         """Bulk get the E2E room keys for a given backup, optionally filtered to a given
         room, or a given session.
@@ -109,8 +109,8 @@ class E2eRoomKeysHandler:
         self,
         user_id: str,
         version: str,
-        room_id: Optional[str] = None,
-        session_id: Optional[str] = None,
+        room_id: str | None = None,
+        session_id: str | None = None,
     ) -> JsonDict:
         """Bulk delete the E2E room keys for a given backup, optionally filtered to a given
         room or a given session.
@@ -299,7 +299,7 @@ class E2eRoomKeysHandler:
 
     @staticmethod
     def _should_replace_room_key(
-        current_room_key: Optional[RoomKey], room_key: RoomKey
+        current_room_key: RoomKey | None, room_key: RoomKey
     ) -> bool:
         """
         Determine whether to replace a given current_room_key (if any)
@@ -360,7 +360,7 @@ class E2eRoomKeysHandler:
             return new_version
 
     async def get_version_info(
-        self, user_id: str, version: Optional[str] = None
+        self, user_id: str, version: str | None = None
     ) -> JsonDict:
         """Get the info about a given version of the user's backup
 
@@ -394,7 +394,7 @@ class E2eRoomKeysHandler:
             return res
 
     @trace
-    async def delete_version(self, user_id: str, version: Optional[str] = None) -> None:
+    async def delete_version(self, user_id: str, version: str | None = None) -> None:
         """Deletes a given version of the user's e2e_room_keys backup
 
         Args:
diff --git a/synapse/handlers/event_auth.py b/synapse/handlers/event_auth.py
index 1f1f67dc0d..daa8dd5eba 100644
--- a/synapse/handlers/event_auth.py
+++ b/synapse/handlers/event_auth.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, List, Mapping, Optional, Union
+from typing import TYPE_CHECKING, Mapping
 
 from synapse import event_auth
 from synapse.api.constants import (
@@ -61,7 +61,7 @@ class EventAuthHandler:
     async def check_auth_rules_from_context(
         self,
         event: EventBase,
-        batched_auth_events: Optional[Mapping[str, EventBase]] = None,
+        batched_auth_events: Mapping[str, EventBase] | None = None,
     ) -> None:
         """Check an event passes the auth rules at its own auth events
         Args:
@@ -89,10 +89,10 @@ class EventAuthHandler:
 
     def compute_auth_events(
         self,
-        event: Union[EventBase, EventBuilder],
+        event: EventBase | EventBuilder,
         current_state_ids: StateMap[str],
         for_verification: bool = False,
-    ) -> List[str]:
+    ) -> list[str]:
         """Given an event and current state return the list of event IDs used
         to auth an event.
 
@@ -172,7 +172,7 @@ class EventAuthHandler:
             if len(local_creators) > 0:
                 chosen_user = local_creators.pop()  # random creator
                 user_power_level = CREATOR_POWER_LEVEL
-        else:
+        if chosen_user is None:
             chosen_user = max(
                 local_users_in_room,
                 key=lambda user: users.get(user, users_default_level),
@@ -236,7 +236,7 @@ class EventAuthHandler:
         state_ids: StateMap[str],
         room_version: RoomVersion,
         user_id: str,
-        prev_membership: Optional[str],
+        prev_membership: str | None,
     ) -> None:
         """
         Check whether a user can join a room without an invite due to restricted join rules.
diff --git a/synapse/handlers/events.py b/synapse/handlers/events.py
index 3f46032a43..f6517def9c 100644
--- a/synapse/handlers/events.py
+++ b/synapse/handlers/events.py
@@ -21,7 +21,7 @@
 
 import logging
 import random
-from typing import TYPE_CHECKING, Iterable, List, Optional
+from typing import TYPE_CHECKING, Iterable
 
 from synapse.api.constants import EduTypes, EventTypes, Membership, PresenceState
 from synapse.api.errors import AuthError, SynapseError
@@ -31,7 +31,7 @@ from synapse.handlers.presence import format_user_presence_state
 from synapse.storage.databases.main.events_worker import EventRedactBehaviour
 from synapse.streams.config import PaginationConfig
 from synapse.types import JsonDict, Requester, UserID
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -58,7 +58,7 @@ class EventStreamHandler:
         timeout: int = 0,
         as_client_event: bool = True,
         affect_presence: bool = True,
-        room_id: Optional[str] = None,
+        room_id: str | None = None,
     ) -> JsonDict:
         """Fetches the events stream for a given user."""
 
@@ -100,7 +100,7 @@ class EventStreamHandler:
 
             # When the user joins a new room, or another user joins a currently
             # joined room, we need to send down presence for those users.
-            to_add: List[JsonDict] = []
+            to_add: list[JsonDict] = []
             for event in events:
                 if not isinstance(event, EventBase):
                     continue
@@ -152,11 +152,13 @@ class EventHandler:
     async def get_event(
         self,
         user: UserID,
-        room_id: Optional[str],
+        room_id: str | None,
         event_id: str,
         show_redacted: bool = False,
-    ) -> Optional[EventBase]:
-        """Retrieve a single specified event.
+    ) -> EventBase | None:
+        """Retrieve a single specified event on behalf of a user.
+        The event will be transformed in a user-specific and time-specific way,
+        e.g. having unsigned metadata added or being erased depending on who is accessing.
 
         Args:
             user: The local user requesting the event
@@ -188,7 +190,7 @@ class EventHandler:
         # The user is peeking if they aren't in the room already
         is_peeking = not is_user_in_room
 
-        filtered = await filter_events_for_client(
+        filtered = await filter_and_transform_events_for_client(
             self._storage_controllers,
             user.to_string(),
             [event],
@@ -198,4 +200,4 @@ class EventHandler:
         if not filtered:
             raise AuthError(403, "You don't have permission to access that event.")
 
-        return event
+        return filtered[0]
diff --git a/synapse/handlers/federation.py b/synapse/handlers/federation.py
index 34aae7ef3c..14805ac80f 100644
--- a/synapse/handlers/federation.py
+++ b/synapse/handlers/federation.py
@@ -30,13 +30,7 @@ from http import HTTPStatus
 from typing import (
     TYPE_CHECKING,
     AbstractSet,
-    Dict,
     Iterable,
-    List,
-    Optional,
-    Set,
-    Tuple,
-    Union,
 )
 
 import attr
@@ -72,13 +66,13 @@ from synapse.http.servlet import assert_params_in_dict
 from synapse.logging.context import nested_logging_context
 from synapse.logging.opentracing import SynapseTags, set_tag, tag_args, trace
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.module_api import NOT_SPAM
 from synapse.storage.databases.main.events_worker import EventRedactBehaviour
 from synapse.storage.invite_rule import InviteRule
 from synapse.types import JsonDict, StrCollection, get_domain_from_id
 from synapse.types.state import StateFilter
 from synapse.util.async_helpers import Linearizer
+from synapse.util.duration import Duration
 from synapse.util.retryutils import NotRetryingDestination
 from synapse.visibility import filter_events_for_server
 
@@ -160,7 +154,7 @@ class FederationHandler:
         self._notifier = hs.get_notifier()
         self._worker_locks = hs.get_worker_locks_handler()
 
-        self._room_backfill = Linearizer("room_backfill")
+        self._room_backfill = Linearizer(name="room_backfill", clock=self.clock)
 
         self._third_party_event_rules = (
             hs.get_module_api_callbacks().third_party_event_rules
@@ -169,27 +163,27 @@ class FederationHandler:
         # Tracks running partial state syncs by room ID.
         # Partial state syncs currently only run on the main process, so it's okay to
         # track them in-memory for now.
-        self._active_partial_state_syncs: Set[str] = set()
+        self._active_partial_state_syncs: set[str] = set()
         # Tracks partial state syncs we may want to restart.
         # A dictionary mapping room IDs to (initial destination, other destinations)
         # tuples.
-        self._partial_state_syncs_maybe_needing_restart: Dict[
-            str, Tuple[Optional[str], AbstractSet[str]]
+        self._partial_state_syncs_maybe_needing_restart: dict[
+            str, tuple[str | None, AbstractSet[str]]
         ] = {}
         # A lock guarding the partial state flag for rooms.
         # When the lock is held for a given room, no other concurrent code may
         # partial state or un-partial state the room.
         self._is_partial_state_room_linearizer = Linearizer(
-            name="_is_partial_state_room_linearizer"
+            name="_is_partial_state_room_linearizer",
+            clock=self.clock,
         )
 
         # if this is the main process, fire off a background process to resume
         # any partial-state-resync operations which were in flight when we
         # were shut down.
         if not hs.config.worker.worker_app:
-            run_as_background_process(
+            self.hs.run_as_background_process(
                 "resume_sync_partial_state_room",
-                self.server_name,
                 self._resume_partial_state_room_sync,
             )
 
@@ -237,7 +231,7 @@ class FederationHandler:
         current_depth: int,
         limit: int,
         *,
-        processing_start_time: Optional[int],
+        processing_start_time: int | None,
     ) -> bool:
         """
         Checks whether the `current_depth` is at or approaching any backfill
@@ -273,7 +267,7 @@ class FederationHandler:
 
         # we now have a list of potential places to backpaginate from. We prefer to
         # start with the most recent (ie, max depth), so let's sort the list.
-        sorted_backfill_points: List[_BackfillPoint] = sorted(
+        sorted_backfill_points: list[_BackfillPoint] = sorted(
             backwards_extremities,
             key=lambda e: -int(e.depth),
         )
@@ -317,9 +311,8 @@ class FederationHandler:
             logger.debug(
                 "_maybe_backfill_inner: all backfill points are *after* current depth. Trying again with later backfill points."
             )
-            run_as_background_process(
+            self.hs.run_as_background_process(
                 "_maybe_backfill_inner_anyway_with_max_depth",
-                self.server_name,
                 self.maybe_backfill,
                 room_id=room_id,
                 # We use `MAX_DEPTH` so that we find all backfill points next
@@ -382,7 +375,7 @@ class FederationHandler:
         # there is it's often sufficiently long ago that clients would stop
         # attempting to paginate before backfill reached the visible history.
 
-        extremities_to_request: List[str] = []
+        extremities_to_request: list[str] = []
         for bp in sorted_backfill_points:
             if len(extremities_to_request) >= 5:
                 break
@@ -564,7 +557,7 @@ class FederationHandler:
 
         return pdu
 
-    async def on_event_auth(self, event_id: str) -> List[EventBase]:
+    async def on_event_auth(self, event_id: str) -> list[EventBase]:
         event = await self.store.get_event(event_id)
         auth = await self.store.get_auth_chain(
             event.room_id, list(event.auth_event_ids()), include_given=True
@@ -573,7 +566,7 @@ class FederationHandler:
 
     async def do_invite_join(
         self, target_hosts: Iterable[str], room_id: str, joinee: str, content: JsonDict
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Attempts to join the `joinee` to the room `room_id` via the
         servers contained in `target_hosts`.
 
@@ -801,20 +794,19 @@ class FederationHandler:
             # lots of requests for missing prev_events which we do actually
             # have. Hence we fire off the background task, but don't wait for it.
 
-            run_as_background_process(
+            self.hs.run_as_background_process(
                 "handle_queued_pdus",
-                self.server_name,
                 self._handle_queued_pdus,
                 room_queue,
             )
 
     async def do_knock(
         self,
-        target_hosts: List[str],
+        target_hosts: list[str],
         room_id: str,
         knockee: str,
         content: JsonDict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Sends the knock to the remote server.
 
         This first triggers a make_knock request that returns a partial
@@ -843,7 +835,7 @@ class FederationHandler:
 
         # Ask the remote server to create a valid knock event for us. Once received,
         # we sign the event
-        params: Dict[str, Iterable[str]] = {"ver": supported_room_versions}
+        params: dict[str, Iterable[str]] = {"ver": supported_room_versions}
         origin, event, event_format_version = await self._make_and_verify_event(
             target_hosts, room_id, knockee, Membership.KNOCK, content, params=params
         )
@@ -892,7 +884,7 @@ class FederationHandler:
         return event.event_id, stream_id
 
     async def _handle_queued_pdus(
-        self, room_queue: List[Tuple[EventBase, str]]
+        self, room_queue: list[tuple[EventBase, str]]
     ) -> None:
         """Process PDUs which got queued up while we were busy send_joining.
 
@@ -1147,7 +1139,7 @@ class FederationHandler:
 
     async def do_remotely_reject_invite(
         self, target_hosts: Iterable[str], room_id: str, user_id: str, content: JsonDict
-    ) -> Tuple[EventBase, int]:
+    ) -> tuple[EventBase, int]:
         origin, event, room_version = await self._make_and_verify_event(
             target_hosts, room_id, user_id, "leave", content=content
         )
@@ -1181,8 +1173,8 @@ class FederationHandler:
         user_id: str,
         membership: str,
         content: JsonDict,
-        params: Optional[Dict[str, Union[str, Iterable[str]]]] = None,
-    ) -> Tuple[str, EventBase, RoomVersion]:
+        params: dict[str, str | Iterable[str]] | None = None,
+    ) -> tuple[str, EventBase, RoomVersion]:
         (
             origin,
             event,
@@ -1309,7 +1301,7 @@ class FederationHandler:
 
     @trace
     @tag_args
-    async def get_state_ids_for_pdu(self, room_id: str, event_id: str) -> List[str]:
+    async def get_state_ids_for_pdu(self, room_id: str, event_id: str) -> list[str]:
         """Returns the state at the event. i.e. not including said event."""
         event = await self.store.get_event(event_id, check_room_id=room_id)
         if event.internal_metadata.outlier:
@@ -1342,8 +1334,8 @@ class FederationHandler:
         return list(state_map.values())
 
     async def on_backfill_request(
-        self, origin: str, room_id: str, pdu_list: List[str], limit: int
-    ) -> List[EventBase]:
+        self, origin: str, room_id: str, pdu_list: list[str], limit: int
+    ) -> list[EventBase]:
         # We allow partially joined rooms since in this case we are filtering out
         # non-local events in `filter_events_for_server`.
         await self._event_auth_handler.assert_host_in_room(room_id, origin, True)
@@ -1378,9 +1370,7 @@ class FederationHandler:
 
         return events
 
-    async def get_persisted_pdu(
-        self, origin: str, event_id: str
-    ) -> Optional[EventBase]:
+    async def get_persisted_pdu(self, origin: str, event_id: str) -> EventBase | None:
         """Get an event from the database for the given server.
 
         Args:
@@ -1419,10 +1409,10 @@ class FederationHandler:
         self,
         origin: str,
         room_id: str,
-        earliest_events: List[str],
-        latest_events: List[str],
+        earliest_events: list[str],
+        latest_events: list[str],
         limit: int,
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         # We allow partially joined rooms since in this case we are filtering out
         # non-local events in `filter_events_for_server`.
         await self._event_auth_handler.assert_host_in_room(room_id, origin, True)
@@ -1605,7 +1595,7 @@ class FederationHandler:
         event_dict: JsonDict,
         event: EventBase,
         context: UnpersistedEventContextBase,
-    ) -> Tuple[EventBase, UnpersistedEventContextBase]:
+    ) -> tuple[EventBase, UnpersistedEventContextBase]:
         key = (
             EventTypes.ThirdPartyInvite,
             event.content["third_party_invite"]["signed"]["token"],
@@ -1677,7 +1667,7 @@ class FederationHandler:
 
         logger.debug("Checking auth on event %r", event.content)
 
-        last_exception: Optional[Exception] = None
+        last_exception: Exception | None = None
 
         # for each public key in the 3pid invite event
         for public_key_object in event_auth.get_public_keys(invite_event):
@@ -1761,8 +1751,8 @@ class FederationHandler:
             raise AuthError(403, "Third party certificate was invalid")
 
     async def get_room_complexity(
-        self, remote_room_hosts: List[str], room_id: str
-    ) -> Optional[dict]:
+        self, remote_room_hosts: list[str], room_id: str
+    ) -> dict | None:
         """
         Fetch the complexity of a remote room over federation.
 
@@ -1798,9 +1788,13 @@ class FederationHandler:
                 room_id=room_id,
             )
 
+            # We don't start all the partial state room syncs at once, to avoid
+            # overloading the process.
+            await self.clock.sleep(Duration(milliseconds=10))
+
     def _start_partial_state_room_sync(
         self,
-        initial_destination: Optional[str],
+        initial_destination: str | None,
         other_destinations: AbstractSet[str],
         room_id: str,
     ) -> None:
@@ -1876,15 +1870,14 @@ class FederationHandler:
                             room_id=room_id,
                         )
 
-        run_as_background_process(
+        self.hs.run_as_background_process(
             desc="sync_partial_state_room",
-            server_name=self.server_name,
             func=_sync_partial_state_room_wrapper,
         )
 
     async def _sync_partial_state_room(
         self,
-        initial_destination: Optional[str],
+        initial_destination: str | None,
         other_destinations: AbstractSet[str],
         room_id: str,
     ) -> None:
@@ -1984,7 +1977,9 @@ class FederationHandler:
                                 logger.warning(
                                     "%s; waiting for %d ms...", e, e.retry_after_ms
                                 )
-                                await self.clock.sleep(e.retry_after_ms / 1000)
+                                await self.clock.sleep(
+                                    Duration(milliseconds=e.retry_after_ms)
+                                )
 
                         # Success, no need to try the rest of the destinations.
                         break
@@ -2026,7 +2021,7 @@ class FederationHandler:
 
 
 def _prioritise_destinations_for_partial_state_resync(
-    initial_destination: Optional[str],
+    initial_destination: str | None,
     other_destinations: AbstractSet[str],
     room_id: str,
 ) -> StrCollection:
diff --git a/synapse/handlers/federation_event.py b/synapse/handlers/federation_event.py
index eb40b670e2..1d160fb802 100644
--- a/synapse/handlers/federation_event.py
+++ b/synapse/handlers/federation_event.py
@@ -27,13 +27,8 @@ from typing import (
     TYPE_CHECKING,
     Collection,
     Container,
-    Dict,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
 )
 
 from prometheus_client import Counter, Histogram
@@ -81,7 +76,6 @@ from synapse.logging.opentracing import (
     trace,
 )
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.http.federation import (
     ReplicationFederationSendEventsRestServlet,
 )
@@ -97,6 +91,7 @@ from synapse.types import (
 )
 from synapse.types.state import StateFilter
 from synapse.util.async_helpers import Linearizer, concurrently_execute
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter, partition, sorted_topologically
 from synapse.util.retryutils import NotRetryingDestination
 from synapse.util.stringutils import shortstr
@@ -153,6 +148,7 @@ class FederationEventHandler:
 
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname
+        self.hs = hs
         self._clock = hs.get_clock()
         self._store = hs.get_datastores().main
         self._state_store = hs.get_datastores().state
@@ -175,6 +171,7 @@ class FederationEventHandler:
         )
         self._notifier = hs.get_notifier()
 
+        self._server_name = hs.hostname
         self._is_mine_id = hs.is_mine_id
         self._is_mine_server_name = hs.is_mine_server_name
         self._instance_name = hs.get_instance_name()
@@ -189,9 +186,9 @@ class FederationEventHandler:
         # For each room, a list of (pdu, origin) tuples.
         # TODO: replace this with something more elegant, probably based around the
         # federation event staging area.
-        self.room_queues: Dict[str, List[Tuple[EventBase, str]]] = {}
+        self.room_queues: dict[str, list[tuple[EventBase, str]]] = {}
 
-        self._room_pdu_linearizer = Linearizer("fed_room_pdu")
+        self._room_pdu_linearizer = Linearizer(name="fed_room_pdu", clock=self._clock)
 
     async def on_receive_pdu(self, origin: str, pdu: EventBase) -> None:
         """Process a PDU received via a federation /send/ transaction
@@ -248,9 +245,10 @@ class FederationEventHandler:
             self.room_queues[room_id].append((pdu, origin))
             return
 
-        # If we're not in the room just ditch the event entirely. This is
-        # probably an old server that has come back and thinks we're still in
-        # the room (or we've been rejoined to the room by a state reset).
+        # If we're not in the room just ditch the event entirely (and not
+        # invited). This is probably an old server that has come back and thinks
+        # we're still in the room (or we've been rejoined to the room by a state
+        # reset).
         #
         # Note that if we were never in the room then we would have already
         # dropped the event, since we wouldn't know the room version.
@@ -258,6 +256,43 @@ class FederationEventHandler:
             room_id, self.server_name
         )
         if not is_in_room:
+            # Check if this is a leave event rescinding an invite
+            if (
+                pdu.type == EventTypes.Member
+                and pdu.membership == Membership.LEAVE
+                and pdu.state_key != pdu.sender
+                and self._is_mine_id(pdu.state_key)
+            ):
+                (
+                    membership,
+                    membership_event_id,
+                ) = await self._store.get_local_current_membership_for_user_in_room(
+                    pdu.state_key, pdu.room_id
+                )
+                if (
+                    membership == Membership.INVITE
+                    and membership_event_id
+                    and membership_event_id
+                    in pdu.auth_event_ids()  # The invite should be in the auth events of the rescission.
+                ):
+                    invite_event = await self._store.get_event(
+                        membership_event_id, allow_none=True
+                    )
+
+                    # We cannot fully auth the rescission event, but we can
+                    # check if the sender of the leave event is the same as the
+                    # invite.
+                    #
+                    # Technically, a room admin could rescind the invite, but we
+                    # have no way of knowing who is and isn't a room admin.
+                    if invite_event and pdu.sender == invite_event.sender:
+                        # Handle the rescission event
+                        pdu.internal_metadata.outlier = True
+                        pdu.internal_metadata.out_of_band_membership = True
+                        context = EventContext.for_outlier(self._storage_controllers)
+                        await self.persist_events_and_notify(room_id, [(pdu, context)])
+                        return
+
             logger.info(
                 "Ignoring PDU from %s as we're not in the room",
                 origin,
@@ -472,8 +507,8 @@ class FederationEventHandler:
         self,
         origin: str,
         room_id: str,
-        auth_events: List[EventBase],
-        state: List[EventBase],
+        auth_events: list[EventBase],
+        state: list[EventBase],
         event: EventBase,
         room_version: RoomVersion,
         partial_state: bool,
@@ -556,7 +591,7 @@ class FederationEventHandler:
                 )
                 missing_event_ids = prev_event_ids - seen_event_ids
 
-                state_maps_to_resolve: List[StateMap[str]] = []
+                state_maps_to_resolve: list[StateMap[str]] = []
 
                 # Fetch the state after the prev events that we know about.
                 state_maps_to_resolve.extend(
@@ -716,7 +751,7 @@ class FederationEventHandler:
 
     @trace
     async def _get_missing_events_for_pdu(
-        self, origin: str, pdu: EventBase, prevs: Set[str], min_depth: int
+        self, origin: str, pdu: EventBase, prevs: set[str], min_depth: int
     ) -> None:
         """
         Args:
@@ -863,7 +898,7 @@ class FederationEventHandler:
             [event.event_id for event in events]
         )
 
-        new_events: List[EventBase] = []
+        new_events: list[EventBase] = []
         for event in events:
             event_id = event.event_id
 
@@ -936,9 +971,8 @@ class FederationEventHandler:
         # Process previously failed backfill events in the background to not waste
         # time on something that is likely to fail again.
         if len(events_with_failed_pull_attempts) > 0:
-            run_as_background_process(
+            self.hs.run_as_background_process(
                 "_process_new_pulled_events_with_failed_pull_attempts",
-                self.server_name,
                 _process_new_pulled_events,
                 events_with_failed_pull_attempts,
             )
@@ -1148,7 +1182,7 @@ class FederationEventHandler:
             partial_state = any(partial_state_flags.values())
 
             # state_maps is a list of mappings from (type, state_key) to event_id
-            state_maps: List[StateMap[str]] = []
+            state_maps: list[StateMap[str]] = []
 
             # Ask the remote server for the states we don't
             # know about
@@ -1540,9 +1574,8 @@ class FederationEventHandler:
                     resync = True
 
             if resync:
-                run_as_background_process(
+                self.hs.run_as_background_process(
                     "resync_device_due_to_pdu",
-                    self.server_name,
                     self._resync_device,
                     event.sender,
                 )
@@ -1623,7 +1656,7 @@ class FederationEventHandler:
 
         room_version = await self._store.get_room_version(room_id)
 
-        events: List[EventBase] = []
+        events: list[EventBase] = []
 
         async def get_event(event_id: str) -> None:
             with nested_logging_context(event_id):
@@ -1730,7 +1763,7 @@ class FederationEventHandler:
             )
             auth_map.update(persisted_events)
 
-        events_and_contexts_to_persist: List[EventPersistencePair] = []
+        events_and_contexts_to_persist: list[EventPersistencePair] = []
 
         async def prep(event: EventBase) -> None:
             with nested_logging_context(suffix=event.event_id):
@@ -1784,7 +1817,7 @@ class FederationEventHandler:
             # the reactor. For large rooms let's yield to the reactor
             # occasionally to ensure we don't block other work.
             if (i + 1) % 1000 == 0:
-                await self._clock.sleep(0)
+                await self._clock.sleep(Duration(seconds=0))
 
         # Also persist the new event in batches for similar reasons as above.
         for batch in batch_iter(events_and_contexts_to_persist, 1000):
@@ -1799,7 +1832,7 @@ class FederationEventHandler:
 
     @trace
     async def _check_event_auth(
-        self, origin: Optional[str], event: EventBase, context: EventContext
+        self, origin: str | None, event: EventBase, context: EventContext
     ) -> None:
         """
         Checks whether an event should be rejected (for failing auth checks).
@@ -2027,7 +2060,7 @@ class FederationEventHandler:
             state_sets_d = await self._state_storage_controller.get_state_groups_ids(
                 event.room_id, extrem_ids
             )
-            state_sets: List[StateMap[str]] = list(state_sets_d.values())
+            state_sets: list[StateMap[str]] = list(state_sets_d.values())
             state_ids = await context.get_prev_state_ids()
             state_sets.append(state_ids)
             current_state_ids = (
@@ -2082,7 +2115,7 @@ class FederationEventHandler:
             event.internal_metadata.soft_failed = True
 
     async def _load_or_fetch_auth_events_for_event(
-        self, destination: Optional[str], event: EventBase
+        self, destination: str | None, event: EventBase
     ) -> Collection[EventBase]:
         """Fetch this event's auth_events, from database or remote
 
diff --git a/synapse/handlers/identity.py b/synapse/handlers/identity.py
index d96b585308..1596c55570 100644
--- a/synapse/handlers/identity.py
+++ b/synapse/handlers/identity.py
@@ -24,7 +24,7 @@
 
 import logging
 import urllib.parse
-from typing import TYPE_CHECKING, Awaitable, Callable, Dict, List, Optional, Tuple
+from typing import TYPE_CHECKING, Awaitable, Callable
 
 import attr
 
@@ -39,8 +39,8 @@ from synapse.http import RequestTimedOutError
 from synapse.http.client import SimpleHttpClient
 from synapse.http.site import SynapseRequest
 from synapse.types import JsonDict, Requester
-from synapse.util import json_decoder
 from synapse.util.hash import sha256_and_url_safe_base64
+from synapse.util.json import json_decoder
 from synapse.util.stringutils import (
     assert_valid_client_secret,
     random_string,
@@ -105,8 +105,8 @@ class IdentityHandler:
         )
 
     async def threepid_from_creds(
-        self, id_server: str, creds: Dict[str, str]
-    ) -> Optional[JsonDict]:
+        self, id_server: str, creds: dict[str, str]
+    ) -> JsonDict | None:
         """
         Retrieve and validate a threepid identifier from a "credentials" dictionary against a
         given identity server
@@ -227,7 +227,7 @@ class IdentityHandler:
             return data
 
     async def try_unbind_threepid(
-        self, mxid: str, medium: str, address: str, id_server: Optional[str]
+        self, mxid: str, medium: str, address: str, id_server: str | None
     ) -> bool:
         """Attempt to remove a 3PID from one or more identity servers.
 
@@ -338,7 +338,7 @@ class IdentityHandler:
         client_secret: str,
         send_attempt: int,
         send_email_func: Callable[[str, str, str, str], Awaitable],
-        next_link: Optional[str] = None,
+        next_link: str | None = None,
     ) -> str:
         """Send a threepid validation email for password reset or
         registration purposes
@@ -426,7 +426,7 @@ class IdentityHandler:
         phone_number: str,
         client_secret: str,
         send_attempt: int,
-        next_link: Optional[str] = None,
+        next_link: str | None = None,
     ) -> JsonDict:
         """
         Request an external server send an SMS message on our behalf for the purposes of
@@ -473,7 +473,7 @@ class IdentityHandler:
 
     async def validate_threepid_session(
         self, client_secret: str, sid: str
-    ) -> Optional[JsonDict]:
+    ) -> JsonDict | None:
         """Validates a threepid session with only the client secret and session ID
         Tries validating against any configured account_threepid_delegates as well as locally.
 
@@ -541,7 +541,7 @@ class IdentityHandler:
 
     async def lookup_3pid(
         self, id_server: str, medium: str, address: str, id_access_token: str
-    ) -> Optional[str]:
+    ) -> str | None:
         """Looks up a 3pid in the passed identity server.
 
         Args:
@@ -567,7 +567,7 @@ class IdentityHandler:
 
     async def _lookup_3pid_v2(
         self, id_server: str, id_access_token: str, medium: str, address: str
-    ) -> Optional[str]:
+    ) -> str | None:
         """Looks up a 3pid in the passed identity server using v2 lookup.
 
         Args:
@@ -689,11 +689,11 @@ class IdentityHandler:
         room_avatar_url: str,
         room_join_rules: str,
         room_name: str,
-        room_type: Optional[str],
+        room_type: str | None,
         inviter_display_name: str,
         inviter_avatar_url: str,
         id_access_token: str,
-    ) -> Tuple[str, List[Dict[str, str]], Dict[str, str], str]:
+    ) -> tuple[str, list[dict[str, str]], dict[str, str], str]:
         """
         Asks an identity server for a third party invite.
 
@@ -779,7 +779,7 @@ class IdentityHandler:
         return token, public_keys, fallback_public_key, display_name
 
 
-def create_id_access_token_header(id_access_token: str) -> List[str]:
+def create_id_access_token_header(id_access_token: str) -> list[str]:
     """Create an Authorization header for passing to SimpleHttpClient as the header value
     of an HTTP request.
 
diff --git a/synapse/handlers/initial_sync.py b/synapse/handlers/initial_sync.py
index 75d64d2d50..1e5e98a59b 100644
--- a/synapse/handlers/initial_sync.py
+++ b/synapse/handlers/initial_sync.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import (
     AccountDataTypes,
@@ -49,7 +49,7 @@ from synapse.types import (
 from synapse.util import unwrapFirstError
 from synapse.util.async_helpers import concurrently_execute, gather_results
 from synapse.util.caches.response_cache import ResponseCache
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -69,10 +69,10 @@ class InitialSyncHandler:
         self.clock = hs.get_clock()
         self.validator = EventValidator()
         self.snapshot_cache: ResponseCache[
-            Tuple[
+            tuple[
                 str,
-                Optional[StreamToken],
-                Optional[StreamToken],
+                StreamToken | None,
+                StreamToken | None,
                 Direction,
                 int,
                 bool,
@@ -225,7 +225,7 @@ class InitialSyncHandler:
                     )
                 ).addErrback(unwrapFirstError)
 
-                messages = await filter_events_for_client(
+                messages = await filter_and_transform_events_for_client(
                     self._storage_controllers,
                     user_id,
                     messages,
@@ -382,7 +382,7 @@ class InitialSyncHandler:
             room_id, limit=pagin_config.limit, end_token=stream_token
         )
 
-        messages = await filter_events_for_client(
+        messages = await filter_and_transform_events_for_client(
             self._storage_controllers,
             requester.user.to_string(),
             messages,
@@ -451,7 +451,7 @@ class InitialSyncHandler:
 
         presence_handler = self.hs.get_presence_handler()
 
-        async def get_presence() -> List[JsonDict]:
+        async def get_presence() -> list[JsonDict]:
             # If presence is disabled, return an empty list
             if not self.hs.config.server.presence_enabled:
                 return []
@@ -468,7 +468,7 @@ class InitialSyncHandler:
                 for s in states
             ]
 
-        async def get_receipts() -> List[JsonMapping]:
+        async def get_receipts() -> list[JsonMapping]:
             receipts = await self.store.get_linearized_receipts_for_room(
                 room_id, to_key=now_token.receipt_key
             )
@@ -496,7 +496,7 @@ class InitialSyncHandler:
             ).addErrback(unwrapFirstError)
         )
 
-        messages = await filter_events_for_client(
+        messages = await filter_and_transform_events_for_client(
             self._storage_controllers,
             requester.user.to_string(),
             messages,
diff --git a/synapse/handlers/jwt.py b/synapse/handlers/jwt.py
index 400f3a59aa..67b2b7c31d 100644
--- a/synapse/handlers/jwt.py
+++ b/synapse/handlers/jwt.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from authlib.jose import JsonWebToken, JWTClaims
 from authlib.jose.errors import BadSignatureError, InvalidClaimError, JoseError
@@ -41,7 +41,7 @@ class JwtHandler:
         self.jwt_issuer = hs.config.jwt.jwt_issuer
         self.jwt_audiences = hs.config.jwt.jwt_audiences
 
-    def validate_login(self, login_submission: JsonDict) -> Tuple[str, Optional[str]]:
+    def validate_login(self, login_submission: JsonDict) -> tuple[str, str | None]:
         """
         Authenticates the user for the /login API
 
diff --git a/synapse/handlers/message.py b/synapse/handlers/message.py
index d850b617d8..eb01622515 100644
--- a/synapse/handlers/message.py
+++ b/synapse/handlers/message.py
@@ -22,7 +22,7 @@
 import logging
 import random
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Any, Dict, List, Mapping, Optional, Sequence, Tuple
+from typing import TYPE_CHECKING, Any, Mapping, Optional, Sequence
 
 from canonicaljson import encode_canonical_json
 
@@ -67,7 +67,6 @@ from synapse.handlers.directory import DirectoryHandler
 from synapse.handlers.worker_lock import NEW_EVENT_DURING_PURGE_LOCK_NAME
 from synapse.logging import opentracing
 from synapse.logging.context import make_deferred_yieldable, run_in_background
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.http.send_events import ReplicationSendEventsRestServlet
 from synapse.storage.databases.main.events_worker import EventRedactBehaviour
 from synapse.types import (
@@ -81,9 +80,11 @@ from synapse.types import (
     create_requester,
 )
 from synapse.types.state import StateFilter
-from synapse.util import json_decoder, json_encoder, log_failure, unwrapFirstError
+from synapse.util import log_failure, unwrapFirstError
 from synapse.util.async_helpers import Linearizer, gather_results
 from synapse.util.caches.expiringcache import ExpiringCache
+from synapse.util.duration import Duration
+from synapse.util.json import json_decoder, json_encoder
 from synapse.util.metrics import measure_func
 from synapse.visibility import get_effective_room_visibility_from_state
 
@@ -98,6 +99,7 @@ class MessageHandler:
 
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname
+        self.hs = hs
         self.auth = hs.get_auth()
         self.clock = hs.get_clock()
         self.state = hs.get_state_handler()
@@ -112,8 +114,8 @@ class MessageHandler:
         self._scheduled_expiry: Optional[IDelayedCall] = None
 
         if not hs.config.worker.worker_app:
-            run_as_background_process(
-                "_schedule_next_expiry", self.server_name, self._schedule_next_expiry
+            self.hs.run_as_background_process(
+                "_schedule_next_expiry", self._schedule_next_expiry
             )
 
     async def get_room_data(
@@ -122,7 +124,7 @@ class MessageHandler:
         room_id: str,
         event_type: str,
         state_key: str,
-    ) -> Optional[EventBase]:
+    ) -> EventBase | None:
         """Get data from a room.
 
         Args:
@@ -177,9 +179,9 @@ class MessageHandler:
         self,
         requester: Requester,
         room_id: str,
-        state_filter: Optional[StateFilter] = None,
-        at_token: Optional[StreamToken] = None,
-    ) -> List[dict]:
+        state_filter: StateFilter | None = None,
+        at_token: StreamToken | None = None,
+    ) -> list[dict]:
         """Retrieve all state events for a given room. If the user is
         joined to the room then return the current state. If the user has
         left the room return the state events from when they left. If an explicit
@@ -320,7 +322,7 @@ class MessageHandler:
             current_membership,
             _,
         ) = await self.store.get_local_current_membership_for_user_in_room(
-            user_id, event_id
+            user_id, room_id
         )
         return current_membership == Membership.JOIN
 
@@ -432,20 +434,16 @@ class MessageHandler:
 
         # Figure out how many seconds we need to wait before expiring the event.
         now_ms = self.clock.time_msec()
-        delay = (expiry_ts - now_ms) / 1000
+        delay = Duration(milliseconds=max(expiry_ts - now_ms, 0))
 
-        # callLater doesn't support negative delays, so trim the delay to 0 if we're
-        # in that case.
-        if delay < 0:
-            delay = 0
-
-        logger.info("Scheduling expiry for event %s in %.3fs", event_id, delay)
+        logger.info(
+            "Scheduling expiry for event %s in %.3fs", event_id, delay.as_secs()
+        )
 
         self._scheduled_expiry = self.clock.call_later(
             delay,
-            run_as_background_process,
+            self.hs.run_as_background_process,
             "_expire_event",
-            self.server_name,
             self._expire_event,
             event_id,
         )
@@ -512,7 +510,9 @@ class EventCreationHandler:
 
         # We limit concurrent event creation for a room to 1. This prevents state resolution
         # from occurring when sending bursts of events to a local room
-        self.limiter = Linearizer(max_count=1, name="room_event_creation_limit")
+        self.limiter = Linearizer(
+            max_count=1, name="room_event_creation_limit", clock=self.clock
+        )
 
         self._bulk_push_rule_evaluator = hs.get_bulk_push_rule_evaluator()
 
@@ -536,7 +536,7 @@ class EventCreationHandler:
         #
         # map from room id to time-of-last-attempt.
         #
-        self._rooms_to_exclude_from_dummy_event_insertion: Dict[str, int] = {}
+        self._rooms_to_exclude_from_dummy_event_insertion: dict[str, int] = {}
         # The number of forward extremeities before a dummy event is sent.
         self._dummy_events_threshold = hs.config.server.dummy_events_threshold
 
@@ -545,12 +545,11 @@ class EventCreationHandler:
             and self.config.server.cleanup_extremities_with_dummy_events
         ):
             self.clock.looping_call(
-                lambda: run_as_background_process(
+                lambda: self.hs.run_as_background_process(
                     "send_dummy_events_to_fill_extremities",
-                    self.server_name,
                     self._send_dummy_events_to_fill_extremities,
                 ),
-                5 * 60 * 1000,
+                Duration(minutes=5),
             )
 
         self._message_handler = hs.get_message_handler()
@@ -562,11 +561,12 @@ class EventCreationHandler:
         # Stores the state groups we've recently added to the joined hosts
         # external cache. Note that the timeout must be significantly less than
         # the TTL on the external cache.
-        self._external_cache_joined_hosts_updates: Optional[ExpiringCache] = None
+        self._external_cache_joined_hosts_updates: ExpiringCache | None = None
         if self._external_cache.is_enabled():
             self._external_cache_joined_hosts_updates = ExpiringCache(
                 cache_name="_external_cache_joined_hosts_updates",
                 server_name=self.server_name,
+                hs=self.hs,
                 clock=self.clock,
                 expiry_ms=30 * 60 * 1000,
             )
@@ -575,17 +575,18 @@ class EventCreationHandler:
         self,
         requester: Requester,
         event_dict: dict,
-        txn_id: Optional[str] = None,
-        prev_event_ids: Optional[List[str]] = None,
-        auth_event_ids: Optional[List[str]] = None,
-        state_event_ids: Optional[List[str]] = None,
+        txn_id: str | None = None,
+        prev_event_ids: list[str] | None = None,
+        auth_event_ids: list[str] | None = None,
+        state_event_ids: list[str] | None = None,
         require_consent: bool = True,
         outlier: bool = False,
-        depth: Optional[int] = None,
-        state_map: Optional[StateMap[str]] = None,
+        depth: int | None = None,
+        state_map: StateMap[str] | None = None,
         for_batch: bool = False,
-        current_state_group: Optional[int] = None,
-    ) -> Tuple[EventBase, UnpersistedEventContextBase]:
+        current_state_group: int | None = None,
+        delay_id: str | None = None,
+    ) -> tuple[EventBase, UnpersistedEventContextBase]:
         """
         Given a dict from a client, create a new event. If bool for_batch is true, will
         create an event using the prev_event_ids, and will create an event context for
@@ -600,7 +601,7 @@ class EventCreationHandler:
         Args:
             requester
             event_dict: An entire event
-            txn_id
+            txn_id: The transaction ID.
             prev_event_ids:
                 the forward extremities to use as the prev_events for the
                 new event.
@@ -639,6 +640,8 @@ class EventCreationHandler:
             current_state_group: the current state group, used only for creating events for
                 batch persisting
 
+            delay_id: The delay ID of this event, if it was a delayed event.
+
         Raises:
             ResourceLimitError if server is blocked to some resource being
             exceeded
@@ -726,6 +729,9 @@ class EventCreationHandler:
         if txn_id is not None:
             builder.internal_metadata.txn_id = txn_id
 
+        if delay_id is not None:
+            builder.internal_metadata.delay_id = delay_id
+
         builder.internal_metadata.outlier = outlier
 
         event, unpersisted_context = await self.create_new_client_event(
@@ -863,7 +869,7 @@ class EventCreationHandler:
 
     async def deduplicate_state_event(
         self, event: EventBase, context: EventContext
-    ) -> Optional[EventBase]:
+    ) -> EventBase | None:
         """
         Checks whether event is in the latest resolved state in context.
 
@@ -901,7 +907,7 @@ class EventCreationHandler:
         requester: Requester,
         txn_id: str,
         room_id: str,
-    ) -> Optional[str]:
+    ) -> str | None:
         """For the given transaction ID and room ID, check if there is a matching event ID.
 
         Args:
@@ -935,7 +941,7 @@ class EventCreationHandler:
         requester: Requester,
         txn_id: str,
         room_id: str,
-    ) -> Optional[EventBase]:
+    ) -> EventBase | None:
         """For the given transaction ID and room ID, check if there is a matching event.
         If so, fetch it and return it.
 
@@ -959,14 +965,15 @@ class EventCreationHandler:
         self,
         requester: Requester,
         event_dict: dict,
-        prev_event_ids: Optional[List[str]] = None,
-        state_event_ids: Optional[List[str]] = None,
+        prev_event_ids: list[str] | None = None,
+        state_event_ids: list[str] | None = None,
         ratelimit: bool = True,
-        txn_id: Optional[str] = None,
+        txn_id: str | None = None,
         ignore_shadow_ban: bool = False,
         outlier: bool = False,
-        depth: Optional[int] = None,
-    ) -> Tuple[EventBase, int]:
+        depth: int | None = None,
+        delay_id: str | None = None,
+    ) -> tuple[EventBase, int]:
         """
         Creates an event, then sends it.
 
@@ -994,6 +1001,7 @@ class EventCreationHandler:
             depth: Override the depth used to order the event in the DAG.
                 Should normally be set to None, which will cause the depth to be calculated
                 based on the prev_events.
+            delay_id: The delay ID of this event, if it was a delayed event.
 
         Returns:
             The event, and its stream ordering (if deduplication happened,
@@ -1010,17 +1018,40 @@ class EventCreationHandler:
 
         if not ignore_shadow_ban and requester.shadow_banned:
             # We randomly sleep a bit just to annoy the requester.
-            await self.clock.sleep(random.randint(1, 10))
+            await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
             raise ShadowBanError()
 
-        if ratelimit:
+        room_version = None
+
+        if (
+            event_dict["type"] == EventTypes.Redaction
+            and "redacts" in event_dict["content"]
+            and self.hs.config.experimental.msc4169_enabled
+        ):
             room_id = event_dict["room_id"]
             try:
                 room_version = await self.store.get_room_version(room_id)
             except NotFoundError:
-                # The room doesn't exist.
                 raise AuthError(403, f"User {requester.user} not in room {room_id}")
 
+            if not room_version.updated_redaction_rules:
+                # Legacy room versions need the "redacts" field outside of the event's
+                # content. However clients may still send it within the content, so move
+                # the field if necessary for compatibility.
+                redacts = event_dict.get("redacts") or event_dict["content"].pop(
+                    "redacts", None
+                )
+                if redacts is not None and "redacts" not in event_dict:
+                    event_dict["redacts"] = redacts
+
+        if ratelimit:
+            if room_version is None:
+                room_id = event_dict["room_id"]
+                try:
+                    room_version = await self.store.get_room_version(room_id)
+                except NotFoundError:
+                    raise AuthError(403, f"User {requester.user} not in room {room_id}")
+
             if room_version.updated_redaction_rules:
                 redacts = event_dict["content"].get("redacts")
             else:
@@ -1067,20 +1098,22 @@ class EventCreationHandler:
                 ignore_shadow_ban=ignore_shadow_ban,
                 outlier=outlier,
                 depth=depth,
+                delay_id=delay_id,
             )
 
     async def _create_and_send_nonmember_event_locked(
         self,
         requester: Requester,
         event_dict: dict,
-        prev_event_ids: Optional[List[str]] = None,
-        state_event_ids: Optional[List[str]] = None,
+        prev_event_ids: list[str] | None = None,
+        state_event_ids: list[str] | None = None,
         ratelimit: bool = True,
-        txn_id: Optional[str] = None,
+        txn_id: str | None = None,
         ignore_shadow_ban: bool = False,
         outlier: bool = False,
-        depth: Optional[int] = None,
-    ) -> Tuple[EventBase, int]:
+        depth: int | None = None,
+        delay_id: str | None = None,
+    ) -> tuple[EventBase, int]:
         room_id = event_dict["room_id"]
 
         # If we don't have any prev event IDs specified then we need to
@@ -1108,12 +1141,19 @@ class EventCreationHandler:
                     state_event_ids=state_event_ids,
                     outlier=outlier,
                     depth=depth,
+                    delay_id=delay_id,
                 )
                 context = await unpersisted_context.persist(event)
 
                 assert self.hs.is_mine_id(event.sender), "User must be our own: %s" % (
                     event.sender,
                 )
+                # if this room uses a policy server, try to get a signature now.
+                # We use verify=False here as we are about to call is_event_allowed on the same event
+                # which will do sig checks.
+                await self._policy_handler.ask_policy_server_to_sign_event(
+                    event, verify=False
+                )
 
                 policy_allowed = await self._policy_handler.is_event_allowed(event)
                 if not policy_allowed:
@@ -1188,15 +1228,15 @@ class EventCreationHandler:
     async def create_new_client_event(
         self,
         builder: EventBuilder,
-        requester: Optional[Requester] = None,
-        prev_event_ids: Optional[List[str]] = None,
-        auth_event_ids: Optional[List[str]] = None,
-        state_event_ids: Optional[List[str]] = None,
-        depth: Optional[int] = None,
-        state_map: Optional[StateMap[str]] = None,
+        requester: Requester | None = None,
+        prev_event_ids: list[str] | None = None,
+        auth_event_ids: list[str] | None = None,
+        state_event_ids: list[str] | None = None,
+        depth: int | None = None,
+        state_map: StateMap[str] | None = None,
         for_batch: bool = False,
-        current_state_group: Optional[int] = None,
-    ) -> Tuple[EventBase, UnpersistedEventContextBase]:
+        current_state_group: int | None = None,
+    ) -> tuple[EventBase, UnpersistedEventContextBase]:
         """Create a new event for a local client. If bool for_batch is true, will
         create an event using the prev_event_ids, and will create an event context for
         the event using the parameters state_map and current_state_group, thus these parameters
@@ -1440,9 +1480,9 @@ class EventCreationHandler:
     async def handle_new_client_event(
         self,
         requester: Requester,
-        events_and_context: List[EventPersistencePair],
+        events_and_context: list[EventPersistencePair],
         ratelimit: bool = True,
-        extra_users: Optional[List[UserID]] = None,
+        extra_users: list[UserID] | None = None,
         ignore_shadow_ban: bool = False,
     ) -> EventBase:
         """Processes new events. Please note that if batch persisting events, an error in
@@ -1484,7 +1524,7 @@ class EventCreationHandler:
                 and requester.shadow_banned
             ):
                 # We randomly sleep a bit just to annoy the requester.
-                await self.clock.sleep(random.randint(1, 10))
+                await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
                 raise ShadowBanError()
 
             if event.is_state():
@@ -1561,7 +1601,7 @@ class EventCreationHandler:
         self,
         requester: Requester,
         room_id: str,
-        prev_event_id: Optional[str],
+        prev_event_id: str | None,
         event_dicts: Sequence[JsonDict],
         ratelimit: bool = True,
         ignore_shadow_ban: bool = False,
@@ -1652,9 +1692,9 @@ class EventCreationHandler:
     async def _persist_events(
         self,
         requester: Requester,
-        events_and_context: List[EventPersistencePair],
+        events_and_context: list[EventPersistencePair],
         ratelimit: bool = True,
-        extra_users: Optional[List[UserID]] = None,
+        extra_users: list[UserID] | None = None,
     ) -> EventBase:
         """Actually persists new events. Should only be called by
         `handle_new_client_event`, and see its docstring for documentation of
@@ -1738,7 +1778,7 @@ class EventCreationHandler:
             raise
 
     async def cache_joined_hosts_for_events(
-        self, events_and_context: List[EventPersistencePair]
+        self, events_and_context: list[EventPersistencePair]
     ) -> None:
         """Precalculate the joined hosts at each of the given events, when using Redis, so that
         external federation senders don't have to recalculate it themselves.
@@ -1844,9 +1884,9 @@ class EventCreationHandler:
     async def persist_and_notify_client_events(
         self,
         requester: Requester,
-        events_and_context: List[EventPersistencePair],
+        events_and_context: list[EventPersistencePair],
         ratelimit: bool = True,
-        extra_users: Optional[List[UserID]] = None,
+        extra_users: list[UserID] | None = None,
     ) -> EventBase:
         """Called when we have fully built the events, have already
         calculated the push actions for the events, and checked auth.
@@ -1926,6 +1966,12 @@ class EventCreationHandler:
                 room_alias_str = event.content.get("alias", None)
                 directory_handler = self.hs.get_directory_handler()
                 if room_alias_str and room_alias_str != original_alias:
+                    if not isinstance(room_alias_str, str):
+                        raise SynapseError(
+                            400,
+                            "The alias must be of type string.",
+                            Codes.INVALID_PARAM,
+                        )
                     await self._validate_canonical_alias(
                         directory_handler, room_alias_str, event.room_id
                     )
@@ -1949,6 +1995,12 @@ class EventCreationHandler:
                 new_alt_aliases = set(alt_aliases) - set(original_alt_aliases)
                 if new_alt_aliases:
                     for alias_str in new_alt_aliases:
+                        if not isinstance(alias_str, str):
+                            raise SynapseError(
+                                400,
+                                "Each alt_alias must be of type string.",
+                                Codes.INVALID_PARAM,
+                            )
                         await self._validate_canonical_alias(
                             directory_handler, alias_str, event.room_id
                         )
@@ -2081,9 +2133,8 @@ class EventCreationHandler:
             if event.type == EventTypes.Message:
                 # We don't want to block sending messages on any presence code. This
                 # matters as sometimes presence code can take a while.
-                run_as_background_process(
+                self.hs.run_as_background_process(
                     "bump_presence_active_time",
-                    self.server_name,
                     self._bump_active_time,
                     requester.user,
                     requester.device_id,
@@ -2102,7 +2153,7 @@ class EventCreationHandler:
         return persisted_events[-1]
 
     async def is_admin_redaction(
-        self, event_type: str, sender: str, redacts: Optional[str]
+        self, event_type: str, sender: str, redacts: str | None
     ) -> bool:
         """Return whether the event is a redaction made by an admin, and thus
         should use a different ratelimiter.
@@ -2144,7 +2195,7 @@ class EventCreationHandler:
         logger.info("maybe_kick_guest_users %r", current_state)
         await self.hs.get_room_member_handler().kick_guest_users(current_state)
 
-    async def _bump_active_time(self, user: UserID, device_id: Optional[str]) -> None:
+    async def _bump_active_time(self, user: UserID, device_id: str | None) -> None:
         try:
             presence = self.hs.get_presence_handler()
             await presence.bump_presence_active_time(user, device_id)
@@ -2255,7 +2306,7 @@ class EventCreationHandler:
 
     async def _rebuild_event_after_third_party_rules(
         self, third_party_result: dict, original_event: EventBase
-    ) -> Tuple[EventBase, UnpersistedEventContextBase]:
+    ) -> tuple[EventBase, UnpersistedEventContextBase]:
         # the third_party_event_rules want to replace the event.
         # we do some basic checks, and then return the replacement event.
 
diff --git a/synapse/handlers/oidc.py b/synapse/handlers/oidc.py
index 8f3e717fb4..09b19056a7 100644
--- a/synapse/handlers/oidc.py
+++ b/synapse/handlers/oidc.py
@@ -26,14 +26,9 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Any,
-    Dict,
     Generic,
-    List,
-    Optional,
-    Type,
     TypedDict,
     TypeVar,
-    Union,
 )
 from urllib.parse import urlencode, urlparse
 
@@ -54,25 +49,29 @@ from pymacaroons.exceptions import (
     MacaroonInvalidSignatureException,
 )
 
+from twisted.internet import defer
+from twisted.internet.defer import Deferred
 from twisted.web.client import readBody
 from twisted.web.http_headers import Headers
 
 from synapse.api.errors import SynapseError
 from synapse.config import ConfigError
 from synapse.config.oidc import OidcProviderClientSecretJwtKey, OidcProviderConfig
-from synapse.handlers.sso import MappingException, UserAttributes
+from synapse.handlers.sso import MappingException, SsoSetupError, UserAttributes
 from synapse.http.server import finish_request
 from synapse.http.servlet import parse_string
 from synapse.http.site import SynapseRequest
 from synapse.logging.context import make_deferred_yieldable
-from synapse.module_api import ModuleApi
+from synapse.metrics.background_process_metrics import wrap_as_background_process
 from synapse.types import JsonDict, UserID, map_username_to_mxid_localpart
-from synapse.util import Clock, json_decoder
 from synapse.util.caches.cached_call import RetryOnExceptionCachedCall
+from synapse.util.clock import Clock
+from synapse.util.json import json_decoder
 from synapse.util.macaroons import MacaroonGenerator, OidcSessionData
 from synapse.util.templates import _localpart_from_email_filter
 
 if TYPE_CHECKING:
+    from synapse.module_api import ModuleApi
     from synapse.server import HomeServer
 
 logger = logging.getLogger(__name__)
@@ -95,7 +94,7 @@ logger = logging.getLogger(__name__)
 # Here we have the names of the cookies, and the options we use to set them.
 _SESSION_COOKIES = [
     (b"oidc_session", b"HttpOnly; Secure; SameSite=None"),
-    (b"oidc_session_no_samesite", b"HttpOnly"),
+    (b"oidc_session_no_samesite", b"HttpOnly; Secure"),
 ]
 
 
@@ -104,22 +103,22 @@ _SESSION_COOKIES = [
 class Token(TypedDict):
     access_token: str
     token_type: str
-    id_token: Optional[str]
-    refresh_token: Optional[str]
+    id_token: str | None
+    refresh_token: str | None
     expires_in: int
-    scope: Optional[str]
+    scope: str | None
 
 
 #: A JWK, as per RFC7517 sec 4. The type could be more precise than that, but
 #: there is no real point of doing this in our case.
-JWK = Dict[str, str]
+JWK = dict[str, str]
 
 C = TypeVar("C")
 
 
 #: A JWK Set, as per RFC7517 sec 5.
 class JWKS(TypedDict):
-    keys: List[JWK]
+    keys: list[JWK]
 
 
 class OidcHandler:
@@ -127,31 +126,60 @@ class OidcHandler:
 
     def __init__(self, hs: "HomeServer"):
         self._sso_handler = hs.get_sso_handler()
+        # Needed for wrap_as_background_process
+        self.hs = hs
 
         provider_confs = hs.config.oidc.oidc_providers
         # we should not have been instantiated if there is no configured provider.
         assert provider_confs
 
         self._macaroon_generator = hs.get_macaroon_generator()
-        self._providers: Dict[str, "OidcProvider"] = {
+        self._providers: dict[str, "OidcProvider"] = {
             p.idp_id: OidcProvider(hs, self._macaroon_generator, p)
             for p in provider_confs
         }
 
-    async def load_metadata(self) -> None:
-        """Validate the config and load the metadata from the remote endpoint.
+    @wrap_as_background_process("preload_oidc_metadata")
+    async def _preload_metadata_one_provider(
+        self, idp_id: str, p: "OidcProvider"
+    ) -> None:
+        """Attempt to preload the metadata from a single OIDC provider's remote endpoint
+        in the background.
 
-        Called at startup to ensure we have everything we need.
+        Will not raise exceptions, but will log at CRITICAL if an OIDC provider is broken.
         """
+
+        logger.info("Preloading OIDC provider %r", idp_id)
+        try:
+            await p.load_metadata()
+            if not p._uses_userinfo:
+                await p.load_jwks()
+        except Exception:
+            logger.critical(
+                # Include 'login' keyword for searchability.
+                "Error while preloading OIDC provider %r. Login may be broken!",
+                idp_id,
+                exc_info=True,
+            )
+
+    def preload_metadata(self) -> "Deferred[list[tuple[bool, None]]]":
+        """Attempt to preload the metadata from all the OIDC providers' remote endpoints
+        in the background.
+
+        Will not raise exceptions, but will log at CRITICAL if an OIDC provider is broken.
+
+        Can be **optionally** awaited in which case it will resolve when all
+        preloads are finished.
+        """
+
+        to_wait = []
         for idp_id, p in self._providers.items():
-            try:
-                await p.load_metadata()
-                if not p._uses_userinfo:
-                    await p.load_jwks()
-            except Exception as e:
-                raise Exception(
-                    "Error while initialising OIDC provider %r" % (idp_id,)
-                ) from e
+            to_wait.append(self._preload_metadata_one_provider(idp_id, p))
+
+        return defer.DeferredList(
+            to_wait,
+            consumeErrors=True,
+        )
 
     async def handle_oidc_callback(self, request: SynapseRequest) -> None:
         """Handle an incoming request to /_synapse/client/oidc/callback
@@ -208,7 +236,7 @@ class OidcHandler:
         # are two.
 
         for cookie_name, _ in _SESSION_COOKIES:
-            session: Optional[bytes] = request.getCookie(cookie_name)
+            session: bytes | None = request.getCookie(cookie_name)
             if session is not None:
                 break
         else:
@@ -331,13 +359,13 @@ class OidcHandler:
 
             # At this point we properly checked both claims types
             issuer: str = iss
-            audience: List[str] = aud
+            audience: list[str] = aud
         except (TypeError, KeyError):
             raise SynapseError(400, "Invalid issuer/audience in logout_token")
 
         # Now that we know the audience and the issuer, we can figure out from
         # what provider it is coming from
-        oidc_provider: Optional[OidcProvider] = None
+        oidc_provider: OidcProvider | None = None
         for provider in self._providers.values():
             if provider.issuer == issuer and provider.client_id in audience:
                 oidc_provider = provider
@@ -353,7 +381,7 @@ class OidcHandler:
 class OidcError(Exception):
     """Used to catch errors when calling the token_endpoint"""
 
-    def __init__(self, error: str, error_description: Optional[str] = None):
+    def __init__(self, error: str, error_description: str | None = None):
         self.error = error
         self.error_description = error_description
 
@@ -363,6 +391,18 @@ class OidcError(Exception):
         return self.error
 
 
+class OidcDiscoveryError(SsoSetupError):
+    """
+    Used to catch and mark errors when performing OIDC discovery.
+    """
+
+
+class OidcMetadataError(SsoSetupError):
+    """
+    Used to catch and mark errors in the OIDC metadata configuration.
+    """
+
+
 class OidcProvider:
     """Wraps the config for a single OIDC IdentityProvider
 
@@ -376,6 +416,9 @@ class OidcProvider:
         macaroon_generator: MacaroonGenerator,
         provider: OidcProviderConfig,
     ):
+        # Needed here to break import loops
+        from synapse.module_api import ModuleApi
+
         self._store = hs.get_datastores().main
         self._clock = hs.get_clock()
 
@@ -400,7 +443,7 @@ class OidcProvider:
         self._scopes = provider.scopes
         self._user_profile_method = provider.user_profile_method
 
-        client_secret: Optional[Union[str, JwtClientSecret]] = None
+        client_secret: str | JwtClientSecret | None = None
         if provider.client_secret:
             client_secret = provider.client_secret
         elif provider.client_secret_jwt_key:
@@ -427,8 +470,10 @@ class OidcProvider:
         # from the IdP's jwks_uri, if required.
         self._jwks = RetryOnExceptionCachedCall(self._load_jwks)
 
+        # type-ignore: we will not be instantiating a subclass of the provider class,
+        # so the warning about directly accessing __init__ being unsound does not apply here
         user_mapping_provider_init_method = (
-            provider.user_mapping_provider_class.__init__
+            provider.user_mapping_provider_class.__init__  # type: ignore[misc]
         )
         if len(inspect.signature(user_mapping_provider_init_method).parameters) == 3:
             self._user_mapping_provider = provider.user_mapping_provider_class(
@@ -646,9 +691,15 @@ class OidcProvider:
 
         # load any data from the discovery endpoint, if enabled
         if self._config.discover:
-            url = get_well_known_url(self._config.issuer, external=True)
-            metadata_response = await self._http_client.get_json(url)
-            metadata.update(metadata_response)
+            try:
+                url = get_well_known_url(self._config.issuer, external=True)
+                metadata_response = await self._http_client.get_json(url)
+                metadata.update(metadata_response)
+            except Exception as e:
+                # This `Exception` bound is a bit broad, but at least expecting
+                # `twisted.internet.error.ConnectionRefusedError`
+                # and likely many other network or JSON errors.
+                raise OidcDiscoveryError() from e
 
         # override any discovered data with any settings in our config
         if self._config.authorization_endpoint:
@@ -673,7 +724,12 @@ class OidcProvider:
                 self._config.id_token_signing_alg_values_supported
             )
 
-        self._validate_metadata(metadata)
+        try:
+            self._validate_metadata(metadata)
+        except ValueError as e:
+            # Wrap this error so that we can special-case it higher up
+            # Pass through `str(e)` as the message so tests can match it.
+            raise OidcMetadataError(str(e)) from e
 
         return metadata
 
@@ -757,7 +813,7 @@ class OidcProvider:
         """
         metadata = await self.load_metadata()
         token_endpoint = metadata.get("token_endpoint")
-        raw_headers: Dict[str, str] = {
+        raw_headers: dict[str, str] = {
             "Content-Type": "application/x-www-form-urlencoded",
             "User-Agent": self._http_client.user_agent.decode("ascii"),
             "Accept": "application/json",
@@ -901,11 +957,11 @@ class OidcProvider:
 
     async def _verify_jwt(
         self,
-        alg_values: List[str],
+        alg_values: list[str],
         token: str,
-        claims_cls: Type[C],
-        claims_options: Optional[dict] = None,
-        claims_params: Optional[dict] = None,
+        claims_cls: type[C],
+        claims_options: dict | None = None,
+        claims_params: dict | None = None,
     ) -> C:
         """Decode and validate a JWT, re-fetching the JWKS as needed.
 
@@ -1005,8 +1061,8 @@ class OidcProvider:
     async def handle_redirect_request(
         self,
         request: SynapseRequest,
-        client_redirect_url: Optional[bytes],
-        ui_auth_session_id: Optional[str] = None,
+        client_redirect_url: bytes | None,
+        ui_auth_session_id: str | None = None,
     ) -> str:
         """Handle an incoming request to /login/sso/redirect
 
@@ -1235,7 +1291,7 @@ class OidcProvider:
         token: Token,
         request: SynapseRequest,
         client_redirect_url: str,
-        sid: Optional[str],
+        sid: str | None,
     ) -> None:
         """Given a UserInfo response, complete the login flow
 
@@ -1300,7 +1356,7 @@ class OidcProvider:
 
             return UserAttributes(**attributes)
 
-        async def grandfather_existing_users() -> Optional[str]:
+        async def grandfather_existing_users() -> str | None:
             if self._allow_existing_users:
                 # If allowing existing users we want to generate a single localpart
                 # and attempt to match it.
@@ -1444,8 +1500,8 @@ class OidcProvider:
         # If the `sub` claim was included in the logout token, we check that it matches
         # that it matches the right user. We can have cases where the `sub` claim is not
         # the ID saved in database, so we let admins disable this check in config.
-        sub: Optional[str] = claims.get("sub")
-        expected_user_id: Optional[str] = None
+        sub: str | None = claims.get("sub")
+        expected_user_id: str | None = None
         if sub is not None and not self._config.backchannel_logout_ignore_sub:
             expected_user_id = await self._store.get_user_by_external_id(
                 self.idp_id, sub
@@ -1473,7 +1529,7 @@ class LogoutToken(JWTClaims):  # type: ignore[misc]
 
     REGISTERED_CLAIMS = ["iss", "sub", "aud", "iat", "jti", "events", "sid"]
 
-    def validate(self, now: Optional[int] = None, leeway: int = 0) -> None:
+    def validate(self, now: int | None = None, leeway: int = 0) -> None:
         """Validate everything in claims payload."""
         super().validate(now, leeway)
         self.validate_sid()
@@ -1584,11 +1640,11 @@ class JwtClientSecret:
 
 
 class UserAttributeDict(TypedDict):
-    localpart: Optional[str]
+    localpart: str | None
     confirm_localpart: bool
-    display_name: Optional[str]
-    picture: Optional[str]  # may be omitted by older `OidcMappingProviders`
-    emails: List[str]
+    display_name: str | None
+    picture: str | None  # may be omitted by older `OidcMappingProviders`
+    emails: list[str]
 
 
 class OidcMappingProvider(Generic[C]):
@@ -1674,10 +1730,10 @@ env.filters.update(
 class JinjaOidcMappingConfig:
     subject_template: Template
     picture_template: Template
-    localpart_template: Optional[Template]
-    display_name_template: Optional[Template]
-    email_template: Optional[Template]
-    extra_attributes: Dict[str, Template]
+    localpart_template: Template | None
+    display_name_template: Template | None
+    email_template: Template | None
+    extra_attributes: dict[str, Template]
     confirm_localpart: bool = False
 
 
@@ -1687,7 +1743,7 @@ class JinjaOidcMappingProvider(OidcMappingProvider[JinjaOidcMappingConfig]):
     This is the default mapping provider.
     """
 
-    def __init__(self, config: JinjaOidcMappingConfig, module_api: ModuleApi):
+    def __init__(self, config: JinjaOidcMappingConfig, module_api: "ModuleApi"):
         self._config = config
 
     @staticmethod
@@ -1710,7 +1766,7 @@ class JinjaOidcMappingProvider(OidcMappingProvider[JinjaOidcMappingConfig]):
         subject_template = parse_template_config_with_claim("subject", "sub")
         picture_template = parse_template_config_with_claim("picture", "picture")
 
-        def parse_template_config(option_name: str) -> Optional[Template]:
+        def parse_template_config(option_name: str) -> Template | None:
             if option_name not in config:
                 return None
             try:
@@ -1768,7 +1824,7 @@ class JinjaOidcMappingProvider(OidcMappingProvider[JinjaOidcMappingConfig]):
             # a usable mxid.
             localpart += str(failures) if failures else ""
 
-        def render_template_field(template: Optional[Template]) -> Optional[str]:
+        def render_template_field(template: Template | None) -> str | None:
             if template is None:
                 return None
             return template.render(user=userinfo).strip()
@@ -1777,7 +1833,7 @@ class JinjaOidcMappingProvider(OidcMappingProvider[JinjaOidcMappingConfig]):
         if display_name == "":
             display_name = None
 
-        emails: List[str] = []
+        emails: list[str] = []
         email = render_template_field(self._config.email_template)
         if email:
             emails.append(email)
@@ -1793,7 +1849,7 @@ class JinjaOidcMappingProvider(OidcMappingProvider[JinjaOidcMappingConfig]):
         )
 
     async def get_extra_attributes(self, userinfo: UserInfo, token: Token) -> JsonDict:
-        extras: Dict[str, str] = {}
+        extras: dict[str, str] = {}
         for key, template in self._config.extra_attributes.items():
             try:
                 extras[key] = template.render(user=userinfo).strip()
diff --git a/synapse/handlers/pagination.py b/synapse/handlers/pagination.py
index df1a7e714c..7b9c829056 100644
--- a/synapse/handlers/pagination.py
+++ b/synapse/handlers/pagination.py
@@ -19,31 +19,34 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, List, Optional, Set, Tuple, cast
+from typing import TYPE_CHECKING, cast
+
+import attr
 
 from twisted.python.failure import Failure
 
 from synapse.api.constants import Direction, EventTypes, Membership
 from synapse.api.errors import SynapseError
 from synapse.api.filtering import Filter
-from synapse.events.utils import SerializeEventConfig
+from synapse.events import EventBase
+from synapse.handlers.relations import BundledAggregations
 from synapse.handlers.worker_lock import NEW_EVENT_DURING_PURGE_LOCK_NAME
 from synapse.logging.opentracing import trace
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.rest.admin._base import assert_user_is_admin
 from synapse.streams.config import PaginationConfig
 from synapse.types import (
-    JsonDict,
     JsonMapping,
     Requester,
     ScheduledTask,
     StreamKeyType,
+    StreamToken,
     TaskStatus,
 )
 from synapse.types.handlers import ShutdownRoomParams, ShutdownRoomResponse
 from synapse.types.state import StateFilter
 from synapse.util.async_helpers import ReadWriteLock
-from synapse.visibility import filter_events_for_client
+from synapse.util.duration import Duration
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -70,6 +73,58 @@ PURGE_ROOM_ACTION_NAME = "purge_room"
 SHUTDOWN_AND_PURGE_ROOM_ACTION_NAME = "shutdown_and_purge_room"
 
 
+@attr.s(slots=True, frozen=True, auto_attribs=True)
+class GetMessagesResult:
+    """
+    Everything needed to serialize a `/messages` response.
+    """
+
+    messages_chunk: list[EventBase]
+    """
+    A list of room events.
+
+     - When the request is `Direction.FORWARDS`, events will be in the range:
+       `start_token` < x <= `end_token`, (ascending topological_order)
+     - When the request is `Direction.BACKWARDS`, events will be in the range:
+       `start_token` >= x > `end_token`, (descending topological_order)
+
+    Note that an empty chunk does not necessarily imply that no more events are
+    available. Clients should continue to paginate until no `end_token` property is returned.
+    """
+
+    bundled_aggregations: dict[str, BundledAggregations]
+    """
+    A map of event ID to the bundled aggregations for the events in the chunk.
+
+    If an event doesn't have any bundled aggregations, it may not appear in the map.
+    """
+
+    state: list[EventBase] | None
+    """
+    A list of state events relevant to showing the chunk. For example, if
+    lazy_load_members is enabled in the filter then this may contain the membership
+    events for the senders of events in the chunk.
+
+    Omitted from the response when `None`.
+    """
+
+    start_token: StreamToken
+    """
+    Token corresponding to the start of chunk. This will be the same as the value given
+    in `from` query parameter of the `/messages` request.
+    """
+
+    end_token: StreamToken | None
+    """
+    A token corresponding to the end of chunk. This token can be passed back to this
+    endpoint to request further events.
+
+    If no further events are available (either because we have reached the start of the
+    timeline, or because the user does not have permission to see any more events), this
+    property is omitted from the response.
+    """
+
+
 class PaginationHandler:
     """Handles pagination and purge history requests.
 
@@ -92,7 +147,7 @@ class PaginationHandler:
 
         self.pagination_lock = ReadWriteLock()
         # IDs of rooms in which there currently an active purge *or delete* operation.
-        self._purges_in_progress_by_room: Set[str] = set()
+        self._purges_in_progress_by_room: set[str] = set()
         self._event_serializer = hs.get_event_client_serializer()
 
         self._retention_default_max_lifetime = (
@@ -116,10 +171,9 @@ class PaginationHandler:
                 logger.info("Setting up purge job with config: %s", job)
 
                 self.clock.looping_call(
-                    run_as_background_process,
-                    job.interval,
+                    self.hs.run_as_background_process,
+                    Duration(milliseconds=job.interval),
                     "purge_history_for_rooms_in_range",
-                    self.server_name,
                     self.purge_history_for_rooms_in_range,
                     job.shortest_max_lifetime,
                     job.longest_max_lifetime,
@@ -134,7 +188,7 @@ class PaginationHandler:
         )
 
     async def purge_history_for_rooms_in_range(
-        self, min_ms: Optional[int], max_ms: Optional[int]
+        self, min_ms: int | None, max_ms: int | None
     ) -> None:
         """Purge outdated events from rooms within the given retention range.
 
@@ -244,9 +298,8 @@ class PaginationHandler:
             # We want to purge everything, including local events, and to run the purge in
             # the background so that it's not blocking any other operation apart from
             # other purges in the same room.
-            run_as_background_process(
+            self.hs.run_as_background_process(
                 PURGE_HISTORY_ACTION_NAME,
-                self.server_name,
                 self.purge_history,
                 room_id,
                 token,
@@ -282,7 +335,7 @@ class PaginationHandler:
     async def _purge_history(
         self,
         task: ScheduledTask,
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         """
         Scheduler action to purge some history of a room.
         """
@@ -311,7 +364,7 @@ class PaginationHandler:
         room_id: str,
         token: str,
         delete_local_events: bool,
-    ) -> Optional[str]:
+    ) -> str | None:
         """Carry out a history purge on a room.
 
         Args:
@@ -335,7 +388,7 @@ class PaginationHandler:
             )
             return f.getErrorMessage()
 
-    async def get_delete_task(self, delete_id: str) -> Optional[ScheduledTask]:
+    async def get_delete_task(self, delete_id: str) -> ScheduledTask | None:
         """Get the current status of an active deleting
 
         Args:
@@ -345,8 +398,8 @@ class PaginationHandler:
         return await self._task_scheduler.get_task(delete_id)
 
     async def get_delete_tasks_by_room(
-        self, room_id: str, only_active: Optional[bool] = False
-    ) -> List[ScheduledTask]:
+        self, room_id: str, only_active: bool | None = False
+    ) -> list[ScheduledTask]:
         """Get complete, failed or active delete tasks by room
 
         Args:
@@ -366,7 +419,7 @@ class PaginationHandler:
     async def _purge_room(
         self,
         task: ScheduledTask,
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         """
         Scheduler action to purge a room.
         """
@@ -418,9 +471,9 @@ class PaginationHandler:
         room_id: str,
         pagin_config: PaginationConfig,
         as_client_event: bool = True,
-        event_filter: Optional[Filter] = None,
+        event_filter: Filter | None = None,
         use_admin_priviledge: bool = False,
-    ) -> JsonDict:
+    ) -> GetMessagesResult:
         """Get messages in a room.
 
         Args:
@@ -526,7 +579,7 @@ class PaginationHandler:
             # We use a `Set` because there can be multiple events at a given depth
             # and we only care about looking at the unique continum of depths to
             # find gaps.
-            event_depths: Set[int] = {event.depth for event in events}
+            event_depths: set[int] = {event.depth for event in events}
             sorted_event_depths = sorted(event_depths)
 
             # Inspect the depths of the returned events to see if there are any gaps
@@ -604,9 +657,8 @@ class PaginationHandler:
                 # Otherwise, we can backfill in the background for eventual
                 # consistency's sake but we don't need to block the client waiting
                 # for a costly federation call and processing.
-                run_as_background_process(
+                self.hs.run_as_background_process(
                     "maybe_backfill_in_the_background",
-                    self.server_name,
                     self.hs.get_federation_handler().maybe_backfill,
                     room_id,
                     curr_topo,
@@ -620,16 +672,19 @@ class PaginationHandler:
         # In that case we do not return end, to tell the client
         # there is no need for further queries.
         if not events:
-            return {
-                "chunk": [],
-                "start": await from_token.to_string(self.store),
-            }
+            return GetMessagesResult(
+                messages_chunk=[],
+                bundled_aggregations={},
+                state=None,
+                start_token=from_token,
+                end_token=None,
+            )
 
         if event_filter:
             events = await event_filter.filter(events)
 
         if not use_admin_priviledge:
-            events = await filter_events_for_client(
+            events = await filter_and_transform_events_for_client(
                 self._storage_controllers,
                 user_id,
                 events,
@@ -639,11 +694,13 @@ class PaginationHandler:
         # if after the filter applied there are no more events
         # return immediately - but there might be more in next_token batch
         if not events:
-            return {
-                "chunk": [],
-                "start": await from_token.to_string(self.store),
-                "end": await next_token.to_string(self.store),
-            }
+            return GetMessagesResult(
+                messages_chunk=[],
+                bundled_aggregations={},
+                state=None,
+                start_token=from_token,
+                end_token=next_token,
+            )
 
         state = None
         if event_filter and event_filter.lazy_load_members and len(events) > 0:
@@ -660,42 +717,24 @@ class PaginationHandler:
 
             if state_ids:
                 state_dict = await self.store.get_events(list(state_ids.values()))
-                state = state_dict.values()
+                state = list(state_dict.values())
 
         aggregations = await self._relations_handler.get_bundled_aggregations(
             events, user_id
         )
 
-        time_now = self.clock.time_msec()
-
-        serialize_options = SerializeEventConfig(
-            as_client_event=as_client_event, requester=requester
+        return GetMessagesResult(
+            messages_chunk=events,
+            bundled_aggregations=aggregations,
+            state=state,
+            start_token=from_token,
+            end_token=next_token,
         )
 
-        chunk = {
-            "chunk": (
-                await self._event_serializer.serialize_events(
-                    events,
-                    time_now,
-                    config=serialize_options,
-                    bundle_aggregations=aggregations,
-                )
-            ),
-            "start": await from_token.to_string(self.store),
-            "end": await next_token.to_string(self.store),
-        }
-
-        if state:
-            chunk["state"] = await self._event_serializer.serialize_events(
-                state, time_now, config=serialize_options
-            )
-
-        return chunk
-
     async def _shutdown_and_purge_room(
         self,
         task: ScheduledTask,
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         """
         Scheduler action to shutdown and purge a room.
         """
@@ -706,7 +745,7 @@ class PaginationHandler:
 
         room_id = task.resource_id
 
-        async def update_result(result: Optional[JsonMapping]) -> None:
+        async def update_result(result: JsonMapping | None) -> None:
             await self._task_scheduler.update_task(task.id, result=result)
 
         shutdown_result = (
diff --git a/synapse/handlers/presence.py b/synapse/handlers/presence.py
index b253117498..4c3adca46e 100644
--- a/synapse/handlers/presence.py
+++ b/synapse/handlers/presence.py
@@ -86,14 +86,8 @@ from typing import (
     Callable,
     Collection,
     ContextManager,
-    Dict,
     Generator,
     Iterable,
-    List,
-    Optional,
-    Set,
-    Tuple,
-    Type,
 )
 
 from prometheus_client import Counter
@@ -107,7 +101,6 @@ from synapse.events.presence_router import PresenceRouter
 from synapse.logging.context import run_in_background
 from synapse.metrics import SERVER_NAME_LABEL, LaterGauge
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.replication.http.presence import (
@@ -128,6 +121,7 @@ from synapse.types import (
     get_domain_from_id,
 )
 from synapse.util.async_helpers import Linearizer
+from synapse.util.duration import Duration
 from synapse.util.metrics import Measure
 from synapse.util.wheel_timer import WheelTimer
 
@@ -173,6 +167,18 @@ state_transition_counter = Counter(
     labelnames=["locality", "from", "to", SERVER_NAME_LABEL],
 )
 
+presence_user_to_current_state_size_gauge = LaterGauge(
+    name="synapse_handlers_presence_user_to_current_state_size",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
+presence_wheel_timer_size_gauge = LaterGauge(
+    name="synapse_handlers_presence_wheel_timer_size",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
 # If a user was last active in the last LAST_ACTIVE_GRANULARITY, consider them
 # "currently_active"
 LAST_ACTIVE_GRANULARITY = 60 * 1000
@@ -198,7 +204,7 @@ EXTERNAL_PROCESS_EXPIRY = 5 * 60 * 1000
 
 # Delay before a worker tells the presence handler that a user has stopped
 # syncing.
-UPDATE_SYNCING_USERS_MS = 10 * 1000
+UPDATE_SYNCING_USERS = Duration(seconds=10)
 
 assert LAST_ACTIVE_GRANULARITY < IDLE_TIMER
 
@@ -225,7 +231,7 @@ class BasePresenceHandler(abc.ABC):
 
         self._federation_queue = PresenceFederationQueue(hs, self)
 
-        self.VALID_PRESENCE: Tuple[str, ...] = (
+        self.VALID_PRESENCE: tuple[str, ...] = (
             PresenceState.ONLINE,
             PresenceState.UNAVAILABLE,
             PresenceState.OFFLINE,
@@ -242,7 +248,7 @@ class BasePresenceHandler(abc.ABC):
     async def user_syncing(
         self,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         affect_presence: bool,
         presence_state: str,
     ) -> ContextManager[None]:
@@ -265,7 +271,7 @@ class BasePresenceHandler(abc.ABC):
     @abc.abstractmethod
     def get_currently_syncing_users_for_replication(
         self,
-    ) -> Iterable[Tuple[str, Optional[str]]]:
+    ) -> Iterable[tuple[str, str | None]]:
         """Get an iterable of syncing users and devices on this worker, to send to the presence handler
 
         This is called when a replication connection is established. It should return
@@ -282,7 +288,7 @@ class BasePresenceHandler(abc.ABC):
 
     async def get_states(
         self, target_user_ids: Iterable[str]
-    ) -> List[UserPresenceState]:
+    ) -> list[UserPresenceState]:
         """Get the presence state for users."""
 
         updates_d = await self.current_state_for_users(target_user_ids)
@@ -295,7 +301,7 @@ class BasePresenceHandler(abc.ABC):
 
     async def current_state_for_users(
         self, user_ids: Iterable[str]
-    ) -> Dict[str, UserPresenceState]:
+    ) -> dict[str, UserPresenceState]:
         """Get the current presence state for multiple users.
 
         Returns:
@@ -334,7 +340,7 @@ class BasePresenceHandler(abc.ABC):
     async def set_state(
         self,
         target_user: UserID,
-        device_id: Optional[str],
+        device_id: str | None,
         state: JsonDict,
         force_notify: bool = False,
         is_sync: bool = False,
@@ -354,7 +360,7 @@ class BasePresenceHandler(abc.ABC):
 
     @abc.abstractmethod
     async def bump_presence_active_time(
-        self, user: UserID, device_id: Optional[str]
+        self, user: UserID, device_id: str | None
     ) -> None:
         """We've seen the user do something that indicates they're interacting
         with the app.
@@ -364,7 +370,7 @@ class BasePresenceHandler(abc.ABC):
         self,
         process_id: str,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         is_syncing: bool,
         sync_time_msec: int,
     ) -> None:
@@ -406,7 +412,7 @@ class BasePresenceHandler(abc.ABC):
         return self._federation_queue
 
     async def maybe_send_presence_to_interested_destinations(
-        self, states: List[UserPresenceState]
+        self, states: list[UserPresenceState]
     ) -> None:
         """If this instance is a federation sender, send the states to all
         destinations that are interested. Filters out any states for remote
@@ -490,9 +496,9 @@ class _NullContextManager(ContextManager[None]):
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_val: Optional[BaseException],
-        exc_tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
     ) -> None:
         pass
 
@@ -511,33 +517,27 @@ class WorkerPresenceHandler(BasePresenceHandler):
 
         # The number of ongoing syncs on this process, by (user ID, device ID).
         # Empty if _presence_enabled is false.
-        self._user_device_to_num_current_syncs: Dict[
-            Tuple[str, Optional[str]], int
-        ] = {}
+        self._user_device_to_num_current_syncs: dict[tuple[str, str | None], int] = {}
 
         self.notifier = hs.get_notifier()
         self.instance_id = hs.get_instance_id()
 
         # (user_id, device_id) -> last_sync_ms. Lists the devices that have stopped
         # syncing but we haven't notified the presence writer of that yet
-        self._user_devices_going_offline: Dict[Tuple[str, Optional[str]], int] = {}
+        self._user_devices_going_offline: dict[tuple[str, str | None], int] = {}
 
         self._bump_active_client = ReplicationBumpPresenceActiveTime.make_client(hs)
         self._set_state_client = ReplicationPresenceSetState.make_client(hs)
 
-        self._send_stop_syncing_loop = self.clock.looping_call(
-            self.send_stop_syncing, UPDATE_SYNCING_USERS_MS
-        )
-
-        hs.get_reactor().addSystemEventTrigger(
-            "before",
-            "shutdown",
-            run_as_background_process,
-            "generic_presence.on_shutdown",
-            self.server_name,
-            self._on_shutdown,
+        self.clock.looping_call(self.send_stop_syncing, UPDATE_SYNCING_USERS)
+
+        hs.register_async_shutdown_handler(
+            phase="before",
+            eventType="shutdown",
+            shutdown_func=self._on_shutdown,
         )
 
+    @wrap_as_background_process("WorkerPresenceHandler._on_shutdown")
     async def _on_shutdown(self) -> None:
         if self._track_presence:
             self.hs.get_replication_command_handler().send_command(
@@ -547,7 +547,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
     def send_user_sync(
         self,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         is_syncing: bool,
         last_sync_ms: int,
     ) -> None:
@@ -556,7 +556,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
                 self.instance_id, user_id, device_id, is_syncing, last_sync_ms
             )
 
-    def mark_as_coming_online(self, user_id: str, device_id: Optional[str]) -> None:
+    def mark_as_coming_online(self, user_id: str, device_id: str | None) -> None:
         """A user has started syncing. Send a UserSync to the presence writer,
         unless they had recently stopped syncing.
         """
@@ -566,7 +566,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
             # were offline
             self.send_user_sync(user_id, device_id, True, self.clock.time_msec())
 
-    def mark_as_going_offline(self, user_id: str, device_id: Optional[str]) -> None:
+    def mark_as_going_offline(self, user_id: str, device_id: str | None) -> None:
         """A user has stopped syncing. We wait before notifying the presence
         writer as its likely they'll come back soon. This allows us to avoid
         sending a stopped syncing immediately followed by a started syncing
@@ -582,14 +582,14 @@ class WorkerPresenceHandler(BasePresenceHandler):
         for (user_id, device_id), last_sync_ms in list(
             self._user_devices_going_offline.items()
         ):
-            if now - last_sync_ms > UPDATE_SYNCING_USERS_MS:
+            if now - last_sync_ms > UPDATE_SYNCING_USERS.as_millis():
                 self._user_devices_going_offline.pop((user_id, device_id), None)
                 self.send_user_sync(user_id, device_id, False, last_sync_ms)
 
     async def user_syncing(
         self,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         affect_presence: bool,
         presence_state: str,
     ) -> ContextManager[None]:
@@ -638,7 +638,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
         return _user_syncing()
 
     async def notify_from_replication(
-        self, states: List[UserPresenceState], stream_id: int
+        self, states: list[UserPresenceState], stream_id: int
     ) -> None:
         parties = await get_interested_parties(self.store, self.presence_router, states)
         room_ids_to_states, users_to_states = parties
@@ -697,7 +697,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
 
     def get_currently_syncing_users_for_replication(
         self,
-    ) -> Iterable[Tuple[str, Optional[str]]]:
+    ) -> Iterable[tuple[str, str | None]]:
         return [
             user_id_device_id
             for user_id_device_id, count in self._user_device_to_num_current_syncs.items()
@@ -707,7 +707,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
     async def set_state(
         self,
         target_user: UserID,
-        device_id: Optional[str],
+        device_id: str | None,
         state: JsonDict,
         force_notify: bool = False,
         is_sync: bool = False,
@@ -746,7 +746,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
         )
 
     async def bump_presence_active_time(
-        self, user: UserID, device_id: Optional[str]
+        self, user: UserID, device_id: str | None
     ) -> None:
         """We've seen the user do something that indicates they're interacting
         with the app.
@@ -767,9 +767,7 @@ class WorkerPresenceHandler(BasePresenceHandler):
 class PresenceHandler(BasePresenceHandler):
     def __init__(self, hs: "HomeServer"):
         super().__init__(hs)
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
         self.wheel_timer: WheelTimer[str] = WheelTimer()
         self.notifier = hs.get_notifier()
 
@@ -779,16 +777,14 @@ class PresenceHandler(BasePresenceHandler):
             EduTypes.PRESENCE, self.incoming_presence
         )
 
-        LaterGauge(
-            name="synapse_handlers_presence_user_to_current_state_size",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {(self.server_name,): len(self.user_to_current_state)},
+        presence_user_to_current_state_size_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {(self.server_name,): len(self.user_to_current_state)},
         )
 
         # The per-device presence state, maps user to devices to per-device presence state.
-        self._user_to_device_to_current_state: Dict[
-            str, Dict[Optional[str], UserDevicePresenceState]
+        self._user_to_device_to_current_state: dict[
+            str, dict[str | None, UserDevicePresenceState]
         ] = {}
 
         now = self.clock.time_msec()
@@ -830,22 +826,17 @@ class PresenceHandler(BasePresenceHandler):
 
         # Set of users who have presence in the `user_to_current_state` that
         # have not yet been persisted
-        self.unpersisted_users_changes: Set[str] = set()
+        self.unpersisted_users_changes: set[str] = set()
 
-        hs.get_reactor().addSystemEventTrigger(
-            "before",
-            "shutdown",
-            run_as_background_process,
-            "presence.on_shutdown",
-            self.server_name,
-            self._on_shutdown,
+        hs.register_async_shutdown_handler(
+            phase="before",
+            eventType="shutdown",
+            shutdown_func=self._on_shutdown,
         )
 
         # Keeps track of the number of *ongoing* syncs on this process. While
         # this is non zero a user will never go offline.
-        self._user_device_to_num_current_syncs: Dict[
-            Tuple[str, Optional[str]], int
-        ] = {}
+        self._user_device_to_num_current_syncs: dict[tuple[str, str | None], int] = {}
 
         # Keeps track of the number of *ongoing* syncs on other processes.
         #
@@ -857,36 +848,39 @@ class PresenceHandler(BasePresenceHandler):
         # we assume that all the sync requests on that process have stopped.
         # Stored as a dict from process_id to set of (user_id, device_id), and
         # a dict of process_id to millisecond timestamp last updated.
-        self.external_process_to_current_syncs: Dict[
-            str, Set[Tuple[str, Optional[str]]]
+        self.external_process_to_current_syncs: dict[
+            str, set[tuple[str, str | None]]
         ] = {}
-        self.external_process_last_updated_ms: Dict[str, int] = {}
+        self.external_process_last_updated_ms: dict[str, int] = {}
 
-        self.external_sync_linearizer = Linearizer(name="external_sync_linearizer")
+        self.external_sync_linearizer = Linearizer(
+            name="external_sync_linearizer", clock=self.clock
+        )
 
         if self._track_presence:
             # Start a LoopingCall in 30s that fires every 5s.
             # The initial delay is to allow disconnected clients a chance to
             # reconnect before we treat them as offline.
             self.clock.call_later(
-                30, self.clock.looping_call, self._handle_timeouts, 5000
+                Duration(seconds=30),
+                self.clock.looping_call,
+                self._handle_timeouts,
+                Duration(seconds=5),
             )
 
         # Presence information is persisted, whether or not it is being tracked
         # internally.
         if self._presence_enabled:
             self.clock.call_later(
-                60,
+                Duration(minutes=1),
                 self.clock.looping_call,
                 self._persist_unpersisted_changes,
-                60 * 1000,
+                Duration(minutes=1),
             )
 
-        LaterGauge(
-            name="synapse_handlers_presence_wheel_timer_size",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {(self.server_name,): len(self.wheel_timer)},
+        presence_wheel_timer_size_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {(self.server_name,): len(self.wheel_timer)},
         )
 
         # Used to handle sending of presence to newly joined users/servers
@@ -898,6 +892,7 @@ class PresenceHandler(BasePresenceHandler):
         self._event_pos = self.store.get_room_max_stream_ordering()
         self._event_processing = False
 
+    @wrap_as_background_process("PresenceHandler._on_shutdown")
     async def _on_shutdown(self) -> None:
         """Gets called when shutting down. This lets us persist any updates that
         we haven't yet persisted, e.g. updates that only changes some internal
@@ -1118,7 +1113,7 @@ class PresenceHandler(BasePresenceHandler):
         return await self._update_states(changes)
 
     async def bump_presence_active_time(
-        self, user: UserID, device_id: Optional[str]
+        self, user: UserID, device_id: str | None
     ) -> None:
         """We've seen the user do something that indicates they're interacting
         with the app.
@@ -1147,7 +1142,7 @@ class PresenceHandler(BasePresenceHandler):
         # Update the user state, this will always update last_active_ts and
         # might update the presence state.
         prev_state = await self.current_state_for_user(user_id)
-        new_fields: Dict[str, Any] = {
+        new_fields: dict[str, Any] = {
             "last_active_ts": now,
             "state": _combine_device_states(devices.values()),
         }
@@ -1157,7 +1152,7 @@ class PresenceHandler(BasePresenceHandler):
     async def user_syncing(
         self,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         affect_presence: bool = True,
         presence_state: str = PresenceState.ONLINE,
     ) -> ContextManager[None]:
@@ -1217,7 +1212,7 @@ class PresenceHandler(BasePresenceHandler):
 
     def get_currently_syncing_users_for_replication(
         self,
-    ) -> Iterable[Tuple[str, Optional[str]]]:
+    ) -> Iterable[tuple[str, str | None]]:
         # since we are the process handling presence, there is nothing to do here.
         return []
 
@@ -1225,7 +1220,7 @@ class PresenceHandler(BasePresenceHandler):
         self,
         process_id: str,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         is_syncing: bool,
         sync_time_msec: int,
     ) -> None:
@@ -1313,7 +1308,7 @@ class PresenceHandler(BasePresenceHandler):
             )
             self.external_process_last_updated_ms.pop(process_id, None)
 
-    async def _persist_and_notify(self, states: List[UserPresenceState]) -> None:
+    async def _persist_and_notify(self, states: list[UserPresenceState]) -> None:
         """Persist states in the database, poke the notifier and send to
         interested remote servers
         """
@@ -1389,7 +1384,7 @@ class PresenceHandler(BasePresenceHandler):
     async def set_state(
         self,
         target_user: UserID,
-        device_id: Optional[str],
+        device_id: str | None,
         state: JsonDict,
         force_notify: bool = False,
         is_sync: bool = False,
@@ -1473,7 +1468,7 @@ class PresenceHandler(BasePresenceHandler):
 
     async def get_all_presence_updates(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, list]], int, bool]:
+    ) -> tuple[list[tuple[int, list]], int, bool]:
         """
         Gets a list of presence update rows from between the given stream ids.
         Each row has:
@@ -1529,8 +1524,8 @@ class PresenceHandler(BasePresenceHandler):
             finally:
                 self._event_processing = False
 
-        run_as_background_process(
-            "presence.notify_new_event", self.server_name, _process_presence
+        self.hs.run_as_background_process(
+            "presence.notify_new_event", _process_presence
         )
 
     async def _unsafe_process(self) -> None:
@@ -1540,7 +1535,7 @@ class PresenceHandler(BasePresenceHandler):
                 self.clock, name="presence_delta", server_name=self.server_name
             ):
                 room_max_stream_ordering = self.store.get_room_max_stream_ordering()
-                if self._event_pos == room_max_stream_ordering:
+                if self._event_pos >= room_max_stream_ordering:
                     return
 
                 logger.debug(
@@ -1558,7 +1553,7 @@ class PresenceHandler(BasePresenceHandler):
                 # We may get multiple deltas for different rooms, but we want to
                 # handle them on a room by room basis, so we batch them up by
                 # room.
-                deltas_by_room: Dict[str, List[StateDelta]] = {}
+                deltas_by_room: dict[str, list[StateDelta]] = {}
                 for delta in deltas:
                     deltas_by_room.setdefault(delta.room_id, []).append(delta)
 
@@ -1572,7 +1567,7 @@ class PresenceHandler(BasePresenceHandler):
                     name="presence", **{SERVER_NAME_LABEL: self.server_name}
                 ).set(max_pos)
 
-    async def _handle_state_delta(self, room_id: str, deltas: List[StateDelta]) -> None:
+    async def _handle_state_delta(self, room_id: str, deltas: list[StateDelta]) -> None:
         """Process current state deltas for the room to find new joins that need
         to be handled.
         """
@@ -1836,16 +1831,16 @@ class PresenceEventSource(EventSource[int, UserPresenceState]):
     async def get_new_events(
         self,
         user: UserID,
-        from_key: Optional[int],
+        from_key: int | None,
         # Having a default limit doesn't match the EventSource API, but some
         # callers do not provide it. It is unused in this class.
         limit: int = 0,
-        room_ids: Optional[StrCollection] = None,
+        room_ids: StrCollection | None = None,
         is_guest: bool = False,
-        explicit_room_id: Optional[str] = None,
+        explicit_room_id: str | None = None,
         include_offline: bool = True,
-        service: Optional[ApplicationService] = None,
-    ) -> Tuple[List[UserPresenceState], int]:
+        service: ApplicationService | None = None,
+    ) -> tuple[list[UserPresenceState], int]:
         # The process for getting presence events are:
         #  1. Get the rooms the user is in.
         #  2. Get the list of user in the rooms.
@@ -1996,8 +1991,8 @@ class PresenceEventSource(EventSource[int, UserPresenceState]):
         self,
         user_id: str,
         include_offline: bool,
-        from_key: Optional[int] = None,
-    ) -> List[UserPresenceState]:
+        from_key: int | None = None,
+    ) -> list[UserPresenceState]:
         """
         Computes the presence updates a user should receive.
 
@@ -2054,7 +2049,7 @@ class PresenceEventSource(EventSource[int, UserPresenceState]):
 
     def _filter_offline_presence_state(
         self, presence_updates: Iterable[UserPresenceState]
-    ) -> List[UserPresenceState]:
+    ) -> list[UserPresenceState]:
         """Given an iterable containing user presence updates, return a list with any offline
         presence states removed.
 
@@ -2075,12 +2070,12 @@ class PresenceEventSource(EventSource[int, UserPresenceState]):
 
 
 def handle_timeouts(
-    user_states: List[UserPresenceState],
+    user_states: list[UserPresenceState],
     is_mine_fn: Callable[[str], bool],
-    syncing_user_devices: AbstractSet[Tuple[str, Optional[str]]],
-    user_to_devices: Dict[str, Dict[Optional[str], UserDevicePresenceState]],
+    syncing_user_devices: AbstractSet[tuple[str, str | None]],
+    user_to_devices: dict[str, dict[str | None, UserDevicePresenceState]],
     now: int,
-) -> List[UserPresenceState]:
+) -> list[UserPresenceState]:
     """Checks the presence of users that have timed out and updates as
     appropriate.
 
@@ -2116,10 +2111,10 @@ def handle_timeouts(
 def handle_timeout(
     state: UserPresenceState,
     is_mine: bool,
-    syncing_device_ids: AbstractSet[Tuple[str, Optional[str]]],
-    user_devices: Dict[Optional[str], UserDevicePresenceState],
+    syncing_device_ids: AbstractSet[tuple[str, str | None]],
+    user_devices: dict[str | None, UserDevicePresenceState],
     now: int,
-) -> Optional[UserPresenceState]:
+) -> UserPresenceState | None:
     """Checks the presence of the user to see if any of the timers have elapsed
 
     Args:
@@ -2214,7 +2209,7 @@ def handle_update(
     wheel_timer: WheelTimer,
     now: int,
     persist: bool,
-) -> Tuple[UserPresenceState, bool, bool]:
+) -> tuple[UserPresenceState, bool, bool]:
     """Given a presence update:
         1. Add any appropriate timers.
         2. Check if we should notify anyone.
@@ -2340,8 +2335,8 @@ def _combine_device_states(
 
 
 async def get_interested_parties(
-    store: DataStore, presence_router: PresenceRouter, states: List[UserPresenceState]
-) -> Tuple[Dict[str, List[UserPresenceState]], Dict[str, List[UserPresenceState]]]:
+    store: DataStore, presence_router: PresenceRouter, states: list[UserPresenceState]
+) -> tuple[dict[str, list[UserPresenceState]], dict[str, list[UserPresenceState]]]:
     """Given a list of states return which entities (rooms, users)
     are interested in the given states.
 
@@ -2354,8 +2349,8 @@ async def get_interested_parties(
         A 2-tuple of `(room_ids_to_states, users_to_states)`,
         with each item being a dict of `entity_name` -> `[UserPresenceState]`
     """
-    room_ids_to_states: Dict[str, List[UserPresenceState]] = {}
-    users_to_states: Dict[str, List[UserPresenceState]] = {}
+    room_ids_to_states: dict[str, list[UserPresenceState]] = {}
+    users_to_states: dict[str, list[UserPresenceState]] = {}
     for state in states:
         room_ids = await store.get_rooms_for_user(state.user_id)
         for room_id in room_ids:
@@ -2378,8 +2373,8 @@ async def get_interested_parties(
 async def get_interested_remotes(
     store: DataStore,
     presence_router: PresenceRouter,
-    states: List[UserPresenceState],
-) -> List[Tuple[StrCollection, Collection[UserPresenceState]]]:
+    states: list[UserPresenceState],
+) -> list[tuple[StrCollection, Collection[UserPresenceState]]]:
     """Given a list of presence states figure out which remote servers
     should be sent which.
 
@@ -2393,14 +2388,14 @@ async def get_interested_remotes(
     Returns:
         A map from destinations to presence states to send to that destination.
     """
-    hosts_and_states: List[Tuple[StrCollection, Collection[UserPresenceState]]] = []
+    hosts_and_states: list[tuple[StrCollection, Collection[UserPresenceState]]] = []
 
     # First we look up the rooms each user is in (as well as any explicit
     # subscriptions), then for each distinct room we look up the remote
     # hosts in those rooms.
     for state in states:
         room_ids = await store.get_rooms_for_user(state.user_id)
-        hosts: Set[str] = set()
+        hosts: set[str] = set()
         for room_id in room_ids:
             room_hosts = await store.get_current_hosts_in_room(room_id)
             hosts.update(room_hosts)
@@ -2436,7 +2431,7 @@ class PresenceFederationQueue:
     _KEEP_ITEMS_IN_QUEUE_FOR_MS = 5 * 60 * 1000
 
     # How often to check if we can expire entries from the queue.
-    _CLEAR_ITEMS_EVERY_MS = 60 * 1000
+    _CLEAR_ITEMS_EVERY_MS = Duration(minutes=1)
 
     def __init__(self, hs: "HomeServer", presence_handler: BasePresenceHandler):
         self._clock = hs.get_clock()
@@ -2469,12 +2464,12 @@ class PresenceFederationQueue:
         # stream_id, destinations, user_ids)`. We don't store the full states
         # for efficiency, and remote workers will already have the full states
         # cached.
-        self._queue: List[Tuple[int, int, StrCollection, Set[str]]] = []
+        self._queue: list[tuple[int, int, StrCollection, set[str]]] = []
 
         self._next_id = 1
 
         # Map from instance name to current token
-        self._current_tokens: Dict[str, int] = {}
+        self._current_tokens: dict[str, int] = {}
 
         if self._queue_presence_updates:
             self._clock.looping_call(self._clear_queue, self._CLEAR_ITEMS_EVERY_MS)
@@ -2543,7 +2538,7 @@ class PresenceFederationQueue:
         from_token: int,
         upto_token: int,
         target_row_count: int,
-    ) -> Tuple[List[Tuple[int, Tuple[str, str]]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple[str, str]]], int, bool]:
         """Get all the updates between the two tokens.
 
         We return rows in the form of `(destination, user_id)` to keep the size
@@ -2579,7 +2574,7 @@ class PresenceFederationQueue:
         # handle the case where `from_token` stream ID has already been dropped.
         start_idx = max(from_token + 1 - self._next_id, -len(self._queue))
 
-        to_send: List[Tuple[int, Tuple[str, str]]] = []
+        to_send: list[tuple[int, tuple[str, str]]] = []
         limited = False
         new_id = upto_token
         for _, stream_id, destinations, user_ids in self._queue[start_idx:]:
@@ -2627,7 +2622,7 @@ class PresenceFederationQueue:
         if not self._federation:
             return
 
-        hosts_to_users: Dict[str, Set[str]] = {}
+        hosts_to_users: dict[str, set[str]] = {}
         for row in rows:
             hosts_to_users.setdefault(row.destination, set()).add(row.user_id)
 
diff --git a/synapse/handlers/profile.py b/synapse/handlers/profile.py
index dbff28e7fb..d123bcdd36 100644
--- a/synapse/handlers/profile.py
+++ b/synapse/handlers/profile.py
@@ -20,7 +20,10 @@
 #
 import logging
 import random
-from typing import TYPE_CHECKING, List, Optional, Union
+from bisect import bisect_right
+from typing import TYPE_CHECKING
+
+from twisted.internet.defer import CancelledError
 
 from synapse.api.constants import ProfileFields
 from synapse.api.errors import (
@@ -32,8 +35,19 @@ from synapse.api.errors import (
     SynapseError,
 )
 from synapse.storage.databases.main.media_repository import LocalMedia, RemoteMedia
-from synapse.types import JsonDict, JsonValue, Requester, UserID, create_requester
+from synapse.storage.roommember import ProfileInfo
+from synapse.types import (
+    JsonDict,
+    JsonMapping,
+    JsonValue,
+    Requester,
+    ScheduledTask,
+    TaskStatus,
+    UserID,
+    create_requester,
+)
 from synapse.util.caches.descriptors import cached
+from synapse.util.duration import Duration
 from synapse.util.stringutils import parse_and_validate_mxc_uri
 
 if TYPE_CHECKING:
@@ -45,6 +59,8 @@ MAX_DISPLAYNAME_LEN = 256
 MAX_AVATAR_URL_LEN = 1000
 # Field name length is specced at 255 bytes.
 MAX_CUSTOM_FIELD_LEN = 255
+UPDATE_JOIN_STATES_ACTION_NAME = "update_join_states"
+UPDATE_JOIN_STATES_LOCK_NAME = "update_join_states_lock"
 
 
 class ProfileHandler:
@@ -56,8 +72,8 @@ class ProfileHandler:
 
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname  # nb must be called this for @cached
+        self.clock = hs.get_clock()  # nb must be called this for @cached
         self.store = hs.get_datastores().main
-        self.clock = hs.get_clock()
         self.hs = hs
 
         self.federation = hs.get_federation_client()
@@ -68,8 +84,8 @@ class ProfileHandler:
         self.user_directory_handler = hs.get_user_directory_handler()
         self.request_ratelimiter = hs.get_request_ratelimiter()
 
-        self.max_avatar_size: Optional[int] = hs.config.server.max_avatar_size
-        self.allowed_avatar_mimetypes: Optional[List[str]] = (
+        self.max_avatar_size: int | None = hs.config.server.max_avatar_size
+        self.allowed_avatar_mimetypes: list[str] | None = (
             hs.config.server.allowed_avatar_mimetypes
         )
 
@@ -77,6 +93,12 @@ class ProfileHandler:
 
         self._third_party_rules = hs.get_module_api_callbacks().third_party_event_rules
 
+        self._task_scheduler = hs.get_task_scheduler()
+        self._task_scheduler.register_action(
+            self._update_join_states_task, UPDATE_JOIN_STATES_ACTION_NAME
+        )
+        self._worker_locks = hs.get_worker_locks_handler()
+
     async def get_profile(self, user_id: str, ignore_backoff: bool = True) -> JsonDict:
         """
         Get a user's profile as a JSON dictionary.
@@ -133,7 +155,7 @@ class ProfileHandler:
                     raise SynapseError(502, "Failed to fetch profile")
                 raise e.to_synapse_error()
 
-    async def get_displayname(self, target_user: UserID) -> Optional[str]:
+    async def get_displayname(self, target_user: UserID) -> str | None:
         """
         Fetch a user's display name from their profile.
 
@@ -172,18 +194,24 @@ class ProfileHandler:
         target_user: UserID,
         requester: Requester,
         new_displayname: str,
+        *,
         by_admin: bool = False,
-        deactivation: bool = False,
         propagate: bool = True,
     ) -> None:
         """Set the displayname of a user
 
+        Preconditions:
+        - This must NOT be called as part of deactivating the user, because we will
+          notify modules about the change whilst claiming it is not related
+          to user deactivation and we will also (if `propagate=True`) send
+          updates into rooms, which could cause rooms to be accidentally joined
+          after the deactivated user has left them.
+
         Args:
             target_user: the user whose displayname is to be changed.
             requester: The user attempting to make this change.
             new_displayname: The displayname to give this user.
             by_admin: Whether this change was made by an administrator.
-            deactivation: Whether this change was made while deactivating the user.
             propagate: Whether this change also applies to the user's membership events.
         """
         if not self.hs.is_mine(target_user):
@@ -211,7 +239,7 @@ class ProfileHandler:
                 400, "Displayname is too long (max %i)" % (MAX_DISPLAYNAME_LEN,)
             )
 
-        displayname_to_set: Optional[str] = new_displayname.strip()
+        displayname_to_set: str | None = new_displayname.strip()
         if new_displayname == "":
             displayname_to_set = None
 
@@ -227,18 +255,19 @@ class ProfileHandler:
         await self.store.set_profile_displayname(target_user, displayname_to_set)
 
         profile = await self.store.get_profileinfo(target_user)
+
         await self.user_directory_handler.handle_local_profile_change(
             target_user.to_string(), profile
         )
 
         await self._third_party_rules.on_profile_update(
-            target_user.to_string(), profile, by_admin, deactivation
+            target_user.to_string(), profile, by_admin, deactivation=False
         )
 
         if propagate:
             await self._update_join_states(requester, target_user)
 
-    async def get_avatar_url(self, target_user: UserID) -> Optional[str]:
+    async def get_avatar_url(self, target_user: UserID) -> str | None:
         """
         Fetch a user's avatar URL from their profile.
 
@@ -276,18 +305,24 @@ class ProfileHandler:
         target_user: UserID,
         requester: Requester,
         new_avatar_url: str,
+        *,
         by_admin: bool = False,
-        deactivation: bool = False,
         propagate: bool = True,
     ) -> None:
         """Set a new avatar URL for a user.
 
+        Preconditions:
+        - This must NOT be called as part of deactivating the user, because we will
+          notify modules about the change whilst claiming it is not related
+          to user deactivation and we will also (if `propagate=True`) send
+          updates into rooms, which could cause rooms to be accidentally joined
+          after the deactivated user has left them.
+
         Args:
             target_user: the user whose avatar URL is to be changed.
             requester: The user attempting to make this change.
             new_avatar_url: The avatar URL to give this user.
             by_admin: Whether this change was made by an administrator.
-            deactivation: Whether this change was made while deactivating the user.
             propagate: Whether this change also applies to the user's membership events.
         """
         if not self.hs.is_mine(target_user):
@@ -316,7 +351,7 @@ class ProfileHandler:
         if not await self.check_avatar_size_and_mime_type(new_avatar_url):
             raise SynapseError(403, "This avatar is not allowed", Codes.FORBIDDEN)
 
-        avatar_url_to_set: Optional[str] = new_avatar_url
+        avatar_url_to_set: str | None = new_avatar_url
         if new_avatar_url == "":
             avatar_url_to_set = None
 
@@ -329,17 +364,79 @@ class ProfileHandler:
         await self.store.set_profile_avatar_url(target_user, avatar_url_to_set)
 
         profile = await self.store.get_profileinfo(target_user)
+
         await self.user_directory_handler.handle_local_profile_change(
             target_user.to_string(), profile
         )
 
         await self._third_party_rules.on_profile_update(
-            target_user.to_string(), profile, by_admin, deactivation
+            target_user.to_string(), profile, by_admin, deactivation=False
         )
 
         if propagate:
             await self._update_join_states(requester, target_user)
 
+    async def delete_profile_upon_deactivation(
+        self,
+        target_user: UserID,
+        requester: Requester,
+        by_admin: bool = False,
+    ) -> None:
+        """
+        Clear the user's profile upon user deactivation (specifically, when user erasure is needed).
+
+        This includes the displayname, avatar_url, all custom profile fields.
+
+        The user directory is NOT updated in any way; it is the caller's responsibility to remove
+        the user from the user directory.
+
+        Rooms' join states are NOT updated in any way; it is the caller's responsibility to soon
+        **leave** the room on the user's behalf, so there's no point sending new join events into
+        rooms to propagate the profile deletion.
+        See the `users_pending_deactivation` table and the associated user parter loop.
+        """
+        if not self.hs.is_mine(target_user):
+            raise SynapseError(400, "User is not hosted on this homeserver")
+
+        # Prevent users from deactivating anyone but themselves,
+        # except for admins who can deactivate anyone.
+        if not by_admin and target_user != requester.user:
+            # It's a little strange to have this check here, but given all the sibling
+            # methods have these checks, it'd be even stranger to be inconsistent and not
+            # have it.
+            raise AuthError(400, "Cannot remove another user's profile")
+
+        if not by_admin:
+            current_profile = await self.store.get_profileinfo(target_user)
+            if not self.hs.config.registration.enable_set_displayname:
+                if current_profile.display_name:
+                    # SUSPICIOUS: It seems strange to block deactivation on this,
+                    # though this is preserving previous behaviour.
+                    raise SynapseError(
+                        400,
+                        "Changing display name is disabled on this server",
+                        Codes.FORBIDDEN,
+                    )
+
+            if not self.hs.config.registration.enable_set_avatar_url:
+                if current_profile.avatar_url:
+                    # SUSPICIOUS: It seems strange to block deactivation on this,
+                    # though this is preserving previous behaviour.
+                    raise SynapseError(
+                        400,
+                        "Changing avatar is disabled on this server",
+                        Codes.FORBIDDEN,
+                    )
+
+        await self.store.delete_profile(target_user)
+
+        await self._third_party_rules.on_profile_update(
+            target_user.to_string(),
+            ProfileInfo(None, None),
+            by_admin,
+            deactivation=True,
+        )
+
     @cached()
     async def check_avatar_size_and_mime_type(self, mxc: str) -> bool:
         """Check that the size and content type of the avatar at the given MXC URI are
@@ -367,9 +464,9 @@ class ProfileHandler:
             server_name = host
 
         if self._is_mine_server_name(server_name):
-            media_info: Optional[
-                Union[LocalMedia, RemoteMedia]
-            ] = await self.store.get_local_media(media_id)
+            media_info: (
+                LocalMedia | RemoteMedia | None
+            ) = await self.store.get_local_media(media_id)
         else:
             media_info = await self.store.get_cached_remote_media(server_name, media_id)
 
@@ -461,18 +558,22 @@ class ProfileHandler:
         requester: Requester,
         field_name: str,
         new_value: JsonValue,
+        *,
         by_admin: bool = False,
-        deactivation: bool = False,
     ) -> None:
         """Set a new profile field for a user.
 
+        Preconditions:
+        - This must NOT be called as part of deactivating the user, because we will
+          notify modules about the change whilst claiming it is not related
+          to user deactivation.
+
         Args:
             target_user: the user whose profile is to be changed.
             requester: The user attempting to make this change.
             field_name: The name of the profile field to update.
             new_value: The new field value for this user.
             by_admin: Whether this change was made by an administrator.
-            deactivation: Whether this change was made while deactivating the user.
         """
         if not self.hs.is_mine(target_user):
             raise SynapseError(400, "User is not hosted on this homeserver")
@@ -485,7 +586,7 @@ class ProfileHandler:
         # Custom fields do not propagate into the user directory *or* rooms.
         profile = await self.store.get_profileinfo(target_user)
         await self._third_party_rules.on_profile_update(
-            target_user.to_string(), profile, by_admin, deactivation
+            target_user.to_string(), profile, by_admin, deactivation=False
         )
 
     async def delete_profile_field(
@@ -493,17 +594,21 @@ class ProfileHandler:
         target_user: UserID,
         requester: Requester,
         field_name: str,
+        *,
         by_admin: bool = False,
-        deactivation: bool = False,
     ) -> None:
         """Delete a field from a user's profile.
 
+        Preconditions:
+        - This must NOT be called as part of deactivating the user, because we will
+          notify modules about the change whilst claiming it is not related
+          to user deactivation.
+
         Args:
             target_user: the user whose profile is to be changed.
             requester: The user attempting to make this change.
             field_name: The name of the profile field to remove.
             by_admin: Whether this change was made by an administrator.
-            deactivation: Whether this change was made while deactivating the user.
         """
         if not self.hs.is_mine(target_user):
             raise SynapseError(400, "User is not hosted on this homeserver")
@@ -516,7 +621,7 @@ class ProfileHandler:
         # Custom fields do not propagate into the user directory *or* rooms.
         profile = await self.store.get_profileinfo(target_user)
         await self._third_party_rules.on_profile_update(
-            target_user.to_string(), profile, by_admin, deactivation
+            target_user.to_string(), profile, by_admin, deactivation=False
         )
 
     async def on_profile_query(self, args: JsonDict) -> JsonDict:
@@ -583,10 +688,56 @@ class ProfileHandler:
         # Do not actually update the room state for shadow-banned users.
         if requester.shadow_banned:
             # We randomly sleep a bit just to annoy the requester.
-            await self.clock.sleep(random.randint(1, 10))
+            await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
             return
 
-        room_ids = await self.store.get_rooms_for_user(target_user.to_string())
+        target_user_str = target_user.to_string()
+
+        # Cancel any ongoing profile membership updates for this user,
+        # and start a new one.
+        async with self._worker_locks.acquire_lock(
+            UPDATE_JOIN_STATES_LOCK_NAME,
+            target_user_str,
+        ):
+            tasks_to_cancel = await self._task_scheduler.get_tasks(
+                actions=[UPDATE_JOIN_STATES_ACTION_NAME],
+                resource_id=target_user_str,
+                statuses=[TaskStatus.ACTIVE, TaskStatus.SCHEDULED],
+            )
+            assert len(tasks_to_cancel) <= 1, "Expected at most one task to cancel"
+            for task in tasks_to_cancel:
+                await self._task_scheduler.cancel_task(task.id)
+
+            await self._task_scheduler.schedule_task(
+                UPDATE_JOIN_STATES_ACTION_NAME,
+                resource_id=target_user_str,
+                params={
+                    "requester_authenticated_entity": requester.authenticated_entity,
+                },
+            )
+
+    async def _update_join_states_task(
+        self,
+        task: ScheduledTask,
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
+        assert task.resource_id
+        assert task.params
+
+        target_user = UserID.from_string(task.resource_id)
+        room_ids = sorted(await self.store.get_rooms_for_user(target_user.to_string()))
+
+        last_room_id = task.result.get("last_room_id", None) if task.result else None
+
+        if last_room_id:
+            # Filter out room IDs that have already been handled
+            # by finding the first room ID greater than the last handled room ID
+            # and slicing the list from that point onwards.
+            room_ids = room_ids[bisect_right(room_ids, last_room_id) :]
+
+        requester = create_requester(
+            user_id=target_user,
+            authenticated_entity=task.params.get("requester_authenticated_entity"),
+        )
 
         for room_id in room_ids:
             handler = self.hs.get_room_member_handler()
@@ -600,13 +751,20 @@ class ProfileHandler:
                     "join",  # We treat a profile update like a join.
                     ratelimit=False,  # Try to hide that these events aren't atomic.
                 )
+            except CancelledError as e:
+                raise e
             except Exception as e:
                 logger.warning(
                     "Failed to update join event for room %s - %s", room_id, str(e)
                 )
+            await self._task_scheduler.update_task(
+                task.id, result={"last_room_id": room_id}
+            )
+
+        return TaskStatus.COMPLETE, None, None
 
     async def check_profile_query_allowed(
-        self, target_user: UserID, requester: Optional[UserID] = None
+        self, target_user: UserID, requester: UserID | None = None
     ) -> None:
         """Checks whether a profile query is allowed. If the
         'require_auth_for_profile_requests' config flag is set to True and a
diff --git a/synapse/handlers/push_rules.py b/synapse/handlers/push_rules.py
index 4ef6a04c51..746c712bac 100644
--- a/synapse/handlers/push_rules.py
+++ b/synapse/handlers/push_rules.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import TYPE_CHECKING, Any, Dict, List, Optional, Union
+from typing import TYPE_CHECKING, Any
 
 import attr
 
@@ -40,7 +40,7 @@ class RuleSpec:
     scope: str
     template: str
     rule_id: str
-    attr: Optional[str]
+    attr: str | None
 
 
 class PushRulesHandler:
@@ -51,7 +51,7 @@ class PushRulesHandler:
         self._main_store = hs.get_datastores().main
 
     async def set_rule_attr(
-        self, user_id: str, spec: RuleSpec, val: Union[bool, JsonDict]
+        self, user_id: str, spec: RuleSpec, val: bool | JsonDict
     ) -> None:
         """Set an attribute (enabled or actions) on an existing push rule.
 
@@ -127,7 +127,7 @@ class PushRulesHandler:
 
     async def push_rules_for_user(
         self, user: UserID
-    ) -> Dict[str, Dict[str, List[Dict[str, Any]]]]:
+    ) -> dict[str, dict[str, list[dict[str, Any]]]]:
         """
         Push rules aren't really account data, but get formatted as such for /sync.
         """
@@ -137,7 +137,7 @@ class PushRulesHandler:
         return rules
 
 
-def check_actions(actions: List[Union[str, JsonDict]]) -> None:
+def check_actions(actions: list[str | JsonDict]) -> None:
     """Check if the given actions are spec compliant.
 
     Args:
diff --git a/synapse/handlers/read_marker.py b/synapse/handlers/read_marker.py
index fb39c8e04b..85d2dd62bb 100644
--- a/synapse/handlers/read_marker.py
+++ b/synapse/handlers/read_marker.py
@@ -36,7 +36,9 @@ class ReadMarkerHandler:
     def __init__(self, hs: "HomeServer"):
         self.store = hs.get_datastores().main
         self.account_data_handler = hs.get_account_data_handler()
-        self.read_marker_linearizer = Linearizer(name="read_marker")
+        self.read_marker_linearizer = Linearizer(
+            name="read_marker", clock=hs.get_clock()
+        )
 
     async def received_client_read_marker(
         self, room_id: str, user_id: str, event_id: str
diff --git a/synapse/handlers/receipts.py b/synapse/handlers/receipts.py
index c776654d12..f6383baf0b 100644
--- a/synapse/handlers/receipts.py
+++ b/synapse/handlers/receipts.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Iterable, List, Optional, Sequence, Tuple
+from typing import TYPE_CHECKING, Iterable, Sequence
 
 from synapse.api.constants import EduTypes, ReceiptTypes
 from synapse.appservice import ApplicationService
@@ -136,10 +136,10 @@ class ReceiptsHandler:
 
         await self._handle_new_receipts(receipts)
 
-    async def _handle_new_receipts(self, receipts: List[ReadReceipt]) -> bool:
+    async def _handle_new_receipts(self, receipts: list[ReadReceipt]) -> bool:
         """Takes a list of receipts, stores them and informs the notifier."""
 
-        receipts_persisted: List[ReadReceipt] = []
+        receipts_persisted: list[ReadReceipt] = []
         for receipt in receipts:
             stream_id = await self.store.insert_receipt(
                 receipt.room_id,
@@ -180,7 +180,7 @@ class ReceiptsHandler:
         receipt_type: str,
         user_id: UserID,
         event_id: str,
-        thread_id: Optional[str],
+        thread_id: str | None,
     ) -> None:
         """Called when a client tells us a local user has read up to the given
         event_id in the room.
@@ -216,7 +216,7 @@ class ReceiptEventSource(EventSource[MultiWriterStreamToken, JsonMapping]):
     @staticmethod
     def filter_out_private_receipts(
         rooms: Sequence[JsonMapping], user_id: str
-    ) -> List[JsonMapping]:
+    ) -> list[JsonMapping]:
         """
         Filters a list of serialized receipts (as returned by /sync and /initialSync)
         and removes private read receipts of other users.
@@ -233,7 +233,7 @@ class ReceiptEventSource(EventSource[MultiWriterStreamToken, JsonMapping]):
             The same as rooms, but filtered.
         """
 
-        result: List[JsonMapping] = []
+        result: list[JsonMapping] = []
 
         # Iterate through each room's receipt content.
         for room in rooms:
@@ -285,9 +285,9 @@ class ReceiptEventSource(EventSource[MultiWriterStreamToken, JsonMapping]):
         limit: int,
         room_ids: Iterable[str],
         is_guest: bool,
-        explicit_room_id: Optional[str] = None,
-        to_key: Optional[MultiWriterStreamToken] = None,
-    ) -> Tuple[List[JsonMapping], MultiWriterStreamToken]:
+        explicit_room_id: str | None = None,
+        to_key: MultiWriterStreamToken | None = None,
+    ) -> tuple[list[JsonMapping], MultiWriterStreamToken]:
         """
         Find read receipts for given rooms (> `from_token` and <= `to_token`)
         """
@@ -313,7 +313,7 @@ class ReceiptEventSource(EventSource[MultiWriterStreamToken, JsonMapping]):
         from_key: MultiWriterStreamToken,
         to_key: MultiWriterStreamToken,
         service: ApplicationService,
-    ) -> Tuple[List[JsonMapping], MultiWriterStreamToken]:
+    ) -> tuple[list[JsonMapping], MultiWriterStreamToken]:
         """Returns a set of new read receipt events that an appservice
         may be interested in.
 
diff --git a/synapse/handlers/register.py b/synapse/handlers/register.py
index 5761a7f70b..139c14dcf4 100644
--- a/synapse/handlers/register.py
+++ b/synapse/handlers/register.py
@@ -23,7 +23,11 @@
 """Contains functions for registering clients."""
 
 import logging
-from typing import TYPE_CHECKING, Iterable, List, Optional, Tuple, TypedDict
+from typing import (
+    TYPE_CHECKING,
+    Iterable,
+    TypedDict,
+)
 
 from prometheus_client import Counter
 
@@ -101,8 +105,8 @@ def init_counters_for_auth_provider(auth_provider_id: str, server_name: str) ->
 class LoginDict(TypedDict):
     device_id: str
     access_token: str
-    valid_until_ms: Optional[int]
-    refresh_token: Optional[str]
+    valid_until_ms: int | None
+    refresh_token: str | None
 
 
 class RegistrationHandler:
@@ -155,8 +159,8 @@ class RegistrationHandler:
     async def check_username(
         self,
         localpart: str,
-        guest_access_token: Optional[str] = None,
-        assigned_user_id: Optional[str] = None,
+        guest_access_token: str | None = None,
+        assigned_user_id: str | None = None,
         inhibit_user_in_use_error: bool = False,
     ) -> None:
         if types.contains_invalid_mxid_characters(localpart):
@@ -223,19 +227,19 @@ class RegistrationHandler:
 
     async def register_user(
         self,
-        localpart: Optional[str] = None,
-        password_hash: Optional[str] = None,
-        guest_access_token: Optional[str] = None,
+        localpart: str | None = None,
+        password_hash: str | None = None,
+        guest_access_token: str | None = None,
         make_guest: bool = False,
         admin: bool = False,
-        threepid: Optional[dict] = None,
-        user_type: Optional[str] = None,
-        default_display_name: Optional[str] = None,
-        address: Optional[str] = None,
-        bind_emails: Optional[Iterable[str]] = None,
+        threepid: dict | None = None,
+        user_type: str | None = None,
+        default_display_name: str | None = None,
+        address: str | None = None,
+        bind_emails: Iterable[str] | None = None,
         by_admin: bool = False,
-        user_agent_ips: Optional[List[Tuple[str, str]]] = None,
-        auth_provider_id: Optional[str] = None,
+        user_agent_ips: list[tuple[str, str]] | None = None,
+        auth_provider_id: str | None = None,
         approved: bool = False,
     ) -> str:
         """Registers a new client on the server.
@@ -648,7 +652,7 @@ class RegistrationHandler:
 
     async def appservice_register(
         self, user_localpart: str, as_token: str
-    ) -> Tuple[str, ApplicationService]:
+    ) -> tuple[str, ApplicationService]:
         user = UserID(user_localpart, self.hs.hostname)
         user_id = user.to_string()
         service = self.store.get_app_service_by_token(as_token)
@@ -674,7 +678,7 @@ class RegistrationHandler:
         return (user_id, service)
 
     def check_user_id_not_appservice_exclusive(
-        self, user_id: str, allowed_appservice: Optional[ApplicationService] = None
+        self, user_id: str, allowed_appservice: ApplicationService | None = None
     ) -> None:
         # don't allow people to register the server notices mxid
         if self._server_notices_mxid is not None:
@@ -699,7 +703,7 @@ class RegistrationHandler:
                     errcode=Codes.EXCLUSIVE,
                 )
 
-    async def check_registration_ratelimit(self, address: Optional[str]) -> None:
+    async def check_registration_ratelimit(self, address: str | None) -> None:
         """A simple helper method to check whether the registration rate limit has been hit
         for a given IP address
 
@@ -718,14 +722,14 @@ class RegistrationHandler:
     async def register_with_store(
         self,
         user_id: str,
-        password_hash: Optional[str] = None,
+        password_hash: str | None = None,
         was_guest: bool = False,
         make_guest: bool = False,
-        appservice_id: Optional[str] = None,
-        create_profile_with_displayname: Optional[str] = None,
+        appservice_id: str | None = None,
+        create_profile_with_displayname: str | None = None,
         admin: bool = False,
-        user_type: Optional[str] = None,
-        address: Optional[str] = None,
+        user_type: str | None = None,
+        address: str | None = None,
         shadow_banned: bool = False,
         approved: bool = False,
     ) -> None:
@@ -766,14 +770,14 @@ class RegistrationHandler:
     async def register_device(
         self,
         user_id: str,
-        device_id: Optional[str],
-        initial_display_name: Optional[str],
+        device_id: str | None,
+        initial_display_name: str | None,
         is_guest: bool = False,
         is_appservice_ghost: bool = False,
-        auth_provider_id: Optional[str] = None,
+        auth_provider_id: str | None = None,
         should_issue_refresh_token: bool = False,
-        auth_provider_session_id: Optional[str] = None,
-    ) -> Tuple[str, str, Optional[int], Optional[str]]:
+        auth_provider_session_id: str | None = None,
+    ) -> tuple[str, str, int | None, str | None]:
         """Register a device for a user and generate an access token.
 
         The access token will be limited by the homeserver's session_lifetime config.
@@ -816,13 +820,13 @@ class RegistrationHandler:
     async def register_device_inner(
         self,
         user_id: str,
-        device_id: Optional[str],
-        initial_display_name: Optional[str],
+        device_id: str | None,
+        initial_display_name: str | None,
         is_guest: bool = False,
         is_appservice_ghost: bool = False,
         should_issue_refresh_token: bool = False,
-        auth_provider_id: Optional[str] = None,
-        auth_provider_session_id: Optional[str] = None,
+        auth_provider_id: str | None = None,
+        auth_provider_session_id: str | None = None,
     ) -> LoginDict:
         """Helper for register_device
 
@@ -922,7 +926,7 @@ class RegistrationHandler:
         }
 
     async def post_registration_actions(
-        self, user_id: str, auth_result: dict, access_token: Optional[str]
+        self, user_id: str, auth_result: dict, access_token: str | None
     ) -> None:
         """A user has completed registration
 
@@ -972,7 +976,7 @@ class RegistrationHandler:
         await self.post_consent_actions(user_id)
 
     async def _register_email_threepid(
-        self, user_id: str, threepid: dict, token: Optional[str]
+        self, user_id: str, threepid: dict, token: str | None
     ) -> None:
         """Add an email address as a 3pid identifier
 
diff --git a/synapse/handlers/relations.py b/synapse/handlers/relations.py
index b1158ee77d..d7d3002fbe 100644
--- a/synapse/handlers/relations.py
+++ b/synapse/handlers/relations.py
@@ -23,12 +23,8 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Collection,
-    Dict,
-    FrozenSet,
     Iterable,
-    List,
     Mapping,
-    Optional,
     Sequence,
 )
 
@@ -44,7 +40,7 @@ from synapse.storage.databases.main.relations import ThreadsNextBatch, _RelatedE
 from synapse.streams.config import PaginationConfig
 from synapse.types import JsonDict, Requester, UserID
 from synapse.util.async_helpers import gather_results
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -78,9 +74,9 @@ class BundledAggregations:
     Some values require additional processing during serialization.
     """
 
-    references: Optional[JsonDict] = None
-    replace: Optional[EventBase] = None
-    thread: Optional[_ThreadAggregation] = None
+    references: JsonDict | None = None
+    replace: EventBase | None = None
+    thread: _ThreadAggregation | None = None
 
     def __bool__(self) -> bool:
         return bool(self.references or self.replace or self.thread)
@@ -104,8 +100,8 @@ class RelationsHandler:
         pagin_config: PaginationConfig,
         recurse: bool,
         include_original_event: bool,
-        relation_type: Optional[str] = None,
-        event_type: Optional[str] = None,
+        relation_type: str | None = None,
+        event_type: str | None = None,
     ) -> JsonDict:
         """Get related events of a event, ordered by topological ordering.
 
@@ -158,7 +154,7 @@ class RelationsHandler:
             [e.event_id for e in related_events]
         )
 
-        events = await filter_events_for_client(
+        events = await filter_and_transform_events_for_client(
             self._storage_controllers,
             user_id,
             events,
@@ -212,7 +208,7 @@ class RelationsHandler:
         requester: Requester,
         event_id: str,
         initial_redaction_event: EventBase,
-        relation_types: List[str],
+        relation_types: list[str],
     ) -> None:
         """Redacts all events related to the given event ID with one of the given
         relation types.
@@ -267,7 +263,7 @@ class RelationsHandler:
                 )
 
     async def get_references_for_events(
-        self, event_ids: Collection[str], ignored_users: FrozenSet[str] = frozenset()
+        self, event_ids: Collection[str], ignored_users: frozenset[str] = frozenset()
     ) -> Mapping[str, Sequence[_RelatedEvent]]:
         """Get a list of references to the given events.
 
@@ -308,11 +304,11 @@ class RelationsHandler:
 
     async def _get_threads_for_events(
         self,
-        events_by_id: Dict[str, EventBase],
-        relations_by_id: Dict[str, str],
+        events_by_id: dict[str, EventBase],
+        relations_by_id: dict[str, str],
         user_id: str,
-        ignored_users: FrozenSet[str],
-    ) -> Dict[str, _ThreadAggregation]:
+        ignored_users: frozenset[str],
+    ) -> dict[str, _ThreadAggregation]:
         """Get the bundled aggregations for threads for the requested events.
 
         Args:
@@ -437,7 +433,7 @@ class RelationsHandler:
     @trace
     async def get_bundled_aggregations(
         self, events: Iterable[EventBase], user_id: str
-    ) -> Dict[str, BundledAggregations]:
+    ) -> dict[str, BundledAggregations]:
         """Generate bundled aggregations for events.
 
         Args:
@@ -456,7 +452,7 @@ class RelationsHandler:
         # De-duplicated events by ID to handle the same event requested multiple times.
         events_by_id = {}
         # A map of event ID to the relation in that event, if there is one.
-        relations_by_id: Dict[str, str] = {}
+        relations_by_id: dict[str, str] = {}
         for event in events:
             # State events do not get bundled aggregations.
             if event.is_state():
@@ -479,7 +475,7 @@ class RelationsHandler:
             events_by_id[event.event_id] = event
 
         # event ID -> bundled aggregation in non-serialized form.
-        results: Dict[str, BundledAggregations] = {}
+        results: dict[str, BundledAggregations] = {}
 
         # Fetch any ignored users of the requesting user.
         ignored_users = await self._main_store.ignored_users(user_id)
@@ -556,7 +552,7 @@ class RelationsHandler:
         room_id: str,
         include: ThreadsListInclude,
         limit: int = 5,
-        from_token: Optional[ThreadsNextBatch] = None,
+        from_token: ThreadsNextBatch | None = None,
     ) -> JsonDict:
         """Get related events of a event, ordered by topological ordering.
 
@@ -603,7 +599,7 @@ class RelationsHandler:
             # Limit the returned threads to those the user has participated in.
             events = [event for event in events if participated[event.event_id]]
 
-        events = await filter_events_for_client(
+        events = await filter_and_transform_events_for_client(
             self._storage_controllers,
             user_id,
             events,
diff --git a/synapse/handlers/room.py b/synapse/handlers/room.py
index 47bd139ca7..1c3489a00e 100644
--- a/synapse/handlers/room.py
+++ b/synapse/handlers/room.py
@@ -33,10 +33,6 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
-    List,
-    Optional,
-    Tuple,
     cast,
 )
 
@@ -96,9 +92,10 @@ from synapse.types.state import StateFilter
 from synapse.util import stringutils
 from synapse.util.async_helpers import concurrently_execute
 from synapse.util.caches.response_cache import ResponseCache
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
 from synapse.util.stringutils import parse_and_validate_server_name
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -112,11 +109,11 @@ FIVE_MINUTES_IN_MS = 5 * 60 * 1000
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class EventContext:
-    events_before: List[EventBase]
+    events_before: list[EventBase]
     event: EventBase
-    events_after: List[EventBase]
-    state: List[EventBase]
-    aggregations: Dict[str, BundledAggregations]
+    events_after: list[EventBase]
+    state: list[EventBase]
+    aggregations: dict[str, BundledAggregations]
     start: str
     end: str
 
@@ -143,7 +140,7 @@ class RoomCreationHandler:
         )
 
         # Room state based off defined presets
-        self._presets_dict: Dict[str, Dict[str, Any]] = {
+        self._presets_dict: dict[str, dict[str, Any]] = {
             RoomCreationPreset.PRIVATE_CHAT: {
                 "join_rules": JoinRules.INVITE,
                 "history_visibility": HistoryVisibility.SHARED,
@@ -184,11 +181,11 @@ class RoomCreationHandler:
         # If a user tries to update the same room multiple times in quick
         # succession, only process the first attempt and return its result to
         # subsequent requests
-        self._upgrade_response_cache: ResponseCache[Tuple[str, str]] = ResponseCache(
+        self._upgrade_response_cache: ResponseCache[tuple[str, str]] = ResponseCache(
             clock=hs.get_clock(),
             name="room_upgrade",
             server_name=self.server_name,
-            timeout_ms=FIVE_MINUTES_IN_MS,
+            timeout=Duration(minutes=5),
         )
         self._server_notices_mxid = hs.config.servernotices.server_notices_mxid
 
@@ -201,7 +198,7 @@ class RoomCreationHandler:
         requester: Requester,
         old_room_id: str,
         new_version: RoomVersion,
-        additional_creators: Optional[List[str]],
+        additional_creators: list[str] | None,
         auto_member: bool = False,
         ratelimit: bool = True,
     ) -> str:
@@ -339,15 +336,16 @@ class RoomCreationHandler:
         self,
         requester: Requester,
         old_room_id: str,
-        old_room: Tuple[bool, str, bool],
+        old_room: tuple[bool, str, bool],
         new_room_id: str,
         new_version: RoomVersion,
         tombstone_event: EventBase,
         tombstone_context: synapse.events.snapshot.EventContext,
-        additional_creators: Optional[List[str]],
-        creation_event_with_context: Optional[
-            Tuple[EventBase, synapse.events.snapshot.EventContext]
-        ] = None,
+        additional_creators: list[str] | None,
+        creation_event_with_context: tuple[
+            EventBase, synapse.events.snapshot.EventContext
+        ]
+        | None = None,
         auto_member: bool = False,
     ) -> str:
         """
@@ -437,7 +435,7 @@ class RoomCreationHandler:
         old_room_id: str,
         new_room_id: str,
         old_room_state: StateMap[str],
-        additional_creators: Optional[List[str]],
+        additional_creators: list[str] | None,
     ) -> None:
         """Send updated power levels in both rooms after an upgrade
 
@@ -527,9 +525,9 @@ class RoomCreationHandler:
     def _calculate_upgraded_room_creation_content(
         self,
         old_room_create_event: EventBase,
-        tombstone_event_id: Optional[str],
+        tombstone_event_id: str | None,
         new_room_version: RoomVersion,
-        additional_creators: Optional[List[str]],
+        additional_creators: list[str] | None,
     ) -> JsonDict:
         creation_content: JsonDict = {
             "room_version": new_room_version.identifier,
@@ -561,10 +559,11 @@ class RoomCreationHandler:
         new_room_id: str,
         new_room_version: RoomVersion,
         tombstone_event_id: str,
-        additional_creators: Optional[List[str]],
-        creation_event_with_context: Optional[
-            Tuple[EventBase, synapse.events.snapshot.EventContext]
-        ] = None,
+        additional_creators: list[str] | None,
+        creation_event_with_context: tuple[
+            EventBase, synapse.events.snapshot.EventContext
+        ]
+        | None = None,
         auto_member: bool = False,
     ) -> None:
         """Populate a new room based on an old room
@@ -597,10 +596,10 @@ class RoomCreationHandler:
                 new_room_version,
                 additional_creators=additional_creators,
             )
-        initial_state = {}
+        initial_state: MutableStateMap = {}
 
         # Replicate relevant room events
-        types_to_copy: List[Tuple[str, Optional[str]]] = [
+        types_to_copy: list[tuple[str, str | None]] = [
             (EventTypes.JoinRules, ""),
             (EventTypes.Name, ""),
             (EventTypes.Topic, ""),
@@ -693,14 +692,23 @@ class RoomCreationHandler:
                 additional_creators,
             )
 
-        # We construct what the body of a call to /createRoom would look like for passing
-        # to the spam checker. We don't include a preset here, as we expect the
+        # We construct a subset of what the body of a call to /createRoom would look like
+        # for passing to the spam checker. We don't include a preset here, as we expect the
         # initial state to contain everything we need.
+        # TODO: given we are upgrading, it would make sense to pass the room_version
+        # TODO: the preset might be useful too
         spam_check = await self._spam_checker_module_callbacks.user_may_create_room(
             user_id,
             {
                 "creation_content": creation_content,
-                "initial_state": list(initial_state.items()),
+                "initial_state": [
+                    {
+                        "type": state_key[0],
+                        "state_key": state_key[1],
+                        "content": event_content,
+                    }
+                    for state_key, event_content in initial_state.items()
+                ],
             },
         )
         if spam_check != self._spam_checker_module_callbacks.NOT_SPAM:
@@ -1033,9 +1041,9 @@ class RoomCreationHandler:
         requester: Requester,
         config: JsonDict,
         ratelimit: bool = True,
-        creator_join_profile: Optional[JsonDict] = None,
+        creator_join_profile: JsonDict | None = None,
         ignore_forced_encryption: bool = False,
-    ) -> Tuple[str, Optional[RoomAlias], int]:
+    ) -> tuple[str, RoomAlias | None, int]:
         """Creates a new room.
 
         Args:
@@ -1172,7 +1180,7 @@ class RoomCreationHandler:
 
         if (invite_list or invite_3pid_list) and requester.shadow_banned:
             # We randomly sleep a bit just to annoy the requester.
-            await self.clock.sleep(random.randint(1, 10))
+            await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
 
             # Allow the request to go through, but remove any associated invites.
             invite_3pid_list = []
@@ -1385,7 +1393,7 @@ class RoomCreationHandler:
         creation_content: JsonDict,
         is_public: bool,
         room_version: RoomVersion,
-    ) -> Tuple[EventBase, synapse.events.snapshot.EventContext]:
+    ) -> tuple[EventBase, synapse.events.snapshot.EventContext]:
         (
             creation_event,
             new_unpersisted_context,
@@ -1417,17 +1425,18 @@ class RoomCreationHandler:
         room_id: str,
         room_version: RoomVersion,
         room_config: JsonDict,
-        invite_list: List[str],
+        invite_list: list[str],
         initial_state: MutableStateMap,
         creation_content: JsonDict,
-        room_alias: Optional[RoomAlias] = None,
-        power_level_content_override: Optional[JsonDict] = None,
-        creator_join_profile: Optional[JsonDict] = None,
+        room_alias: RoomAlias | None = None,
+        power_level_content_override: JsonDict | None = None,
+        creator_join_profile: JsonDict | None = None,
         ignore_forced_encryption: bool = False,
-        creation_event_with_context: Optional[
-            Tuple[EventBase, synapse.events.snapshot.EventContext]
-        ] = None,
-    ) -> Tuple[int, str, int]:
+        creation_event_with_context: tuple[
+            EventBase, synapse.events.snapshot.EventContext
+        ]
+        | None = None,
+    ) -> tuple[int, str, int]:
         """Sends the initial events into a new room. Sends the room creation, membership,
         and power level events into the room sequentially, then creates and batches up the
         rest of the events to persist as a batch to the DB.
@@ -1476,7 +1485,7 @@ class RoomCreationHandler:
         depth = 1
 
         # the most recently created event
-        prev_event: List[str] = []
+        prev_event: list[str] = []
         # a map of event types, state keys -> event_ids. We collect these mappings this as events are
         # created (but not persisted to the db) to determine state for future created events
         # (as this info can't be pulled from the db)
@@ -1487,7 +1496,7 @@ class RoomCreationHandler:
             content: JsonDict,
             for_batch: bool,
             **kwargs: Any,
-        ) -> Tuple[EventBase, synapse.events.snapshot.UnpersistedEventContextBase]:
+        ) -> tuple[EventBase, synapse.events.snapshot.UnpersistedEventContextBase]:
             """
             Creates an event and associated event context.
             Args:
@@ -1783,7 +1792,7 @@ class RoomCreationHandler:
                             f"You cannot create an encrypted room. user_level ({room_admin_level}) < send_level ({encryption_level})",
                         )
 
-    def _room_preset_config(self, room_config: JsonDict) -> Tuple[str, dict]:
+    def _room_preset_config(self, room_config: JsonDict) -> tuple[str, dict]:
         # The spec says rooms should default to private visibility if
         # `visibility` is not specified.
         visibility = room_config.get("visibility", "private")
@@ -1805,9 +1814,9 @@ class RoomCreationHandler:
 
     def _remove_creators_from_pl_users_map(
         self,
-        users_map: Dict[str, int],
+        users_map: dict[str, int],
         creator: str,
-        additional_creators: Optional[List[str]],
+        additional_creators: list[str] | None,
     ) -> None:
         creators = [creator]
         if additional_creators:
@@ -1874,9 +1883,9 @@ class RoomContextHandler:
         room_id: str,
         event_id: str,
         limit: int,
-        event_filter: Optional[Filter],
+        event_filter: Filter | None,
         use_admin_priviledge: bool = False,
-    ) -> Optional[EventContext]:
+    ) -> EventContext | None:
         """Retrieves events, pagination tokens and state around a given event
         in a room.
 
@@ -1907,10 +1916,10 @@ class RoomContextHandler:
         # The user is peeking if they aren't in the room already
         is_peeking = not is_user_in_room
 
-        async def filter_evts(events: List[EventBase]) -> List[EventBase]:
+        async def filter_evts(events: list[EventBase]) -> list[EventBase]:
             if use_admin_priviledge:
                 return events
-            return await filter_events_for_client(
+            return await filter_and_transform_events_for_client(
                 self._storage_controllers,
                 user.to_string(),
                 events,
@@ -2012,7 +2021,7 @@ class TimestampLookupHandler:
         room_id: str,
         timestamp: int,
         direction: Direction,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Find the closest event to the given timestamp in the given direction.
         If we can't find an event locally or the event we have locally is next to a gap,
         it will ask other federated homeservers for an event.
@@ -2162,8 +2171,8 @@ class RoomEventSource(EventSource[RoomStreamToken, EventBase]):
         limit: int,
         room_ids: StrCollection,
         is_guest: bool,
-        explicit_room_id: Optional[str] = None,
-    ) -> Tuple[List[EventBase], RoomStreamToken]:
+        explicit_room_id: str | None = None,
+    ) -> tuple[list[EventBase], RoomStreamToken]:
         # We just ignore the key for now.
 
         to_key = self.get_current_key()
@@ -2238,11 +2247,10 @@ class RoomShutdownHandler:
         self,
         room_id: str,
         params: ShutdownRoomParams,
-        result: Optional[ShutdownRoomResponse] = None,
-        update_result_fct: Optional[
-            Callable[[Optional[JsonMapping]], Awaitable[None]]
-        ] = None,
-    ) -> Optional[ShutdownRoomResponse]:
+        result: ShutdownRoomResponse | None = None,
+        update_result_fct: Callable[[JsonMapping | None], Awaitable[None]]
+        | None = None,
+    ) -> ShutdownRoomResponse | None:
         """
         Shuts down a room. Moves all joined local users and room aliases automatically
         to a new room if `new_room_user_id` is set. Otherwise local users only
diff --git a/synapse/handlers/room_list.py b/synapse/handlers/room_list.py
index 9d4307fb07..b25fd0a1e7 100644
--- a/synapse/handlers/room_list.py
+++ b/synapse/handlers/room_list.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Any, List, Optional, Tuple
+from typing import TYPE_CHECKING, Any
 
 import attr
 import msgpack
@@ -44,6 +44,7 @@ from synapse.storage.databases.main.room import LargestRoomStats
 from synapse.types import JsonDict, JsonMapping, ThirdPartyInstanceID
 from synapse.util.caches.descriptors import _CacheContext, cached
 from synapse.util.caches.response_cache import ResponseCache
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -67,28 +68,28 @@ class RoomListHandler:
         self.hs = hs
         self.enable_room_list_search = hs.config.roomdirectory.enable_room_list_search
         self.response_cache: ResponseCache[
-            Tuple[Optional[int], Optional[str], Optional[ThirdPartyInstanceID]]
+            tuple[int | None, str | None, ThirdPartyInstanceID | None]
         ] = ResponseCache(
             clock=hs.get_clock(),
             name="room_list",
             server_name=self.server_name,
         )
         self.remote_response_cache: ResponseCache[
-            Tuple[str, Optional[int], Optional[str], bool, Optional[str]]
+            tuple[str, int | None, str | None, bool, str | None]
         ] = ResponseCache(
             clock=hs.get_clock(),
             name="remote_room_list",
             server_name=self.server_name,
-            timeout_ms=30 * 1000,
+            timeout=Duration(seconds=30),
         )
 
     async def get_local_public_room_list(
         self,
-        limit: Optional[int] = None,
-        since_token: Optional[str] = None,
-        search_filter: Optional[dict] = None,
-        network_tuple: Optional[ThirdPartyInstanceID] = EMPTY_THIRD_PARTY_ID,
-        from_federation_origin: Optional[str] = None,
+        limit: int | None = None,
+        since_token: str | None = None,
+        search_filter: dict | None = None,
+        network_tuple: ThirdPartyInstanceID | None = EMPTY_THIRD_PARTY_ID,
+        from_federation_origin: str | None = None,
     ) -> JsonDict:
         """Generate a local public room list.
 
@@ -150,10 +151,10 @@ class RoomListHandler:
     async def _get_public_room_list(
         self,
         limit: int,
-        since_token: Optional[str] = None,
-        search_filter: Optional[dict] = None,
-        network_tuple: Optional[ThirdPartyInstanceID] = EMPTY_THIRD_PARTY_ID,
-        from_federation_origin: Optional[str] = None,
+        since_token: str | None = None,
+        search_filter: dict | None = None,
+        network_tuple: ThirdPartyInstanceID | None = EMPTY_THIRD_PARTY_ID,
+        from_federation_origin: str | None = None,
     ) -> JsonDict:
         """Generate a public room list.
         Args:
@@ -175,7 +176,7 @@ class RoomListHandler:
         if since_token:
             batch_token = RoomListNextBatch.from_token(since_token)
 
-            bounds: Optional[Tuple[int, str]] = (
+            bounds: tuple[int, str] | None = (
                 batch_token.last_joined_members,
                 batch_token.last_room_id,
             )
@@ -226,7 +227,7 @@ class RoomListHandler:
             return {k: v for k, v in entry.items() if v is not None}
 
         # Build a list of up to `limit` entries.
-        room_entries: List[JsonDict] = []
+        room_entries: list[JsonDict] = []
         rooms_iterator = results if forwards else reversed(results)
 
         # Track the first and last 'considered' rooms so that we can provide correct
@@ -235,8 +236,8 @@ class RoomListHandler:
         # `len(room_entries) >= limit` and we might be left with rooms we didn't
         # 'consider' (iterate over) and we should save those rooms for the next
         # batch.
-        first_considered_room: Optional[LargestRoomStats] = None
-        last_considered_room: Optional[LargestRoomStats] = None
+        first_considered_room: LargestRoomStats | None = None
+        last_considered_room: LargestRoomStats | None = None
         cut_off_due_to_limit: bool = False
 
         for room_result in rooms_iterator:
@@ -349,7 +350,7 @@ class RoomListHandler:
         cache_context: _CacheContext,
         with_alias: bool = True,
         allow_private: bool = False,
-    ) -> Optional[JsonMapping]:
+    ) -> JsonMapping | None:
         """Returns the entry for a room
 
         Args:
@@ -455,11 +456,11 @@ class RoomListHandler:
     async def get_remote_public_room_list(
         self,
         server_name: str,
-        limit: Optional[int] = None,
-        since_token: Optional[str] = None,
-        search_filter: Optional[dict] = None,
+        limit: int | None = None,
+        since_token: str | None = None,
+        search_filter: dict | None = None,
         include_all_networks: bool = False,
-        third_party_instance_id: Optional[str] = None,
+        third_party_instance_id: str | None = None,
     ) -> JsonDict:
         """Get the public room list from remote server
 
@@ -531,11 +532,11 @@ class RoomListHandler:
     async def _get_remote_list_cached(
         self,
         server_name: str,
-        limit: Optional[int] = None,
-        since_token: Optional[str] = None,
-        search_filter: Optional[dict] = None,
+        limit: int | None = None,
+        since_token: str | None = None,
+        search_filter: dict | None = None,
         include_all_networks: bool = False,
-        third_party_instance_id: Optional[str] = None,
+        third_party_instance_id: str | None = None,
     ) -> JsonDict:
         """Wrapper around FederationClient.get_public_rooms that caches the
         result.
diff --git a/synapse/handlers/room_member.py b/synapse/handlers/room_member.py
index 5ba64912c9..b2e678e90e 100644
--- a/synapse/handlers/room_member.py
+++ b/synapse/handlers/room_member.py
@@ -23,7 +23,7 @@ import abc
 import logging
 import random
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Iterable, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Iterable
 
 from synapse import types
 from synapse.api.constants import (
@@ -49,8 +49,8 @@ from synapse.handlers.profile import MAX_AVATAR_URL_LEN, MAX_DISPLAYNAME_LEN
 from synapse.handlers.state_deltas import MatchChange, StateDeltasHandler
 from synapse.handlers.worker_lock import NEW_EVENT_DURING_PURGE_LOCK_NAME
 from synapse.logging import opentracing
+from synapse.logging.opentracing import SynapseTags, set_tag, tag_args, trace
 from synapse.metrics import SERVER_NAME_LABEL, event_processing_positions
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.http.push import ReplicationCopyPusherRestServlet
 from synapse.storage.databases.main.state_deltas import StateDelta
 from synapse.storage.invite_rule import InviteRule
@@ -67,6 +67,7 @@ from synapse.types import (
 from synapse.types.state import StateFilter
 from synapse.util.async_helpers import Linearizer
 from synapse.util.distributor import user_left_room
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -114,8 +115,12 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         if self.hs.config.server.include_profile_data_on_invite:
             self._membership_types_to_include_profile_data_in.add(Membership.INVITE)
 
-        self.member_linearizer: Linearizer = Linearizer(name="member")
-        self.member_as_limiter = Linearizer(max_count=10, name="member_as_limiter")
+        self.member_linearizer: Linearizer = Linearizer(
+            name="member", clock=hs.get_clock()
+        )
+        self.member_as_limiter = Linearizer(
+            max_count=10, name="member_as_limiter", clock=hs.get_clock()
+        )
 
         self.clock = hs.get_clock()
         self._spam_checker_module_callbacks = hs.get_module_api_callbacks().spam_checker
@@ -214,11 +219,11 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
     async def _remote_join(
         self,
         requester: Requester,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         room_id: str,
         user: UserID,
         content: dict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Try and join a room that this server is not in
 
         Args:
@@ -238,11 +243,11 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
     async def remote_knock(
         self,
         requester: Requester,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         room_id: str,
         user: UserID,
         content: dict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Try and knock on a room that this server is not in
 
         Args:
@@ -257,10 +262,10 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
     async def remote_reject_invite(
         self,
         invite_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """
         Rejects an out-of-band invite we have received from a remote server
 
@@ -280,10 +285,10 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
     async def remote_rescind_knock(
         self,
         knock_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Rescind a local knock made on a remote room.
 
         Args:
@@ -346,8 +351,8 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
 
     async def ratelimit_multiple_invites(
         self,
-        requester: Optional[Requester],
-        room_id: Optional[str],
+        requester: Requester | None,
+        room_id: str | None,
         n_invites: int,
         update: bool = True,
     ) -> None:
@@ -371,8 +376,8 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
 
     async def ratelimit_invite(
         self,
-        requester: Optional[Requester],
-        room_id: Optional[str],
+        requester: Requester | None,
+        room_id: str | None,
         invitee_user_id: str,
     ) -> None:
         """Ratelimit invites by room and by target user.
@@ -386,6 +391,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         if requester is not None:
             await self._invites_per_issuer_limiter.ratelimit(requester)
 
+    @trace
     async def _local_membership_update(
         self,
         *,
@@ -393,16 +399,17 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         target: UserID,
         room_id: str,
         membership: str,
-        prev_event_ids: Optional[List[str]] = None,
-        state_event_ids: Optional[List[str]] = None,
-        depth: Optional[int] = None,
-        txn_id: Optional[str] = None,
+        prev_event_ids: list[str] | None = None,
+        state_event_ids: list[str] | None = None,
+        depth: int | None = None,
+        txn_id: str | None = None,
         ratelimit: bool = True,
-        content: Optional[dict] = None,
+        content: dict | None = None,
         require_consent: bool = True,
         outlier: bool = False,
-        origin_server_ts: Optional[int] = None,
-    ) -> Tuple[str, int]:
+        origin_server_ts: int | None = None,
+        delay_id: str | None = None,
+    ) -> tuple[str, int]:
         """
         Internal membership update function to get an existing event or create
         and persist a new event for the new membership change.
@@ -434,6 +441,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
                 opposed to being inline with the current DAG.
             origin_server_ts: The origin_server_ts to use if a new event is created. Uses
                 the current timestamp if set to None.
+            delay_id: The delay ID of this event, if it was a delayed event.
 
         Returns:
             Tuple of event ID and stream ordering position
@@ -486,6 +494,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
                     depth=depth,
                     require_consent=require_consent,
                     outlier=outlier,
+                    delay_id=delay_id,
                 )
                 context = await unpersisted_context.persist(event)
                 prev_state_ids = await context.get_prev_state_ids(
@@ -569,19 +578,20 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         target: UserID,
         room_id: str,
         action: str,
-        txn_id: Optional[str] = None,
-        remote_room_hosts: Optional[List[str]] = None,
-        third_party_signed: Optional[dict] = None,
+        txn_id: str | None = None,
+        remote_room_hosts: list[str] | None = None,
+        third_party_signed: dict | None = None,
         ratelimit: bool = True,
-        content: Optional[dict] = None,
+        content: dict | None = None,
         new_room: bool = False,
         require_consent: bool = True,
         outlier: bool = False,
-        prev_event_ids: Optional[List[str]] = None,
-        state_event_ids: Optional[List[str]] = None,
-        depth: Optional[int] = None,
-        origin_server_ts: Optional[int] = None,
-    ) -> Tuple[str, int]:
+        prev_event_ids: list[str] | None = None,
+        state_event_ids: list[str] | None = None,
+        depth: int | None = None,
+        origin_server_ts: int | None = None,
+        delay_id: str | None = None,
+    ) -> tuple[str, int]:
         """Update a user's membership in a room.
 
         Params:
@@ -611,6 +621,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
                 based on the prev_events.
             origin_server_ts: The origin_server_ts to use if a new event is created. Uses
                 the current timestamp if set to None.
+            delay_id: The delay ID of this event, if it was a delayed event.
 
         Returns:
             A tuple of the new event ID and stream ID.
@@ -639,7 +650,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
 
         if action == Membership.INVITE and requester.shadow_banned:
             # We randomly sleep a bit just to annoy the requester.
-            await self.clock.sleep(random.randint(1, 10))
+            await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
             raise ShadowBanError()
 
         key = (room_id,)
@@ -673,6 +684,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
                             state_event_ids=state_event_ids,
                             depth=depth,
                             origin_server_ts=origin_server_ts,
+                            delay_id=delay_id,
                         )
 
         return result
@@ -683,19 +695,20 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         target: UserID,
         room_id: str,
         action: str,
-        txn_id: Optional[str] = None,
-        remote_room_hosts: Optional[List[str]] = None,
-        third_party_signed: Optional[dict] = None,
+        txn_id: str | None = None,
+        remote_room_hosts: list[str] | None = None,
+        third_party_signed: dict | None = None,
         ratelimit: bool = True,
-        content: Optional[dict] = None,
+        content: dict | None = None,
         new_room: bool = False,
         require_consent: bool = True,
         outlier: bool = False,
-        prev_event_ids: Optional[List[str]] = None,
-        state_event_ids: Optional[List[str]] = None,
-        depth: Optional[int] = None,
-        origin_server_ts: Optional[int] = None,
-    ) -> Tuple[str, int]:
+        prev_event_ids: list[str] | None = None,
+        state_event_ids: list[str] | None = None,
+        depth: int | None = None,
+        origin_server_ts: int | None = None,
+        delay_id: str | None = None,
+    ) -> tuple[str, int]:
         """Helper for update_membership.
 
         Assumes that the membership linearizer is already held for the room.
@@ -727,6 +740,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
                 based on the prev_events.
             origin_server_ts: The origin_server_ts to use if a new event is created. Uses
                 the current timestamp if set to None.
+            delay_id: The delay ID of this event, if it was a delayed event.
 
         Returns:
             A tuple of the new event ID and stream ID.
@@ -870,7 +884,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
             if target_id == self._server_notices_mxid:
                 raise SynapseError(HTTPStatus.FORBIDDEN, "Cannot invite this user")
 
-            block_invite_result = None
+            block_invite_result: tuple[Codes, dict] | None = None
 
             if (
                 self._server_notices_mxid is not None
@@ -937,6 +951,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
                 require_consent=require_consent,
                 outlier=outlier,
                 origin_server_ts=origin_server_ts,
+                delay_id=delay_id,
             )
 
         latest_event_ids = await self.store.get_prev_events_for_room(room_id)
@@ -1195,6 +1210,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
             require_consent=require_consent,
             outlier=outlier,
             origin_server_ts=origin_server_ts,
+            delay_id=delay_id,
         )
 
     async def check_for_any_membership_in_room(
@@ -1217,16 +1233,18 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         if result is None or result == (None, None):
             raise AuthError(403, f"User {user_id} has no membership in room {room_id}")
 
+    @trace
+    @tag_args
     async def _should_perform_remote_join(
         self,
         user_id: str,
         room_id: str,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         content: JsonDict,
         is_partial_state_room: bool,
         is_host_in_room: bool,
         partial_state_before_join: StateMap[str],
-    ) -> Tuple[bool, List[str]]:
+    ) -> tuple[bool, list[str]]:
         """
         Check whether the server should do a remote join (as opposed to a local
         join) for a user.
@@ -1271,6 +1289,12 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
             prev_member_event = await self.store.get_event(prev_member_event_id)
             previous_membership = prev_member_event.membership
 
+        # Interesting because it's used in the logic below to make decisions
+        set_tag(
+            SynapseTags.RESULT_PREFIX + "previous_membership",
+            str(previous_membership),
+        )
+
         # If we are not fully joined yet, and the target is not already in the room,
         # let's do a remote join so another server with the full state can validate
         # that the user has not been banned for example.
@@ -1311,15 +1335,19 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
             state_key: event_map[event_id]
             for state_key, event_id in state_before_join.items()
         }
-        allowed_servers = get_servers_from_users(
+        servers_that_can_issue_invite = get_servers_from_users(
             get_users_which_can_issue_invite(current_state)
         )
+        set_tag(
+            SynapseTags.RESULT_PREFIX + "servers_that_can_issue_invite",
+            str(servers_that_can_issue_invite),
+        )
 
         # If the local server is not one of allowed servers, then a remote
         # join must be done. Return the list of prospective servers based on
         # which can issue invites.
-        if self.hs.hostname not in allowed_servers:
-            return True, list(allowed_servers)
+        if self.hs.hostname not in servers_that_can_issue_invite:
+            return True, list(servers_that_can_issue_invite)
 
         # Ensure the member should be allowed access via membership in a room.
         await self.event_auth_handler.check_restricted_join_rules(
@@ -1417,7 +1445,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
 
     async def send_membership_event(
         self,
-        requester: Optional[Requester],
+        requester: Requester | None,
         event: EventBase,
         context: EventContext,
         ratelimit: bool = True,
@@ -1562,7 +1590,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
 
     async def lookup_room_alias(
         self, room_alias: RoomAlias
-    ) -> Tuple[RoomID, List[str]]:
+    ) -> tuple[RoomID, list[str]]:
         """
         Get the room ID associated with a room alias.
 
@@ -1591,7 +1619,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
 
         return RoomID.from_string(room_id), servers
 
-    async def _get_inviter(self, user_id: str, room_id: str) -> Optional[UserID]:
+    async def _get_inviter(self, user_id: str, room_id: str) -> UserID | None:
         invite = await self.store.get_invite_for_local_user_in_room(
             user_id=user_id, room_id=room_id
         )
@@ -1607,11 +1635,11 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         address: str,
         id_server: str,
         requester: Requester,
-        txn_id: Optional[str],
+        txn_id: str | None,
         id_access_token: str,
-        prev_event_ids: Optional[List[str]] = None,
-        depth: Optional[int] = None,
-    ) -> Tuple[str, int]:
+        prev_event_ids: list[str] | None = None,
+        depth: int | None = None,
+    ) -> tuple[str, int]:
         """Invite a 3PID to a room.
 
         Args:
@@ -1644,7 +1672,7 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
 
         if requester.shadow_banned:
             # We randomly sleep a bit just to annoy the requester.
-            await self.clock.sleep(random.randint(1, 10))
+            await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
             raise ShadowBanError()
 
         # We need to rate limit *before* we send out any 3PID invites, so we
@@ -1721,11 +1749,11 @@ class RoomMemberHandler(metaclass=abc.ABCMeta):
         address: str,
         room_id: str,
         user: UserID,
-        txn_id: Optional[str],
+        txn_id: str | None,
         id_access_token: str,
-        prev_event_ids: Optional[List[str]] = None,
-        depth: Optional[int] = None,
-    ) -> Tuple[EventBase, int]:
+        prev_event_ids: list[str] | None = None,
+        depth: int | None = None,
+    ) -> tuple[EventBase, int]:
         room_state = await self._storage_controllers.state.get_current_state(
             room_id,
             StateFilter.from_types(
@@ -1860,8 +1888,8 @@ class RoomMemberMasterHandler(RoomMemberHandler):
         self.distributor.declare("user_left_room")
 
     async def _is_remote_room_too_complex(
-        self, room_id: str, remote_room_hosts: List[str]
-    ) -> Optional[bool]:
+        self, room_id: str, remote_room_hosts: list[str]
+    ) -> bool | None:
         """
         Check if complexity of a remote room is too great.
 
@@ -1893,14 +1921,15 @@ class RoomMemberMasterHandler(RoomMemberHandler):
 
         return complexity["v1"] > max_complexity
 
+    @trace
     async def _remote_join(
         self,
         requester: Requester,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         room_id: str,
         user: UserID,
         content: dict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Implements RoomMemberHandler._remote_join"""
         # filter ourselves out of remote_room_hosts: do_invite_join ignores it
         # and if it is the only entry we'd like to return a 404 rather than a
@@ -1971,13 +2000,14 @@ class RoomMemberMasterHandler(RoomMemberHandler):
 
         return event_id, stream_id
 
+    @trace
     async def remote_reject_invite(
         self,
         invite_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """
         Rejects an out-of-band invite received from a remote user
 
@@ -2008,13 +2038,14 @@ class RoomMemberMasterHandler(RoomMemberHandler):
                 invite_event, txn_id, requester, content
             )
 
+    @trace
     async def remote_rescind_knock(
         self,
         knock_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """
         Rescinds a local knock made on a remote room
 
@@ -2040,10 +2071,10 @@ class RoomMemberMasterHandler(RoomMemberHandler):
     async def _generate_local_out_of_band_leave(
         self,
         previous_membership_event: EventBase,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Generate a local leave event for a room
 
         This can be called after we e.g fail to reject an invite via a remote server.
@@ -2120,14 +2151,15 @@ class RoomMemberMasterHandler(RoomMemberHandler):
 
         return result_event.event_id, result_event.internal_metadata.stream_ordering
 
+    @trace
     async def remote_knock(
         self,
         requester: Requester,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         room_id: str,
         user: UserID,
         content: dict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Sends a knock to a room. Attempts to do so via one remote out of a given list.
 
         Args:
@@ -2177,7 +2209,7 @@ class RoomForgetterHandler(StateDeltasHandler):
         self._room_member_handler = hs.get_room_member_handler()
 
         # The current position in the current_state_delta stream
-        self.pos: Optional[int] = None
+        self.pos: int | None = None
 
         # Guard to ensure we only process deltas one at a time
         self._is_processing = False
@@ -2186,7 +2218,10 @@ class RoomForgetterHandler(StateDeltasHandler):
             self._notifier.add_replication_callback(self.notify_new_event)
 
             # We kick this off to pick up outstanding work from before the last restart.
-            self._clock.call_later(0, self.notify_new_event)
+            self._clock.call_later(
+                Duration(seconds=0),
+                self.notify_new_event,
+            )
 
     def notify_new_event(self) -> None:
         """Called when there may be more deltas to process"""
@@ -2201,9 +2236,7 @@ class RoomForgetterHandler(StateDeltasHandler):
             finally:
                 self._is_processing = False
 
-        run_as_background_process(
-            "room_forgetter.notify_new_event", self.server_name, process
-        )
+        self._hs.run_as_background_process("room_forgetter.notify_new_event", process)
 
     async def _unsafe_process(self) -> None:
         # If self.pos is None then means we haven't fetched it from DB
@@ -2228,7 +2261,7 @@ class RoomForgetterHandler(StateDeltasHandler):
             #
             # We wait for a short time so that we don't "tight" loop just
             # keeping the table up to date.
-            await self._clock.sleep(0.5)
+            await self._clock.sleep(Duration(milliseconds=500))
 
             self.pos = self._store.get_room_max_stream_ordering()
             await self._store.update_room_forgetter_stream_pos(self.pos)
@@ -2266,7 +2299,7 @@ class RoomForgetterHandler(StateDeltasHandler):
 
             await self._store.update_room_forgetter_stream_pos(max_pos)
 
-    async def _handle_deltas(self, deltas: List[StateDelta]) -> None:
+    async def _handle_deltas(self, deltas: list[StateDelta]) -> None:
         """Called with the state deltas to process"""
         for delta in deltas:
             if delta.event_type != EventTypes.Member:
@@ -2296,7 +2329,7 @@ class RoomForgetterHandler(StateDeltasHandler):
                         raise
 
 
-def get_users_which_can_issue_invite(auth_events: StateMap[EventBase]) -> List[str]:
+def get_users_which_can_issue_invite(auth_events: StateMap[EventBase]) -> list[str]:
     """
     Return the list of users which can issue invites.
 
@@ -2342,7 +2375,7 @@ def get_users_which_can_issue_invite(auth_events: StateMap[EventBase]) -> List[s
     return result
 
 
-def get_servers_from_users(users: List[str]) -> Set[str]:
+def get_servers_from_users(users: list[str]) -> set[str]:
     """
     Resolve a list of users into their servers.
 
diff --git a/synapse/handlers/room_member_worker.py b/synapse/handlers/room_member_worker.py
index 0616a9864d..da63525598 100644
--- a/synapse/handlers/room_member_worker.py
+++ b/synapse/handlers/room_member_worker.py
@@ -20,9 +20,10 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.handlers.room_member import NoKnownServersError, RoomMemberHandler
+from synapse.logging.opentracing import trace
 from synapse.replication.http.membership import (
     ReplicationRemoteJoinRestServlet as ReplRemoteJoin,
     ReplicationRemoteKnockRestServlet as ReplRemoteKnock,
@@ -48,14 +49,15 @@ class RoomMemberWorkerHandler(RoomMemberHandler):
         self._remote_rescind_client = ReplRescindKnock.make_client(hs)
         self._notify_change_client = ReplJoinedLeft.make_client(hs)
 
+    @trace
     async def _remote_join(
         self,
         requester: Requester,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         room_id: str,
         user: UserID,
         content: dict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Implements RoomMemberHandler._remote_join"""
         if len(remote_room_hosts) == 0:
             raise NoKnownServersError()
@@ -70,13 +72,14 @@ class RoomMemberWorkerHandler(RoomMemberHandler):
 
         return ret["event_id"], ret["stream_id"]
 
+    @trace
     async def remote_reject_invite(
         self,
         invite_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: dict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """
         Rejects an out-of-band invite received from a remote user
 
@@ -90,13 +93,14 @@ class RoomMemberWorkerHandler(RoomMemberHandler):
         )
         return ret["event_id"], ret["stream_id"]
 
+    @trace
     async def remote_rescind_knock(
         self,
         knock_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """
         Rescinds a local knock made on a remote room
 
@@ -118,14 +122,15 @@ class RoomMemberWorkerHandler(RoomMemberHandler):
         )
         return ret["event_id"], ret["stream_id"]
 
+    @trace
     async def remote_knock(
         self,
         requester: Requester,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         room_id: str,
         user: UserID,
         content: dict,
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Sends a knock to a room.
 
         Implements RoomMemberHandler.remote_knock
diff --git a/synapse/handlers/room_policy.py b/synapse/handlers/room_policy.py
index 170c477d6f..01943e1991 100644
--- a/synapse/handlers/room_policy.py
+++ b/synapse/handlers/room_policy.py
@@ -17,8 +17,14 @@
 import logging
 from typing import TYPE_CHECKING
 
+import attr
+from signedjson.key import decode_verify_key_bytes
+from unpaddedbase64 import decode_base64
+
+from synapse.api.constants import EventTypes
+from synapse.api.errors import Codes, HttpResponseException, SynapseError
+from synapse.crypto.keyring import VerifyJsonRequest
 from synapse.events import EventBase
-from synapse.types.handlers.policy_server import RECOMMENDATION_OK
 from synapse.util.stringutils import parse_and_validate_server_name
 
 if TYPE_CHECKING:
@@ -26,6 +32,17 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+POLICY_SERVER_KEY_ID = "ed25519:policy_server"
+
+
+@attr.s(slots=True, auto_attribs=True)
+class PolicyServerInfo:
+    # name of the server.
+    server_name: str
+
+    # the unpadded base64-encoded Ed25519 public key of the server.
+    public_key: str
+
 
 class RoomPolicyHandler:
     def __init__(self, hs: "HomeServer"):
@@ -35,6 +52,86 @@ class RoomPolicyHandler:
         self._event_auth_handler = hs.get_event_auth_handler()
         self._federation_client = hs.get_federation_client()
 
+    def _is_policy_server_state_event(self, event: EventBase) -> bool:
+        state_key = event.get_state_key()
+        if state_key is not None and state_key == "":
+            # TODO: Remove unstable MSC4284 support
+            # https://github.com/element-hq/synapse/issues/19502
+            # Note: we can probably drop this whole function when we remove unstable support
+            return event.type in [EventTypes.RoomPolicy, "org.matrix.msc4284.policy"]
+        return False
+
+    async def _get_policy_server(self, room_id: str) -> PolicyServerInfo | None:
+        """Get the policy server's name and Ed25519 public key for the room, if set.
+
+        If the `m.room.policy` state event is invalid, then a policy server is not set. It
+        can be invalid if:
+        - The room doesn't have an `m.room.policy` state event with empty state key.
+        - The policy state event is missing the `via` or `public_keys` field.
+        - The policy state event's public keys is missing an `ed25519` key.
+        - The via server is not a valid server name.
+        - The via server is not in the room.
+        - The via server is Synapse itself.
+
+        TODO: Remove unstable MSC4284 support - https://github.com/element-hq/synapse/issues/19502
+        This function also checks for the unstable `org.matrix.msc4284.policy` state event.
+
+        Args:
+            room_id: The room ID to get the policy server for.
+
+        Returns:
+            A tuple of policy server name and its Ed25519 public key (unpadded base64).
+            Both values will be None if no policy server is configured or the configration
+            is invalid.
+        """
+        policy_event = await self._storage_controllers.state.get_current_state_event(
+            room_id, EventTypes.RoomPolicy, ""
+        )
+        public_key = None
+        if not policy_event:
+            # TODO: Remove unstable MSC4284 support
+            # https://github.com/element-hq/synapse/issues/19502
+            policy_event = (
+                await self._storage_controllers.state.get_current_state_event(
+                    room_id, "org.matrix.msc4284.policy", ""
+                )
+            )
+            if not policy_event:
+                return None  # neither stable or unstable configured
+
+            # Unstable configured, grab its public key
+            public_key = policy_event.content.get("public_key", None)
+        else:
+            # Stable configured, grab its public key
+            public_keys = policy_event.content.get("public_keys")
+            if isinstance(public_keys, dict):
+                ed25519_key = public_keys.get("ed25519")
+                if isinstance(ed25519_key, str):
+                    public_key = ed25519_key
+
+        if public_key is None or not isinstance(public_key, str):
+            return None  # no public key means no policy server
+
+        policy_server = policy_event.content.get("via", "")
+        if policy_server is None or not isinstance(policy_server, str):
+            return None  # no policy server
+
+        if policy_server == self._hs.hostname:
+            return None  # Synapse itself can't be a policy server (currently)
+
+        try:
+            parse_and_validate_server_name(policy_server)
+        except ValueError:
+            return None  # invalid policy server
+
+        is_in_room = await self._event_auth_handler.is_host_in_room(
+            room_id, policy_server
+        )
+        if not is_in_room:
+            return None  # policy server not in room
+
+        return PolicyServerInfo(policy_server, public_key)
+
     async def is_event_allowed(self, event: EventBase) -> bool:
         """Check if the given event is allowed in the room by the policy server.
 
@@ -54,39 +151,128 @@ class RoomPolicyHandler:
         Returns:
             bool: True if the event is allowed in the room, False otherwise.
         """
-        if event.type == "org.matrix.msc4284.policy" and event.state_key is not None:
+        if self._is_policy_server_state_event(event):
             return True  # always allow policy server change events
 
-        policy_event = await self._storage_controllers.state.get_current_state_event(
-            event.room_id, "org.matrix.msc4284.policy", ""
+        policy_server = await self._get_policy_server(event.room_id)
+        if policy_server is None:
+            return True  # no policy server configured, so allow
+
+        # Check if the event has been signed with the public key in the policy server
+        # state event. If it is, the event is valid according to the policy server and
+        # we don't need to request a fresh signature.
+        valid = await self._verify_policy_server_signature(
+            event, policy_server.server_name, policy_server.public_key
         )
-        if not policy_event:
-            return True  # no policy server == default allow
-
-        policy_server = policy_event.content.get("via", "")
-        if policy_server is None or not isinstance(policy_server, str):
-            return True  # no policy server == default allow
-
-        if policy_server == self._hs.hostname:
-            return True  # Synapse itself can't be a policy server (currently)
+        if valid:
+            return True  # valid signature == allow
 
+        # We couldn't save the HTTP hit, so do that hit.
         try:
-            parse_and_validate_server_name(policy_server)
-        except ValueError:
-            return True  # invalid policy server == default allow
-
-        is_in_room = await self._event_auth_handler.is_host_in_room(
-            event.room_id, policy_server
-        )
-        if not is_in_room:
-            return True  # policy server not in room == default allow
-
-        # At this point, the server appears valid and is in the room, so ask it to check
-        # the event.
-        recommendation = await self._federation_client.get_pdu_policy_recommendation(
-            policy_server, event
-        )
-        if recommendation != RECOMMENDATION_OK:
+            await self.ask_policy_server_to_sign_event(event, verify=True)
+        except Exception as ex:
+            # We probably caught either a refusal to sign, an invalid signature, or
+            # some other transient or network error. These are all rejection cases.
+            logger.warning("Failed to get a signature from the policy server: %s", ex)
             return False
 
-        return True  # default allow
+        return True  # passed all verifications and checks, so allow
+
+    async def _verify_policy_server_signature(
+        self, event: EventBase, policy_server: str, public_key: str
+    ) -> bool:
+        # check the event is signed with this (via, public_key).
+        verify_json_req = VerifyJsonRequest.from_event(policy_server, event, 0)
+        try:
+            key_bytes = decode_base64(public_key)
+            verify_key = decode_verify_key_bytes(POLICY_SERVER_KEY_ID, key_bytes)
+            # We would normally use KeyRing.verify_event_for_server but we can't here as we don't
+            # want to fetch the server key, and instead want to use the public key in the state event.
+            await self._hs.get_keyring().process_json(verify_key, verify_json_req)
+            # if the event is correctly signed by the public key in the policy server state event = Allow
+            return True
+        except Exception as ex:
+            logger.warning(
+                "failed to verify event using public key in policy server event: %s", ex
+            )
+        return False
+
+    async def ask_policy_server_to_sign_event(
+        self, event: EventBase, verify: bool = False
+    ) -> None:
+        """Ask the policy server to sign this event. The signature is added to the event signatures block.
+
+        Does nothing if there is no policy server state event in the room. If the policy server
+        refuses to sign the event (as it's marked as spam), an error is raised.
+
+        Args:
+            event: The event to sign.
+            verify: If True, verify that the signature is correctly signed by the policy server's
+                defined public key.
+        Raises:
+            When the policy server refuses to sign the event, or when verify is True and the
+            signature is invalid.
+        """
+        if self._is_policy_server_state_event(event):
+            # per spec, policy servers aren't asked to sign `m.room.policy` state events
+            # with empty state keys
+            return
+
+        policy_server = await self._get_policy_server(event.room_id)
+        if policy_server is None:
+            return
+
+        # Ask the policy server to sign this event.
+        try:
+            signature = await self._federation_client.ask_policy_server_to_sign_event(
+                policy_server.server_name,
+                event,
+                # We set a smallish timeout here as we don't want to block event sending
+                # too long.
+                #
+                # We were previously seeing regular timeouts with media
+                # scanning/checking when the timeout was set to 3s. 30s was chosen based
+                # on vibes and light real world testing.
+                timeout=30000,
+            )
+            # TODO: We can *probably* remove this when we remove unstable MSC4284 support.
+            # The server *should* be returning either a signature or an error, but there could
+            # also be implementation bugs. Whoever reads this when removing unstable MSC4284
+            # stuff, make a decision on whether to remove this bit.
+            # https://github.com/element-hq/synapse/issues/19502
+            if not signature or len(signature) == 0:
+                raise SynapseError(
+                    403,
+                    "This event has been rejected as probable spam by the policy server",
+                    Codes.FORBIDDEN,
+                )
+
+            # Note: if the policy server and event sender are the same server, the sender
+            # might not have added policy server signatures to the event for whatever reason.
+            # When this happens, we don't want to obliterate the event's existing signatures
+            # because the event will fail authorization. This is why we add defaults rather
+            # than simply `update` the signatures on the event.
+            #
+            # This situation can happen if the homeserver and policy server parts are
+            # logically the same server, but run by different software. For example, Synapse
+            # will not ask "itself" for a policy server signature, even if its server name
+            # is the designated policy server, so it could send an event outwards that other
+            # servers need to manually fetch signatures for. This is the code that allows
+            # those events to continue working (because they're legally sent, even if missing
+            # the policy server signature).
+            event.signatures.setdefault(policy_server.server_name, {}).update(
+                signature.get(policy_server.server_name, {})
+            )
+        except HttpResponseException as ex:
+            # re-wrap HTTP errors as `SynapseError` so they can be proxied to clients directly
+            raise ex.to_synapse_error() from ex
+
+        if verify:
+            is_valid = await self._verify_policy_server_signature(
+                event, policy_server.server_name, policy_server.public_key
+            )
+            if not is_valid:
+                raise SynapseError(
+                    500,
+                    f"policy server {policy_server.server_name} failed to sign event correctly",
+                )
diff --git a/synapse/handlers/room_summary.py b/synapse/handlers/room_summary.py
index 838fee6a30..bbcdc0877e 100644
--- a/synapse/handlers/room_summary.py
+++ b/synapse/handlers/room_summary.py
@@ -22,7 +22,7 @@
 import itertools
 import logging
 import re
-from typing import TYPE_CHECKING, Dict, Iterable, List, Optional, Sequence, Set, Tuple
+from typing import TYPE_CHECKING, Iterable, Optional, Sequence
 
 import attr
 
@@ -71,7 +71,7 @@ class _PaginationKey:
     # during a pagination session).
     room_id: str
     suggested_only: bool
-    max_depth: Optional[int]
+    max_depth: int | None
     # The randomly generated token.
     token: str
 
@@ -83,9 +83,9 @@ class _PaginationSession:
     # The time the pagination session was created, in milliseconds.
     creation_time_ms: int
     # The queue of rooms which are still to process.
-    room_queue: List["_RoomQueueEntry"]
+    room_queue: list["_RoomQueueEntry"]
     # A set of rooms which have been processed.
-    processed_rooms: Set[str]
+    processed_rooms: set[str]
 
 
 class RoomSummaryHandler:
@@ -112,31 +112,34 @@ class RoomSummaryHandler:
         # If a user tries to fetch the same page multiple times in quick succession,
         # only process the first attempt and return its result to subsequent requests.
         self._pagination_response_cache: ResponseCache[
-            Tuple[
+            tuple[
                 str,
                 str,
                 bool,
-                Optional[int],
-                Optional[int],
-                Optional[str],
-                Optional[Tuple[str, ...]],
+                bool,
+                bool,
+                int | None,
+                int | None,
+                str | None,
+                tuple[str, ...] | None,
             ]
         ] = ResponseCache(
             clock=hs.get_clock(),
             name="get_room_hierarchy",
             server_name=self.server_name,
         )
-        self._msc3266_enabled = hs.config.experimental.msc3266_enabled
 
     async def get_room_hierarchy(
         self,
         requester: Requester,
         requested_room_id: str,
         suggested_only: bool = False,
-        max_depth: Optional[int] = None,
-        limit: Optional[int] = None,
-        from_token: Optional[str] = None,
-        remote_room_hosts: Optional[Tuple[str, ...]] = None,
+        omit_remote_room_hierarchy: bool = False,
+        admin_skip_room_visibility_check: bool = False,
+        max_depth: int | None = None,
+        limit: int | None = None,
+        from_token: str | None = None,
+        remote_room_hosts: tuple[str, ...] | None = None,
     ) -> JsonDict:
         """
         Implementation of the room hierarchy C-S API.
@@ -146,6 +149,11 @@ class RoomSummaryHandler:
             requested_room_id: The room ID to start the hierarchy at (the "root" room).
             suggested_only: Whether we should only return children with the "suggested"
                 flag set.
+            omit_remote_room_hierarchy: Whether to skip reaching out over
+                federation to get information on rooms which the server
+                is not currently joined to
+            admin_skip_room_visibility_check: Whether to skip checking if the room can
+                be accessed by the requester, used for the admin endpoints.
             max_depth: The maximum depth in the tree to explore, must be a
                 non-negative integer.
 
@@ -173,6 +181,8 @@ class RoomSummaryHandler:
                 requester.user.to_string(),
                 requested_room_id,
                 suggested_only,
+                omit_remote_room_hierarchy,
+                admin_skip_room_visibility_check,
                 max_depth,
                 limit,
                 from_token,
@@ -182,6 +192,8 @@ class RoomSummaryHandler:
             requester.user.to_string(),
             requested_room_id,
             suggested_only,
+            omit_remote_room_hierarchy,
+            admin_skip_room_visibility_check,
             max_depth,
             limit,
             from_token,
@@ -193,10 +205,12 @@ class RoomSummaryHandler:
         requester: str,
         requested_room_id: str,
         suggested_only: bool = False,
-        max_depth: Optional[int] = None,
-        limit: Optional[int] = None,
-        from_token: Optional[str] = None,
-        remote_room_hosts: Optional[Tuple[str, ...]] = None,
+        omit_remote_room_hierarchy: bool = False,
+        admin_skip_room_visibility_check: bool = False,
+        max_depth: int | None = None,
+        limit: int | None = None,
+        from_token: str | None = None,
+        remote_room_hosts: tuple[str, ...] | None = None,
     ) -> JsonDict:
         """See docstring for SpaceSummaryHandler.get_room_hierarchy."""
 
@@ -204,17 +218,18 @@ class RoomSummaryHandler:
         local_room = await self._store.is_host_joined(
             requested_room_id, self._server_name
         )
-        if local_room and not await self._is_local_room_accessible(
-            requested_room_id, requester
-        ):
-            raise UnstableSpecAuthError(
-                403,
-                "User %s not in room %s, and room previews are disabled"
-                % (requester, requested_room_id),
-                errcode=Codes.NOT_JOINED,
-            )
+        if not admin_skip_room_visibility_check:
+            if local_room and not await self._is_local_room_accessible(
+                requested_room_id, requester
+            ):
+                raise UnstableSpecAuthError(
+                    403,
+                    "User %s not in room %s, and room previews are disabled"
+                    % (requester, requested_room_id),
+                    errcode=Codes.NOT_JOINED,
+                )
 
-        if not local_room:
+        if not local_room and not omit_remote_room_hierarchy:
             room_hierarchy = await self._summarize_remote_room_hierarchy(
                 _RoomQueueEntry(requested_room_id, remote_room_hosts or ()),
                 False,
@@ -223,12 +238,13 @@ class RoomSummaryHandler:
             if not root_room_entry or not await self._is_remote_room_accessible(
                 requester, requested_room_id, root_room_entry.room
             ):
-                raise UnstableSpecAuthError(
-                    403,
-                    "User %s not in room %s, and room previews are disabled"
-                    % (requester, requested_room_id),
-                    errcode=Codes.NOT_JOINED,
-                )
+                if not admin_skip_room_visibility_check:
+                    raise UnstableSpecAuthError(
+                        403,
+                        "User %s not in room %s, and room previews are disabled"
+                        % (requester, requested_room_id),
+                        errcode=Codes.NOT_JOINED,
+                    )
 
         # If this is continuing a previous session, pull the persisted data.
         if from_token:
@@ -240,13 +256,18 @@ class RoomSummaryHandler:
             except StoreError:
                 raise SynapseError(400, "Unknown pagination token", Codes.INVALID_PARAM)
 
-            # If the requester, room ID, suggested-only, or max depth were modified
-            # the session is invalid.
+            # If the requester, room ID, suggested-only, max depth,
+            # omit_remote_room_hierarchy, or admin_skip_room_visibility_check
+            # were modified the session is invalid.
             if (
                 requester != pagination_session["requester"]
                 or requested_room_id != pagination_session["room_id"]
                 or suggested_only != pagination_session["suggested_only"]
                 or max_depth != pagination_session["max_depth"]
+                or omit_remote_room_hierarchy
+                != pagination_session["omit_remote_room_hierarchy"]
+                or admin_skip_room_visibility_check
+                != pagination_session["admin_skip_room_visibility_check"]
             ):
                 raise SynapseError(400, "Unknown pagination token", Codes.INVALID_PARAM)
 
@@ -262,7 +283,7 @@ class RoomSummaryHandler:
             # Rooms we have already processed.
             processed_rooms = set()
 
-        rooms_result: List[JsonDict] = []
+        rooms_result: list[JsonDict] = []
 
         # Cap the limit to a server-side maximum.
         if limit is None:
@@ -286,12 +307,12 @@ class RoomSummaryHandler:
             # federation. The rationale for caching these and *maybe* using them
             # is to prefer any information local to the homeserver before trusting
             # data received over federation.
-            children_room_entries: Dict[str, JsonDict] = {}
+            children_room_entries: dict[str, JsonDict] = {}
             # A set of room IDs which are children that did not have information
             # returned over federation and are known to be inaccessible to the
             # current server. We should not reach out over federation to try to
             # summarise these rooms.
-            inaccessible_children: Set[str] = set()
+            inaccessible_children: set[str] = set()
 
             # If the room is known locally, summarise it!
             is_in_room = await self._store.is_host_joined(room_id, self._server_name)
@@ -301,6 +322,7 @@ class RoomSummaryHandler:
                     None,
                     room_id,
                     suggested_only,
+                    admin_skip_room_visibility_check=admin_skip_room_visibility_check,
                 )
 
             # Otherwise, attempt to use information for federation.
@@ -321,7 +343,7 @@ class RoomSummaryHandler:
 
                 # If the above isn't true, attempt to fetch the room
                 # information over federation.
-                else:
+                elif not omit_remote_room_hierarchy:
                     (
                         room_entry,
                         children_room_entries,
@@ -378,6 +400,8 @@ class RoomSummaryHandler:
                     "room_id": requested_room_id,
                     "suggested_only": suggested_only,
                     "max_depth": max_depth,
+                    "omit_remote_room_hierarchy": omit_remote_room_hierarchy,
+                    "admin_skip_room_visibility_check": admin_skip_room_visibility_check,
                     # The stored state.
                     "room_queue": [
                         attr.astuple(room_entry) for room_entry in room_queue
@@ -418,8 +442,8 @@ class RoomSummaryHandler:
             # Room is inaccessible to the requesting server.
             raise SynapseError(404, "Unknown room: %s" % (requested_room_id,))
 
-        children_rooms_result: List[JsonDict] = []
-        inaccessible_children: List[str] = []
+        children_rooms_result: list[JsonDict] = []
+        inaccessible_children: list[str] = []
 
         # Iterate through each child and potentially add it, but not its children,
         # to the response.
@@ -455,11 +479,12 @@ class RoomSummaryHandler:
 
     async def _summarize_local_room(
         self,
-        requester: Optional[str],
-        origin: Optional[str],
+        requester: str | None,
+        origin: str | None,
         room_id: str,
         suggested_only: bool,
         include_children: bool = True,
+        admin_skip_room_visibility_check: bool = False,
     ) -> Optional["_RoomEntry"]:
         """
         Generate a room entry and a list of event entries for a given room.
@@ -476,11 +501,16 @@ class RoomSummaryHandler:
                 Otherwise, all children are returned.
             include_children:
                 Whether to include the events of any children.
+            admin_skip_room_visibility_check: Whether to skip checking if the room
+                can be accessed by the requester, used for the admin endpoints.
 
         Returns:
             A room entry if the room should be returned. None, otherwise.
         """
-        if not await self._is_local_room_accessible(room_id, requester, origin):
+        if (
+            not admin_skip_room_visibility_check
+            and not await self._is_local_room_accessible(room_id, requester, origin)
+        ):
             return None
 
         room_entry = await self._build_room_entry(room_id, for_federation=bool(origin))
@@ -496,7 +526,7 @@ class RoomSummaryHandler:
             # we only care about suggested children
             child_events = filter(_is_suggested_child_event, child_events)
 
-        stripped_events: List[JsonDict] = [
+        stripped_events: list[JsonDict] = [
             {
                 "type": e.type,
                 "state_key": e.state_key,
@@ -510,7 +540,7 @@ class RoomSummaryHandler:
 
     async def _summarize_remote_room_hierarchy(
         self, room: "_RoomQueueEntry", suggested_only: bool
-    ) -> Tuple[Optional["_RoomEntry"], Dict[str, JsonDict], Set[str]]:
+    ) -> tuple[Optional["_RoomEntry"], dict[str, JsonDict], set[str]]:
         """
         Request room entries and a list of event entries for a given room by querying a remote server.
 
@@ -563,7 +593,7 @@ class RoomSummaryHandler:
         )
 
     async def _is_local_room_accessible(
-        self, room_id: str, requester: Optional[str], origin: Optional[str] = None
+        self, room_id: str, requester: str | None, origin: str | None = None
     ) -> bool:
         """
         Calculate whether the room should be shown to the requester.
@@ -692,7 +722,7 @@ class RoomSummaryHandler:
         return False
 
     async def _is_remote_room_accessible(
-        self, requester: Optional[str], room_id: str, room: JsonDict
+        self, requester: str | None, room_id: str, room: JsonDict
     ) -> bool:
         """
         Calculate whether the room received over federation should be shown to the requester.
@@ -760,6 +790,7 @@ class RoomSummaryHandler:
 
         entry: JsonDict = {
             "room_id": stats.room_id,
+            "room_version": stats.version,
             "name": stats.name,
             "topic": stats.topic,
             "canonical_alias": stats.canonical_alias,
@@ -771,12 +802,9 @@ class RoomSummaryHandler:
             ),
             "guest_can_join": stats.guest_access == "can_join",
             "room_type": stats.room_type,
+            "encryption": stats.encryption,
         }
 
-        if self._msc3266_enabled:
-            entry["im.nheko.summary.version"] = stats.version
-            entry["im.nheko.summary.encryption"] = stats.encryption
-
         # Federation requests need to provide additional information so the
         # requested server is able to filter the response appropriately.
         if for_federation:
@@ -833,9 +861,9 @@ class RoomSummaryHandler:
 
     async def get_room_summary(
         self,
-        requester: Optional[str],
+        requester: str | None,
         room_id: str,
-        remote_room_hosts: Optional[List[str]] = None,
+        remote_room_hosts: list[str] | None = None,
     ) -> JsonDict:
         """
         Implementation of the room summary C-S API from MSC3266
@@ -934,7 +962,7 @@ class _RoomQueueEntry:
     depth: int = 0
     # The room summary for this room returned via federation. This will only be
     # used if the room is not known locally (and is not a space).
-    remote_room: Optional[JsonDict] = None
+    remote_room: JsonDict | None = None
 
 
 @attr.s(frozen=True, slots=True, auto_attribs=True)
@@ -995,7 +1023,7 @@ _INVALID_ORDER_CHARS_RE = re.compile(r"[^\x20-\x7E]")
 
 def _child_events_comparison_key(
     child: EventBase,
-) -> Tuple[bool, Optional[str], int, str]:
+) -> tuple[bool, str | None, int, str]:
     """
     Generate a value for comparing two child events for ordering.
 
diff --git a/synapse/handlers/saml.py b/synapse/handlers/saml.py
index 81bec7499c..8f2b37c46d 100644
--- a/synapse/handlers/saml.py
+++ b/synapse/handlers/saml.py
@@ -20,7 +20,7 @@
 #
 import logging
 import re
-from typing import TYPE_CHECKING, Callable, Dict, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Callable
 
 import attr
 import saml2
@@ -54,7 +54,7 @@ class Saml2SessionData:
     creation_time: int
     # The user interactive authentication session ID associated with this SAML
     # session (or None if this SAML session is for an initial login).
-    ui_auth_session_id: Optional[str] = None
+    ui_auth_session_id: str | None = None
 
 
 class SamlHandler:
@@ -90,7 +90,7 @@ class SamlHandler:
         self.idp_brand = hs.config.saml2.idp_brand
 
         # a map from saml session id to Saml2SessionData object
-        self._outstanding_requests_dict: Dict[str, Saml2SessionData] = {}
+        self._outstanding_requests_dict: dict[str, Saml2SessionData] = {}
 
         self._sso_handler = hs.get_sso_handler()
         self._sso_handler.register_identity_provider(self)
@@ -98,8 +98,8 @@ class SamlHandler:
     async def handle_redirect_request(
         self,
         request: SynapseRequest,
-        client_redirect_url: Optional[bytes],
-        ui_auth_session_id: Optional[str] = None,
+        client_redirect_url: bytes | None,
+        ui_auth_session_id: str | None = None,
     ) -> str:
         """Handle an incoming request to /login/sso/redirect
 
@@ -303,7 +303,7 @@ class SamlHandler:
                 emails=result.get("emails", []),
             )
 
-        async def grandfather_existing_users() -> Optional[str]:
+        async def grandfather_existing_users() -> str | None:
             # backwards-compatibility hack: see if there is an existing user with a
             # suitable mapping from the uid
             if (
@@ -341,7 +341,7 @@ class SamlHandler:
     def _remote_id_from_saml_response(
         self,
         saml2_auth: saml2.response.AuthnResponse,
-        client_redirect_url: Optional[str],
+        client_redirect_url: str | None,
     ) -> str:
         """Extract the unique remote id from a SAML2 AuthnResponse
 
@@ -393,7 +393,7 @@ def dot_replace_for_mxid(username: str) -> str:
     return username
 
 
-MXID_MAPPER_MAP: Dict[str, Callable[[str], str]] = {
+MXID_MAPPER_MAP: dict[str, Callable[[str], str]] = {
     "hexencode": map_username_to_mxid_localpart,
     "dotreplace": dot_replace_for_mxid,
 }
@@ -509,7 +509,7 @@ class DefaultSamlMappingProvider:
         return SamlConfig(mxid_source_attribute, mxid_mapper)
 
     @staticmethod
-    def get_saml_attributes(config: SamlConfig) -> Tuple[Set[str], Set[str]]:
+    def get_saml_attributes(config: SamlConfig) -> tuple[set[str], set[str]]:
         """Returns the required attributes of a SAML
 
         Args:
diff --git a/synapse/handlers/search.py b/synapse/handlers/search.py
index 1a71135d5f..56c047b0e8 100644
--- a/synapse/handlers/search.py
+++ b/synapse/handlers/search.py
@@ -21,7 +21,7 @@
 
 import itertools
 import logging
-from typing import TYPE_CHECKING, Dict, Iterable, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Iterable
 
 import attr
 from unpaddedbase64 import decode_base64, encode_base64
@@ -33,7 +33,7 @@ from synapse.events import EventBase
 from synapse.events.utils import SerializeEventConfig
 from synapse.types import JsonDict, Requester, StrCollection, StreamKeyType, UserID
 from synapse.types.state import StateFilter
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -46,13 +46,13 @@ class _SearchResult:
     # The count of results.
     count: int
     # A mapping of event ID to the rank of that event.
-    rank_map: Dict[str, int]
+    rank_map: dict[str, int]
     # A list of the resulting events.
-    allowed_events: List[EventBase]
+    allowed_events: list[EventBase]
     # A map of room ID to results.
-    room_groups: Dict[str, JsonDict]
+    room_groups: dict[str, JsonDict]
     # A set of event IDs to highlight.
-    highlights: Set[str]
+    highlights: set[str]
 
 
 class SearchHandler:
@@ -117,7 +117,7 @@ class SearchHandler:
         return historical_room_ids
 
     async def search(
-        self, requester: Requester, content: JsonDict, batch: Optional[str] = None
+        self, requester: Requester, content: JsonDict, batch: str | None = None
     ) -> JsonDict:
         """Performs a full text search for a user.
 
@@ -226,18 +226,18 @@ class SearchHandler:
     async def _search(
         self,
         requester: Requester,
-        batch_group: Optional[str],
-        batch_group_key: Optional[str],
-        batch_token: Optional[str],
+        batch_group: str | None,
+        batch_group_key: str | None,
+        batch_token: str | None,
         search_term: str,
-        keys: List[str],
+        keys: list[str],
         filter_dict: JsonDict,
         order_by: str,
         include_state: bool,
-        group_keys: List[str],
-        event_context: Optional[bool],
-        before_limit: Optional[int],
-        after_limit: Optional[int],
+        group_keys: list[str],
+        event_context: bool | None,
+        before_limit: int | None,
+        after_limit: int | None,
         include_profile: bool,
     ) -> JsonDict:
         """Performs a full text search for a user.
@@ -286,7 +286,7 @@ class SearchHandler:
         # If doing a subset of all rooms search, check if any of the rooms
         # are from an upgraded room, and search their contents as well
         if search_filter.rooms:
-            historical_room_ids: List[str] = []
+            historical_room_ids: list[str] = []
             for room_id in search_filter.rooms:
                 # Add any previous rooms to the search if they exist
                 ids = await self.get_old_rooms_from_upgraded_room(room_id)
@@ -307,7 +307,7 @@ class SearchHandler:
                 }
             }
 
-        sender_group: Optional[Dict[str, JsonDict]]
+        sender_group: dict[str, JsonDict] | None
 
         if order_by == "rank":
             search_result, sender_group = await self._search_by_rank(
@@ -442,7 +442,7 @@ class SearchHandler:
         search_term: str,
         keys: Iterable[str],
         search_filter: Filter,
-    ) -> Tuple[_SearchResult, Dict[str, JsonDict]]:
+    ) -> tuple[_SearchResult, dict[str, JsonDict]]:
         """
         Performs a full text search for a user ordering by rank.
 
@@ -461,9 +461,9 @@ class SearchHandler:
         """
         rank_map = {}  # event_id -> rank of event
         # Holds result of grouping by room, if applicable
-        room_groups: Dict[str, JsonDict] = {}
+        room_groups: dict[str, JsonDict] = {}
         # Holds result of grouping by sender, if applicable
-        sender_group: Dict[str, JsonDict] = {}
+        sender_group: dict[str, JsonDict] = {}
 
         search_result = await self.store.search_msgs(room_ids, search_term, keys)
 
@@ -479,7 +479,7 @@ class SearchHandler:
 
         filtered_events = await search_filter.filter([r["event"] for r in results])
 
-        events = await filter_events_for_client(
+        events = await filter_and_transform_events_for_client(
             self._storage_controllers,
             user.to_string(),
             filtered_events,
@@ -517,10 +517,10 @@ class SearchHandler:
         search_term: str,
         keys: Iterable[str],
         search_filter: Filter,
-        batch_group: Optional[str],
-        batch_group_key: Optional[str],
-        batch_token: Optional[str],
-    ) -> Tuple[_SearchResult, Optional[str]]:
+        batch_group: str | None,
+        batch_group_key: str | None,
+        batch_token: str | None,
+    ) -> tuple[_SearchResult, str | None]:
         """
         Performs a full text search for a user ordering by recent.
 
@@ -542,14 +542,14 @@ class SearchHandler:
         """
         rank_map = {}  # event_id -> rank of event
         # Holds result of grouping by room, if applicable
-        room_groups: Dict[str, JsonDict] = {}
+        room_groups: dict[str, JsonDict] = {}
 
         # Holds the next_batch for the entire result set if one of those exists
         global_next_batch = None
 
         highlights = set()
 
-        room_events: List[EventBase] = []
+        room_events: list[EventBase] = []
         i = 0
 
         pagination_token = batch_token
@@ -580,7 +580,7 @@ class SearchHandler:
 
             filtered_events = await search_filter.filter([r["event"] for r in results])
 
-            events = await filter_events_for_client(
+            events = await filter_and_transform_events_for_client(
                 self._storage_controllers,
                 user.to_string(),
                 filtered_events,
@@ -632,11 +632,11 @@ class SearchHandler:
     async def _calculate_event_contexts(
         self,
         user: UserID,
-        allowed_events: List[EventBase],
+        allowed_events: list[EventBase],
         before_limit: int,
         after_limit: int,
         include_profile: bool,
-    ) -> Dict[str, JsonDict]:
+    ) -> dict[str, JsonDict]:
         """
         Calculates the contextual events for any search results.
 
@@ -667,13 +667,13 @@ class SearchHandler:
                 len(res.events_after),
             )
 
-            events_before = await filter_events_for_client(
+            events_before = await filter_and_transform_events_for_client(
                 self._storage_controllers,
                 user.to_string(),
                 res.events_before,
             )
 
-            events_after = await filter_events_for_client(
+            events_after = await filter_and_transform_events_for_client(
                 self._storage_controllers,
                 user.to_string(),
                 res.events_after,
diff --git a/synapse/handlers/send_email.py b/synapse/handlers/send_email.py
index 6469b182c8..8cdf9c6a87 100644
--- a/synapse/handlers/send_email.py
+++ b/synapse/handlers/send_email.py
@@ -24,7 +24,7 @@ import logging
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from io import BytesIO
-from typing import TYPE_CHECKING, Dict, Optional
+from typing import TYPE_CHECKING
 
 from twisted.internet.defer import Deferred
 from twisted.internet.endpoints import HostnameEndpoint
@@ -49,13 +49,13 @@ async def _sendmail(
     from_addr: str,
     to_addr: str,
     msg_bytes: bytes,
-    username: Optional[bytes] = None,
-    password: Optional[bytes] = None,
+    username: bytes | None = None,
+    password: bytes | None = None,
     require_auth: bool = False,
     require_tls: bool = False,
     enable_tls: bool = True,
     force_tls: bool = False,
-    tlsname: Optional[str] = None,
+    tlsname: str | None = None,
 ) -> None:
     """A simple wrapper around ESMTPSenderFactory, to allow substitution in tests
 
@@ -136,7 +136,7 @@ class SendEmailHandler:
         app_name: str,
         html: str,
         text: str,
-        additional_headers: Optional[Dict[str, str]] = None,
+        additional_headers: dict[str, str] | None = None,
     ) -> None:
         """Send a multipart email with the given information.
 
diff --git a/synapse/handlers/set_password.py b/synapse/handlers/set_password.py
index 54116a9b72..042cb4e1b5 100644
--- a/synapse/handlers/set_password.py
+++ b/synapse/handlers/set_password.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import Codes, StoreError, SynapseError
 from synapse.types import Requester
@@ -42,7 +42,7 @@ class SetPasswordHandler:
         user_id: str,
         password_hash: str,
         logout_devices: bool,
-        requester: Optional[Requester] = None,
+        requester: Requester | None = None,
     ) -> None:
         if not self._auth_handler.can_change_password():
             raise SynapseError(403, "Password change disabled", errcode=Codes.FORBIDDEN)
diff --git a/synapse/handlers/sliding_sync/__init__.py b/synapse/handlers/sliding_sync/__init__.py
index 071a271ab7..6feb6c292e 100644
--- a/synapse/handlers/sliding_sync/__init__.py
+++ b/synapse/handlers/sliding_sync/__init__.py
@@ -15,8 +15,9 @@
 import itertools
 import logging
 from itertools import chain
-from typing import TYPE_CHECKING, AbstractSet, Dict, List, Mapping, Optional, Set, Tuple
+from typing import TYPE_CHECKING, AbstractSet, Mapping
 
+import attr
 from prometheus_client import Histogram
 from typing_extensions import assert_never
 
@@ -62,6 +63,7 @@ from synapse.types.handlers.sliding_sync import (
     HaveSentRoomFlag,
     MutablePerConnectionState,
     PerConnectionState,
+    RoomLazyMembershipChanges,
     RoomSyncConfig,
     SlidingSyncConfig,
     SlidingSyncResult,
@@ -69,7 +71,7 @@ from synapse.types.handlers.sliding_sync import (
 )
 from synapse.types.state import StateFilter
 from synapse.util.async_helpers import concurrently_execute
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -106,7 +108,7 @@ class SlidingSyncHandler:
         self.rooms_to_exclude_globally = hs.config.server.rooms_to_exclude_from_sync
         self.is_mine_id = hs.is_mine_id
 
-        self.connection_store = SlidingSyncConnectionStore(self.store)
+        self.connection_store = SlidingSyncConnectionStore(self.clock, self.store)
         self.extensions = SlidingSyncExtensionHandler(hs)
         self.room_lists = SlidingSyncRoomLists(hs)
 
@@ -114,9 +116,9 @@ class SlidingSyncHandler:
         self,
         requester: Requester,
         sync_config: SlidingSyncConfig,
-        from_token: Optional[SlidingSyncStreamToken] = None,
+        from_token: SlidingSyncStreamToken | None = None,
         timeout_ms: int = 0,
-    ) -> Tuple[SlidingSyncResult, bool]:
+    ) -> tuple[SlidingSyncResult, bool]:
         """
         Get the sync for a client if we have new data for it now. Otherwise
         wait for new data to arrive on the server. If the timeout expires, then
@@ -201,7 +203,7 @@ class SlidingSyncHandler:
         self,
         sync_config: SlidingSyncConfig,
         to_token: StreamToken,
-        from_token: Optional[SlidingSyncStreamToken] = None,
+        from_token: SlidingSyncStreamToken | None = None,
     ) -> SlidingSyncResult:
         """
         Generates the response body of a Sliding Sync result, represented as a
@@ -211,7 +213,7 @@ class SlidingSyncHandler:
 
         Args:
             sync_config: Sync configuration
-            to_token: The point in the stream to sync up to.
+            to_token: The latest point in the stream to sync up to.
             from_token: The point in the stream to sync from. Token of the end of the
                 previous batch. May be `None` if this is the initial sync request.
         """
@@ -262,7 +264,7 @@ class SlidingSyncHandler:
         relevant_rooms_to_send_map = interested_rooms.relevant_rooms_to_send_map
 
         # Fetch room data
-        rooms: Dict[str, SlidingSyncResult.RoomResult] = {}
+        rooms: dict[str, SlidingSyncResult.RoomResult] = {}
 
         new_connection_state = previous_connection_state.get_mutable()
 
@@ -490,7 +492,7 @@ class SlidingSyncHandler:
         room_membership_for_user_at_to_token: RoomsForUserType,
         from_token: RoomStreamToken,
         to_token: RoomStreamToken,
-    ) -> List[StateDelta]:
+    ) -> list[StateDelta]:
         """
         Get the state deltas between two tokens taking into account the user's
         membership. If the user is LEAVE/BAN, we will only get the state deltas up to
@@ -550,7 +552,7 @@ class SlidingSyncHandler:
         room_id: str,
         room_sync_config: RoomSyncConfig,
         room_membership_for_user_at_to_token: RoomsForUserType,
-        from_token: Optional[SlidingSyncStreamToken],
+        from_token: SlidingSyncStreamToken | None,
         to_token: StreamToken,
         newly_joined: bool,
         newly_left: bool,
@@ -677,11 +679,11 @@ class SlidingSyncHandler:
         # membership. Currently, we have to make all of these optional because
         # `invite`/`knock` rooms only have `stripped_state`. See
         # https://github.com/matrix-org/matrix-spec-proposals/pull/3575#discussion_r1653045932
-        timeline_events: List[EventBase] = []
-        bundled_aggregations: Optional[Dict[str, BundledAggregations]] = None
-        limited: Optional[bool] = None
-        prev_batch_token: Optional[StreamToken] = None
-        num_live: Optional[int] = None
+        timeline_events: list[EventBase] = []
+        bundled_aggregations: dict[str, BundledAggregations] | None = None
+        limited: bool | None = None
+        prev_batch_token: StreamToken | None = None
+        num_live: int | None = None
         if (
             room_sync_config.timeline_limit > 0
             # No timeline for invite/knock rooms (just `stripped_state`)
@@ -753,7 +755,7 @@ class SlidingSyncHandler:
             timeline_events.reverse()
 
             # Make sure we don't expose any events that the client shouldn't see
-            timeline_events = await filter_events_for_client(
+            timeline_events = await filter_and_transform_events_for_client(
                 self.storage_controllers,
                 user.to_string(),
                 timeline_events,
@@ -761,8 +763,6 @@ class SlidingSyncHandler:
                 != Membership.JOIN,
                 filter_send_to_client=True,
             )
-            # TODO: Filter out `EventTypes.CallInvite` in public rooms,
-            # see https://github.com/element-hq/synapse/issues/17359
 
             # TODO: Handle timeline gaps (`get_timeline_gaps()`)
 
@@ -813,7 +813,7 @@ class SlidingSyncHandler:
 
         # Figure out any stripped state events for invite/knocks. This allows the
         # potential joiner to identify the room.
-        stripped_state: List[JsonDict] = []
+        stripped_state: list[JsonDict] = []
         if room_membership_for_user_at_to_token.membership in (
             Membership.INVITE,
             Membership.KNOCK,
@@ -850,7 +850,7 @@ class SlidingSyncHandler:
         # For incremental syncs, we can do this first to determine if something relevant
         # has changed and strategically avoid fetching other costly things.
         room_state_delta_id_map: MutableStateMap[str] = {}
-        name_event_id: Optional[str] = None
+        name_event_id: str | None = None
         membership_changed = False
         name_changed = False
         avatar_changed = False
@@ -914,7 +914,7 @@ class SlidingSyncHandler:
         # We only need the room summary for calculating heroes, however if we do
         # fetch it then we can use it to calculate `joined_count` and
         # `invited_count`.
-        room_membership_summary: Optional[Mapping[str, MemberSummary]] = None
+        room_membership_summary: Mapping[str, MemberSummary] | None = None
 
         # `heroes` are required if the room name is not set.
         #
@@ -924,7 +924,7 @@ class SlidingSyncHandler:
         # see https://github.com/matrix-org/matrix-spec/issues/380. This means that
         # clients won't be able to calculate the room name when necessary and just a
         # pitfall we have to deal with until that spec issue is resolved.
-        hero_user_ids: List[str] = []
+        hero_user_ids: list[str] = []
         # TODO: Should we also check for `EventTypes.CanonicalAlias`
         # (`m.room.canonical_alias`) as a fallback for the room name? see
         # https://github.com/matrix-org/matrix-spec-proposals/pull/3575#discussion_r1671260153
@@ -950,8 +950,8 @@ class SlidingSyncHandler:
         #
         # Similarly to other metadata, we only need to calculate the member
         # counts if this is an initial sync or the memberships have changed.
-        joined_count: Optional[int] = None
-        invited_count: Optional[int] = None
+        joined_count: int | None = None
+        invited_count: int | None = None
         if (
             initial or membership_changed
         ) and room_membership_for_user_at_to_token.membership == Membership.JOIN:
@@ -983,14 +983,15 @@ class SlidingSyncHandler:
         #
         # Calculate the `StateFilter` based on the `required_state` for the room
         required_state_filter = StateFilter.none()
-        # The requested `required_state_map` with the lazy membership expanded and
-        # `$ME` replaced with the user's ID. This allows us to see what membership we've
-        # sent down to the client in the next request.
-        #
-        # Make a copy so we can modify it. Still need to be careful to make a copy of
-        # the state key sets if we want to add/remove from them. We could make a deep
-        # copy but this saves us some work.
-        expanded_required_state_map = dict(room_sync_config.required_state_map)
+
+        # Keep track of which users' state we may need to fetch. We split this
+        # into explicit users and lazy loaded users.
+        explicit_user_state = set()
+        lazy_load_user_ids = set()
+
+        # Whether lazy-loading of room members is enabled.
+        lazy_load_room_members = False
+
         if room_membership_for_user_at_to_token.membership not in (
             Membership.INVITE,
             Membership.KNOCK,
@@ -1036,9 +1037,8 @@ class SlidingSyncHandler:
                 )
                 required_state_filter = StateFilter.all()
             else:
-                required_state_types: List[Tuple[str, Optional[str]]] = []
+                required_state_types: list[tuple[str, str | None]] = []
                 num_wild_state_keys = 0
-                lazy_load_room_members = False
                 num_others = 0
                 for (
                     state_type,
@@ -1057,7 +1057,7 @@ class SlidingSyncHandler:
                             lazy_load_room_members = True
 
                             # Everyone in the timeline is relevant
-                            timeline_membership: Set[str] = set()
+                            timeline_membership: set[str] = set()
                             if timeline_events is not None:
                                 for timeline_event in timeline_events:
                                     # Anyone who sent a message is relevant
@@ -1070,43 +1070,60 @@ class SlidingSyncHandler:
                                             timeline_event.state_key
                                         )
 
+                            # The client needs to know the membership of everyone in
+                            # the timeline we're returning.
+                            lazy_load_user_ids.update(timeline_membership)
+
                             # Update the required state filter so we pick up the new
                             # membership
-                            for user_id in timeline_membership:
-                                required_state_types.append(
-                                    (EventTypes.Member, user_id)
-                                )
+                            if limited or initial:
+                                # If the timeline is limited, we only need to
+                                # return the membership changes for people in
+                                # the timeline.
+                                for user_id in timeline_membership:
+                                    required_state_types.append(
+                                        (EventTypes.Member, user_id)
+                                    )
+                            else:
+                                # For non-limited timelines we always return all
+                                # membership changes. This is so that clients
+                                # who have fetched the full membership list
+                                # already can continue to maintain it for
+                                # non-limited syncs.
+                                #
+                                # This assumes that for non-limited syncs there
+                                # won't be many membership changes that wouldn't
+                                # have been included already (this can only
+                                # happen if membership state was rolled back due
+                                # to state resolution anyway).
+                                #
+                                # `None` is a wildcard in the `StateFilter`
+                                required_state_types.append((EventTypes.Member, None))
 
-                            # Add an explicit entry for each user in the timeline
-                            #
-                            # Make a new set or copy of the state key set so we can
-                            # modify it without affecting the original
-                            # `required_state_map`
-                            expanded_required_state_map[EventTypes.Member] = (
-                                expanded_required_state_map.get(
-                                    EventTypes.Member, set()
+                                # Record the extra members we're returning.
+                                lazy_load_user_ids.update(
+                                    state_key
+                                    for event_type, state_key in room_state_delta_id_map
+                                    if event_type == EventTypes.Member
                                 )
-                                | timeline_membership
-                            )
-                        elif state_key == StateValues.ME:
+                        else:
                             num_others += 1
-                            required_state_types.append((state_type, user.to_string()))
+
                             # Replace `$ME` with the user's ID so we can deduplicate
                             # when someone requests the same state with `$ME` or with
                             # their user ID.
-                            #
-                            # Make a new set or copy of the state key set so we can
-                            # modify it without affecting the original
-                            # `required_state_map`
-                            expanded_required_state_map[EventTypes.Member] = (
-                                expanded_required_state_map.get(
-                                    EventTypes.Member, set()
-                                )
-                                | {user.to_string()}
+                            normalized_state_key = state_key
+                            if state_key == StateValues.ME:
+                                normalized_state_key = user.to_string()
+
+                            if state_type == EventTypes.Member:
+                                # Also track explicitly requested member state for
+                                # lazy membership tracking.
+                                explicit_user_state.add(normalized_state_key)
+
+                            required_state_types.append(
+                                (state_type, normalized_state_key)
                             )
-                        else:
-                            num_others += 1
-                            required_state_types.append((state_type, state_key))
 
                 set_tag(
                     SynapseTags.FUNC_ARG_PREFIX
@@ -1124,6 +1141,10 @@ class SlidingSyncHandler:
 
                 required_state_filter = StateFilter.from_types(required_state_types)
 
+        # Remove any explicitly requested user state from the lazy-loaded set,
+        # as we track them separately.
+        lazy_load_user_ids -= explicit_user_state
+
         # We need this base set of info for the response so let's just fetch it along
         # with the `required_state` for the room
         hero_room_state = [
@@ -1146,11 +1167,27 @@ class SlidingSyncHandler:
 
         # The required state map to store in the room sync config, if it has
         # changed.
-        changed_required_state_map: Optional[Mapping[str, AbstractSet[str]]] = None
+        changed_required_state_map: Mapping[str, AbstractSet[str]] | None = None
 
         # We can return all of the state that was requested if this was the first
         # time we've sent the room down this connection.
         room_state: StateMap[EventBase] = {}
+
+        # Includes the state for the heroes if we need them (may contain other
+        # state as well).
+        hero_membership_state: StateMap[EventBase] = {}
+
+        # By default, we mark all `lazy_load_user_ids` as being sent down
+        # for the first time in this sync. We later check if we sent any of them
+        # down previously and update `returned_user_id_to_last_seen_ts_map` if
+        # we have.
+        returned_user_id_to_last_seen_ts_map = {}
+        if lazy_load_room_members:
+            returned_user_id_to_last_seen_ts_map = dict.fromkeys(lazy_load_user_ids)
+        new_connection_state.room_lazy_membership[room_id] = RoomLazyMembershipChanges(
+            returned_user_id_to_last_seen_ts_map=returned_user_id_to_last_seen_ts_map
+        )
+
         if initial:
             room_state = await self.get_current_state_at(
                 room_id=room_id,
@@ -1158,28 +1195,97 @@ class SlidingSyncHandler:
                 state_filter=state_filter,
                 to_token=to_token,
             )
+
+            # The `room_state` includes the hero membership state if needed.
+            # We'll later filter this down so we don't need to do so here.
+            hero_membership_state = room_state
         else:
+            assert from_token is not None
             assert from_bound is not None
 
             if prev_room_sync_config is not None:
+                # Define `all_required_user_state` as all user state we want, which
+                # is the explicitly requested members, any needed for lazy
+                # loading, and users whose membership has changed.
+                all_required_user_state = explicit_user_state | lazy_load_user_ids
+                for state_type, state_key in room_state_delta_id_map:
+                    if state_type == EventTypes.Member:
+                        all_required_user_state.add(state_key)
+
+                # We need to know what user state we previously sent down the
+                # connection so we can determine what has changed.
+                #
+                # We need to fetch all users whose memberships we may want
+                # to send down this sync. This includes (and matches
+                # `all_required_user_state`):
+                #   1. Explicitly requested user state
+                #   2. Lazy loaded members, i.e. users who appear in the
+                #      timeline.
+                #   3. The users whose membership has changed in the room, i.e.
+                #      in the state deltas.
+                #
+                # This is to correctly handle the cases where a user was
+                # previously sent down as a lazy loaded member:
+                #   - and is now explicitly requested (so shouldn't be sent down
+                #     again); or
+                #   - their membership has changed (so we need to invalidate
+                #     their entry in the lazy loaded table if we don't send the
+                #     change down).
+                if all_required_user_state:
+                    previously_returned_user_to_last_seen = (
+                        await self.store.get_sliding_sync_connection_lazy_members(
+                            connection_position=from_token.connection_position,
+                            room_id=room_id,
+                            user_ids=all_required_user_state,
+                        )
+                    )
+
+                    # Update the room lazy membership changes to track which
+                    # lazy loaded members were needed for this sync. This is so
+                    # that we can correctly track the last time we sent down
+                    # users' membership (and so can evict old membership state
+                    # from the DB tables).
+                    returned_user_id_to_last_seen_ts_map.update(
+                        (user_id, timestamp)
+                        for user_id, timestamp in previously_returned_user_to_last_seen.items()
+                        if user_id in lazy_load_user_ids
+                    )
+                else:
+                    previously_returned_user_to_last_seen = {}
+
                 # Check if there are any changes to the required state config
                 # that we need to handle.
-                changed_required_state_map, added_state_filter = (
-                    _required_state_changes(
-                        user.to_string(),
-                        prev_required_state_map=prev_room_sync_config.required_state_map,
-                        request_required_state_map=expanded_required_state_map,
-                        state_deltas=room_state_delta_id_map,
-                    )
+                changes_return = _required_state_changes(
+                    user.to_string(),
+                    prev_required_state_map=prev_room_sync_config.required_state_map,
+                    request_required_state_map=room_sync_config.required_state_map,
+                    previously_returned_lazy_user_ids=previously_returned_user_to_last_seen.keys(),
+                    request_lazy_load_user_ids=lazy_load_user_ids,
+                    state_deltas=room_state_delta_id_map,
                 )
+                changed_required_state_map = changes_return.changed_required_state_map
 
-                if added_state_filter:
+                new_connection_state.room_lazy_membership[
+                    room_id
+                ].invalidated_user_ids = changes_return.lazy_members_invalidated
+
+                # Add any previously returned explicit memberships to the lazy
+                # loaded table. This happens when a client requested explicit
+                # members and then converted them to lazy loading.
+                for user_id in changes_return.extra_users_to_add_to_lazy_cache:
+                    # We don't know the right timestamp to use here, as we don't
+                    # know the last time we would have sent the membership down.
+                    # So we don't overwrite it if we have a timestamp already,
+                    # and fallback to `None` (which means now) if we don't.
+                    returned_user_id_to_last_seen_ts_map.setdefault(user_id, None)
+
+                if changes_return.added_state_filter:
                     # Some state entries got added, so we pull out the current
                     # state for them. If we don't do this we'd only send down new deltas.
                     state_ids = await self.get_current_state_ids_at(
                         room_id=room_id,
                         room_membership_for_user_at_to_token=room_membership_for_user_at_to_token,
-                        state_filter=added_state_filter,
+                        state_filter=changes_return.added_state_filter,
                         to_token=to_token,
                     )
                     room_state_delta_id_map.update(state_ids)
@@ -1191,6 +1297,7 @@ class SlidingSyncHandler:
 
             # If the membership changed and we have to get heroes, get the remaining
             # heroes from the state
+            hero_membership_state = {}
             if hero_user_ids:
                 hero_membership_state = await self.get_current_state_at(
                     room_id=room_id,
@@ -1198,14 +1305,13 @@ class SlidingSyncHandler:
                     state_filter=StateFilter.from_types(hero_room_state),
                     to_token=to_token,
                 )
-                room_state.update(hero_membership_state)
 
         required_room_state: StateMap[EventBase] = {}
         if required_state_filter != StateFilter.none():
             required_room_state = required_state_filter.filter_state(room_state)
 
         # Find the room name and avatar from the state
-        room_name: Optional[str] = None
+        room_name: str | None = None
         # TODO: Should we also check for `EventTypes.CanonicalAlias`
         # (`m.room.canonical_alias`) as a fallback for the room name? see
         # https://github.com/matrix-org/matrix-spec-proposals/pull/3575#discussion_r1671260153
@@ -1213,15 +1319,15 @@ class SlidingSyncHandler:
         if name_event is not None:
             room_name = name_event.content.get("name")
 
-        room_avatar: Optional[str] = None
+        room_avatar: str | None = None
         avatar_event = room_state.get((EventTypes.RoomAvatar, ""))
         if avatar_event is not None:
             room_avatar = avatar_event.content.get("url")
 
         # Assemble heroes: extract the info from the state we just fetched
-        heroes: List[SlidingSyncResult.RoomResult.StrippedHero] = []
+        heroes: list[SlidingSyncResult.RoomResult.StrippedHero] = []
         for hero_user_id in hero_user_ids:
-            member_event = room_state.get((EventTypes.Member, hero_user_id))
+            member_event = hero_membership_state.get((EventTypes.Member, hero_user_id))
             if member_event is not None:
                 heroes.append(
                     SlidingSyncResult.RoomResult.StrippedHero(
@@ -1283,7 +1389,7 @@ class SlidingSyncHandler:
             bump_stamp = 0
 
         room_sync_required_state_map_to_persist: Mapping[str, AbstractSet[str]] = (
-            expanded_required_state_map
+            room_sync_config.required_state_map
         )
         if changed_required_state_map:
             room_sync_required_state_map_to_persist = changed_required_state_map
@@ -1374,9 +1480,9 @@ class SlidingSyncHandler:
         self,
         room_id: str,
         to_token: StreamToken,
-        timeline: List[EventBase],
+        timeline: list[EventBase],
         check_outside_timeline: bool,
-    ) -> Optional[int]:
+    ) -> int | None:
         """Get a bump stamp for the room, if we have a bump event and it has
         changed.
 
@@ -1473,13 +1579,37 @@ class SlidingSyncHandler:
             return None
 
 
+@attr.s(auto_attribs=True)
+class _RequiredStateChangesReturn:
+    """Return type for _required_state_changes."""
+
+    changed_required_state_map: Mapping[str, AbstractSet[str]] | None
+    """The updated required state map to store in the room config, or None if
+    there is no change."""
+
+    added_state_filter: StateFilter
+    """The state filter to use to fetch any additional current state that needs
+    to be returned to the client."""
+
+    extra_users_to_add_to_lazy_cache: AbstractSet[str] = frozenset()
+    """The set of user IDs we should add to the lazy members cache that we had
+    previously returned. Handles the case where a user was previously sent down
+    explicitly but is now being lazy loaded."""
+
+    lazy_members_invalidated: AbstractSet[str] = frozenset()
+    """The set of user IDs whose membership has changed but we didn't send down,
+    so we need to invalidate them from the cache."""
+
+
 def _required_state_changes(
     user_id: str,
     *,
     prev_required_state_map: Mapping[str, AbstractSet[str]],
     request_required_state_map: Mapping[str, AbstractSet[str]],
+    previously_returned_lazy_user_ids: AbstractSet[str],
+    request_lazy_load_user_ids: AbstractSet[str],
     state_deltas: StateMap[str],
-) -> Tuple[Optional[Mapping[str, AbstractSet[str]]], StateFilter]:
+) -> _RequiredStateChangesReturn:
     """Calculates the changes between the required state room config from the
     previous requests compared with the current request.
 
@@ -1493,14 +1623,62 @@ def _required_state_changes(
     added, removed and then added again to the required state. In that case we
     only want to re-send that entry down sync if it has changed.
 
-    Returns:
-        A 2-tuple of updated required state config (or None if there is no update)
-        and the state filter to use to fetch extra current state that we need to
-        return.
+    Args:
+        user_id: The user ID of the user making the request.
+        prev_required_state_map: The required state map from the previous
+            request.
+        request_required_state_map: The required state map from the current
+            request.
+        previously_returned_lazy_user_ids: The set of user IDs whose membership
+            we have previously returned to the client due to lazy loading. This
+            is filtered to only include users who have either sent events in the
+            `timeline`, `required_state` or whose membership changed.
+        request_lazy_load_user_ids: The set of user IDs whose lazy-loaded
+            membership is required for this request.
+        state_deltas: The state deltas in the room in the request token range,
+            considering user membership. See `get_current_state_deltas_for_room`
+            for more details.
     """
+
+    # First we find any lazy members that have been invalidated due to state
+    # changes that we are not sending down.
+    lazy_members_invalidated = set()
+    for event_type, state_key in state_deltas:
+        if event_type != EventTypes.Member:
+            continue
+
+        if state_key in request_lazy_load_user_ids:
+            # Because it's part of the `request_lazy_load_user_ids`, we're going to
+            # send this member change down.
+            continue
+
+        if state_key not in previously_returned_lazy_user_ids:
+            # We've not previously returned this member so nothing to
+            # invalidate.
+            continue
+
+        lazy_members_invalidated.add(state_key)
+
     if prev_required_state_map == request_required_state_map:
-        # There has been no change. Return immediately.
-        return None, StateFilter.none()
+        # There has been no change in state, just need to check lazy members.
+        newly_returned_lazy_members = (
+            request_lazy_load_user_ids - previously_returned_lazy_user_ids
+        )
+        if newly_returned_lazy_members:
+            # There are some new lazy members we need to fetch.
+            added_types: list[tuple[str, str | None]] = []
+            for new_user_id in newly_returned_lazy_members:
+                added_types.append((EventTypes.Member, new_user_id))
+
+            added_state_filter = StateFilter.from_types(added_types)
+        else:
+            added_state_filter = StateFilter.none()
+
+        return _RequiredStateChangesReturn(
+            changed_required_state_map=None,
+            added_state_filter=added_state_filter,
+            lazy_members_invalidated=lazy_members_invalidated,
+        )
 
     prev_wildcard = prev_required_state_map.get(StateValues.WILDCARD, set())
     request_wildcard = request_required_state_map.get(StateValues.WILDCARD, set())
@@ -1510,29 +1688,41 @@ def _required_state_changes(
     # already fetching everything, we don't have to fetch anything now that they've
     # narrowed.
     if StateValues.WILDCARD in prev_wildcard:
-        return request_required_state_map, StateFilter.none()
+        return _RequiredStateChangesReturn(
+            changed_required_state_map=request_required_state_map,
+            added_state_filter=StateFilter.none(),
+            lazy_members_invalidated=lazy_members_invalidated,
+        )
 
     # If a event type wildcard has been added or removed we don't try and do
     # anything fancy, and instead always update the effective room required
     # state config to match the request.
     if request_wildcard - prev_wildcard:
         # Some keys were added, so we need to fetch everything
-        return request_required_state_map, StateFilter.all()
+        return _RequiredStateChangesReturn(
+            changed_required_state_map=request_required_state_map,
+            added_state_filter=StateFilter.all(),
+            lazy_members_invalidated=lazy_members_invalidated,
+        )
     if prev_wildcard - request_wildcard:
         # Keys were only removed, so we don't have to fetch everything.
-        return request_required_state_map, StateFilter.none()
+        return _RequiredStateChangesReturn(
+            changed_required_state_map=request_required_state_map,
+            added_state_filter=StateFilter.none(),
+            lazy_members_invalidated=lazy_members_invalidated,
+        )
 
     # Contains updates to the required state map compared with the previous room
     # config. This has the same format as `RoomSyncConfig.required_state`
-    changes: Dict[str, AbstractSet[str]] = {}
+    changes: dict[str, AbstractSet[str]] = {}
 
     # The set of types/state keys that we need to fetch and return to the
     # client. Passed to `StateFilter.from_types(...)`
-    added: List[Tuple[str, Optional[str]]] = []
+    added: list[tuple[str, str | None]] = []
 
     # Convert the list of state deltas to map from type to state_keys that have
     # changed.
-    changed_types_to_state_keys: Dict[str, Set[str]] = {}
+    changed_types_to_state_keys: dict[str, set[str]] = {}
     for event_type, state_key in state_deltas:
         changed_types_to_state_keys.setdefault(event_type, set()).add(state_key)
 
@@ -1552,6 +1742,17 @@ def _required_state_changes(
             # Nothing *added*, so we skip. Removals happen below.
             continue
 
+        # Handle the special case of adding `$LAZY` membership, where we want to
+        # always record the change to be lazy loading, as we immediately start
+        # using the lazy loading tables so there is no point *not* recording the
+        # change to lazy load in the effective room config.
+        if event_type == EventTypes.Member:
+            old_state_key_lazy = StateValues.LAZY in old_state_keys
+            request_state_key_lazy = StateValues.LAZY in request_state_keys
+            if not old_state_key_lazy and request_state_key_lazy:
+                changes[event_type] = request_state_keys
+                continue
+
         # We only remove state keys from the effective state if they've been
         # removed from the request *and* the state has changed. This ensures
         # that if a client removes and then re-adds a state key, we only send
@@ -1622,9 +1823,31 @@ def _required_state_changes(
                     # LAZY values should also be ignore for event types that are
                     # not membership.
                     pass
+                elif event_type == EventTypes.Member:
+                    if state_key not in previously_returned_lazy_user_ids:
+                        # Only add *explicit* members we haven't previously sent
+                        # down.
+                        added.append((event_type, state_key))
                 else:
                     added.append((event_type, state_key))
 
+    previously_required_state_members = set(
+        prev_required_state_map.get(EventTypes.Member, ())
+    )
+    if StateValues.ME in previously_required_state_members:
+        previously_required_state_members.add(user_id)
+
+    # We also need to pull out any lazy members that are now required but
+    # haven't previously been returned.
+    for required_user_id in (
+        request_lazy_load_user_ids
+        # Remove previously returned users
+        - previously_returned_lazy_user_ids
+        # Exclude previously explicitly requested members.
+        - previously_required_state_members
+    ):
+        added.append((EventTypes.Member, required_user_id))
+
     added_state_filter = StateFilter.from_types(added)
 
     # Figure out what changes we need to apply to the effective required state
@@ -1665,13 +1888,25 @@ def _required_state_changes(
             changes[event_type] = request_state_keys
             continue
 
+        # When handling $LAZY membership, we want to either a) not update the
+        # state or b) update it to match the request. This is to avoid churn of
+        # the effective required state for rooms (we deduplicate required state
+        # between rooms), and because we can store the previously returned
+        # explicit memberships with the lazy loaded memberships.
         if event_type == EventTypes.Member:
             old_state_key_lazy = StateValues.LAZY in old_state_keys
             request_state_key_lazy = StateValues.LAZY in request_state_keys
+            has_lazy = old_state_key_lazy or request_state_key_lazy
 
+            # If a "$LAZY" has been added or removed we always update to match
+            # the request.
             if old_state_key_lazy != request_state_key_lazy:
-                # If a "$LAZY" has been added or removed we always update the effective room
-                # required state config to match the request.
+                changes[event_type] = request_state_keys
+                continue
+
+            # Or if we have lazy membership and there are invalidated
+            # explicit memberships.
+            if has_lazy and invalidated_state_keys:
                 changes[event_type] = request_state_keys
                 continue
 
@@ -1686,6 +1921,28 @@ def _required_state_changes(
         if invalidated_state_keys:
             changes[event_type] = old_state_keys - invalidated_state_keys
 
+    # Check for any explicit membership changes that were removed that we can
+    # add to the lazy members previously returned. This is so that we don't
+    # return a user due to lazy loading if they were previously returned as an
+    # explicit membership.
+    users_to_add_to_lazy_cache: set[str] = set()
+
+    membership_changes = changes.get(EventTypes.Member, set())
+    if membership_changes and StateValues.LAZY in request_state_keys:
+        for state_key in prev_required_state_map.get(EventTypes.Member, set()):
+            if state_key == StateValues.WILDCARD or state_key == StateValues.LAZY:
+                # Ignore non-user IDs.
+                continue
+
+            if state_key == StateValues.ME:
+                # Normalize to proper user ID
+                state_key = user_id
+
+            # We remember the user if they haven't been invalidated
+            if (EventTypes.Member, state_key) not in state_deltas:
+                users_to_add_to_lazy_cache.add(state_key)
+
+    new_required_state_map = None
     if changes:
         # Update the required state config based on the changes.
         new_required_state_map = dict(prev_required_state_map)
@@ -1696,6 +1953,9 @@ def _required_state_changes(
                 # Remove entries with empty state keys.
                 new_required_state_map.pop(event_type, None)
 
-        return new_required_state_map, added_state_filter
-    else:
-        return None, added_state_filter
+    return _RequiredStateChangesReturn(
+        changed_required_state_map=new_required_state_map,
+        added_state_filter=added_state_filter,
+        lazy_members_invalidated=lazy_members_invalidated,
+        extra_users_to_add_to_lazy_cache=users_to_add_to_lazy_cache,
+    )
diff --git a/synapse/handlers/sliding_sync/extensions.py b/synapse/handlers/sliding_sync/extensions.py
index 077887ec32..9b7a01df14 100644
--- a/synapse/handlers/sliding_sync/extensions.py
+++ b/synapse/handlers/sliding_sync/extensions.py
@@ -14,20 +14,17 @@
 
 import itertools
 import logging
+from collections import ChainMap
 from typing import (
     TYPE_CHECKING,
     AbstractSet,
-    ChainMap,
-    Dict,
     Mapping,
     MutableMapping,
-    Optional,
     Sequence,
-    Set,
     cast,
 )
 
-from typing_extensions import assert_never
+from typing_extensions import TypeAlias, assert_never
 
 from synapse.api.constants import AccountDataTypes, EduTypes
 from synapse.handlers.receipts import ReceiptEventSource
@@ -40,6 +37,7 @@ from synapse.types import (
     SlidingSyncStreamToken,
     StrCollection,
     StreamToken,
+    ThreadSubscriptionsToken,
 )
 from synapse.types.handlers.sliding_sync import (
     HaveSentRoomFlag,
@@ -54,6 +52,13 @@ from synapse.util.async_helpers import (
     gather_optional_coroutines,
 )
 
+_ThreadSubscription: TypeAlias = (
+    SlidingSyncResult.Extensions.ThreadSubscriptionsExtension.ThreadSubscription
+)
+_ThreadUnsubscription: TypeAlias = (
+    SlidingSyncResult.Extensions.ThreadSubscriptionsExtension.ThreadUnsubscription
+)
+
 if TYPE_CHECKING:
     from synapse.server import HomeServer
 
@@ -68,6 +73,7 @@ class SlidingSyncExtensionHandler:
         self.event_sources = hs.get_event_sources()
         self.device_handler = hs.get_device_handler()
         self.push_rules_handler = hs.get_push_rules_handler()
+        self._enable_thread_subscriptions = hs.config.experimental.msc4306_enabled
 
     @trace
     async def get_extensions_response(
@@ -76,10 +82,10 @@ class SlidingSyncExtensionHandler:
         previous_connection_state: "PerConnectionState",
         new_connection_state: "MutablePerConnectionState",
         actual_lists: Mapping[str, SlidingSyncResult.SlidingWindowList],
-        actual_room_ids: Set[str],
+        actual_room_ids: set[str],
         actual_room_response_map: Mapping[str, SlidingSyncResult.RoomResult],
         to_token: StreamToken,
-        from_token: Optional[SlidingSyncStreamToken],
+        from_token: SlidingSyncStreamToken | None,
     ) -> SlidingSyncResult.Extensions:
         """Handle extension requests.
 
@@ -93,7 +99,7 @@ class SlidingSyncExtensionHandler:
             actual_room_ids: The actual room IDs in the the Sliding Sync response.
             actual_room_response_map: A map of room ID to room results in the the
                 Sliding Sync response.
-            to_token: The point in the stream to sync up to.
+            to_token: The latest point in the stream to sync up to.
             from_token: The point in the stream to sync from.
         """
 
@@ -156,18 +162,32 @@ class SlidingSyncExtensionHandler:
                 from_token=from_token,
             )
 
+        thread_subs_coro = None
+        if (
+            sync_config.extensions.thread_subscriptions is not None
+            and self._enable_thread_subscriptions
+        ):
+            thread_subs_coro = self.get_thread_subscriptions_extension_response(
+                sync_config=sync_config,
+                thread_subscriptions_request=sync_config.extensions.thread_subscriptions,
+                to_token=to_token,
+                from_token=from_token,
+            )
+
         (
             to_device_response,
             e2ee_response,
             account_data_response,
             receipts_response,
             typing_response,
+            thread_subs_response,
         ) = await gather_optional_coroutines(
             to_device_coro,
             e2ee_coro,
             account_data_coro,
             receipts_coro,
             typing_coro,
+            thread_subs_coro,
         )
 
         return SlidingSyncResult.Extensions(
@@ -176,15 +196,16 @@ class SlidingSyncExtensionHandler:
             account_data=account_data_response,
             receipts=receipts_response,
             typing=typing_response,
+            thread_subscriptions=thread_subs_response,
         )
 
     def find_relevant_room_ids_for_extension(
         self,
-        requested_lists: Optional[StrCollection],
-        requested_room_ids: Optional[StrCollection],
+        requested_lists: StrCollection | None,
+        requested_room_ids: StrCollection | None,
         actual_lists: Mapping[str, SlidingSyncResult.SlidingWindowList],
         actual_room_ids: AbstractSet[str],
-    ) -> Set[str]:
+    ) -> set[str]:
         """
         Handle the reserved `lists`/`rooms` keys for extensions. Extensions should only
         return results for rooms in the Sliding Sync response. This matches up the
@@ -207,7 +228,7 @@ class SlidingSyncExtensionHandler:
 
         # We only want to include account data for rooms that are already in the sliding
         # sync response AND that were requested in the account data request.
-        relevant_room_ids: Set[str] = set()
+        relevant_room_ids: set[str] = set()
 
         # See what rooms from the room subscriptions we should get account data for
         if requested_room_ids is not None:
@@ -224,7 +245,7 @@ class SlidingSyncExtensionHandler:
         if requested_lists is not None:
             for list_key in requested_lists:
                 # Just some typing because we share the variable name in multiple places
-                actual_list: Optional[SlidingSyncResult.SlidingWindowList] = None
+                actual_list: SlidingSyncResult.SlidingWindowList | None = None
 
                 # A wildcard means we process rooms from all lists
                 if list_key == "*":
@@ -255,7 +276,7 @@ class SlidingSyncExtensionHandler:
         sync_config: SlidingSyncConfig,
         to_device_request: SlidingSyncConfig.Extensions.ToDeviceExtension,
         to_token: StreamToken,
-    ) -> Optional[SlidingSyncResult.Extensions.ToDeviceExtension]:
+    ) -> SlidingSyncResult.Extensions.ToDeviceExtension | None:
         """Handle to-device extension (MSC3885)
 
         Args:
@@ -330,8 +351,8 @@ class SlidingSyncExtensionHandler:
         sync_config: SlidingSyncConfig,
         e2ee_request: SlidingSyncConfig.Extensions.E2eeExtension,
         to_token: StreamToken,
-        from_token: Optional[SlidingSyncStreamToken],
-    ) -> Optional[SlidingSyncResult.Extensions.E2eeExtension]:
+        from_token: SlidingSyncStreamToken | None,
+    ) -> SlidingSyncResult.Extensions.E2eeExtension | None:
         """Handle E2EE device extension (MSC3884)
 
         Args:
@@ -347,7 +368,7 @@ class SlidingSyncExtensionHandler:
         if not e2ee_request.enabled:
             return None
 
-        device_list_updates: Optional[DeviceListUpdates] = None
+        device_list_updates: DeviceListUpdates | None = None
         if from_token is not None:
             # TODO: This should take into account the `from_token` and `to_token`
             device_list_updates = await self.device_handler.get_user_ids_changed(
@@ -382,11 +403,11 @@ class SlidingSyncExtensionHandler:
         previous_connection_state: "PerConnectionState",
         new_connection_state: "MutablePerConnectionState",
         actual_lists: Mapping[str, SlidingSyncResult.SlidingWindowList],
-        actual_room_ids: Set[str],
+        actual_room_ids: set[str],
         account_data_request: SlidingSyncConfig.Extensions.AccountDataExtension,
         to_token: StreamToken,
-        from_token: Optional[SlidingSyncStreamToken],
-    ) -> Optional[SlidingSyncResult.Extensions.AccountDataExtension]:
+        from_token: SlidingSyncStreamToken | None,
+    ) -> SlidingSyncResult.Extensions.AccountDataExtension | None:
         """Handle Account Data extension (MSC3959)
 
         Args:
@@ -457,7 +478,7 @@ class SlidingSyncExtensionHandler:
             # down account data previously or not, so we split the relevant
             # rooms up into different collections based on status.
             live_rooms = set()
-            previously_rooms: Dict[str, int] = {}
+            previously_rooms: dict[str, int] = {}
             initial_rooms = set()
 
             for room_id in relevant_room_ids:
@@ -614,12 +635,12 @@ class SlidingSyncExtensionHandler:
         previous_connection_state: "PerConnectionState",
         new_connection_state: "MutablePerConnectionState",
         actual_lists: Mapping[str, SlidingSyncResult.SlidingWindowList],
-        actual_room_ids: Set[str],
+        actual_room_ids: set[str],
         actual_room_response_map: Mapping[str, SlidingSyncResult.RoomResult],
         receipts_request: SlidingSyncConfig.Extensions.ReceiptsExtension,
         to_token: StreamToken,
-        from_token: Optional[SlidingSyncStreamToken],
-    ) -> Optional[SlidingSyncResult.Extensions.ReceiptsExtension]:
+        from_token: SlidingSyncStreamToken | None,
+    ) -> SlidingSyncResult.Extensions.ReceiptsExtension | None:
         """Handle Receipts extension (MSC3960)
 
         Args:
@@ -647,13 +668,13 @@ class SlidingSyncExtensionHandler:
             actual_room_ids=actual_room_ids,
         )
 
-        room_id_to_receipt_map: Dict[str, JsonMapping] = {}
+        room_id_to_receipt_map: dict[str, JsonMapping] = {}
         if len(relevant_room_ids) > 0:
             # We need to handle the different cases depending on if we have sent
             # down receipts previously or not, so we split the relevant rooms
             # up into different collections based on status.
             live_rooms = set()
-            previously_rooms: Dict[str, MultiWriterStreamToken] = {}
+            previously_rooms: dict[str, MultiWriterStreamToken] = {}
             initial_rooms = set()
 
             for room_id in relevant_room_ids:
@@ -818,12 +839,12 @@ class SlidingSyncExtensionHandler:
         self,
         sync_config: SlidingSyncConfig,
         actual_lists: Mapping[str, SlidingSyncResult.SlidingWindowList],
-        actual_room_ids: Set[str],
+        actual_room_ids: set[str],
         actual_room_response_map: Mapping[str, SlidingSyncResult.RoomResult],
         typing_request: SlidingSyncConfig.Extensions.TypingExtension,
         to_token: StreamToken,
-        from_token: Optional[SlidingSyncStreamToken],
-    ) -> Optional[SlidingSyncResult.Extensions.TypingExtension]:
+        from_token: SlidingSyncStreamToken | None,
+    ) -> SlidingSyncResult.Extensions.TypingExtension | None:
         """Handle Typing Notification extension (MSC3961)
 
         Args:
@@ -848,7 +869,7 @@ class SlidingSyncExtensionHandler:
             actual_room_ids=actual_room_ids,
         )
 
-        room_id_to_typing_map: Dict[str, JsonMapping] = {}
+        room_id_to_typing_map: dict[str, JsonMapping] = {}
         if len(relevant_room_ids) > 0:
             # Note: We don't need to take connection tracking into account for typing
             # notifications because they'll get anything still relevant and hasn't timed
@@ -877,3 +898,72 @@ class SlidingSyncExtensionHandler:
         return SlidingSyncResult.Extensions.TypingExtension(
             room_id_to_typing_map=room_id_to_typing_map,
         )
+
+    async def get_thread_subscriptions_extension_response(
+        self,
+        sync_config: SlidingSyncConfig,
+        thread_subscriptions_request: SlidingSyncConfig.Extensions.ThreadSubscriptionsExtension,
+        to_token: StreamToken,
+        from_token: SlidingSyncStreamToken | None,
+    ) -> SlidingSyncResult.Extensions.ThreadSubscriptionsExtension | None:
+        """Handle Thread Subscriptions extension (MSC4308)
+
+        Args:
+            sync_config: Sync configuration
+            thread_subscriptions_request: The thread_subscriptions extension from the request
+            to_token: The point in the stream to sync up to.
+            from_token: The point in the stream to sync from.
+
+        Returns:
+            the response (None if empty or thread subscriptions are disabled)
+        """
+        if not thread_subscriptions_request.enabled:
+            return None
+
+        limit = thread_subscriptions_request.limit
+
+        if from_token:
+            from_stream_id = from_token.stream_token.thread_subscriptions_key
+        else:
+            from_stream_id = StreamToken.START.thread_subscriptions_key
+
+        to_stream_id = to_token.thread_subscriptions_key
+
+        updates = await self.store.get_latest_updated_thread_subscriptions_for_user(
+            user_id=sync_config.user.to_string(),
+            from_id=from_stream_id,
+            to_id=to_stream_id,
+            limit=limit,
+        )
+
+        if len(updates) == 0:
+            return None
+
+        subscribed_threads: dict[str, dict[str, _ThreadSubscription]] = {}
+        unsubscribed_threads: dict[str, dict[str, _ThreadUnsubscription]] = {}
+        for stream_id, room_id, thread_root_id, subscribed, automatic in updates:
+            if subscribed:
+                subscribed_threads.setdefault(room_id, {})[thread_root_id] = (
+                    _ThreadSubscription(
+                        automatic=automatic,
+                        bump_stamp=stream_id,
+                    )
+                )
+            else:
+                unsubscribed_threads.setdefault(room_id, {})[thread_root_id] = (
+                    _ThreadUnsubscription(bump_stamp=stream_id)
+                )
+
+        prev_batch = None
+        if len(updates) == limit:
+            # Tell the client about a potential gap where there may be more
+            # thread subscriptions for it to backpaginate.
+            # We subtract one because the 'later in the stream' bound is inclusive,
+            # and we already saw the element at index 0.
+            prev_batch = ThreadSubscriptionsToken(updates[0][0] - 1)
+
+        return SlidingSyncResult.Extensions.ThreadSubscriptionsExtension(
+            subscribed=subscribed_threads,
+            unsubscribed=unsubscribed_threads,
+            prev_batch=prev_batch,
+        )
diff --git a/synapse/handlers/sliding_sync/room_lists.py b/synapse/handlers/sliding_sync/room_lists.py
index e196199f8a..8969d91583 100644
--- a/synapse/handlers/sliding_sync/room_lists.py
+++ b/synapse/handlers/sliding_sync/room_lists.py
@@ -13,21 +13,14 @@
 #
 
 
-import enum
 import logging
 from itertools import chain
 from typing import (
     TYPE_CHECKING,
     AbstractSet,
-    Dict,
-    List,
     Literal,
     Mapping,
     MutableMapping,
-    Optional,
-    Set,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -41,10 +34,12 @@ from synapse.api.constants import (
     EventTypes,
     Membership,
 )
+from synapse.api.errors import SlidingSyncUnknownPosition
 from synapse.api.room_versions import KNOWN_ROOM_VERSIONS
 from synapse.events import StrippedStateEvent
 from synapse.events.utils import parse_stripped_state_event
 from synapse.logging.opentracing import start_active_span, trace
+from synapse.storage.databases.main.sliding_sync import UPDATE_INTERVAL_LAST_USED_TS
 from synapse.storage.databases.main.state import (
     ROOM_UNKNOWN_SENTINEL,
     Sentinel as StateSentinel,
@@ -75,6 +70,8 @@ from synapse.types.handlers.sliding_sync import (
 )
 from synapse.types.state import StateFilter
 from synapse.util import MutableOverlayMapping
+from synapse.util.duration import Duration
+from synapse.util.sentinel import Sentinel
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -83,15 +80,30 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
-class Sentinel(enum.Enum):
-    # defining a sentinel in this way allows mypy to correctly handle the
-    # type of a dictionary lookup and subsequent type narrowing.
-    UNSET_SENTINEL = object()
+# Minimum time in milliseconds since the last sync before we consider expiring
+# the connection due to too many rooms to send. This stops from getting into
+# tight loops with clients that request lots of data at once.
+#
+# c.f. `NUM_ROOMS_THRESHOLD`. These values are somewhat arbitrary picked.
+MINIMUM_NOT_USED_AGE_EXPIRY = Duration(hours=1)
 
+# How many rooms with updates we allow before we consider the connection expired
+# due to too many rooms to send.
+#
+# c.f. `MINIMUM_NOT_USED_AGE_EXPIRY_MS`. These values are somewhat arbitrary
+# picked.
+NUM_ROOMS_THRESHOLD = 100
+
+# Sanity check that our minimum age is sensible compared to the update interval,
+# i.e. if `MINIMUM_NOT_USED_AGE_EXPIRY_MS` is too small then we might expire the
+# connection even if it is actively being used (and we're just not updating the
+# DB frequently enough). We arbitrarily double the update interval to give some
+# wiggle room.
+assert 2 * UPDATE_INTERVAL_LAST_USED_TS < MINIMUM_NOT_USED_AGE_EXPIRY
 
 # Helper definition for the types that we might return. We do this to avoid
 # copying data between types (which can be expensive for many rooms).
-RoomsForUserType = Union[RoomsForUserStateReset, RoomsForUser, RoomsForUserSlidingSync]
+RoomsForUserType = RoomsForUserStateReset | RoomsForUser | RoomsForUserSlidingSync
 
 
 @attr.s(auto_attribs=True, slots=True, frozen=True)
@@ -119,7 +131,7 @@ class SlidingSyncInterestedRooms:
     lists: Mapping[str, SlidingSyncResult.SlidingWindowList]
     relevant_room_map: Mapping[str, RoomSyncConfig]
     relevant_rooms_to_send_map: Mapping[str, RoomSyncConfig]
-    all_rooms: Set[str]
+    all_rooms: set[str]
     room_membership_for_user_map: Mapping[str, RoomsForUserType]
 
     newly_joined_rooms: AbstractSet[str]
@@ -188,13 +200,14 @@ class SlidingSyncRoomLists:
         self.storage_controllers = hs.get_storage_controllers()
         self.rooms_to_exclude_globally = hs.config.server.rooms_to_exclude_from_sync
         self.is_mine_id = hs.is_mine_id
+        self._clock = hs.get_clock()
 
     async def compute_interested_rooms(
         self,
         sync_config: SlidingSyncConfig,
         previous_connection_state: "PerConnectionState",
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
+        from_token: StreamToken | None,
     ) -> SlidingSyncInterestedRooms:
         """Fetch the set of rooms that match the request"""
         has_lists = sync_config.lists is not None and len(sync_config.lists) > 0
@@ -231,18 +244,18 @@ class SlidingSyncRoomLists:
         sync_config: SlidingSyncConfig,
         previous_connection_state: "PerConnectionState",
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
+        from_token: StreamToken | None,
     ) -> SlidingSyncInterestedRooms:
         """Implementation of `compute_interested_rooms` using new sliding sync db tables."""
         user_id = sync_config.user.to_string()
 
         # Assemble sliding window lists
-        lists: Dict[str, SlidingSyncResult.SlidingWindowList] = {}
+        lists: dict[str, SlidingSyncResult.SlidingWindowList] = {}
         # Keep track of the rooms that we can display and need to fetch more info about
-        relevant_room_map: Dict[str, RoomSyncConfig] = {}
+        relevant_room_map: dict[str, RoomSyncConfig] = {}
         # The set of room IDs of all rooms that could appear in any list. These
         # include rooms that are outside the list ranges.
-        all_rooms: Set[str] = set()
+        all_rooms: set[str] = set()
 
         # Note: this won't include rooms the user has left themselves. We add back
         # `newly_left` rooms below. This is more efficient than fetching all rooms and
@@ -478,7 +491,7 @@ class SlidingSyncRoomLists:
 
                     all_rooms.update(filtered_sync_room_map)
 
-                    ops: List[SlidingSyncResult.SlidingWindowList.Operation] = []
+                    ops: list[SlidingSyncResult.SlidingWindowList.Operation] = []
 
                     if list_config.ranges:
                         # Optimization: If we are asking for the full range, we don't
@@ -493,7 +506,7 @@ class SlidingSyncRoomLists:
                             and list_config.ranges[0][1]
                             >= len(filtered_sync_room_map) - 1
                         ):
-                            sorted_room_info: List[RoomsForUserType] = list(
+                            sorted_room_info: list[RoomsForUserType] = list(
                                 filtered_sync_room_map.values()
                             )
                         else:
@@ -502,7 +515,7 @@ class SlidingSyncRoomLists:
                                 # Cast is safe because RoomsForUserSlidingSync is part
                                 # of the `RoomsForUserType` union. Why can't it detect this?
                                 cast(
-                                    Dict[str, RoomsForUserType], filtered_sync_room_map
+                                    dict[str, RoomsForUserType], filtered_sync_room_map
                                 ),
                                 to_token,
                                 # We only need to sort the rooms up to the end
@@ -512,7 +525,7 @@ class SlidingSyncRoomLists:
                             )
 
                         for range in list_config.ranges:
-                            room_ids_in_list: List[str] = []
+                            room_ids_in_list: list[str] = []
 
                             # We're going to loop through the sorted list of rooms starting
                             # at the range start index and keep adding rooms until we fill
@@ -630,7 +643,7 @@ class SlidingSyncRoomLists:
         sync_config: SlidingSyncConfig,
         previous_connection_state: "PerConnectionState",
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
+        from_token: StreamToken | None,
     ) -> SlidingSyncInterestedRooms:
         """Fallback code when the database background updates haven't completed yet."""
 
@@ -645,12 +658,12 @@ class SlidingSyncRoomLists:
         dm_room_ids = await self._get_dm_rooms_for_user(sync_config.user.to_string())
 
         # Assemble sliding window lists
-        lists: Dict[str, SlidingSyncResult.SlidingWindowList] = {}
+        lists: dict[str, SlidingSyncResult.SlidingWindowList] = {}
         # Keep track of the rooms that we can display and need to fetch more info about
-        relevant_room_map: Dict[str, RoomSyncConfig] = {}
+        relevant_room_map: dict[str, RoomSyncConfig] = {}
         # The set of room IDs of all rooms that could appear in any list. These
         # include rooms that are outside the list ranges.
-        all_rooms: Set[str] = set()
+        all_rooms: set[str] = set()
 
         if sync_config.lists:
             with start_active_span("assemble_sliding_window_lists"):
@@ -697,10 +710,10 @@ class SlidingSyncRoomLists:
                         filtered_sync_room_map, to_token
                     )
 
-                    ops: List[SlidingSyncResult.SlidingWindowList.Operation] = []
+                    ops: list[SlidingSyncResult.SlidingWindowList.Operation] = []
                     if list_config.ranges:
                         for range in list_config.ranges:
-                            room_ids_in_list: List[str] = []
+                            room_ids_in_list: list[str] = []
 
                             # We're going to loop through the sorted list of rooms starting
                             # at the range start index and keep adding rooms until we fill
@@ -816,15 +829,15 @@ class SlidingSyncRoomLists:
     async def _filter_relevant_rooms_to_send(
         self,
         previous_connection_state: PerConnectionState,
-        from_token: Optional[StreamToken],
-        relevant_room_map: Dict[str, RoomSyncConfig],
-    ) -> Dict[str, RoomSyncConfig]:
+        from_token: StreamToken | None,
+        relevant_room_map: dict[str, RoomSyncConfig],
+    ) -> dict[str, RoomSyncConfig]:
         """Filters the `relevant_room_map` down to those rooms that may have
         updates we need to fetch and return."""
 
         # Filtered subset of `relevant_room_map` for rooms that may have updates
         # (in the event stream)
-        relevant_rooms_to_send_map: Dict[str, RoomSyncConfig] = relevant_room_map
+        relevant_rooms_to_send_map: dict[str, RoomSyncConfig] = relevant_room_map
         if relevant_room_map:
             with start_active_span("filter_relevant_rooms_to_send"):
                 if from_token:
@@ -869,11 +882,41 @@ class SlidingSyncRoomLists:
 
                     # We only need to check for new events since any state changes
                     # will also come down as new events.
-                    rooms_that_have_updates = (
-                        self.store.get_rooms_that_might_have_updates(
+
+                    rooms_that_have_updates = await (
+                        self.store.get_rooms_that_have_updates_since_sliding_sync_table(
                             relevant_room_map.keys(), from_token.room_key
                         )
                     )
+
+                    # Check if we have lots of updates to send, if so then its
+                    # better for us to tell the client to do a full resync
+                    # instead (to try and avoid long SSS response times when
+                    # there is new data).
+                    #
+                    # Due to the construction of the SSS API, the client is in
+                    # charge of setting the range of rooms to request updates
+                    # for. Generally, it will start with a small range and then
+                    # expand (and occasionally it may contract the range again
+                    # if its been offline for a while). If we know there are a
+                    # lot of updates, it's better to reset the connection and
+                    # wait for the client to start again (with a much smaller
+                    # range) than to try and send down a large number of updates
+                    # (which can take a long time).
+                    #
+                    # We only do this if the last sync was over
+                    # `MINIMUM_NOT_USED_AGE_EXPIRY_MS` to ensure we don't get
+                    # into tight loops with clients that keep requesting large
+                    # sliding sync windows.
+                    if len(rooms_that_have_updates) > NUM_ROOMS_THRESHOLD:
+                        last_sync_ts = previous_connection_state.last_used_ts
+                        if (
+                            last_sync_ts is not None
+                            and (self._clock.time_msec() - last_sync_ts)
+                            > MINIMUM_NOT_USED_AGE_EXPIRY.as_millis()
+                        ):
+                            raise SlidingSyncUnknownPosition()
+
                     rooms_should_send.update(rooms_that_have_updates)
                     relevant_rooms_to_send_map = {
                         room_id: room_sync_config
@@ -889,7 +932,7 @@ class SlidingSyncRoomLists:
         user: UserID,
         rooms_for_user: Mapping[str, RoomsForUserType],
         to_token: StreamToken,
-    ) -> Mapping[str, Optional[RoomsForUser]]:
+    ) -> Mapping[str, RoomsForUser | None]:
         """
         Takes the current set of rooms for a user (retrieved after the given
         token), and returns the changes needed to "rewind" it to match the set of
@@ -914,7 +957,7 @@ class SlidingSyncRoomLists:
         #
         # First, we need to get the max stream_ordering of each event persister instance
         # that we queried events from.
-        instance_to_max_stream_ordering_map: Dict[str, int] = {}
+        instance_to_max_stream_ordering_map: dict[str, int] = {}
         for room_for_user in rooms_for_user.values():
             instance_name = room_for_user.event_pos.instance_name
             stream_ordering = room_for_user.event_pos.stream
@@ -972,12 +1015,12 @@ class SlidingSyncRoomLists:
 
         # Otherwise we're about to make changes to `rooms_for_user`, so we turn
         # it into a mutable dict.
-        changes: Dict[str, Optional[RoomsForUser]] = {}
+        changes: dict[str, RoomsForUser | None] = {}
 
         # Assemble a list of the first membership event after the `to_token` so we can
         # step backward to the previous membership that would apply to the from/to
         # range.
-        first_membership_change_by_room_id_after_to_token: Dict[
+        first_membership_change_by_room_id_after_to_token: dict[
             str, CurrentStateDeltaMembership
         ] = {}
         for membership_change in current_state_delta_membership_changes_after_to_token:
@@ -1038,8 +1081,8 @@ class SlidingSyncRoomLists:
         self,
         user: UserID,
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
-    ) -> Tuple[Dict[str, RoomsForUserType], AbstractSet[str], AbstractSet[str]]:
+        from_token: StreamToken | None,
+    ) -> tuple[dict[str, RoomsForUserType], AbstractSet[str], AbstractSet[str]]:
         """
         Fetch room IDs that the user has had membership in (the full room list including
         long-lost left rooms that will be filtered, sorted, and sliced).
@@ -1114,7 +1157,7 @@ class SlidingSyncRoomLists:
         # Since we fetched the users room list at some point in time after the
         # tokens, we need to revert/rewind some membership changes to match the point in
         # time of the `to_token`.
-        rooms_for_user: Dict[str, RoomsForUserType] = {
+        rooms_for_user: dict[str, RoomsForUserType] = {
             room.room_id: room for room in room_for_user_list
         }
         changes = await self._get_rewind_changes_to_current_membership_to_token(
@@ -1148,8 +1191,8 @@ class SlidingSyncRoomLists:
         self,
         user_id: str,
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
-    ) -> Tuple[AbstractSet[str], Mapping[str, RoomsForUserStateReset]]:
+        from_token: StreamToken | None,
+    ) -> tuple[AbstractSet[str], Mapping[str, RoomsForUserStateReset]]:
         """Fetch the sets of rooms that the user newly joined or left in the
         given token range.
 
@@ -1169,8 +1212,8 @@ class SlidingSyncRoomLists:
             need to check if a membership still exists in the room.
         """
 
-        newly_joined_room_ids: Set[str] = set()
-        newly_left_room_map: Dict[str, RoomsForUserStateReset] = {}
+        newly_joined_room_ids: set[str] = set()
+        newly_left_room_map: dict[str, RoomsForUserStateReset] = {}
 
         if not from_token:
             return newly_joined_room_ids, newly_left_room_map
@@ -1195,8 +1238,8 @@ class SlidingSyncRoomLists:
         self,
         user_id: str,
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
-    ) -> Tuple[AbstractSet[str], Mapping[str, RoomsForUserStateReset]]:
+        from_token: StreamToken | None,
+    ) -> tuple[AbstractSet[str], Mapping[str, RoomsForUserStateReset]]:
         """Fetch the sets of rooms that the user newly joined or left in the
         given token range.
 
@@ -1215,8 +1258,8 @@ class SlidingSyncRoomLists:
             was state reset out of the room. To actually check for a state reset, you
             need to check if a membership still exists in the room.
         """
-        newly_joined_room_ids: Set[str] = set()
-        newly_left_room_map: Dict[str, RoomsForUserStateReset] = {}
+        newly_joined_room_ids: set[str] = set()
+        newly_left_room_map: dict[str, RoomsForUserStateReset] = {}
 
         # We need to figure out the
         #
@@ -1238,20 +1281,20 @@ class SlidingSyncRoomLists:
         # 1) Assemble a list of the last membership events in some given ranges. Someone
         # could have left and joined multiple times during the given range but we only
         # care about end-result so we grab the last one.
-        last_membership_change_by_room_id_in_from_to_range: Dict[
+        last_membership_change_by_room_id_in_from_to_range: dict[
             str, CurrentStateDeltaMembership
         ] = {}
         # We also want to assemble a list of the first membership events during the token
         # range so we can step backward to the previous membership that would apply to
         # before the token range to see if we have `newly_joined` the room.
-        first_membership_change_by_room_id_in_from_to_range: Dict[
+        first_membership_change_by_room_id_in_from_to_range: dict[
             str, CurrentStateDeltaMembership
         ] = {}
         # Keep track if the room has a non-join event in the token range so we can later
         # tell if it was a `newly_joined` room. If the last membership event in the
         # token range is a join and there is also some non-join in the range, we know
         # they `newly_joined`.
-        has_non_join_event_by_room_id_in_from_to_range: Dict[str, bool] = {}
+        has_non_join_event_by_room_id_in_from_to_range: dict[str, bool] = {}
         for (
             membership_change
         ) in current_state_delta_membership_changes_in_from_to_range:
@@ -1361,9 +1404,9 @@ class SlidingSyncRoomLists:
     async def filter_rooms_relevant_for_sync(
         self,
         user: UserID,
-        room_membership_for_user_map: Dict[str, RoomsForUserType],
+        room_membership_for_user_map: dict[str, RoomsForUserType],
         newly_left_room_ids: AbstractSet[str],
-    ) -> Dict[str, RoomsForUserType]:
+    ) -> dict[str, RoomsForUserType]:
         """
         Filter room IDs that should/can be listed for this user in the sync response (the
         full room list that will be further filtered, sorted, and sliced).
@@ -1408,9 +1451,9 @@ class SlidingSyncRoomLists:
     async def check_room_subscription_allowed_for_user(
         self,
         room_id: str,
-        room_membership_for_user_map: Dict[str, RoomsForUserType],
+        room_membership_for_user_map: dict[str, RoomsForUserType],
         to_token: StreamToken,
-    ) -> Optional[RoomsForUserType]:
+    ) -> RoomsForUserType | None:
         """
         Check whether the user is allowed to see the room based on whether they have
         ever had membership in the room or if the room is `world_readable`.
@@ -1475,8 +1518,8 @@ class SlidingSyncRoomLists:
     async def _bulk_get_stripped_state_for_rooms_from_sync_room_map(
         self,
         room_ids: StrCollection,
-        sync_room_map: Dict[str, RoomsForUserType],
-    ) -> Dict[str, Optional[StateMap[StrippedStateEvent]]]:
+        sync_room_map: dict[str, RoomsForUserType],
+    ) -> dict[str, StateMap[StrippedStateEvent] | None]:
         """
         Fetch stripped state for a list of room IDs. Stripped state is only
         applicable to invite/knock rooms. Other rooms will have `None` as their
@@ -1494,8 +1537,8 @@ class SlidingSyncRoomLists:
             Mapping from room_id to mapping of (type, state_key) to stripped state
             event.
         """
-        room_id_to_stripped_state_map: Dict[
-            str, Optional[StateMap[StrippedStateEvent]]
+        room_id_to_stripped_state_map: dict[
+            str, StateMap[StrippedStateEvent] | None
         ] = {}
 
         # Fetch what we haven't before
@@ -1506,7 +1549,7 @@ class SlidingSyncRoomLists:
         ]
 
         # Gather a list of event IDs we can grab stripped state from
-        invite_or_knock_event_ids: List[str] = []
+        invite_or_knock_event_ids: list[str] = []
         for room_id in room_ids_to_fetch:
             if sync_room_map[room_id].membership in (
                 Membership.INVITE,
@@ -1540,7 +1583,7 @@ class SlidingSyncRoomLists:
                     f"Unexpected membership {membership} (this is a problem with Synapse itself)"
                 )
 
-            stripped_state_map: Optional[MutableStateMap[StrippedStateEvent]] = None
+            stripped_state_map: MutableStateMap[StrippedStateEvent] | None = None
             # Scrutinize unsigned things. `raw_stripped_state_events` should be a list
             # of stripped events
             if raw_stripped_state_events is not None:
@@ -1571,13 +1614,11 @@ class SlidingSyncRoomLists:
             # `content.algorithm` from `EventTypes.RoomEncryption`
             "room_encryption",
         ],
-        room_ids: Set[str],
-        sync_room_map: Dict[str, RoomsForUserType],
+        room_ids: set[str],
+        sync_room_map: dict[str, RoomsForUserType],
         to_token: StreamToken,
-        room_id_to_stripped_state_map: Dict[
-            str, Optional[StateMap[StrippedStateEvent]]
-        ],
-    ) -> Mapping[str, Union[Optional[str], StateSentinel]]:
+        room_id_to_stripped_state_map: dict[str, StateMap[StrippedStateEvent] | None],
+    ) -> Mapping[str, str | None | StateSentinel]:
         """
         Get the given state event content for a list of rooms. First we check the
         current state of the room, then fallback to stripped state if available, then
@@ -1599,7 +1640,7 @@ class SlidingSyncRoomLists:
             the given state event (event_type, ""), otherwise `None`. Rooms unknown to
             this server will return `ROOM_UNKNOWN_SENTINEL`.
         """
-        room_id_to_content: Dict[str, Union[Optional[str], StateSentinel]] = {}
+        room_id_to_content: dict[str, str | None | StateSentinel] = {}
 
         # As a bulk shortcut, use the current state if the server is particpating in the
         # room (meaning we have current state). Ideally, for leave/ban rooms, we would
@@ -1656,7 +1697,7 @@ class SlidingSyncRoomLists:
 
         # Update our `room_id_to_content` map based on the stripped state
         # (applies to invite/knock rooms)
-        rooms_ids_without_stripped_state: Set[str] = set()
+        rooms_ids_without_stripped_state: set[str] = set()
         for room_id in room_ids_without_results:
             stripped_state_map = room_id_to_stripped_state_map.get(
                 room_id, Sentinel.UNSET_SENTINEL
@@ -1736,12 +1777,12 @@ class SlidingSyncRoomLists:
     async def filter_rooms(
         self,
         user: UserID,
-        sync_room_map: Dict[str, RoomsForUserType],
+        sync_room_map: dict[str, RoomsForUserType],
         previous_connection_state: PerConnectionState,
         filters: SlidingSyncConfig.SlidingSyncList.Filters,
         to_token: StreamToken,
         dm_room_ids: AbstractSet[str],
-    ) -> Dict[str, RoomsForUserType]:
+    ) -> dict[str, RoomsForUserType]:
         """
         Filter rooms based on the sync request.
 
@@ -1759,8 +1800,8 @@ class SlidingSyncRoomLists:
         """
         user_id = user.to_string()
 
-        room_id_to_stripped_state_map: Dict[
-            str, Optional[StateMap[StrippedStateEvent]]
+        room_id_to_stripped_state_map: dict[
+            str, StateMap[StrippedStateEvent] | None
         ] = {}
 
         filtered_room_id_set = set(sync_room_map.keys())
@@ -1897,7 +1938,7 @@ class SlidingSyncRoomLists:
             with start_active_span("filters.tags"):
                 # Fetch the user tags for their rooms
                 room_tags = await self.store.get_tags_for_user(user_id)
-                room_id_to_tag_name_set: Dict[str, Set[str]] = {
+                room_id_to_tag_name_set: dict[str, set[str]] = {
                     room_id: set(tags.keys()) for room_id, tags in room_tags.items()
                 }
 
@@ -1953,7 +1994,7 @@ class SlidingSyncRoomLists:
         filters: SlidingSyncConfig.SlidingSyncList.Filters,
         to_token: StreamToken,
         dm_room_ids: AbstractSet[str],
-    ) -> Dict[str, RoomsForUserSlidingSync]:
+    ) -> dict[str, RoomsForUserSlidingSync]:
         """
         Filter rooms based on the sync request.
 
@@ -2065,7 +2106,7 @@ class SlidingSyncRoomLists:
             with start_active_span("filters.tags"):
                 # Fetch the user tags for their rooms
                 room_tags = await self.store.get_tags_for_user(user_id)
-                room_id_to_tag_name_set: Dict[str, Set[str]] = {
+                room_id_to_tag_name_set: dict[str, set[str]] = {
                     room_id: set(tags.keys()) for room_id, tags in room_tags.items()
                 }
 
@@ -2115,10 +2156,10 @@ class SlidingSyncRoomLists:
     @trace
     async def sort_rooms(
         self,
-        sync_room_map: Dict[str, RoomsForUserType],
+        sync_room_map: dict[str, RoomsForUserType],
         to_token: StreamToken,
-        limit: Optional[int] = None,
-    ) -> List[RoomsForUserType]:
+        limit: int | None = None,
+    ) -> list[RoomsForUserType]:
         """
         Sort by `stream_ordering` of the last event that the user should see in the
         room. `stream_ordering` is unique so we get a stable sort.
@@ -2139,11 +2180,11 @@ class SlidingSyncRoomLists:
 
         # Assemble a map of room ID to the `stream_ordering` of the last activity that the
         # user should see in the room (<= `to_token`)
-        last_activity_in_room_map: Dict[str, int] = {}
+        last_activity_in_room_map: dict[str, int] = {}
 
         # Same as above, except for positions that we know are in the event
         # stream cache.
-        cached_positions: Dict[str, int] = {}
+        cached_positions: dict[str, int] = {}
 
         earliest_cache_position = (
             self.store._events_stream_cache.get_earliest_known_position()
diff --git a/synapse/handlers/sliding_sync/store.py b/synapse/handlers/sliding_sync/store.py
index d24fccf76f..65febe58aa 100644
--- a/synapse/handlers/sliding_sync/store.py
+++ b/synapse/handlers/sliding_sync/store.py
@@ -13,7 +13,6 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional
 
 import attr
 
@@ -25,9 +24,7 @@ from synapse.types.handlers.sliding_sync import (
     PerConnectionState,
     SlidingSyncConfig,
 )
-
-if TYPE_CHECKING:
-    pass
+from synapse.util.clock import Clock
 
 logger = logging.getLogger(__name__)
 
@@ -61,12 +58,13 @@ class SlidingSyncConnectionStore:
             to mapping of room ID to `HaveSentRoom`.
     """
 
-    store: "DataStore"
+    clock: Clock
+    store: DataStore
 
     async def get_and_clear_connection_positions(
         self,
         sync_config: SlidingSyncConfig,
-        from_token: Optional[SlidingSyncStreamToken],
+        from_token: SlidingSyncStreamToken | None,
     ) -> PerConnectionState:
         """Fetch the per-connection state for the token.
 
@@ -75,7 +73,7 @@ class SlidingSyncConnectionStore:
         """
         # If this is our first request, there is no previous connection state to fetch out of the database
         if from_token is None or from_token.connection_position == 0:
-            return PerConnectionState()
+            return PerConnectionState(last_used_ts=None)
 
         conn_id = sync_config.conn_id or ""
 
@@ -93,7 +91,7 @@ class SlidingSyncConnectionStore:
     async def record_new_state(
         self,
         sync_config: SlidingSyncConfig,
-        from_token: Optional[SlidingSyncStreamToken],
+        from_token: SlidingSyncStreamToken | None,
         new_connection_state: MutablePerConnectionState,
     ) -> int:
         """Record updated per-connection state, returning the connection
@@ -101,7 +99,7 @@ class SlidingSyncConnectionStore:
         If there are no changes to the state this may return the same token as
         the existing per-connection state.
         """
-        if not new_connection_state.has_updates():
+        if not new_connection_state.has_updates(self.clock):
             if from_token is not None:
                 return from_token.connection_position
             else:
diff --git a/synapse/handlers/sso.py b/synapse/handlers/sso.py
index eec420cbb1..bb5ca329e0 100644
--- a/synapse/handlers/sso.py
+++ b/synapse/handlers/sso.py
@@ -27,14 +27,10 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
     Iterable,
-    List,
     Mapping,
     NoReturn,
-    Optional,
     Protocol,
-    Set,
 )
 from urllib.parse import urlencode
 
@@ -74,6 +70,15 @@ class MappingException(Exception):
     """
 
 
+class SsoSetupError(Exception):
+    """
+    Used to catch and tag errors relating to an SSO setup's.
+
+    Used as the superclass of specific error classes,
+    as note we can't e.g. import the OIDC module unless OIDC dependencies are installed.
+    """
+
+
 class SsoIdentityProvider(Protocol):
     """Abstract base class to be implemented by SSO Identity Providers
 
@@ -105,12 +110,12 @@ class SsoIdentityProvider(Protocol):
         """User-facing name for this provider"""
 
     @property
-    def idp_icon(self) -> Optional[str]:
+    def idp_icon(self) -> str | None:
         """Optional MXC URI for user-facing icon"""
         return None
 
     @property
-    def idp_brand(self) -> Optional[str]:
+    def idp_brand(self) -> str | None:
         """Optional branding identifier"""
         return None
 
@@ -118,8 +123,8 @@ class SsoIdentityProvider(Protocol):
     async def handle_redirect_request(
         self,
         request: SynapseRequest,
-        client_redirect_url: Optional[bytes],
-        ui_auth_session_id: Optional[str] = None,
+        client_redirect_url: bytes | None,
+        ui_auth_session_id: str | None = None,
     ) -> str:
         """Handle an incoming request to /login/sso/redirect
 
@@ -144,10 +149,10 @@ class UserAttributes:
     # the localpart of the mxid that the mapper has assigned to the user.
     # if `None`, the mapper has not picked a userid, and the user should be prompted to
     # enter one.
-    localpart: Optional[str]
+    localpart: str | None
     confirm_localpart: bool = False
-    display_name: Optional[str] = None
-    picture: Optional[str] = None
+    display_name: str | None = None
+    picture: str | None = None
     # mypy thinks these are incompatible for some reason.
     emails: StrCollection = attr.Factory(list)
 
@@ -160,19 +165,19 @@ class UsernameMappingSession:
     auth_provider_id: str
 
     # An optional session ID from the IdP.
-    auth_provider_session_id: Optional[str]
+    auth_provider_session_id: str | None
 
     # user ID on the IdP server
     remote_user_id: str
 
     # attributes returned by the ID mapper
-    display_name: Optional[str]
+    display_name: str | None
     emails: StrCollection
-    avatar_url: Optional[str]
+    avatar_url: str | None
 
     # An optional dictionary of extra attributes to be provided to the client in the
     # login response.
-    extra_login_attributes: Optional[JsonDict]
+    extra_login_attributes: JsonDict | None
 
     # where to redirect the client back to
     client_redirect_url: str
@@ -181,11 +186,11 @@ class UsernameMappingSession:
     expiry_time_ms: int
 
     # choices made by the user
-    chosen_localpart: Optional[str] = None
+    chosen_localpart: str | None = None
     use_display_name: bool = True
     use_avatar: bool = True
     emails_to_use: StrCollection = ()
-    terms_accepted_version: Optional[str] = None
+    terms_accepted_version: str | None = None
 
 
 # the HTTP cookie used to track the mapping session id
@@ -224,13 +229,13 @@ class SsoHandler:
         )
 
         # a lock on the mappings
-        self._mapping_lock = Linearizer(name="sso_user_mapping", clock=hs.get_clock())
+        self._mapping_lock = Linearizer(clock=hs.get_clock(), name="sso_user_mapping")
 
         # a map from session id to session data
-        self._username_mapping_sessions: Dict[str, UsernameMappingSession] = {}
+        self._username_mapping_sessions: dict[str, UsernameMappingSession] = {}
 
         # map from idp_id to SsoIdentityProvider
-        self._identity_providers: Dict[str, SsoIdentityProvider] = {}
+        self._identity_providers: dict[str, SsoIdentityProvider] = {}
 
         self._consent_at_registration = hs.config.consent.user_consent_at_registration
 
@@ -281,7 +286,7 @@ class SsoHandler:
         self,
         request: Request,
         error: str,
-        error_description: Optional[str] = None,
+        error_description: str | None = None,
         code: int = 400,
     ) -> None:
         """Renders the error template and responds with it.
@@ -305,7 +310,7 @@ class SsoHandler:
         self,
         request: SynapseRequest,
         client_redirect_url: bytes,
-        idp_id: Optional[str],
+        idp_id: str | None,
     ) -> str:
         """Handle a request to /login/sso/redirect
 
@@ -324,7 +329,7 @@ class SsoHandler:
             )
 
         # if the client chose an IdP, use that
-        idp: Optional[SsoIdentityProvider] = None
+        idp: SsoIdentityProvider | None = None
         if idp_id:
             idp = self._identity_providers.get(idp_id)
             if not idp:
@@ -344,7 +349,7 @@ class SsoHandler:
 
     async def get_sso_user_by_remote_user_id(
         self, auth_provider_id: str, remote_user_id: str
-    ) -> Optional[str]:
+    ) -> str | None:
         """
         Maps the user ID of a remote IdP to a mxid for a previously seen user.
 
@@ -392,9 +397,9 @@ class SsoHandler:
         request: SynapseRequest,
         client_redirect_url: str,
         sso_to_matrix_id_mapper: Callable[[int], Awaitable[UserAttributes]],
-        grandfather_existing_users: Callable[[], Awaitable[Optional[str]]],
-        extra_login_attributes: Optional[JsonDict] = None,
-        auth_provider_session_id: Optional[str] = None,
+        grandfather_existing_users: Callable[[], Awaitable[str | None]],
+        extra_login_attributes: JsonDict | None = None,
+        auth_provider_session_id: str | None = None,
         registration_enabled: bool = True,
     ) -> None:
         """
@@ -526,7 +531,10 @@ class SsoHandler:
                             authenticated_entity=user_id,
                         )
                         await self._profile_handler.set_displayname(
-                            user_id_obj, requester, attributes.display_name, True
+                            user_id_obj,
+                            requester,
+                            attributes.display_name,
+                            by_admin=True,
                         )
                 if attributes.picture:
                     await self.set_avatar(user_id, attributes.picture)
@@ -585,8 +593,8 @@ class SsoHandler:
 
     def _get_url_for_next_new_user_step(
         self,
-        attributes: Optional[UserAttributes] = None,
-        session: Optional[UsernameMappingSession] = None,
+        attributes: UserAttributes | None = None,
+        session: UsernameMappingSession | None = None,
     ) -> bytes:
         """Returns the URL to redirect to for the next step of new user registration
 
@@ -625,8 +633,8 @@ class SsoHandler:
         attributes: UserAttributes,
         client_redirect_url: str,
         next_step_url: bytes,
-        extra_login_attributes: Optional[JsonDict],
-        auth_provider_session_id: Optional[str],
+        extra_login_attributes: JsonDict | None,
+        auth_provider_session_id: str | None,
     ) -> NoReturn:
         """Creates a UsernameMappingSession and redirects the browser
 
@@ -999,7 +1007,7 @@ class SsoHandler:
         session.use_avatar = use_avatar
 
         emails_from_idp = set(session.emails)
-        filtered_emails: Set[str] = set()
+        filtered_emails: set[str] = set()
 
         # we iterate through the list rather than just building a set conjunction, so
         # that we can log attempts to use unknown addresses
@@ -1142,7 +1150,7 @@ class SsoHandler:
     def check_required_attributes(
         self,
         request: SynapseRequest,
-        attributes: Mapping[str, List[Any]],
+        attributes: Mapping[str, list[Any]],
         attribute_requirements: Iterable[SsoAttributeRequirement],
     ) -> bool:
         """
@@ -1178,7 +1186,7 @@ class SsoHandler:
         self,
         auth_provider_id: str,
         auth_provider_session_id: str,
-        expected_user_id: Optional[str] = None,
+        expected_user_id: str | None = None,
     ) -> None:
         """Revoke any devices and in-flight logins tied to a provider session.
 
@@ -1259,7 +1267,7 @@ def get_username_mapping_session_cookie_from_request(request: IRequest) -> str:
 
 
 def _check_attribute_requirement(
-    attributes: Mapping[str, List[Any]], req: SsoAttributeRequirement
+    attributes: Mapping[str, list[Any]], req: SsoAttributeRequirement
 ) -> bool:
     """Check if SSO attributes meet the proper requirements.
 
diff --git a/synapse/handlers/state_deltas.py b/synapse/handlers/state_deltas.py
index 2fbe407a63..db63f0483d 100644
--- a/synapse/handlers/state_deltas.py
+++ b/synapse/handlers/state_deltas.py
@@ -20,7 +20,7 @@
 
 import logging
 from enum import Enum, auto
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -40,8 +40,8 @@ class StateDeltasHandler:
 
     async def _get_key_change(
         self,
-        prev_event_id: Optional[str],
-        event_id: Optional[str],
+        prev_event_id: str | None,
+        event_id: str | None,
         key_name: str,
         public_value: str,
     ) -> MatchChange:
diff --git a/synapse/handlers/stats.py b/synapse/handlers/stats.py
index a2602ea818..c87b5f854a 100644
--- a/synapse/handlers/stats.py
+++ b/synapse/handlers/stats.py
@@ -25,17 +25,14 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Counter as CounterType,
-    Dict,
     Iterable,
-    Optional,
-    Tuple,
 )
 
 from synapse.api.constants import EventContentFields, EventTypes, Membership
 from synapse.metrics import SERVER_NAME_LABEL, event_processing_positions
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.storage.databases.main.state_deltas import StateDelta
 from synapse.types import JsonDict
+from synapse.util.duration import Duration
 from synapse.util.events import get_plain_text_topic_from_event_content
 
 if TYPE_CHECKING:
@@ -65,7 +62,7 @@ class StatsHandler:
         self.stats_enabled = hs.config.stats.stats_enabled
 
         # The current position in the current_state_delta stream
-        self.pos: Optional[int] = None
+        self.pos: int | None = None
 
         # Guard to ensure we only process deltas one at a time
         self._is_processing = False
@@ -75,7 +72,10 @@ class StatsHandler:
 
             # We kick this off so that we don't have to wait for a change before
             # we start populating stats
-            self.clock.call_later(0, self.notify_new_event)
+            self.clock.call_later(
+                Duration(seconds=0),
+                self.notify_new_event,
+            )
 
     def notify_new_event(self) -> None:
         """Called when there may be more deltas to process"""
@@ -90,7 +90,7 @@ class StatsHandler:
             finally:
                 self._is_processing = False
 
-        run_as_background_process("stats.notify_new_event", self.server_name, process)
+        self.hs.run_as_background_process("stats.notify_new_event", process)
 
     async def _unsafe_process(self) -> None:
         # If self.pos is None then means we haven't fetched it from DB
@@ -155,7 +155,7 @@ class StatsHandler:
 
     async def _handle_deltas(
         self, deltas: Iterable[StateDelta]
-    ) -> Tuple[Dict[str, CounterType[str]], Dict[str, CounterType[str]]]:
+    ) -> tuple[dict[str, CounterType[str]], dict[str, CounterType[str]]]:
         """Called with the state deltas to process
 
         Returns:
@@ -163,10 +163,10 @@ class StatsHandler:
             mapping from room/user ID to changes in the various fields.
         """
 
-        room_to_stats_deltas: Dict[str, CounterType[str]] = {}
-        user_to_stats_deltas: Dict[str, CounterType[str]] = {}
+        room_to_stats_deltas: dict[str, CounterType[str]] = {}
+        user_to_stats_deltas: dict[str, CounterType[str]] = {}
 
-        room_to_state_updates: Dict[str, Dict[str, Any]] = {}
+        room_to_state_updates: dict[str, dict[str, Any]] = {}
 
         for delta in deltas:
             logger.debug(
diff --git a/synapse/handlers/sync.py b/synapse/handlers/sync.py
index 7bfe4e8760..c8ef5e2aa6 100644
--- a/synapse/handlers/sync.py
+++ b/synapse/handlers/sync.py
@@ -20,22 +20,12 @@
 #
 import itertools
 import logging
-from enum import Enum
 from typing import (
     TYPE_CHECKING,
     AbstractSet,
     Any,
-    Dict,
-    FrozenSet,
-    List,
-    Literal,
     Mapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
-    Union,
-    overload,
 )
 
 import attr
@@ -46,8 +36,8 @@ from synapse.api.constants import (
     Direction,
     EventContentFields,
     EventTypes,
-    JoinRules,
     Membership,
+    StickyEvent,
 )
 from synapse.api.filtering import FilterCollection
 from synapse.api.presence import UserPresenceState
@@ -88,8 +78,9 @@ from synapse.util.async_helpers import concurrently_execute
 from synapse.util.caches.expiringcache import ExpiringCache
 from synapse.util.caches.lrucache import LruCache
 from synapse.util.caches.response_cache import ResponseCache, ResponseCacheContext
+from synapse.util.cancellation import cancellable
 from synapse.util.metrics import Measure
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -117,26 +108,7 @@ LAZY_LOADED_MEMBERS_CACHE_MAX_AGE = 30 * 60 * 1000
 LAZY_LOADED_MEMBERS_CACHE_MAX_SIZE = 100
 
 
-SyncRequestKey = Tuple[Any, ...]
-
-
-class SyncVersion(Enum):
-    """
-    Enum for specifying the version of sync request. This is used to key which type of
-    sync response that we are generating.
-
-    This is different than the `sync_type` you might see used in other code below; which
-    specifies the sub-type sync request (e.g. initial_sync, full_state_sync,
-    incremental_sync) and is really only relevant for the `/sync` v2 endpoint.
-    """
-
-    # These string values are semantically significant because they are used in the the
-    # metrics
-
-    # Traditional `/sync` endpoint
-    SYNC_V2 = "sync_v2"
-    # Part of MSC3575 Sliding Sync
-    E2EE_SYNC = "e2ee_sync"
+SyncRequestKey = tuple[Any, ...]
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -144,7 +116,7 @@ class SyncConfig:
     user: UserID
     filter_collection: FilterCollection
     is_guest: bool
-    device_id: Optional[str]
+    device_id: str | None
     use_state_after: bool
 
 
@@ -155,7 +127,7 @@ class TimelineBatch:
     limited: bool
     # A mapping of event ID to the bundled aggregations for the above events.
     # This is only calculated if limited is true.
-    bundled_aggregations: Optional[Dict[str, BundledAggregations]] = None
+    bundled_aggregations: dict[str, BundledAggregations] | None = None
 
     def __bool__(self) -> bool:
         """Make the result appear empty if there are no updates. This is used
@@ -174,11 +146,12 @@ class JoinedSyncResult:
     room_id: str
     timeline: TimelineBatch
     state: StateMap[EventBase]
-    ephemeral: List[JsonDict]
-    account_data: List[JsonDict]
+    ephemeral: list[JsonDict]
+    account_data: list[JsonDict]
+    sticky: list[EventBase]
     unread_notifications: JsonDict
     unread_thread_notifications: JsonDict
-    summary: Optional[JsonDict]
+    summary: JsonDict | None
     unread_count: int
 
     def __bool__(self) -> bool:
@@ -186,7 +159,11 @@ class JoinedSyncResult:
         to tell if room needs to be part of the sync result.
         """
         return bool(
-            self.timeline or self.state or self.ephemeral or self.account_data
+            self.timeline
+            or self.state
+            or self.ephemeral
+            or self.account_data
+            or self.sticky
             # nb the notification count does not, er, count: if there's nothing
             # else in the result, we don't need to send it.
         )
@@ -197,7 +174,7 @@ class ArchivedSyncResult:
     room_id: str
     timeline: TimelineBatch
     state: StateMap[EventBase]
-    account_data: List[JsonDict]
+    account_data: list[JsonDict]
 
     def __bool__(self) -> bool:
         """Make the result appear empty if there are no updates. This is used
@@ -232,11 +209,11 @@ class _RoomChanges:
     and left room IDs since last sync.
     """
 
-    room_entries: List["RoomSyncResultBuilder"]
-    invited: List[InvitedSyncResult]
-    knocked: List[KnockedSyncResult]
-    newly_joined_rooms: List[str]
-    newly_left_rooms: List[str]
+    room_entries: list["RoomSyncResultBuilder"]
+    invited: list[InvitedSyncResult]
+    knocked: list[KnockedSyncResult]
+    newly_joined_rooms: list[str]
+    newly_left_rooms: list[str]
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -259,16 +236,16 @@ class SyncResult:
     """
 
     next_batch: StreamToken
-    presence: List[UserPresenceState]
-    account_data: List[JsonDict]
-    joined: List[JoinedSyncResult]
-    invited: List[InvitedSyncResult]
-    knocked: List[KnockedSyncResult]
-    archived: List[ArchivedSyncResult]
-    to_device: List[JsonDict]
+    presence: list[UserPresenceState]
+    account_data: list[JsonDict]
+    joined: list[JoinedSyncResult]
+    invited: list[InvitedSyncResult]
+    knocked: list[KnockedSyncResult]
+    archived: list[ArchivedSyncResult]
+    to_device: list[JsonDict]
     device_lists: DeviceListUpdates
     device_one_time_keys_count: JsonMapping
-    device_unused_fallback_key_types: List[str]
+    device_unused_fallback_key_types: list[str]
 
     def __bool__(self) -> bool:
         """Make the result appear empty if there are no updates. This is used
@@ -290,7 +267,7 @@ class SyncResult:
     def empty(
         next_batch: StreamToken,
         device_one_time_keys_count: JsonMapping,
-        device_unused_fallback_key_types: List[str],
+        device_unused_fallback_key_types: list[str],
     ) -> "SyncResult":
         "Return a new empty result"
         return SyncResult(
@@ -308,26 +285,6 @@ class SyncResult:
         )
 
 
-@attr.s(slots=True, frozen=True, auto_attribs=True)
-class E2eeSyncResult:
-    """
-    Attributes:
-        next_batch: Token for the next sync
-        to_device: List of direct messages for the device.
-        device_lists: List of user_ids whose devices have changed
-        device_one_time_keys_count: Dict of algorithm to count for one time keys
-            for this device
-        device_unused_fallback_key_types: List of key types that have an unused fallback
-            key
-    """
-
-    next_batch: StreamToken
-    to_device: List[JsonDict]
-    device_lists: DeviceListUpdates
-    device_one_time_keys_count: JsonMapping
-    device_unused_fallback_key_types: List[str]
-
-
 class SyncHandler:
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname
@@ -357,15 +314,16 @@ class SyncHandler:
             clock=hs.get_clock(),
             name="sync",
             server_name=self.server_name,
-            timeout_ms=hs.config.caches.sync_response_cache_duration,
+            timeout=hs.config.caches.sync_response_cache_duration,
         )
 
         # ExpiringCache((User, Device)) -> LruCache(user_id => event_id)
         self.lazy_loaded_members_cache: ExpiringCache[
-            Tuple[str, Optional[str]], LruCache[str, str]
+            tuple[str, str | None], LruCache[str, str]
         ] = ExpiringCache(
             cache_name="lazy_loaded_members_cache",
             server_name=self.server_name,
+            hs=hs,
             clock=self.clock,
             max_len=0,
             expiry_ms=LAZY_LOADED_MEMBERS_CACHE_MAX_AGE,
@@ -373,52 +331,15 @@ class SyncHandler:
 
         self.rooms_to_exclude_globally = hs.config.server.rooms_to_exclude_from_sync
 
-    @overload
     async def wait_for_sync_for_user(
         self,
         requester: Requester,
         sync_config: SyncConfig,
-        sync_version: Literal[SyncVersion.SYNC_V2],
         request_key: SyncRequestKey,
-        since_token: Optional[StreamToken] = None,
+        since_token: StreamToken | None = None,
         timeout: int = 0,
         full_state: bool = False,
-    ) -> SyncResult: ...
-
-    @overload
-    async def wait_for_sync_for_user(
-        self,
-        requester: Requester,
-        sync_config: SyncConfig,
-        sync_version: Literal[SyncVersion.E2EE_SYNC],
-        request_key: SyncRequestKey,
-        since_token: Optional[StreamToken] = None,
-        timeout: int = 0,
-        full_state: bool = False,
-    ) -> E2eeSyncResult: ...
-
-    @overload
-    async def wait_for_sync_for_user(
-        self,
-        requester: Requester,
-        sync_config: SyncConfig,
-        sync_version: SyncVersion,
-        request_key: SyncRequestKey,
-        since_token: Optional[StreamToken] = None,
-        timeout: int = 0,
-        full_state: bool = False,
-    ) -> Union[SyncResult, E2eeSyncResult]: ...
-
-    async def wait_for_sync_for_user(
-        self,
-        requester: Requester,
-        sync_config: SyncConfig,
-        sync_version: SyncVersion,
-        request_key: SyncRequestKey,
-        since_token: Optional[StreamToken] = None,
-        timeout: int = 0,
-        full_state: bool = False,
-    ) -> Union[SyncResult, E2eeSyncResult]:
+    ) -> SyncResult:
         """Get the sync for a client if we have new data for it now. Otherwise
         wait for new data to arrive on the server. If the timeout expires, then
         return an empty sync result.
@@ -433,8 +354,7 @@ class SyncHandler:
             full_state: Whether to return the full state for each room.
 
         Returns:
-            When `SyncVersion.SYNC_V2`, returns a full `SyncResult`.
-            When `SyncVersion.E2EE_SYNC`, returns a `E2eeSyncResult`.
+            returns a full `SyncResult`.
         """
         # If the user is not part of the mau group, then check that limits have
         # not been exceeded (if not part of the group by this point, almost certain
@@ -446,7 +366,6 @@ class SyncHandler:
             request_key,
             self._wait_for_sync_for_user,
             sync_config,
-            sync_version,
             since_token,
             timeout,
             full_state,
@@ -455,48 +374,18 @@ class SyncHandler:
         logger.debug("Returning sync response for %s", user_id)
         return res
 
-    @overload
+    # TODO: We mark this as cancellable, and we have tests for it, but we
+    # haven't gone through and exhaustively checked that all the code paths in
+    # this method are actually cancellable.
+    @cancellable
     async def _wait_for_sync_for_user(
         self,
         sync_config: SyncConfig,
-        sync_version: Literal[SyncVersion.SYNC_V2],
-        since_token: Optional[StreamToken],
+        since_token: StreamToken | None,
         timeout: int,
         full_state: bool,
         cache_context: ResponseCacheContext[SyncRequestKey],
-    ) -> SyncResult: ...
-
-    @overload
-    async def _wait_for_sync_for_user(
-        self,
-        sync_config: SyncConfig,
-        sync_version: Literal[SyncVersion.E2EE_SYNC],
-        since_token: Optional[StreamToken],
-        timeout: int,
-        full_state: bool,
-        cache_context: ResponseCacheContext[SyncRequestKey],
-    ) -> E2eeSyncResult: ...
-
-    @overload
-    async def _wait_for_sync_for_user(
-        self,
-        sync_config: SyncConfig,
-        sync_version: SyncVersion,
-        since_token: Optional[StreamToken],
-        timeout: int,
-        full_state: bool,
-        cache_context: ResponseCacheContext[SyncRequestKey],
-    ) -> Union[SyncResult, E2eeSyncResult]: ...
-
-    async def _wait_for_sync_for_user(
-        self,
-        sync_config: SyncConfig,
-        sync_version: SyncVersion,
-        since_token: Optional[StreamToken],
-        timeout: int,
-        full_state: bool,
-        cache_context: ResponseCacheContext[SyncRequestKey],
-    ) -> Union[SyncResult, E2eeSyncResult]:
+    ) -> SyncResult:
         """The start of the machinery that produces a /sync response.
 
         See https://spec.matrix.org/v1.1/client-server-api/#syncing for full details.
@@ -517,7 +406,7 @@ class SyncHandler:
         else:
             sync_type = "incremental_sync"
 
-        sync_label = f"{sync_version}:{sync_type}"
+        sync_label = f"sync_v2:{sync_type}"
 
         context = current_context()
         if context:
@@ -534,7 +423,7 @@ class SyncHandler:
                 )
                 device_id = sync_config.device_id
                 one_time_keys_count: JsonMapping = {}
-                unused_fallback_key_types: List[str] = []
+                unused_fallback_key_types: list[str] = []
                 if device_id:
                     user_id = sync_config.user.to_string()
                     # TODO: We should have a way to let clients differentiate between the states of:
@@ -578,19 +467,15 @@ class SyncHandler:
         if timeout == 0 or since_token is None or full_state:
             # we are going to return immediately, so don't bother calling
             # notifier.wait_for_events.
-            result: Union[
-                SyncResult, E2eeSyncResult
-            ] = await self.current_sync_for_user(
-                sync_config, sync_version, since_token, full_state=full_state
+            result = await self.current_sync_for_user(
+                sync_config, since_token, full_state=full_state
             )
         else:
             # Otherwise, we wait for something to happen and report it to the user.
             async def current_sync_callback(
                 before_token: StreamToken, after_token: StreamToken
-            ) -> Union[SyncResult, E2eeSyncResult]:
-                return await self.current_sync_for_user(
-                    sync_config, sync_version, since_token
-                )
+            ) -> SyncResult:
+                return await self.current_sync_for_user(sync_config, since_token)
 
             result = await self.notifier.wait_for_events(
                 sync_config.user.to_string(),
@@ -623,43 +508,15 @@ class SyncHandler:
 
         return result
 
-    @overload
     async def current_sync_for_user(
         self,
         sync_config: SyncConfig,
-        sync_version: Literal[SyncVersion.SYNC_V2],
-        since_token: Optional[StreamToken] = None,
+        since_token: StreamToken | None = None,
         full_state: bool = False,
-    ) -> SyncResult: ...
-
-    @overload
-    async def current_sync_for_user(
-        self,
-        sync_config: SyncConfig,
-        sync_version: Literal[SyncVersion.E2EE_SYNC],
-        since_token: Optional[StreamToken] = None,
-        full_state: bool = False,
-    ) -> E2eeSyncResult: ...
-
-    @overload
-    async def current_sync_for_user(
-        self,
-        sync_config: SyncConfig,
-        sync_version: SyncVersion,
-        since_token: Optional[StreamToken] = None,
-        full_state: bool = False,
-    ) -> Union[SyncResult, E2eeSyncResult]: ...
-
-    async def current_sync_for_user(
-        self,
-        sync_config: SyncConfig,
-        sync_version: SyncVersion,
-        since_token: Optional[StreamToken] = None,
-        full_state: bool = False,
-    ) -> Union[SyncResult, E2eeSyncResult]:
+    ) -> SyncResult:
         """
         Generates the response body of a sync result, represented as a
-        `SyncResult`/`E2eeSyncResult`.
+        `SyncResult`.
 
         This is a wrapper around `generate_sync_result` which starts an open tracing
         span to track the sync. See `generate_sync_result` for the next part of your
@@ -672,28 +529,15 @@ class SyncHandler:
             full_state: Whether to return the full state for each room.
 
         Returns:
-            When `SyncVersion.SYNC_V2`, returns a full `SyncResult`.
-            When `SyncVersion.E2EE_SYNC`, returns a `E2eeSyncResult`.
+            returns a full `SyncResult`.
         """
         with start_active_span("sync.current_sync_for_user"):
             log_kv({"since_token": since_token})
 
             # Go through the `/sync` v2 path
-            if sync_version == SyncVersion.SYNC_V2:
-                sync_result: Union[
-                    SyncResult, E2eeSyncResult
-                ] = await self.generate_sync_result(
-                    sync_config, since_token, full_state
-                )
-            # Go through the MSC3575 Sliding Sync `/sync/e2ee` path
-            elif sync_version == SyncVersion.E2EE_SYNC:
-                sync_result = await self.generate_e2ee_sync_result(
-                    sync_config, since_token
-                )
-            else:
-                raise Exception(
-                    f"Unknown sync_version (this is a Synapse problem): {sync_version}"
-                )
+            sync_result = await self.generate_sync_result(
+                sync_config, since_token, full_state
+            )
 
             set_tag(SynapseTags.SYNC_RESULT, bool(sync_result))
             return sync_result
@@ -702,8 +546,8 @@ class SyncHandler:
         self,
         sync_result_builder: "SyncResultBuilder",
         now_token: StreamToken,
-        since_token: Optional[StreamToken] = None,
-    ) -> Tuple[StreamToken, Dict[str, List[JsonDict]]]:
+        since_token: StreamToken | None = None,
+    ) -> tuple[StreamToken, dict[str, list[JsonDict]]]:
         """Get the ephemeral events for each room the user is in
         Args:
             sync_result_builder
@@ -713,7 +557,7 @@ class SyncHandler:
         Returns:
             A tuple of the now StreamToken, updated to reflect the which typing
             events are included, and a dict mapping from room_id to a list of
-            typing events for that room.
+            ephemeral events for that room.
         """
 
         sync_config = sync_result_builder.sync_config
@@ -738,12 +582,8 @@ class SyncHandler:
             ephemeral_by_room: JsonDict = {}
 
             for event in typing:
-                # we want to exclude the room_id from the event, but modifying the
-                # result returned by the event source is poor form (it might cache
-                # the object)
                 room_id = event["room_id"]
-                event_copy = {k: v for (k, v) in event.items() if k != "room_id"}
-                ephemeral_by_room.setdefault(room_id, []).append(event_copy)
+                ephemeral_by_room.setdefault(room_id, []).append(event)
 
             receipt_key = (
                 since_token.receipt_key
@@ -763,20 +603,53 @@ class SyncHandler:
 
             for event in receipts:
                 room_id = event["room_id"]
-                # exclude room id, as above
-                event_copy = {k: v for (k, v) in event.items() if k != "room_id"}
-                ephemeral_by_room.setdefault(room_id, []).append(event_copy)
+                ephemeral_by_room.setdefault(room_id, []).append(event)
 
         return now_token, ephemeral_by_room
 
+    async def sticky_events_by_room(
+        self,
+        sync_result_builder: "SyncResultBuilder",
+        now_token: StreamToken,
+        since_token: StreamToken | None = None,
+    ) -> tuple[StreamToken, dict[str, list[str]]]:
+        """Get the sticky events for each room the user is in
+        Args:
+            sync_result_builder
+            now_token: Where the server is currently up to.
+            since_token: Where the server was when the client last synced.
+        Returns:
+            A tuple of the now StreamToken, updated to reflect the which sticky
+            events are included, and a dict mapping from room_id to a list
+            of sticky event IDs for that room (in sticky event stream order).
+        """
+        now = self.clock.time_msec()
+        with Measure(
+            self.clock, name="sticky_events_by_room", server_name=self.server_name
+        ):
+            from_id = since_token.sticky_events_key if since_token else 0
+
+            room_ids = sync_result_builder.joined_room_ids
+
+            to_id, sticky_by_room = await self.store.get_sticky_events_in_rooms(
+                room_ids,
+                from_id=from_id,
+                to_id=now_token.sticky_events_key,
+                now=now,
+                limit=StickyEvent.MAX_EVENTS_IN_SYNC,
+            )
+            now_token = now_token.copy_and_replace(StreamKeyType.STICKY_EVENTS, to_id)
+
+        return now_token, sticky_by_room
+
     async def _load_filtered_recents(
         self,
         room_id: str,
         sync_result_builder: "SyncResultBuilder",
         sync_config: SyncConfig,
         upto_token: StreamToken,
-        since_token: Optional[StreamToken] = None,
-        potential_recents: Optional[List[EventBase]] = None,
+        since_token: StreamToken | None = None,
+        potential_recents: list[EventBase] | None = None,
         newly_joined_room: bool = False,
     ) -> TimelineBatch:
         """Create a timeline batch for the room
@@ -835,7 +708,7 @@ class SyncHandler:
                 # We check if there are any state events, if there are then we pass
                 # all current state events to the filter_events function. This is to
                 # ensure that we always include current state in the timeline
-                current_state_ids: FrozenSet[str] = frozenset()
+                current_state_ids: frozenset[str] = frozenset()
                 if any(e.is_state() for e in recents):
                     # FIXME(faster_joins): We use the partial state here as
                     # we don't want to block `/sync` on finishing a lazy join.
@@ -852,7 +725,7 @@ class SyncHandler:
                         )
                     )
 
-                recents = await filter_events_for_client(
+                recents = await filter_and_transform_events_for_client(
                     self._storage_controllers,
                     sync_config.user.to_string(),
                     recents,
@@ -962,22 +835,13 @@ class SyncHandler:
                         )
                     )
 
-                filtered_recents = await filter_events_for_client(
+                loaded_recents = await filter_and_transform_events_for_client(
                     self._storage_controllers,
                     sync_config.user.to_string(),
                     loaded_recents,
                     always_include_ids=current_state_ids,
                 )
 
-                loaded_recents = []
-                for event in filtered_recents:
-                    if event.type == EventTypes.CallInvite:
-                        room_info = await self.store.get_room_with_stats(event.room_id)
-                        assert room_info is not None
-                        if room_info.join_rules == JoinRules.PUBLIC:
-                            continue
-                    loaded_recents.append(event)
-
                 log_kv({"loaded_recents_after_client_filtering": len(loaded_recents)})
 
                 loaded_recents.extend(recents)
@@ -1021,7 +885,7 @@ class SyncHandler:
         batch: TimelineBatch,
         state: MutableStateMap[EventBase],
         now_token: StreamToken,
-    ) -> Optional[JsonDict]:
+    ) -> JsonDict | None:
         """Works out a room summary block for this room, summarising the number
         of joined members in the room, and providing the 'hero' members if the
         room has no name so clients can consistently name rooms.  Also adds
@@ -1134,14 +998,16 @@ class SyncHandler:
         return summary
 
     def get_lazy_loaded_members_cache(
-        self, cache_key: Tuple[str, Optional[str]]
+        self, cache_key: tuple[str, str | None]
     ) -> LruCache[str, str]:
-        cache: Optional[LruCache[str, str]] = self.lazy_loaded_members_cache.get(
-            cache_key
-        )
+        cache: LruCache[str, str] | None = self.lazy_loaded_members_cache.get(cache_key)
         if cache is None:
             logger.debug("creating LruCache for %r", cache_key)
-            cache = LruCache(max_size=LAZY_LOADED_MEMBERS_CACHE_MAX_SIZE)
+            cache = LruCache(
+                max_size=LAZY_LOADED_MEMBERS_CACHE_MAX_SIZE,
+                clock=self.clock,
+                server_name=self.server_name,
+            )
             self.lazy_loaded_members_cache[cache_key] = cache
         else:
             logger.debug("found LruCache for %r", cache_key)
@@ -1152,7 +1018,7 @@ class SyncHandler:
         room_id: str,
         batch: TimelineBatch,
         sync_config: SyncConfig,
-        since_token: Optional[StreamToken],
+        since_token: StreamToken | None,
         end_token: StreamToken,
         full_state: bool,
         joined: bool,
@@ -1191,11 +1057,11 @@ class SyncHandler:
         ):
             # The memberships needed for events in the timeline.
             # Only calculated when `lazy_load_members` is on.
-            members_to_fetch: Optional[Set[str]] = None
+            members_to_fetch: set[str] | None = None
 
             # A dictionary mapping user IDs to the first event in the timeline sent by
             # them. Only calculated when `lazy_load_members` is on.
-            first_event_by_sender_map: Optional[Dict[str, EventBase]] = None
+            first_event_by_sender_map: dict[str, EventBase] | None = None
 
             # The contribution to the room state from state events in the timeline.
             # Only contains the last event for any given state key.
@@ -1221,9 +1087,18 @@ class SyncHandler:
                     if event.sender not in first_event_by_sender_map:
                         first_event_by_sender_map[event.sender] = event
 
-                    # We need the event's sender, unless their membership was in a
-                    # previous timeline event.
-                    if (EventTypes.Member, event.sender) not in timeline_state:
+                    # When using `state_after`, there is no special treatment with
+                    # regards to state also being in the `timeline`. Always fetch
+                    # relevant membership regardless of whether the state event is in
+                    # the `timeline`.
+                    if sync_config.use_state_after:
+                        members_to_fetch.add(event.sender)
+                    # For `state`, the client is supposed to do a flawed re-construction
+                    # of state over time by starting with the given `state` and layering
+                    # on state from the `timeline` as you go (flawed because state
+                    # resolution). In this case, we only need their membership in
+                    # `state` when their membership isn't already in the `timeline`.
+                    elif (EventTypes.Member, event.sender) not in timeline_state:
                         members_to_fetch.add(event.sender)
                     # FIXME: we also care about invite targets etc.
 
@@ -1321,7 +1196,7 @@ class SyncHandler:
                     if t[0] == EventTypes.Member:
                         cache.set(t[1], event_id)
 
-        state: Dict[str, EventBase] = {}
+        state: dict[str, EventBase] = {}
         if state_ids:
             state = await self.store.get_events(list(state_ids.values()))
 
@@ -1339,7 +1214,7 @@ class SyncHandler:
         sync_config: SyncConfig,
         batch: TimelineBatch,
         end_token: StreamToken,
-        members_to_fetch: Optional[Set[str]],
+        members_to_fetch: set[str] | None,
         timeline_state: StateMap[str],
         joined: bool,
     ) -> StateMap[str]:
@@ -1489,7 +1364,7 @@ class SyncHandler:
         batch: TimelineBatch,
         since_token: StreamToken,
         end_token: StreamToken,
-        members_to_fetch: Optional[Set[str]],
+        members_to_fetch: set[str] | None,
         timeline_state: StateMap[str],
     ) -> StateMap[str]:
         """Calculate the state events to be included in an incremental sync response.
@@ -1724,7 +1599,7 @@ class SyncHandler:
 
         # Identify memberships missing from `found_state_ids` and pick out the auth
         # events in which to look for them.
-        auth_event_ids: Set[str] = set()
+        auth_event_ids: set[str] = set()
         for member in members_to_fetch:
             if (EventTypes.Member, member) in found_state_ids:
                 continue
@@ -1816,7 +1691,7 @@ class SyncHandler:
     async def generate_sync_result(
         self,
         sync_config: SyncConfig,
-        since_token: Optional[StreamToken] = None,
+        since_token: StreamToken | None = None,
         full_state: bool = False,
     ) -> SyncResult:
         """Generates the response body of a sync result.
@@ -1927,7 +1802,7 @@ class SyncHandler:
         logger.debug("Fetching OTK data")
         device_id = sync_config.device_id
         one_time_keys_count: JsonMapping = {}
-        unused_fallback_key_types: List[str] = []
+        unused_fallback_key_types: list[str] = []
         if device_id:
             # TODO: We should have a way to let clients differentiate between the states of:
             #   * no change in OTK count since the provided since token
@@ -1968,106 +1843,10 @@ class SyncHandler:
             next_batch=sync_result_builder.now_token,
         )
 
-    async def generate_e2ee_sync_result(
-        self,
-        sync_config: SyncConfig,
-        since_token: Optional[StreamToken] = None,
-    ) -> E2eeSyncResult:
-        """
-        Generates the response body of a MSC3575 Sliding Sync `/sync/e2ee` result.
-
-        This is represented by a `E2eeSyncResult` struct, which is built from small
-        pieces using a `SyncResultBuilder`. The `sync_result_builder` is passed as a
-        mutable ("inout") parameter to various helper functions. These retrieve and
-        process the data which forms the sync body, often writing to the
-        `sync_result_builder` to store their output.
-
-        At the end, we transfer data from the `sync_result_builder` to a new `E2eeSyncResult`
-        instance to signify that the sync calculation is complete.
-        """
-        user_id = sync_config.user.to_string()
-        app_service = self.store.get_app_service_by_user_id(user_id)
-        if app_service:
-            # We no longer support AS users using /sync directly.
-            # See https://github.com/matrix-org/matrix-doc/issues/1144
-            raise NotImplementedError()
-
-        sync_result_builder = await self.get_sync_result_builder(
-            sync_config,
-            since_token,
-            full_state=False,
-        )
-
-        # 1. Calculate `to_device` events
-        await self._generate_sync_entry_for_to_device(sync_result_builder)
-
-        # 2. Calculate `device_lists`
-        # Device list updates are sent if a since token is provided.
-        device_lists = DeviceListUpdates()
-        include_device_list_updates = bool(since_token and since_token.device_list_key)
-        if include_device_list_updates:
-            # Note that _generate_sync_entry_for_rooms sets sync_result_builder.joined, which
-            # is used in calculate_user_changes below.
-            #
-            # TODO: Running `_generate_sync_entry_for_rooms()` is a lot of work just to
-            # figure out the membership changes/derived info needed for
-            # `_generate_sync_entry_for_device_list()`. In the future, we should try to
-            # refactor this away.
-            (
-                newly_joined_rooms,
-                newly_left_rooms,
-            ) = await self._generate_sync_entry_for_rooms(sync_result_builder)
-
-            # This uses the sync_result_builder.joined which is set in
-            # `_generate_sync_entry_for_rooms`, if that didn't find any joined
-            # rooms for some reason it is a no-op.
-            (
-                newly_joined_or_invited_or_knocked_users,
-                newly_left_users,
-            ) = sync_result_builder.calculate_user_changes()
-
-            # include_device_list_updates can only be True if we have a
-            # since token.
-            assert since_token is not None
-            device_lists = await self._device_handler.generate_sync_entry_for_device_list(
-                user_id=user_id,
-                since_token=since_token,
-                now_token=sync_result_builder.now_token,
-                joined_room_ids=sync_result_builder.joined_room_ids,
-                newly_joined_rooms=newly_joined_rooms,
-                newly_joined_or_invited_or_knocked_users=newly_joined_or_invited_or_knocked_users,
-                newly_left_rooms=newly_left_rooms,
-                newly_left_users=newly_left_users,
-            )
-
-        # 3. Calculate `device_one_time_keys_count` and `device_unused_fallback_key_types`
-        device_id = sync_config.device_id
-        one_time_keys_count: JsonMapping = {}
-        unused_fallback_key_types: List[str] = []
-        if device_id:
-            # TODO: We should have a way to let clients differentiate between the states of:
-            #   * no change in OTK count since the provided since token
-            #   * the server has zero OTKs left for this device
-            #  Spec issue: https://github.com/matrix-org/matrix-doc/issues/3298
-            one_time_keys_count = await self.store.count_e2e_one_time_keys(
-                user_id, device_id
-            )
-            unused_fallback_key_types = list(
-                await self.store.get_e2e_unused_fallback_key_types(user_id, device_id)
-            )
-
-        return E2eeSyncResult(
-            to_device=sync_result_builder.to_device,
-            device_lists=device_lists,
-            device_one_time_keys_count=one_time_keys_count,
-            device_unused_fallback_key_types=unused_fallback_key_types,
-            next_batch=sync_result_builder.now_token,
-        )
-
     async def get_sync_result_builder(
         self,
         sync_config: SyncConfig,
-        since_token: Optional[StreamToken] = None,
+        since_token: StreamToken | None = None,
         full_state: bool = False,
     ) -> "SyncResultBuilder":
         """
@@ -2113,7 +1892,7 @@ class SyncHandler:
                 self.rooms_to_exclude_globally,
             )
 
-            last_membership_change_by_room_id: Dict[str, EventBase] = {}
+            last_membership_change_by_room_id: dict[str, EventBase] = {}
             for event in membership_change_events:
                 last_membership_change_by_room_id[event.room_id] = event
 
@@ -2172,7 +1951,7 @@ class SyncHandler:
         # - are full-stated
         # - became fully-stated at some point during the sync period
         #   (These rooms will have been omitted during a previous eager sync.)
-        forced_newly_joined_room_ids: Set[str] = set()
+        forced_newly_joined_room_ids: set[str] = set()
         if since_token and not sync_config.filter_collection.lazy_load_members():
             un_partial_stated_rooms = (
                 await self.store.get_un_partial_stated_rooms_between(
@@ -2381,7 +2160,7 @@ class SyncHandler:
 
     async def _generate_sync_entry_for_rooms(
         self, sync_result_builder: "SyncResultBuilder"
-    ) -> Tuple[AbstractSet[str], AbstractSet[str]]:
+    ) -> tuple[AbstractSet[str], AbstractSet[str]]:
         """Generates the rooms portion of the sync response. Populates the
         `sync_result_builder` with the result.
 
@@ -2430,7 +2209,7 @@ class SyncHandler:
             or sync_result_builder.sync_config.filter_collection.blocks_all_room_ephemeral()
         )
         if block_all_room_ephemeral:
-            ephemeral_by_room: Dict[str, List[JsonDict]] = {}
+            ephemeral_by_room: dict[str, list[JsonDict]] = {}
         else:
             now_token, ephemeral_by_room = await self.ephemeral_by_room(
                 sync_result_builder,
@@ -2439,11 +2218,43 @@ class SyncHandler:
             )
             sync_result_builder.now_token = now_token
 
+        sticky_by_room: dict[str, list[str]] = {}
+        if self.hs_config.experimental.msc4354_enabled:
+            now_token, sticky_by_room = await self.sticky_events_by_room(
+                sync_result_builder, now_token, since_token
+            )
+            sync_result_builder.now_token = now_token
+
         # 2. We check up front if anything has changed, if it hasn't then there is
         # no point in going further.
+        #
+        # If this is an initial sync (no since_token), then of course we can't skip
+        # the sync entry, as we have no base to use as a comparison for the question
+        # 'has anything changed' (this is the client's first time 'seeing' anything).
+        #
+        # Otherwise, for incremental syncs, we consider skipping the sync entry,
+        # doing cheap checks first:
+        #
+        # - are there any per-room EDUs;
+        # - is there any Room Account Data; or
+        # - are there any sticky events in the rooms; or
+        # - might the rooms have changed
+        #   (using in-memory event stream change caches, which can
+        #   only answer either 'Not changed' or 'Possibly changed')
+        #
+        # If none of those cheap checks give us a reason to continue generating the sync entry,
+        # we finally query the database to check for changed room tags.
+        # If there are also no changed tags, we can short-circuit return an empty sync entry.
         if not sync_result_builder.full_state:
-            if since_token and not ephemeral_by_room and not account_data_by_room:
-                have_changed = await self._have_rooms_changed(sync_result_builder)
+            # Cheap checks first
+            if (
+                since_token
+                and not ephemeral_by_room
+                and not account_data_by_room
+                and not sticky_by_room
+            ):
+                # This is also a cheap check, but we log the answer
+                have_changed = self._may_have_rooms_changed(sync_result_builder)
                 log_kv({"rooms_have_changed": have_changed})
                 if not have_changed:
                     tags_by_room = await self.store.get_updated_tags(
@@ -2487,6 +2298,7 @@ class SyncHandler:
                 ephemeral=ephemeral_by_room.get(room_entry.room_id, []),
                 tags=tags_by_room.get(room_entry.room_id),
                 account_data=account_data_by_room.get(room_entry.room_id, {}),
+                sticky_event_ids=sticky_by_room.get(room_entry.room_id, []),
                 always_include=sync_result_builder.full_state,
             )
             logger.debug("Generated room entry for %s", room_entry.room_id)
@@ -2499,11 +2311,9 @@ class SyncHandler:
 
         return set(newly_joined_rooms), set(newly_left_rooms)
 
-    async def _have_rooms_changed(
-        self, sync_result_builder: "SyncResultBuilder"
-    ) -> bool:
+    def _may_have_rooms_changed(self, sync_result_builder: "SyncResultBuilder") -> bool:
         """Returns whether there may be any new events that should be sent down
-        the sync. Returns True if there are.
+        the sync. Returns True if there **may** be.
 
         Does not modify the `sync_result_builder`.
         """
@@ -2524,7 +2334,7 @@ class SyncHandler:
     async def _get_room_changes_for_incremental_sync(
         self,
         sync_result_builder: "SyncResultBuilder",
-        ignored_users: FrozenSet[str],
+        ignored_users: frozenset[str],
     ) -> _RoomChanges:
         """Determine the changes in rooms to report to the user.
 
@@ -2555,17 +2365,17 @@ class SyncHandler:
 
         assert since_token
 
-        mem_change_events_by_room_id: Dict[str, List[EventBase]] = {}
+        mem_change_events_by_room_id: dict[str, list[EventBase]] = {}
         for event in membership_change_events:
             mem_change_events_by_room_id.setdefault(event.room_id, []).append(event)
 
-        newly_joined_rooms: List[str] = list(
+        newly_joined_rooms: list[str] = list(
             sync_result_builder.forced_newly_joined_room_ids
         )
-        newly_left_rooms: List[str] = []
-        room_entries: List[RoomSyncResultBuilder] = []
-        invited: List[InvitedSyncResult] = []
-        knocked: List[KnockedSyncResult] = []
+        newly_left_rooms: list[str] = []
+        room_entries: list[RoomSyncResultBuilder] = []
+        invited: list[InvitedSyncResult] = []
+        knocked: list[KnockedSyncResult] = []
         invite_config = await self.store.get_invite_config_for_user(user_id)
         for room_id, events in mem_change_events_by_room_id.items():
             # The body of this loop will add this room to at least one of the five lists
@@ -2702,7 +2512,7 @@ class SyncHandler:
                 # This is all screaming out for a refactor, as the logic here is
                 # subtle and the moving parts numerous.
                 if leave_event.internal_metadata.is_out_of_band_membership():
-                    batch_events: Optional[List[EventBase]] = [leave_event]
+                    batch_events: list[EventBase] | None = [leave_event]
                 else:
                     batch_events = None
 
@@ -2784,7 +2594,7 @@ class SyncHandler:
     async def _get_room_changes_for_initial_sync(
         self,
         sync_result_builder: "SyncResultBuilder",
-        ignored_users: FrozenSet[str],
+        ignored_users: frozenset[str],
     ) -> _RoomChanges:
         """Returns entries for all rooms for the user.
 
@@ -2870,9 +2680,10 @@ class SyncHandler:
         self,
         sync_result_builder: "SyncResultBuilder",
         room_builder: "RoomSyncResultBuilder",
-        ephemeral: List[JsonDict],
-        tags: Optional[Mapping[str, JsonMapping]],
+        ephemeral: list[JsonDict],
+        tags: Mapping[str, JsonMapping] | None,
         account_data: Mapping[str, JsonMapping],
+        sticky_event_ids: list[str],
         always_include: bool = False,
     ) -> None:
         """Populates the `joined` and `archived` section of `sync_result_builder`
@@ -2902,6 +2713,8 @@ class SyncHandler:
             tags: List of *all* tags for room, or None if there has been
                 no change.
             account_data: List of new account data for room
+            sticky_event_ids: MSC4354 sticky events in the room, if any.
+                In sticky event stream order.
             always_include: Always include this room in the sync response,
                 even if empty.
         """
@@ -2912,7 +2725,13 @@ class SyncHandler:
         events = room_builder.events
 
         # We want to shortcut out as early as possible.
-        if not (always_include or account_data or ephemeral or full_state):
+        if not (
+            always_include
+            or account_data
+            or ephemeral
+            or full_state
+            or sticky_event_ids
+        ):
             if events == [] and tags is None:
                 return
 
@@ -2986,9 +2805,17 @@ class SyncHandler:
                 )
             )
 
-            ephemeral = await sync_config.filter_collection.filter_room_ephemeral(
-                ephemeral
-            )
+            ephemeral = [
+                # per spec, ephemeral events (typing notifications and read receipts)
+                # should not have a `room_id` field when sent to clients
+                # refs:
+                # - https://spec.matrix.org/v1.16/client-server-api/#mtyping
+                # - https://spec.matrix.org/v1.16/client-server-api/#mreceipt
+                {k: v for (k, v) in event.items() if k != "room_id"}
+                for event in await sync_config.filter_collection.filter_room_ephemeral(
+                    ephemeral
+                )
+            ]
 
             if not (
                 always_include
@@ -2996,6 +2823,7 @@ class SyncHandler:
                 or account_data_events
                 or ephemeral
                 or full_state
+                or sticky_event_ids
             ):
                 return
 
@@ -3013,7 +2841,7 @@ class SyncHandler:
                 # An out of band room won't have any state changes.
                 state = {}
 
-            summary: Optional[JsonDict] = {}
+            summary: JsonDict | None = {}
 
             # we include a summary in room responses when we're lazy loading
             # members (as the client otherwise doesn't have enough info to form
@@ -3041,7 +2869,33 @@ class SyncHandler:
                 )
 
             if room_builder.rtype == "joined":
-                unread_notifications: Dict[str, int] = {}
+                unread_notifications: dict[str, int] = {}
+                sticky_events: list[EventBase] = []
+                if sticky_event_ids:
+                    # As per MSC4354:
+                    # Remove sticky events that are already in the timeline, else we will needlessly duplicate
+                    # events.
+                    # There is no purpose in including sticky events in the sticky section if they're already in
+                    # the timeline, as either way the client becomes aware of them.
+                    # This is particularly important given the risk of sticky events spam since
+                    # anyone can send sticky events, so halving the bandwidth on average for each sticky
+                    # event is helpful.
+                    timeline_event_id_set = {ev.event_id for ev in batch.events}
+                    # Must preserve sticky event stream order
+                    sticky_event_ids = [
+                        e for e in sticky_event_ids if e not in timeline_event_id_set
+                    ]
+                    if sticky_event_ids:
+                        # Fetch and filter the sticky events
+                        sticky_events = await filter_and_transform_events_for_client(
+                            self._storage_controllers,
+                            sync_result_builder.sync_config.user.to_string(),
+                            await self.store.get_events_as_list(sticky_event_ids),
+                            # As per MSC4354:
+                            # > History visibility checks MUST NOT be applied to sticky events.
+                            # > Any joined user is authorised to see sticky events for the duration they remain sticky.
+                            always_include_ids=frozenset(sticky_event_ids),
+                        )
                 room_sync = JoinedSyncResult(
                     room_id=room_id,
                     timeline=batch,
@@ -3052,6 +2906,7 @@ class SyncHandler:
                     unread_thread_notifications={},
                     summary=summary,
                     unread_count=0,
+                    sticky=sticky_events,
                 )
 
                 if room_sync or always_include:
@@ -3108,7 +2963,7 @@ class SyncHandler:
                 raise Exception("Unrecognized rtype: %r", room_builder.rtype)
 
 
-def _action_has_highlight(actions: List[JsonDict]) -> bool:
+def _action_has_highlight(actions: list[JsonDict]) -> bool:
     for action in actions:
         try:
             if action.get("set_tweak", None) == "highlight":
@@ -3262,22 +3117,22 @@ class SyncResultBuilder:
 
     sync_config: SyncConfig
     full_state: bool
-    since_token: Optional[StreamToken]
+    since_token: StreamToken | None
     now_token: StreamToken
-    joined_room_ids: FrozenSet[str]
-    excluded_room_ids: FrozenSet[str]
-    forced_newly_joined_room_ids: FrozenSet[str]
-    membership_change_events: List[EventBase]
+    joined_room_ids: frozenset[str]
+    excluded_room_ids: frozenset[str]
+    forced_newly_joined_room_ids: frozenset[str]
+    membership_change_events: list[EventBase]
 
-    presence: List[UserPresenceState] = attr.Factory(list)
-    account_data: List[JsonDict] = attr.Factory(list)
-    joined: List[JoinedSyncResult] = attr.Factory(list)
-    invited: List[InvitedSyncResult] = attr.Factory(list)
-    knocked: List[KnockedSyncResult] = attr.Factory(list)
-    archived: List[ArchivedSyncResult] = attr.Factory(list)
-    to_device: List[JsonDict] = attr.Factory(list)
+    presence: list[UserPresenceState] = attr.Factory(list)
+    account_data: list[JsonDict] = attr.Factory(list)
+    joined: list[JoinedSyncResult] = attr.Factory(list)
+    invited: list[InvitedSyncResult] = attr.Factory(list)
+    knocked: list[KnockedSyncResult] = attr.Factory(list)
+    archived: list[ArchivedSyncResult] = attr.Factory(list)
+    to_device: list[JsonDict] = attr.Factory(list)
 
-    def calculate_user_changes(self) -> Tuple[AbstractSet[str], AbstractSet[str]]:
+    def calculate_user_changes(self) -> tuple[AbstractSet[str], AbstractSet[str]]:
         """Work out which other users have joined or left rooms we are joined to.
 
         This data only is only useful for an incremental sync.
@@ -3355,10 +3210,10 @@ class RoomSyncResultBuilder:
 
     room_id: str
     rtype: str
-    events: Optional[List[EventBase]]
+    events: list[EventBase] | None
     newly_joined: bool
     full_state: bool
-    since_token: Optional[StreamToken]
+    since_token: StreamToken | None
     upto_token: StreamToken
     end_token: StreamToken
     out_of_band: bool = False
diff --git a/synapse/handlers/thread_subscriptions.py b/synapse/handlers/thread_subscriptions.py
index bda4342949..539672c7fe 100644
--- a/synapse/handlers/thread_subscriptions.py
+++ b/synapse/handlers/thread_subscriptions.py
@@ -1,6 +1,6 @@
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import RelationTypes
 from synapse.api.errors import AuthError, Codes, NotFoundError, SynapseError
@@ -9,7 +9,7 @@ from synapse.storage.databases.main.thread_subscriptions import (
     AutomaticSubscriptionConflicted,
     ThreadSubscription,
 )
-from synapse.types import EventOrderings, UserID
+from synapse.types import EventOrderings, StreamKeyType, UserID
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -22,13 +22,14 @@ class ThreadSubscriptionsHandler:
         self.store = hs.get_datastores().main
         self.event_handler = hs.get_event_handler()
         self.auth = hs.get_auth()
+        self._notifier = hs.get_notifier()
 
     async def get_thread_subscription_settings(
         self,
         user_id: UserID,
         room_id: str,
         thread_root_event_id: str,
-    ) -> Optional[ThreadSubscription]:
+    ) -> ThreadSubscription | None:
         """Get thread subscription settings for a specific thread and user.
         Checks that the thread root is both a real event and also that it is visible
         to the user.
@@ -61,8 +62,8 @@ class ThreadSubscriptionsHandler:
         room_id: str,
         thread_root_event_id: str,
         *,
-        automatic_event_id: Optional[str],
-    ) -> Optional[int]:
+        automatic_event_id: str | None,
+    ) -> int | None:
         """Sets or updates a user's subscription settings for a specific thread root.
 
         Args:
@@ -132,11 +133,20 @@ class ThreadSubscriptionsHandler:
                 errcode=Codes.MSC4306_CONFLICTING_UNSUBSCRIPTION,
             )
 
+        if outcome is not None:
+            # wake up user streams (e.g. sliding sync) on the same worker
+            self._notifier.on_new_event(
+                StreamKeyType.THREAD_SUBSCRIPTIONS,
+                # outcome is a stream_id
+                outcome,
+                users=[user_id.to_string()],
+            )
+
         return outcome
 
     async def unsubscribe_user_from_thread(
         self, user_id: UserID, room_id: str, thread_root_event_id: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """Clears a user's subscription settings for a specific thread root.
 
         Args:
@@ -162,8 +172,19 @@ class ThreadSubscriptionsHandler:
             logger.info("rejecting thread subscriptions change (thread not accessible)")
             raise NotFoundError("No such thread root")
 
-        return await self.store.unsubscribe_user_from_thread(
+        outcome = await self.store.unsubscribe_user_from_thread(
             user_id.to_string(),
             event.room_id,
             thread_root_event_id,
         )
+
+        if outcome is not None:
+            # wake up user streams (e.g. sliding sync) on the same worker
+            self._notifier.on_new_event(
+                StreamKeyType.THREAD_SUBSCRIPTIONS,
+                # outcome is a stream_id
+                outcome,
+                users=[user_id.to_string()],
+            )
+
+        return outcome
diff --git a/synapse/handlers/typing.py b/synapse/handlers/typing.py
index 6a7b36ea0c..6daf304432 100644
--- a/synapse/handlers/typing.py
+++ b/synapse/handlers/typing.py
@@ -20,7 +20,7 @@
 #
 import logging
 import random
-from typing import TYPE_CHECKING, Dict, Iterable, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Iterable
 
 import attr
 
@@ -28,7 +28,6 @@ from synapse.api.constants import EduTypes
 from synapse.api.errors import AuthError, ShadowBanError, SynapseError
 from synapse.appservice import ApplicationService
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.replication.tcp.streams import TypingStream
@@ -42,6 +41,7 @@ from synapse.types import (
     UserID,
 )
 from synapse.util.caches.stream_change_cache import StreamChangeCache
+from synapse.util.duration import Duration
 from synapse.util.metrics import Measure
 from synapse.util.retryutils import filter_destinations_by_retry_limiter
 from synapse.util.wheel_timer import WheelTimer
@@ -61,15 +61,15 @@ class RoomMember:
 
 
 # How often we expect remote servers to resend us presence.
-FEDERATION_TIMEOUT = 60 * 1000
+FEDERATION_TIMEOUT = Duration(minutes=1)
 
 # How often to resend typing across federation.
-FEDERATION_PING_INTERVAL = 40 * 1000
+FEDERATION_PING_INTERVAL = Duration(seconds=40)
 
 
 # How long to remember a typing notification happened in a room before
 # forgetting about it.
-FORGET_TIMEOUT = 10 * 60 * 1000
+FORGET_TIMEOUT = Duration(minutes=10)
 
 
 class FollowerTypingHandler:
@@ -78,11 +78,10 @@ class FollowerTypingHandler:
     """
 
     def __init__(self, hs: "HomeServer"):
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
         self.store = hs.get_datastores().main
         self._storage_controllers = hs.get_storage_controllers()
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
         self.clock = hs.get_clock()
         self.is_mine_id = hs.is_mine_id
         self.is_mine_server_name = hs.is_mine_server_name
@@ -98,17 +97,17 @@ class FollowerTypingHandler:
             )
 
         # map room IDs to serial numbers
-        self._room_serials: Dict[str, int] = {}
+        self._room_serials: dict[str, int] = {}
         # map room IDs to sets of users currently typing
-        self._room_typing: Dict[str, Set[str]] = {}
+        self._room_typing: dict[str, set[str]] = {}
 
-        self._member_last_federation_poke: Dict[RoomMember, int] = {}
-        self.wheel_timer: WheelTimer[RoomMember] = WheelTimer(bucket_size=5000)
+        self._member_last_federation_poke: dict[RoomMember, int] = {}
+        self.wheel_timer: WheelTimer[RoomMember] = WheelTimer()
         self._latest_room_serial = 0
 
-        self._rooms_updated: Set[str] = set()
+        self._rooms_updated: set[str] = set()
 
-        self.clock.looping_call(self._handle_timeouts, 5000)
+        self.clock.looping_call(self._handle_timeouts, Duration(seconds=5))
         self.clock.looping_call(self._prune_old_typing, FORGET_TIMEOUT)
 
     def _reset(self) -> None:
@@ -121,7 +120,7 @@ class FollowerTypingHandler:
         self._rooms_updated = set()
 
         self._member_last_federation_poke = {}
-        self.wheel_timer = WheelTimer(bucket_size=5000)
+        self.wheel_timer = WheelTimer()
 
     @wrap_as_background_process("typing._handle_timeouts")
     async def _handle_timeouts(self) -> None:
@@ -143,10 +142,12 @@ class FollowerTypingHandler:
         # user.
         if self.federation and self.is_mine_id(member.user_id):
             last_fed_poke = self._member_last_federation_poke.get(member, None)
-            if not last_fed_poke or last_fed_poke + FEDERATION_PING_INTERVAL <= now:
-                run_as_background_process(
+            if (
+                not last_fed_poke
+                or last_fed_poke + FEDERATION_PING_INTERVAL.as_millis() <= now
+            ):
+                self.hs.run_as_background_process(
                     "typing._push_remote",
-                    self.server_name,
                     self._push_remote,
                     member=member,
                     typing=True,
@@ -168,7 +169,7 @@ class FollowerTypingHandler:
 
             now = self.clock.time_msec()
             self.wheel_timer.insert(
-                now=now, obj=member, then=now + FEDERATION_PING_INTERVAL
+                now=now, obj=member, then=now + FEDERATION_PING_INTERVAL.as_millis()
             )
 
             hosts: StrCollection = (
@@ -198,7 +199,7 @@ class FollowerTypingHandler:
             logger.exception("Error pushing typing notif to remotes")
 
     def process_replication_rows(
-        self, token: int, rows: List[TypingStream.TypingStreamRow]
+        self, token: int, rows: list[TypingStream.TypingStreamRow]
     ) -> None:
         """Should be called whenever we receive updates for typing stream."""
 
@@ -220,9 +221,8 @@ class FollowerTypingHandler:
             self._rooms_updated.add(row.room_id)
 
             if self.federation:
-                run_as_background_process(
+                self.hs.run_as_background_process(
                     "_send_changes_in_typing_to_remotes",
-                    self.server_name,
                     self._send_changes_in_typing_to_remotes,
                     row.room_id,
                     prev_typing,
@@ -230,7 +230,7 @@ class FollowerTypingHandler:
                 )
 
     async def _send_changes_in_typing_to_remotes(
-        self, room_id: str, prev_typing: Set[str], now_typing: Set[str]
+        self, room_id: str, prev_typing: set[str], now_typing: set[str]
     ) -> None:
         """Process a change in typing of a room from replication, sending EDUs
         for any local users.
@@ -284,7 +284,7 @@ class TypingWriterHandler(FollowerTypingHandler):
         hs.get_distributor().observe("user_left_room", self.user_left_room)
 
         # clock time we expect to stop
-        self._member_typing_until: Dict[RoomMember, int] = {}
+        self._member_typing_until: dict[RoomMember, int] = {}
 
         # caches which room_ids changed at which serials
         self._typing_stream_change_cache = StreamChangeCache(
@@ -319,7 +319,7 @@ class TypingWriterHandler(FollowerTypingHandler):
 
         if requester.shadow_banned:
             # We randomly sleep a bit just to annoy the requester.
-            await self.clock.sleep(random.randint(1, 10))
+            await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
             raise ShadowBanError()
 
         await self.auth.check_user_in_room(room_id, requester)
@@ -354,7 +354,7 @@ class TypingWriterHandler(FollowerTypingHandler):
 
         if requester.shadow_banned:
             # We randomly sleep a bit just to annoy the requester.
-            await self.clock.sleep(random.randint(1, 10))
+            await self.clock.sleep(Duration(seconds=random.randint(1, 10)))
             raise ShadowBanError()
 
         await self.auth.check_user_in_room(room_id, requester)
@@ -384,9 +384,8 @@ class TypingWriterHandler(FollowerTypingHandler):
     def _push_update(self, member: RoomMember, typing: bool) -> None:
         if self.hs.is_mine_id(member.user_id):
             # Only send updates for changes to our own users.
-            run_as_background_process(
+            self.hs.run_as_background_process(
                 "typing._push_remote",
-                self.server_name,
                 self._push_remote,
                 member,
                 typing,
@@ -433,8 +432,10 @@ class TypingWriterHandler(FollowerTypingHandler):
         if user.domain in domains:
             logger.info("Got typing update from %s: %r", user_id, content)
             now = self.clock.time_msec()
-            self._member_typing_until[member] = now + FEDERATION_TIMEOUT
-            self.wheel_timer.insert(now=now, obj=member, then=now + FEDERATION_TIMEOUT)
+            self._member_typing_until[member] = now + FEDERATION_TIMEOUT.as_millis()
+            self.wheel_timer.insert(
+                now=now, obj=member, then=now + FEDERATION_TIMEOUT.as_millis()
+            )
             self._push_update_local(member=member, typing=content["typing"])
 
     def _push_update_local(self, member: RoomMember, typing: bool) -> None:
@@ -457,7 +458,7 @@ class TypingWriterHandler(FollowerTypingHandler):
 
     async def get_all_typing_updates(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, list]], int, bool]:
+    ) -> tuple[list[tuple[int, list]], int, bool]:
         """Get updates for typing replication stream.
 
         Args:
@@ -509,7 +510,7 @@ class TypingWriterHandler(FollowerTypingHandler):
         return rows, current_id, limited
 
     def process_replication_rows(
-        self, token: int, rows: List[TypingStream.TypingStreamRow]
+        self, token: int, rows: list[TypingStream.TypingStreamRow]
     ) -> None:
         # The writing process should never get updates from replication.
         raise Exception("Typing writer instance got typing info over replication")
@@ -536,7 +537,7 @@ class TypingNotificationEventSource(EventSource[int, JsonMapping]):
 
     async def get_new_events_as(
         self, from_key: int, service: ApplicationService
-    ) -> Tuple[List[JsonMapping], int]:
+    ) -> tuple[list[JsonMapping], int]:
         """Returns a set of new typing events that an appservice
         may be interested in.
 
@@ -581,9 +582,9 @@ class TypingNotificationEventSource(EventSource[int, JsonMapping]):
         limit: int,
         room_ids: Iterable[str],
         is_guest: bool,
-        explicit_room_id: Optional[str] = None,
-        to_key: Optional[int] = None,
-    ) -> Tuple[List[JsonMapping], int]:
+        explicit_room_id: str | None = None,
+        to_key: int | None = None,
+    ) -> tuple[list[JsonMapping], int]:
         """
         Find typing notifications for given rooms (> `from_token` and <= `to_token`)
         """
diff --git a/synapse/handlers/ui_auth/checkers.py b/synapse/handlers/ui_auth/checkers.py
index 32dca8c43b..a0097dbc96 100644
--- a/synapse/handlers/ui_auth/checkers.py
+++ b/synapse/handlers/ui_auth/checkers.py
@@ -21,13 +21,13 @@
 
 import logging
 from abc import ABC, abstractmethod
-from typing import TYPE_CHECKING, Any, ClassVar, Sequence, Type
+from typing import TYPE_CHECKING, Any, ClassVar, Sequence
 
 from twisted.web.client import PartialDownloadError
 
 from synapse.api.constants import LoginType
 from synapse.api.errors import Codes, LoginError, SynapseError
-from synapse.util import json_decoder
+from synapse.util.json import json_decoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -136,7 +136,7 @@ class RecaptchaAuthChecker(UserInteractiveAuthChecker):
         except PartialDownloadError as pde:
             # Twisted is silly
             data = pde.response
-            # For mypy's benefit. A general Error.response is Optional[bytes], but
+            # For mypy's benefit. A general Error.response is bytes | None, but
             # a PartialDownloadError.response should be bytes AFAICS.
             assert data is not None
             resp_body = json_decoder.decode(data.decode("utf-8"))
@@ -321,7 +321,7 @@ class RegistrationTokenAuthChecker(UserInteractiveAuthChecker):
             )
 
 
-INTERACTIVE_AUTH_CHECKERS: Sequence[Type[UserInteractiveAuthChecker]] = [
+INTERACTIVE_AUTH_CHECKERS: Sequence[type[UserInteractiveAuthChecker]] = [
     DummyAuthChecker,
     TermsAuthChecker,
     RecaptchaAuthChecker,
diff --git a/synapse/handlers/user_directory.py b/synapse/handlers/user_directory.py
index 130099a239..e5c4de03c5 100644
--- a/synapse/handlers/user_directory.py
+++ b/synapse/handlers/user_directory.py
@@ -21,7 +21,7 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Optional
 
 from twisted.internet.interfaces import IDelayedCall
 
@@ -36,11 +36,11 @@ from synapse.api.constants import (
 from synapse.api.errors import Codes, SynapseError
 from synapse.handlers.state_deltas import MatchChange, StateDeltasHandler
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.storage.databases.main.state_deltas import StateDelta
 from synapse.storage.databases.main.user_directory import SearchResult
 from synapse.storage.roommember import ProfileInfo
 from synapse.types import UserID
+from synapse.util.duration import Duration
 from synapse.util.metrics import Measure
 from synapse.util.retryutils import NotRetryingDestination
 from synapse.util.stringutils import non_null_str_or_none
@@ -53,7 +53,7 @@ logger = logging.getLogger(__name__)
 # Don't refresh a stale user directory entry, using a Federation /profile request,
 # for 60 seconds. This gives time for other state events to arrive (which will
 # then be coalesced such that only one /profile request is made).
-USER_DIRECTORY_STALE_REFRESH_TIME_MS = 60 * 1000
+USER_DIRECTORY_STALE_REFRESH_TIME = Duration(minutes=1)
 
 # Maximum number of remote servers that we will attempt to refresh profiles for
 # in one go.
@@ -61,7 +61,7 @@ MAX_SERVERS_TO_REFRESH_PROFILES_FOR_IN_ONE_GO = 5
 
 # As long as we have servers to refresh (without backoff), keep adding more
 # every 15 seconds.
-INTERVAL_TO_ADD_MORE_SERVERS_TO_REFRESH_PROFILES = 15
+INTERVAL_TO_ADD_MORE_SERVERS_TO_REFRESH_PROFILES = Duration(seconds=15)
 
 
 def calculate_time_of_next_retry(now_ts: int, retry_count: int) -> int:
@@ -117,7 +117,7 @@ class UserDirectoryHandler(StateDeltasHandler):
         self._hs = hs
 
         # The current position in the current_state_delta stream
-        self.pos: Optional[int] = None
+        self.pos: int | None = None
 
         # Guard to ensure we only process deltas one at a time
         self._is_processing = False
@@ -130,18 +130,22 @@ class UserDirectoryHandler(StateDeltasHandler):
         # Guard to ensure we only have one process for refreshing remote profiles
         # for the given servers.
         # Set of server names.
-        self._is_refreshing_remote_profiles_for_servers: Set[str] = set()
+        self._is_refreshing_remote_profiles_for_servers: set[str] = set()
 
         if self.update_user_directory:
             self.notifier.add_replication_callback(self.notify_new_event)
 
             # We kick this off so that we don't have to wait for a change before
             # we start populating the user directory
-            self.clock.call_later(0, self.notify_new_event)
+            self.clock.call_later(
+                Duration(seconds=0),
+                self.notify_new_event,
+            )
 
             # Kick off the profile refresh process on startup
             self._refresh_remote_profiles_call_later = self.clock.call_later(
-                10, self.kick_off_remote_profile_refresh_process
+                Duration(seconds=10),
+                self.kick_off_remote_profile_refresh_process,
             )
 
     async def search_users(
@@ -193,9 +197,7 @@ class UserDirectoryHandler(StateDeltasHandler):
                 self._is_processing = False
 
         self._is_processing = True
-        run_as_background_process(
-            "user_directory.notify_new_event", self.server_name, process
-        )
+        self._hs.run_as_background_process("user_directory.notify_new_event", process)
 
     async def handle_local_profile_change(
         self, user_id: str, profile: ProfileInfo
@@ -269,7 +271,7 @@ class UserDirectoryHandler(StateDeltasHandler):
 
                 await self.store.update_user_directory_stream_pos(max_pos)
 
-    async def _handle_deltas(self, deltas: List[StateDelta]) -> None:
+    async def _handle_deltas(self, deltas: list[StateDelta]) -> None:
         """Called with the state deltas to process"""
         for delta in deltas:
             logger.debug(
@@ -298,8 +300,8 @@ class UserDirectoryHandler(StateDeltasHandler):
     async def _handle_room_publicity_change(
         self,
         room_id: str,
-        prev_event_id: Optional[str],
-        event_id: Optional[str],
+        prev_event_id: str | None,
+        event_id: str | None,
         typ: str,
     ) -> None:
         """Handle a room having potentially changed from/to world_readable/publicly
@@ -371,8 +373,8 @@ class UserDirectoryHandler(StateDeltasHandler):
     async def _handle_room_membership_event(
         self,
         room_id: str,
-        prev_event_id: Optional[str],
-        event_id: Optional[str],
+        prev_event_id: str | None,
+        event_id: str | None,
         state_key: str,
     ) -> None:
         """Process a single room membershp event.
@@ -465,7 +467,7 @@ class UserDirectoryHandler(StateDeltasHandler):
                     or await self.store.should_include_local_user_in_dir(other)
                 )
             ]
-            updates_to_users_who_share_rooms: Set[Tuple[str, str]] = set()
+            updates_to_users_who_share_rooms: set[tuple[str, str]] = set()
 
             # First, if the joining user is our local user then we need an
             # update for every other user in the room.
@@ -518,7 +520,7 @@ class UserDirectoryHandler(StateDeltasHandler):
         self,
         user_id: str,
         room_id: str,
-        prev_event_id: Optional[str],
+        prev_event_id: str | None,
         event_id: str,
     ) -> None:
         """Check member event changes for any profile changes and update the
@@ -549,7 +551,7 @@ class UserDirectoryHandler(StateDeltasHandler):
             now_ts = self.clock.time_msec()
             await self.store.set_remote_user_profile_in_user_dir_stale(
                 user_id,
-                next_try_at_ms=now_ts + USER_DIRECTORY_STALE_REFRESH_TIME_MS,
+                next_try_at_ms=now_ts + USER_DIRECTORY_STALE_REFRESH_TIME.as_millis(),
                 retry_counter=0,
             )
             # Schedule a wake-up to refresh the user directory for this server.
@@ -557,13 +559,13 @@ class UserDirectoryHandler(StateDeltasHandler):
             # other servers ahead of it in the queue to get in the way of updating
             # the profile if the server only just sent us an event.
             self.clock.call_later(
-                USER_DIRECTORY_STALE_REFRESH_TIME_MS // 1000 + 1,
+                USER_DIRECTORY_STALE_REFRESH_TIME + Duration(seconds=1),
                 self.kick_off_remote_profile_refresh_process_for_remote_server,
                 UserID.from_string(user_id).domain,
             )
             # Schedule a wake-up to handle any backoffs that may occur in the future.
             self.clock.call_later(
-                2 * USER_DIRECTORY_STALE_REFRESH_TIME_MS // 1000 + 1,
+                USER_DIRECTORY_STALE_REFRESH_TIME * 2 + Duration(seconds=1),
                 self.kick_off_remote_profile_refresh_process,
             )
             return
@@ -609,8 +611,8 @@ class UserDirectoryHandler(StateDeltasHandler):
                 self._is_refreshing_remote_profiles = False
 
         self._is_refreshing_remote_profiles = True
-        run_as_background_process(
-            "user_directory.refresh_remote_profiles", self.server_name, process
+        self._hs.run_as_background_process(
+            "user_directory.refresh_remote_profiles", process
         )
 
     async def _unsafe_refresh_remote_profiles(self) -> None:
@@ -655,8 +657,11 @@ class UserDirectoryHandler(StateDeltasHandler):
                 if not users:
                     return
                 _, _, next_try_at_ts = users[0]
+                delay = Duration(
+                    milliseconds=next_try_at_ts - self.clock.time_msec()
+                ) + Duration(seconds=2)
                 self._refresh_remote_profiles_call_later = self.clock.call_later(
-                    ((next_try_at_ts - self.clock.time_msec()) // 1000) + 2,
+                    delay,
                     self.kick_off_remote_profile_refresh_process,
                 )
 
@@ -692,9 +697,8 @@ class UserDirectoryHandler(StateDeltasHandler):
                 self._is_refreshing_remote_profiles_for_servers.remove(server_name)
 
         self._is_refreshing_remote_profiles_for_servers.add(server_name)
-        run_as_background_process(
+        self._hs.run_as_background_process(
             "user_directory.refresh_remote_profiles_for_remote_server",
-            self.server_name,
             process,
         )
 
diff --git a/synapse/handlers/worker_lock.py b/synapse/handlers/worker_lock.py
index 0b375790dd..1537a18cc0 100644
--- a/synapse/handlers/worker_lock.py
+++ b/synapse/handlers/worker_lock.py
@@ -26,25 +26,20 @@ from typing import (
     TYPE_CHECKING,
     AsyncContextManager,
     Collection,
-    Dict,
-    Optional,
-    Tuple,
-    Type,
-    Union,
 )
 from weakref import WeakSet
 
 import attr
 
 from twisted.internet import defer
-from twisted.internet.interfaces import IReactorTime
 
 from synapse.logging.context import PreserveLoggingContext
 from synapse.logging.opentracing import start_active_span
 from synapse.metrics.background_process_metrics import wrap_as_background_process
 from synapse.storage.databases.main.lock import Lock, LockStore
 from synapse.util.async_helpers import timeout_deferred
-from synapse.util.constants import ONE_MINUTE_SECONDS
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.logging.opentracing import opentracing
@@ -66,10 +61,8 @@ class WorkerLocksHandler:
     """
 
     def __init__(self, hs: "HomeServer") -> None:
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
-        self._reactor = hs.get_reactor()
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
+        self._clock = hs.get_clock()
         self._store = hs.get_datastores().main
         self._clock = hs.get_clock()
         self._notifier = hs.get_notifier()
@@ -77,11 +70,9 @@ class WorkerLocksHandler:
 
         # Map from lock name/key to set of `WaitingLock` that are active for
         # that lock.
-        self._locks: Dict[
-            Tuple[str, str], WeakSet[Union[WaitingLock, WaitingMultiLock]]
-        ] = {}
+        self._locks: dict[tuple[str, str], WeakSet[WaitingLock | WaitingMultiLock]] = {}
 
-        self._clock.looping_call(self._cleanup_locks, 30_000)
+        self._clock.looping_call(self._cleanup_locks, Duration(seconds=30))
 
         self._notifier.add_lock_released_callback(self._on_lock_released)
 
@@ -98,7 +89,7 @@ class WorkerLocksHandler:
         """
 
         lock = WaitingLock(
-            reactor=self._reactor,
+            clock=self._clock,
             store=self._store,
             handler=self,
             lock_name=lock_name,
@@ -129,7 +120,7 @@ class WorkerLocksHandler:
         """
 
         lock = WaitingLock(
-            reactor=self._reactor,
+            clock=self._clock,
             store=self._store,
             handler=self,
             lock_name=lock_name,
@@ -143,7 +134,7 @@ class WorkerLocksHandler:
 
     def acquire_multi_read_write_lock(
         self,
-        lock_names: Collection[Tuple[str, str]],
+        lock_names: Collection[tuple[str, str]],
         *,
         write: bool,
     ) -> "WaitingMultiLock":
@@ -160,7 +151,7 @@ class WorkerLocksHandler:
         lock = WaitingMultiLock(
             lock_names=lock_names,
             write=write,
-            reactor=self._reactor,
+            clock=self._clock,
             store=self._store,
             handler=self,
         )
@@ -190,14 +181,16 @@ class WorkerLocksHandler:
             return
 
         def _wake_all_locks(
-            locks: Collection[Union[WaitingLock, WaitingMultiLock]],
+            locks: Collection[WaitingLock | WaitingMultiLock],
         ) -> None:
             for lock in locks:
-                deferred = lock.deferred
-                if not deferred.called:
-                    deferred.callback(None)
+                lock.release_lock()
 
-        self._clock.call_later(0, _wake_all_locks, locks)
+        self._clock.call_later(
+            Duration(seconds=0),
+            _wake_all_locks,
+            locks,
+        )
 
     @wrap_as_background_process("_cleanup_locks")
     async def _cleanup_locks(self) -> None:
@@ -207,19 +200,25 @@ class WorkerLocksHandler:
 
 @attr.s(auto_attribs=True, eq=False)
 class WaitingLock:
-    reactor: IReactorTime
+    clock: Clock
     store: LockStore
     handler: WorkerLocksHandler
     lock_name: str
     lock_key: str
-    write: Optional[bool]
+    write: bool | None
     deferred: "defer.Deferred[None]" = attr.Factory(defer.Deferred)
-    _inner_lock: Optional[Lock] = None
+    _inner_lock: Lock | None = None
     _retry_interval: float = 0.1
     _lock_span: "opentracing.Scope" = attr.Factory(
         lambda: start_active_span("WaitingLock.lock")
     )
 
+    def release_lock(self) -> None:
+        """Release the lock (by resolving the deferred)"""
+        if not self.deferred.called:
+            with PreserveLoggingContext():
+                self.deferred.callback(None)
+
     async def __aenter__(self) -> None:
         self._lock_span.__enter__()
 
@@ -246,10 +245,11 @@ class WaitingLock:
                     # periodically wake up in case the lock was released but we
                     # weren't notified.
                     with PreserveLoggingContext():
+                        timeout = self._get_next_retry_interval()
                         await timeout_deferred(
                             deferred=self.deferred,
-                            timeout=self._get_next_retry_interval(),
-                            reactor=self.reactor,
+                            timeout=timeout,
+                            clock=self.clock,
                         )
                 except Exception:
                     pass
@@ -258,10 +258,10 @@ class WaitingLock:
 
     async def __aexit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc: Optional[BaseException],
-        tb: Optional[TracebackType],
-    ) -> Optional[bool]:
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        tb: TracebackType | None,
+    ) -> bool | None:
         assert self._inner_lock
 
         self.handler.notify_lock_released(self.lock_name, self.lock_key)
@@ -276,7 +276,7 @@ class WaitingLock:
     def _get_next_retry_interval(self) -> float:
         next = self._retry_interval
         self._retry_interval = max(5, next * 2)
-        if self._retry_interval > 10 * ONE_MINUTE_SECONDS:  # >7 iterations
+        if self._retry_interval > Duration(minutes=10).as_secs():  # >7 iterations
             logger.warning(
                 "Lock timeout is getting excessive: %ss. There may be a deadlock.",
                 self._retry_interval,
@@ -286,22 +286,28 @@ class WaitingLock:
 
 @attr.s(auto_attribs=True, eq=False)
 class WaitingMultiLock:
-    lock_names: Collection[Tuple[str, str]]
+    lock_names: Collection[tuple[str, str]]
 
     write: bool
 
-    reactor: IReactorTime
+    clock: Clock
     store: LockStore
     handler: WorkerLocksHandler
 
     deferred: "defer.Deferred[None]" = attr.Factory(defer.Deferred)
 
-    _inner_lock_cm: Optional[AsyncContextManager] = None
+    _inner_lock_cm: AsyncContextManager | None = None
     _retry_interval: float = 0.1
     _lock_span: "opentracing.Scope" = attr.Factory(
         lambda: start_active_span("WaitingLock.lock")
     )
 
+    def release_lock(self) -> None:
+        """Release the lock (by resolving the deferred)"""
+        if not self.deferred.called:
+            with PreserveLoggingContext():
+                self.deferred.callback(None)
+
     async def __aenter__(self) -> None:
         self._lock_span.__enter__()
 
@@ -323,10 +329,11 @@ class WaitingMultiLock:
                     # periodically wake up in case the lock was released but we
                     # weren't notified.
                     with PreserveLoggingContext():
+                        timeout = self._get_next_retry_interval()
                         await timeout_deferred(
                             deferred=self.deferred,
-                            timeout=self._get_next_retry_interval(),
-                            reactor=self.reactor,
+                            timeout=timeout,
+                            clock=self.clock,
                         )
                 except Exception:
                     pass
@@ -337,10 +344,10 @@ class WaitingMultiLock:
 
     async def __aexit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc: Optional[BaseException],
-        tb: Optional[TracebackType],
-    ) -> Optional[bool]:
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        tb: TracebackType | None,
+    ) -> bool | None:
         assert self._inner_lock_cm
 
         for lock_name, lock_key in self.lock_names:
@@ -356,7 +363,7 @@ class WaitingMultiLock:
     def _get_next_retry_interval(self) -> float:
         next = self._retry_interval
         self._retry_interval = max(5, next * 2)
-        if self._retry_interval > 10 * ONE_MINUTE_SECONDS:  # >7 iterations
+        if self._retry_interval > Duration(minutes=10).as_secs():  # >7 iterations
             logger.warning(
                 "Lock timeout is getting excessive: %ss. There may be a deadlock.",
                 self._retry_interval,
diff --git a/synapse/http/__init__.py b/synapse/http/__init__.py
index 272bbc05f9..f13271f302 100644
--- a/synapse/http/__init__.py
+++ b/synapse/http/__init__.py
@@ -19,7 +19,6 @@
 #
 #
 import re
-from typing import Union
 
 from twisted.internet import address, task
 from twisted.web.client import FileBodyProducer
@@ -75,7 +74,7 @@ def _get_requested_host(request: IRequest) -> bytes:
         return hostname
 
     # no Host header, use the address/port that the request arrived on
-    host: Union[address.IPv4Address, address.IPv6Address] = request.getHost()
+    host: address.IPv4Address | address.IPv6Address = request.getHost()
 
     hostname = host.host.encode("ascii")
 
diff --git a/synapse/http/additional_resource.py b/synapse/http/additional_resource.py
index 59eae841d5..3661a2aeb7 100644
--- a/synapse/http/additional_resource.py
+++ b/synapse/http/additional_resource.py
@@ -18,7 +18,7 @@
 #
 #
 
-from typing import TYPE_CHECKING, Any, Awaitable, Callable, Optional, Tuple
+from typing import TYPE_CHECKING, Any, Awaitable, Callable
 
 from twisted.web.server import Request
 
@@ -41,7 +41,7 @@ class AdditionalResource(DirectServeJsonResource):
     def __init__(
         self,
         hs: "HomeServer",
-        handler: Callable[[Request], Awaitable[Optional[Tuple[int, Any]]]],
+        handler: Callable[[Request], Awaitable[tuple[int, Any] | None]],
     ):
         """Initialise AdditionalResource
 
@@ -56,7 +56,7 @@ class AdditionalResource(DirectServeJsonResource):
         super().__init__(clock=hs.get_clock())
         self._handler = handler
 
-    async def _async_render(self, request: Request) -> Optional[Tuple[int, Any]]:
+    async def _async_render(self, request: Request) -> tuple[int, Any] | None:
         # Cheekily pass the result straight through, so we don't need to worry
         # if its an awaitable or not.
         return await self._handler(request)
diff --git a/synapse/http/client.py b/synapse/http/client.py
index 1f6d4dcd86..05c5f13a87 100644
--- a/synapse/http/client.py
+++ b/synapse/http/client.py
@@ -27,13 +27,9 @@ from typing import (
     Any,
     BinaryIO,
     Callable,
-    Dict,
-    List,
     Mapping,
     Optional,
     Protocol,
-    Tuple,
-    Union,
 )
 
 import attr
@@ -54,7 +50,6 @@ from twisted.internet.interfaces import (
     IOpenSSLContextFactory,
     IReactorCore,
     IReactorPluggableNameResolver,
-    IReactorTime,
     IResolutionReceiver,
     ITCPTransport,
 )
@@ -83,12 +78,18 @@ from synapse.http import QuieterFileBodyProducer, RequestTimedOutError, redact_u
 from synapse.http.proxyagent import ProxyAgent
 from synapse.http.replicationagent import ReplicationAgent
 from synapse.http.types import QueryParams
-from synapse.logging.context import make_deferred_yieldable, run_in_background
+from synapse.logging.context import (
+    PreserveLoggingContext,
+    make_deferred_yieldable,
+    run_in_background,
+)
 from synapse.logging.opentracing import set_tag, start_active_span, tags
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.types import ISynapseReactor, StrSequence
-from synapse.util import json_decoder
 from synapse.util.async_helpers import timeout_deferred
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+from synapse.util.json import json_decoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -121,7 +122,7 @@ incoming_responses_counter = Counter(
 # the type of the headers map, to be passed to the t.w.h.Headers.
 #
 # The actual type accepted by Twisted is
-#   Mapping[Union[str, bytes], Sequence[Union[str, bytes]] ,
+#   Mapping[str | bytes], Sequence[str | bytes] ,
 # allowing us to mix and match str and bytes freely. However: any str is also a
 # Sequence[str]; passing a header string value which is a
 # standalone str is interpreted as a sequence of 1-codepoint strings. This is a disastrous footgun.
@@ -129,21 +130,21 @@ incoming_responses_counter = Counter(
 #
 # We also simplify the keys to be either all str or all bytes. This helps because
 # Dict[K, V] is invariant in K (and indeed V).
-RawHeaders = Union[Mapping[str, "RawHeaderValue"], Mapping[bytes, "RawHeaderValue"]]
+RawHeaders = Mapping[str, "RawHeaderValue"] | Mapping[bytes, "RawHeaderValue"]
 
 # the value actually has to be a List, but List is invariant so we can't specify that
 # the entries can either be Lists or bytes.
-RawHeaderValue = Union[
-    StrSequence,
-    List[bytes],
-    List[Union[str, bytes]],
-    Tuple[bytes, ...],
-    Tuple[Union[str, bytes], ...],
-]
+RawHeaderValue = (
+    StrSequence
+    | list[bytes]
+    | list[str | bytes]
+    | tuple[bytes, ...]
+    | tuple[str | bytes, ...]
+)
 
 
 def _is_ip_blocked(
-    ip_address: IPAddress, allowlist: Optional[IPSet], blocklist: IPSet
+    ip_address: IPAddress, allowlist: IPSet | None, blocklist: IPSet
 ) -> bool:
     """
     Compares an IP address to allowed and disallowed IP sets.
@@ -162,19 +163,22 @@ def _is_ip_blocked(
     return False
 
 
-_EPSILON = 0.00000001
+# The delay used by the scheduler to schedule tasks "as soon as possible", while
+# still allowing other tasks to run between runs.
+_EPSILON = Duration(microseconds=1)
 
 
-def _make_scheduler(
-    reactor: IReactorTime,
-) -> Callable[[Callable[[], object]], IDelayedCall]:
+def _make_scheduler(clock: Clock) -> Callable[[Callable[[], object]], IDelayedCall]:
     """Makes a schedular suitable for a Cooperator using the given reactor.
 
     (This is effectively just a copy from `twisted.internet.task`)
     """
 
     def _scheduler(x: Callable[[], object]) -> IDelayedCall:
-        return reactor.callLater(_EPSILON, x)
+        return clock.call_later(
+            _EPSILON,
+            x,
+        )
 
     return _scheduler
 
@@ -188,7 +192,7 @@ class _IPBlockingResolver:
     def __init__(
         self,
         reactor: IReactorPluggableNameResolver,
-        ip_allowlist: Optional[IPSet],
+        ip_allowlist: IPSet | None,
         ip_blocklist: IPSet,
     ):
         """
@@ -204,7 +208,7 @@ class _IPBlockingResolver:
     def resolveHostName(
         self, recv: IResolutionReceiver, hostname: str, portNumber: int = 0
     ) -> IResolutionReceiver:
-        addresses: List[IAddress] = []
+        addresses: list[IAddress] = []
 
         def _callback() -> None:
             has_bad_ip = False
@@ -264,7 +268,7 @@ class BlocklistingReactorWrapper:
     def __init__(
         self,
         reactor: IReactorPluggableNameResolver,
-        ip_allowlist: Optional[IPSet],
+        ip_allowlist: IPSet | None,
         ip_blocklist: IPSet,
     ):
         self._reactor = reactor
@@ -293,7 +297,7 @@ class BlocklistingAgentWrapper(Agent):
         self,
         agent: IAgent,
         ip_blocklist: IPSet,
-        ip_allowlist: Optional[IPSet] = None,
+        ip_allowlist: IPSet | None = None,
     ):
         """
         Args:
@@ -309,13 +313,13 @@ class BlocklistingAgentWrapper(Agent):
         self,
         method: bytes,
         uri: bytes,
-        headers: Optional[Headers] = None,
+        headers: Headers | None = None,
         bodyProducer: Optional[IBodyProducer] = None,
     ) -> defer.Deferred:
         h = urllib.parse.urlparse(uri.decode("ascii"))
 
         try:
-            # h.hostname is Optional[str], None raises an AddrFormatError, so
+            # h.hostname is str | None, None raises an AddrFormatError, so
             # this is safe even though IPAddress requires a str.
             ip_address = IPAddress(h.hostname)  # type: ignore[arg-type]
         except AddrFormatError:
@@ -348,7 +352,7 @@ class BaseHttpClient:
     def __init__(
         self,
         hs: "HomeServer",
-        treq_args: Optional[Dict[str, Any]] = None,
+        treq_args: dict[str, Any] | None = None,
     ):
         self.hs = hs
         self.server_name = hs.hostname
@@ -367,14 +371,14 @@ class BaseHttpClient:
 
         # We use this for our body producers to ensure that they use the correct
         # reactor.
-        self._cooperator = Cooperator(scheduler=_make_scheduler(hs.get_reactor()))
+        self._cooperator = Cooperator(scheduler=_make_scheduler(hs.get_clock()))
 
     async def request(
         self,
         method: str,
         uri: str,
-        data: Optional[bytes] = None,
-        headers: Optional[Headers] = None,
+        data: bytes | None = None,
+        headers: Headers | None = None,
     ) -> IResponse:
         """
         Args:
@@ -436,9 +440,9 @@ class BaseHttpClient:
                 # we use our own timeout mechanism rather than treq's as a workaround
                 # for https://twistedmatrix.com/trac/ticket/9534.
                 request_deferred = timeout_deferred(
-                    request_deferred,
-                    60,
-                    self.hs.get_reactor(),
+                    deferred=request_deferred,
+                    timeout=60,
+                    clock=self.hs.get_clock(),
                 )
 
                 # turn timeouts into RequestTimedOutErrors
@@ -478,8 +482,8 @@ class BaseHttpClient:
     async def post_urlencoded_get_json(
         self,
         uri: str,
-        args: Optional[Mapping[str, Union[str, List[str]]]] = None,
-        headers: Optional[RawHeaders] = None,
+        args: Mapping[str, str | list[str]] | None = None,
+        headers: RawHeaders | None = None,
     ) -> Any:
         """
         Args:
@@ -527,7 +531,7 @@ class BaseHttpClient:
             )
 
     async def post_json_get_json(
-        self, uri: str, post_json: Any, headers: Optional[RawHeaders] = None
+        self, uri: str, post_json: Any, headers: RawHeaders | None = None
     ) -> Any:
         """
 
@@ -576,8 +580,8 @@ class BaseHttpClient:
     async def get_json(
         self,
         uri: str,
-        args: Optional[QueryParams] = None,
-        headers: Optional[RawHeaders] = None,
+        args: QueryParams | None = None,
+        headers: RawHeaders | None = None,
     ) -> Any:
         """Gets some json from the given URI.
 
@@ -607,8 +611,8 @@ class BaseHttpClient:
         self,
         uri: str,
         json_body: Any,
-        args: Optional[QueryParams] = None,
-        headers: Optional[RawHeaders] = None,
+        args: QueryParams | None = None,
+        headers: RawHeaders | None = None,
     ) -> Any:
         """Puts some json to the given URI.
 
@@ -658,8 +662,8 @@ class BaseHttpClient:
     async def get_raw(
         self,
         uri: str,
-        args: Optional[QueryParams] = None,
-        headers: Optional[RawHeaders] = None,
+        args: QueryParams | None = None,
+        headers: RawHeaders | None = None,
     ) -> bytes:
         """Gets raw text from the given URI.
 
@@ -703,10 +707,10 @@ class BaseHttpClient:
         self,
         url: str,
         output_stream: BinaryIO,
-        max_size: Optional[int] = None,
-        headers: Optional[RawHeaders] = None,
-        is_allowed_content_type: Optional[Callable[[str], bool]] = None,
-    ) -> Tuple[int, Dict[bytes, List[bytes]], str, int]:
+        max_size: int | None = None,
+        headers: RawHeaders | None = None,
+        is_allowed_content_type: Callable[[str], bool] | None = None,
+    ) -> tuple[int, dict[bytes, list[bytes]], str, int]:
         """GETs a file from a given URL
         Args:
             url: The URL to GET
@@ -763,7 +767,11 @@ class BaseHttpClient:
             d = read_body_with_max_size(response, output_stream, max_size)
 
             # Ensure that the body is not read forever.
-            d = timeout_deferred(d, 30, self.hs.get_reactor())
+            d = timeout_deferred(
+                deferred=d,
+                timeout=30,
+                clock=self.hs.get_clock(),
+            )
 
             length = await make_deferred_yieldable(d)
         except BodyExceededMaxSize:
@@ -810,9 +818,9 @@ class SimpleHttpClient(BaseHttpClient):
     def __init__(
         self,
         hs: "HomeServer",
-        treq_args: Optional[Dict[str, Any]] = None,
-        ip_allowlist: Optional[IPSet] = None,
-        ip_blocklist: Optional[IPSet] = None,
+        treq_args: dict[str, Any] | None = None,
+        ip_allowlist: IPSet | None = None,
+        ip_blocklist: IPSet | None = None,
         use_proxy: bool = False,
     ):
         super().__init__(hs, treq_args=treq_args)
@@ -889,8 +897,8 @@ class ReplicationClient(BaseHttpClient):
         self,
         method: str,
         uri: str,
-        data: Optional[bytes] = None,
-        headers: Optional[Headers] = None,
+        data: bytes | None = None,
+        headers: Headers | None = None,
     ) -> IResponse:
         """
         Make a request, differs from BaseHttpClient.request in that it does not use treq.
@@ -957,9 +965,9 @@ class ReplicationClient(BaseHttpClient):
                 # for https://twistedmatrix.com/trac/ticket/9534.
                 # (Updated url https://github.com/twisted/twisted/issues/9534)
                 request_deferred = timeout_deferred(
-                    request_deferred,
-                    60,
-                    self.hs.get_reactor(),
+                    deferred=request_deferred,
+                    timeout=60,
+                    clock=self.hs.get_clock(),
                 )
 
                 # turn timeouts into RequestTimedOutErrors
@@ -1036,7 +1044,8 @@ class _DiscardBodyWithMaxSizeProtocol(protocol.Protocol):
         Report a max size exceed error and disconnect the first time this is called.
         """
         if not self.deferred.called:
-            self.deferred.errback(BodyExceededMaxSize())
+            with PreserveLoggingContext():
+                self.deferred.errback(BodyExceededMaxSize())
             # Close the connection (forcefully) since all the data will get
             # discarded anyway.
             assert self.transport is not None
@@ -1056,10 +1065,10 @@ class MultipartResponse:
     """
 
     json: bytes = b"{}"
-    length: Optional[int] = None
-    content_type: Optional[bytes] = None
-    disposition: Optional[bytes] = None
-    url: Optional[bytes] = None
+    length: int | None = None
+    content_type: bytes | None = None
+    disposition: bytes | None = None
+    url: bytes | None = None
 
 
 class _MultipartParserProtocol(protocol.Protocol):
@@ -1074,13 +1083,13 @@ class _MultipartParserProtocol(protocol.Protocol):
         stream: ByteWriteable,
         deferred: defer.Deferred,
         boundary: str,
-        max_length: Optional[int],
+        max_length: int | None,
     ) -> None:
         self.stream = stream
         self.deferred = deferred
         self.boundary = boundary
         self.max_length = max_length
-        self.parser: Optional[MultipartParser] = None
+        self.parser: MultipartParser | None = None
         self.multipart_response = MultipartResponse()
         self.has_redirect = False
         self.in_json = False
@@ -1135,7 +1144,8 @@ class _MultipartParserProtocol(protocol.Protocol):
                         logger.warning(
                             "Exception encountered writing file data to stream: %s", e
                         )
-                        self.deferred.errback()
+                        with PreserveLoggingContext():
+                            self.deferred.errback()
                     self.file_length += end - start
 
             callbacks: "multipart.MultipartCallbacks" = {
@@ -1147,7 +1157,8 @@ class _MultipartParserProtocol(protocol.Protocol):
 
         self.total_length += len(incoming_data)
         if self.max_length is not None and self.total_length >= self.max_length:
-            self.deferred.errback(BodyExceededMaxSize())
+            with PreserveLoggingContext():
+                self.deferred.errback(BodyExceededMaxSize())
             # Close the connection (forcefully) since all the data will get
             # discarded anyway.
             assert self.transport is not None
@@ -1157,7 +1168,8 @@ class _MultipartParserProtocol(protocol.Protocol):
             self.parser.write(incoming_data)
         except Exception as e:
             logger.warning("Exception writing to multipart parser: %s", e)
-            self.deferred.errback()
+            with PreserveLoggingContext():
+                self.deferred.errback()
             return
 
     def connectionLost(self, reason: Failure = connectionDone) -> None:
@@ -1167,9 +1179,11 @@ class _MultipartParserProtocol(protocol.Protocol):
 
         if reason.check(ResponseDone):
             self.multipart_response.length = self.file_length
-            self.deferred.callback(self.multipart_response)
+            with PreserveLoggingContext():
+                self.deferred.callback(self.multipart_response)
         else:
-            self.deferred.errback(reason)
+            with PreserveLoggingContext():
+                self.deferred.errback(reason)
 
 
 class _ReadBodyWithMaxSizeProtocol(protocol.Protocol):
@@ -1178,7 +1192,7 @@ class _ReadBodyWithMaxSizeProtocol(protocol.Protocol):
     transport: Optional[ITCPTransport] = None
 
     def __init__(
-        self, stream: ByteWriteable, deferred: defer.Deferred, max_size: Optional[int]
+        self, stream: ByteWriteable, deferred: defer.Deferred, max_size: int | None
     ):
         self.stream = stream
         self.deferred = deferred
@@ -1193,7 +1207,8 @@ class _ReadBodyWithMaxSizeProtocol(protocol.Protocol):
         try:
             self.stream.write(data)
         except Exception:
-            self.deferred.errback()
+            with PreserveLoggingContext():
+                self.deferred.errback()
             return
 
         self.length += len(data)
@@ -1201,7 +1216,8 @@ class _ReadBodyWithMaxSizeProtocol(protocol.Protocol):
         # connection. dataReceived might be called again if data was received
         # in the meantime.
         if self.max_size is not None and self.length >= self.max_size:
-            self.deferred.errback(BodyExceededMaxSize())
+            with PreserveLoggingContext():
+                self.deferred.errback(BodyExceededMaxSize())
             # Close the connection (forcefully) since all the data will get
             # discarded anyway.
             assert self.transport is not None
@@ -1213,7 +1229,8 @@ class _ReadBodyWithMaxSizeProtocol(protocol.Protocol):
             return
 
         if reason.check(ResponseDone):
-            self.deferred.callback(self.length)
+            with PreserveLoggingContext():
+                self.deferred.callback(self.length)
         elif reason.check(PotentialDataLoss):
             # This applies to requests which don't set `Content-Length` or a
             # `Transfer-Encoding` in the response because in this case the end of the
@@ -1222,13 +1239,15 @@ class _ReadBodyWithMaxSizeProtocol(protocol.Protocol):
             # behavior is expected of some servers (like YouTube), let's ignore it.
             # Stolen from https://github.com/twisted/treq/pull/49/files
             # http://twistedmatrix.com/trac/ticket/4840
-            self.deferred.callback(self.length)
+            with PreserveLoggingContext():
+                self.deferred.callback(self.length)
         else:
-            self.deferred.errback(reason)
+            with PreserveLoggingContext():
+                self.deferred.errback(reason)
 
 
 def read_body_with_max_size(
-    response: IResponse, stream: ByteWriteable, max_size: Optional[int]
+    response: IResponse, stream: ByteWriteable, max_size: int | None
 ) -> "defer.Deferred[int]":
     """
     Read a HTTP response body to a file-object. Optionally enforcing a maximum file size.
@@ -1258,7 +1277,7 @@ def read_body_with_max_size(
 
 
 def read_multipart_response(
-    response: IResponse, stream: ByteWriteable, boundary: str, max_length: Optional[int]
+    response: IResponse, stream: ByteWriteable, boundary: str, max_length: int | None
 ) -> "defer.Deferred[MultipartResponse]":
     """
     Reads a MSC3916 multipart/mixed response and parses it, reading the file part (if it contains one) into
@@ -1283,7 +1302,7 @@ def read_multipart_response(
     return d
 
 
-def encode_query_args(args: Optional[QueryParams]) -> bytes:
+def encode_query_args(args: QueryParams | None) -> bytes:
     """
     Encodes a map of query arguments to bytes which can be appended to a URL.
 
@@ -1321,7 +1340,7 @@ class InsecureInterceptableContextFactory(ssl.ContextFactory):
 
 
 def is_unknown_endpoint(
-    e: HttpResponseException, synapse_error: Optional[SynapseError] = None
+    e: HttpResponseException, synapse_error: SynapseError | None = None
 ) -> bool:
     """
     Returns true if the response was due to an endpoint being unimplemented.
diff --git a/synapse/http/connectproxyclient.py b/synapse/http/connectproxyclient.py
index db803bc75a..285e6d3546 100644
--- a/synapse/http/connectproxyclient.py
+++ b/synapse/http/connectproxyclient.py
@@ -22,7 +22,7 @@
 import abc
 import base64
 import logging
-from typing import Optional, Union
+from typing import Union
 
 import attr
 from zope.interface import implementer
@@ -41,6 +41,8 @@ from twisted.internet.protocol import ClientFactory, connectionDone
 from twisted.python.failure import Failure
 from twisted.web import http
 
+from synapse.logging.context import PreserveLoggingContext
+
 logger = logging.getLogger(__name__)
 
 
@@ -106,7 +108,7 @@ class HTTPConnectProxyEndpoint:
         proxy_endpoint: IStreamClientEndpoint,
         host: bytes,
         port: int,
-        proxy_creds: Optional[ProxyCredentials],
+        proxy_creds: ProxyCredentials | None,
     ):
         self._reactor = reactor
         self._proxy_endpoint = proxy_endpoint
@@ -146,7 +148,7 @@ class HTTPProxiedClientFactory(protocol.ClientFactory):
         dst_host: bytes,
         dst_port: int,
         wrapped_factory: IProtocolFactory,
-        proxy_creds: Optional[ProxyCredentials],
+        proxy_creds: ProxyCredentials | None,
     ):
         self.dst_host = dst_host
         self.dst_port = dst_port
@@ -176,14 +178,16 @@ class HTTPProxiedClientFactory(protocol.ClientFactory):
     def clientConnectionFailed(self, connector: IConnector, reason: Failure) -> None:
         logger.debug("Connection to proxy failed: %s", reason)
         if not self.on_connection.called:
-            self.on_connection.errback(reason)
+            with PreserveLoggingContext():
+                self.on_connection.errback(reason)
         if isinstance(self.wrapped_factory, ClientFactory):
             return self.wrapped_factory.clientConnectionFailed(connector, reason)
 
     def clientConnectionLost(self, connector: IConnector, reason: Failure) -> None:
         logger.debug("Connection to proxy lost: %s", reason)
         if not self.on_connection.called:
-            self.on_connection.errback(reason)
+            with PreserveLoggingContext():
+                self.on_connection.errback(reason)
         if isinstance(self.wrapped_factory, ClientFactory):
             return self.wrapped_factory.clientConnectionLost(connector, reason)
 
@@ -212,7 +216,7 @@ class HTTPConnectProtocol(protocol.Protocol):
         port: int,
         wrapped_protocol: IProtocol,
         connected_deferred: defer.Deferred,
-        proxy_creds: Optional[ProxyCredentials],
+        proxy_creds: ProxyCredentials | None,
     ):
         self.host = host
         self.port = port
@@ -238,14 +242,16 @@ class HTTPConnectProtocol(protocol.Protocol):
         self.http_setup_client.connectionLost(reason)
 
         if not self.connected_deferred.called:
-            self.connected_deferred.errback(reason)
+            with PreserveLoggingContext():
+                self.connected_deferred.errback(reason)
 
     def proxyConnected(self, _: Union[None, "defer.Deferred[None]"]) -> None:
         self.wrapped_connection_started = True
         assert self.transport is not None
         self.wrapped_protocol.makeConnection(self.transport)
 
-        self.connected_deferred.callback(self.wrapped_protocol)
+        with PreserveLoggingContext():
+            self.connected_deferred.callback(self.wrapped_protocol)
 
         # Get any pending data from the http buf and forward it to the original protocol
         buf = self.http_setup_client.clearLineBuffer()
@@ -275,7 +281,7 @@ class HTTPConnectSetupClient(http.HTTPClient):
         self,
         host: bytes,
         port: int,
-        proxy_creds: Optional[ProxyCredentials],
+        proxy_creds: ProxyCredentials | None,
     ):
         self.host = host
         self.port = port
@@ -303,7 +309,8 @@ class HTTPConnectSetupClient(http.HTTPClient):
 
     def handleEndHeaders(self) -> None:
         logger.debug("End Headers")
-        self.on_connected.callback(None)
+        with PreserveLoggingContext():
+            self.on_connected.callback(None)
 
     def handleResponse(self, body: bytes) -> None:
         pass
diff --git a/synapse/http/federation/matrix_federation_agent.py b/synapse/http/federation/matrix_federation_agent.py
index 6ebadf0dbf..a0167659f1 100644
--- a/synapse/http/federation/matrix_federation_agent.py
+++ b/synapse/http/federation/matrix_federation_agent.py
@@ -19,7 +19,7 @@
 #
 import logging
 import urllib.parse
-from typing import Any, Generator, List, Optional
+from typing import Any, Generator, Optional
 from urllib.request import (  # type: ignore[attr-defined]
     proxy_bypass_environment,
 )
@@ -49,7 +49,7 @@ from synapse.http.federation.well_known_resolver import WellKnownResolver
 from synapse.http.proxyagent import ProxyAgent
 from synapse.logging.context import make_deferred_yieldable, run_in_background
 from synapse.types import ISynapseReactor
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 logger = logging.getLogger(__name__)
 
@@ -67,6 +67,9 @@ class MatrixFederationAgent:
     Args:
         reactor: twisted reactor to use for underlying requests
 
+        clock: Internal `HomeServer` clock used to track delayed and looping calls.
+            Should be obtained from `hs.get_clock()`.
+
         tls_client_options_factory:
             factory to use for fetching client tls options, or none to disable TLS.
 
@@ -97,18 +100,20 @@ class MatrixFederationAgent:
         *,
         server_name: str,
         reactor: ISynapseReactor,
-        tls_client_options_factory: Optional[FederationPolicyForHTTPS],
+        clock: Clock,
+        tls_client_options_factory: FederationPolicyForHTTPS | None,
         user_agent: bytes,
-        ip_allowlist: Optional[IPSet],
+        ip_allowlist: IPSet | None,
         ip_blocklist: IPSet,
-        proxy_config: Optional[ProxyConfig] = None,
-        _srv_resolver: Optional[SrvResolver] = None,
-        _well_known_resolver: Optional[WellKnownResolver] = None,
+        proxy_config: ProxyConfig | None = None,
+        _srv_resolver: SrvResolver | None = None,
+        _well_known_resolver: WellKnownResolver | None = None,
     ):
         """
         Args:
             server_name: Our homeserver name (used to label metrics) (`hs.hostname`).
             reactor
+            clock: Should be the `hs` clock from `hs.get_clock()`
             tls_client_options_factory
             user_agent
             ip_allowlist
@@ -124,7 +129,6 @@ class MatrixFederationAgent:
         # addresses, to prevent DNS rebinding.
         reactor = BlocklistingReactorWrapper(reactor, ip_allowlist, ip_blocklist)
 
-        self._clock = Clock(reactor)
         self._pool = HTTPConnectionPool(reactor)
         self._pool.retryAutomatically = False
         self._pool.maxPersistentPerHost = 5
@@ -147,6 +151,7 @@ class MatrixFederationAgent:
             _well_known_resolver = WellKnownResolver(
                 server_name=server_name,
                 reactor=reactor,
+                clock=clock,
                 agent=BlocklistingAgentWrapper(
                     ProxyAgent(
                         reactor=reactor,
@@ -167,7 +172,7 @@ class MatrixFederationAgent:
         self,
         method: bytes,
         uri: bytes,
-        headers: Optional[Headers] = None,
+        headers: Headers | None = None,
         bodyProducer: Optional[IBodyProducer] = None,
     ) -> Generator[defer.Deferred, Any, IResponse]:
         """
@@ -254,9 +259,9 @@ class MatrixHostnameEndpointFactory:
         *,
         reactor: IReactorCore,
         proxy_reactor: IReactorCore,
-        tls_client_options_factory: Optional[FederationPolicyForHTTPS],
-        srv_resolver: Optional[SrvResolver],
-        proxy_config: Optional[ProxyConfig],
+        tls_client_options_factory: FederationPolicyForHTTPS | None,
+        srv_resolver: SrvResolver | None,
+        proxy_config: ProxyConfig | None,
     ):
         self._reactor = reactor
         self._proxy_reactor = proxy_reactor
@@ -305,9 +310,9 @@ class MatrixHostnameEndpoint:
         *,
         reactor: IReactorCore,
         proxy_reactor: IReactorCore,
-        tls_client_options_factory: Optional[FederationPolicyForHTTPS],
+        tls_client_options_factory: FederationPolicyForHTTPS | None,
         srv_resolver: SrvResolver,
-        proxy_config: Optional[ProxyConfig],
+        proxy_config: ProxyConfig | None,
         parsed_uri: URI,
     ):
         self._reactor = reactor
@@ -408,7 +413,7 @@ class MatrixHostnameEndpoint:
         # to try and if that doesn't work then we'll have an exception.
         raise Exception("Failed to resolve server %r" % (self._parsed_uri.netloc,))
 
-    async def _resolve_server(self) -> List[Server]:
+    async def _resolve_server(self) -> list[Server]:
         """Resolves the server name to a list of hosts and ports to attempt to
         connect to.
         """
diff --git a/synapse/http/federation/srv_resolver.py b/synapse/http/federation/srv_resolver.py
index 639bf309d6..76a51e4873 100644
--- a/synapse/http/federation/srv_resolver.py
+++ b/synapse/http/federation/srv_resolver.py
@@ -22,7 +22,7 @@
 import logging
 import random
 import time
-from typing import Any, Callable, Dict, List
+from typing import Any, Callable
 
 import attr
 
@@ -34,7 +34,7 @@ from synapse.logging.context import make_deferred_yieldable
 
 logger = logging.getLogger(__name__)
 
-SERVER_CACHE: Dict[bytes, List["Server"]] = {}
+SERVER_CACHE: dict[bytes, list["Server"]] = {}
 
 
 @attr.s(auto_attribs=True, slots=True, frozen=True)
@@ -58,11 +58,11 @@ class Server:
     expires: int = 0
 
 
-def _sort_server_list(server_list: List[Server]) -> List[Server]:
+def _sort_server_list(server_list: list[Server]) -> list[Server]:
     """Given a list of SRV records sort them into priority order and shuffle
     each priority with the given weight.
     """
-    priority_map: Dict[int, List[Server]] = {}
+    priority_map: dict[int, list[Server]] = {}
 
     for server in server_list:
         priority_map.setdefault(server.priority, []).append(server)
@@ -116,14 +116,14 @@ class SrvResolver:
     def __init__(
         self,
         dns_client: Any = client,
-        cache: Dict[bytes, List[Server]] = SERVER_CACHE,
+        cache: dict[bytes, list[Server]] = SERVER_CACHE,
         get_time: Callable[[], float] = time.time,
     ):
         self._dns_client = dns_client
         self._cache = cache
         self._get_time = get_time
 
-    async def resolve_service(self, service_name: bytes) -> List[Server]:
+    async def resolve_service(self, service_name: bytes) -> list[Server]:
         """Look up a SRV record
 
         Args:
diff --git a/synapse/http/federation/well_known_resolver.py b/synapse/http/federation/well_known_resolver.py
index 70242ad0ae..303b3856a2 100644
--- a/synapse/http/federation/well_known_resolver.py
+++ b/synapse/http/federation/well_known_resolver.py
@@ -22,12 +22,11 @@ import logging
 import random
 import time
 from io import BytesIO
-from typing import Callable, Dict, Optional, Tuple
+from typing import Callable
 
 import attr
 
 from twisted.internet import defer
-from twisted.internet.interfaces import IReactorTime
 from twisted.web.client import RedirectAgent
 from twisted.web.http import stringToDatetime
 from twisted.web.http_headers import Headers
@@ -35,8 +34,11 @@ from twisted.web.iweb import IAgent, IResponse
 
 from synapse.http.client import BodyExceededMaxSize, read_body_with_max_size
 from synapse.logging.context import make_deferred_yieldable
-from synapse.util import Clock, json_decoder
+from synapse.types import ISynapseThreadlessReactor
 from synapse.util.caches.ttlcache import TTLCache
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+from synapse.util.json import json_decoder
 from synapse.util.metrics import Measure
 
 # period to cache .well-known results for by default
@@ -79,7 +81,7 @@ logger = logging.getLogger(__name__)
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class WellKnownLookupResult:
-    delegated_server: Optional[bytes]
+    delegated_server: bytes | None
 
 
 class WellKnownResolver:
@@ -88,16 +90,18 @@ class WellKnownResolver:
     def __init__(
         self,
         server_name: str,
-        reactor: IReactorTime,
+        reactor: ISynapseThreadlessReactor,
+        clock: Clock,
         agent: IAgent,
         user_agent: bytes,
-        well_known_cache: Optional[TTLCache[bytes, Optional[bytes]]] = None,
-        had_well_known_cache: Optional[TTLCache[bytes, bool]] = None,
+        well_known_cache: TTLCache[bytes, bytes | None] | None = None,
+        had_well_known_cache: TTLCache[bytes, bool] | None = None,
     ):
         """
         Args:
             server_name: Our homeserver name (used to label metrics) (`hs.hostname`).
             reactor
+            clock: Should be the `hs` clock from `hs.get_clock()`
             agent
             user_agent
             well_known_cache
@@ -106,7 +110,7 @@ class WellKnownResolver:
 
         self.server_name = server_name
         self._reactor = reactor
-        self._clock = Clock(reactor)
+        self._clock = clock
 
         if well_known_cache is None:
             well_known_cache = TTLCache(
@@ -153,7 +157,7 @@ class WellKnownResolver:
                 # label metrics)
                 server_name=self.server_name,
             ):
-                result: Optional[bytes]
+                result: bytes | None
                 cache_period: float
 
                 result, cache_period = await self._fetch_well_known(server_name)
@@ -185,7 +189,7 @@ class WellKnownResolver:
 
         return WellKnownLookupResult(delegated_server=result)
 
-    async def _fetch_well_known(self, server_name: bytes) -> Tuple[bytes, float]:
+    async def _fetch_well_known(self, server_name: bytes) -> tuple[bytes, float]:
         """Actually fetch and parse a .well-known, without checking the cache
 
         Args:
@@ -248,7 +252,7 @@ class WellKnownResolver:
 
     async def _make_well_known_request(
         self, server_name: bytes, retry: bool
-    ) -> Tuple[IResponse, bytes]:
+    ) -> tuple[IResponse, bytes]:
         """Make the well known request.
 
         This will retry the request if requested and it fails (with unable
@@ -312,12 +316,12 @@ class WellKnownResolver:
                 logger.info("Error fetching %s: %s. Retrying", uri_str, e)
 
             # Sleep briefly in the hopes that they come back up
-            await self._clock.sleep(0.5)
+            await self._clock.sleep(Duration(milliseconds=500))
 
 
 def _cache_period_from_headers(
     headers: Headers, time_now: Callable[[], float] = time.time
-) -> Optional[float]:
+) -> float | None:
     cache_controls = _parse_cache_control(headers)
 
     if b"no-store" in cache_controls:
@@ -345,7 +349,7 @@ def _cache_period_from_headers(
     return None
 
 
-def _parse_cache_control(headers: Headers) -> Dict[bytes, Optional[bytes]]:
+def _parse_cache_control(headers: Headers) -> dict[bytes, bytes | None]:
     cache_controls = {}
     cache_control_headers = headers.getRawHeaders(b"cache-control") or []
     for hdr in cache_control_headers:
diff --git a/synapse/http/matrixfederationclient.py b/synapse/http/matrixfederationclient.py
index 15f8e147ab..dbd4f1e4b6 100644
--- a/synapse/http/matrixfederationclient.py
+++ b/synapse/http/matrixfederationclient.py
@@ -31,15 +31,11 @@ from typing import (
     Any,
     BinaryIO,
     Callable,
-    Dict,
     Generic,
-    List,
     Literal,
     Optional,
     TextIO,
-    Tuple,
     TypeVar,
-    Union,
     cast,
     overload,
 )
@@ -89,8 +85,9 @@ from synapse.logging.context import make_deferred_yieldable, run_in_background
 from synapse.logging.opentracing import set_tag, start_active_span, tags
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.types import JsonDict
-from synapse.util import json_decoder
 from synapse.util.async_helpers import AwakenableSleeper, Linearizer, timeout_deferred
+from synapse.util.clock import Clock
+from synapse.util.json import json_decoder
 from synapse.util.metrics import Measure
 from synapse.util.stringutils import parse_and_validate_server_name
 
@@ -155,15 +152,15 @@ class MatrixFederationRequest:
     """The remote server to send the HTTP request to.
     """
 
-    json: Optional[JsonDict] = None
+    json: JsonDict | None = None
     """JSON to send in the body.
     """
 
-    json_callback: Optional[Callable[[], JsonDict]] = None
+    json_callback: Callable[[], JsonDict] | None = None
     """A callback to generate the JSON.
     """
 
-    query: Optional[QueryParams] = None
+    query: QueryParams | None = None
     """Query arguments.
     """
 
@@ -206,7 +203,7 @@ class MatrixFederationRequest:
             )
             object.__setattr__(self, "uri", uri)
 
-    def get_json(self) -> Optional[JsonDict]:
+    def get_json(self) -> JsonDict | None:
         if self.json_callback:
             return self.json_callback()
         return self.json
@@ -218,7 +215,7 @@ class _BaseJsonParser(ByteParser[T]):
     CONTENT_TYPE = "application/json"
 
     def __init__(
-        self, validator: Optional[Callable[[Optional[object]], bool]] = None
+        self, validator: Callable[[object | None], bool] | None = None
     ) -> None:
         """
         Args:
@@ -252,7 +249,7 @@ class JsonParser(_BaseJsonParser[JsonDict]):
         return isinstance(v, dict)
 
 
-class LegacyJsonSendParser(_BaseJsonParser[Tuple[int, JsonDict]]):
+class LegacyJsonSendParser(_BaseJsonParser[tuple[int, JsonDict]]):
     """Ensure the legacy responses of /send_join & /send_leave are correct."""
 
     def __init__(self) -> None:
@@ -270,6 +267,7 @@ class LegacyJsonSendParser(_BaseJsonParser[Tuple[int, JsonDict]]):
 
 
 async def _handle_response(
+    clock: Clock,
     reactor: IReactorTime,
     timeout_sec: float,
     request: MatrixFederationRequest,
@@ -299,7 +297,11 @@ async def _handle_response(
         check_content_type_is(response.headers, parser.CONTENT_TYPE)
 
         d = read_body_with_max_size(response, parser, max_response_size)
-        d = timeout_deferred(d, timeout=timeout_sec, reactor=reactor)
+        d = timeout_deferred(
+            deferred=d,
+            timeout=timeout_sec,
+            clock=clock,
+        )
 
         length = await make_deferred_yieldable(d)
 
@@ -387,7 +389,7 @@ class BinaryIOWrapper:
         self.decoder = codecs.getincrementaldecoder(encoding)(errors)
         self.file = file
 
-    def write(self, b: Union[bytes, bytearray]) -> int:
+    def write(self, b: bytes | bytearray) -> int:
         self.file.write(self.decoder.decode(b))
         return len(b)
 
@@ -404,13 +406,14 @@ class MatrixFederationHttpClient:
     def __init__(
         self,
         hs: "HomeServer",
-        tls_client_options_factory: Optional[FederationPolicyForHTTPS],
+        tls_client_options_factory: FederationPolicyForHTTPS | None,
     ):
         self.hs = hs
         self.signing_key = hs.signing_key
         self.server_name = hs.hostname
 
         self.reactor = hs.get_reactor()
+        self.clock = hs.get_clock()
 
         user_agent = hs.version_string
         if hs.config.server.user_agent_suffix:
@@ -424,6 +427,7 @@ class MatrixFederationHttpClient:
             federation_agent: IAgent = MatrixFederationAgent(
                 server_name=self.server_name,
                 reactor=self.reactor,
+                clock=self.clock,
                 tls_client_options_factory=tls_client_options_factory,
                 user_agent=user_agent.encode("ascii"),
                 ip_allowlist=hs.config.server.federation_ip_range_allowlist,
@@ -457,7 +461,6 @@ class MatrixFederationHttpClient:
             ip_blocklist=hs.config.server.federation_ip_range_blocklist,
         )
 
-        self.clock = hs.get_clock()
         self._store = hs.get_datastores().main
         self.version_string_bytes = hs.version_string.encode("ascii")
         self.default_timeout_seconds = hs.config.federation.client_timeout_ms / 1000
@@ -470,9 +473,9 @@ class MatrixFederationHttpClient:
         self.max_long_retries = hs.config.federation.max_long_retries
         self.max_short_retries = hs.config.federation.max_short_retries
 
-        self._cooperator = Cooperator(scheduler=_make_scheduler(self.reactor))
+        self._cooperator = Cooperator(scheduler=_make_scheduler(self.clock))
 
-        self._sleeper = AwakenableSleeper(self.reactor)
+        self._sleeper = AwakenableSleeper(self.clock)
 
         self._simple_http_client = SimpleHttpClient(
             hs,
@@ -481,7 +484,13 @@ class MatrixFederationHttpClient:
             use_proxy=True,
         )
 
-        self.remote_download_linearizer = Linearizer("remote_download_linearizer", 6)
+        self.remote_download_linearizer = Linearizer(
+            name="remote_download_linearizer", max_count=6, clock=self.clock
+        )
+        self._is_shutdown = False
+
+    def shutdown(self) -> None:
+        self._is_shutdown = True
 
     def wake_destination(self, destination: str) -> None:
         """Called when the remote server may have come back online."""
@@ -540,7 +549,7 @@ class MatrixFederationHttpClient:
         self,
         request: MatrixFederationRequest,
         retry_on_dns_fail: bool = True,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         long_retries: bool = False,
         ignore_backoff: bool = False,
         backoff_on_404: bool = False,
@@ -627,6 +636,7 @@ class MatrixFederationHttpClient:
         limiter = await synapse.util.retryutils.get_retry_limiter(
             destination=request.destination,
             our_server_name=self.server_name,
+            hs=self.hs,
             clock=self.clock,
             store=self._store,
             backoff_on_404=backoff_on_404,
@@ -653,7 +663,7 @@ class MatrixFederationHttpClient:
         )
 
         # Inject the span into the headers
-        headers_dict: Dict[bytes, List[bytes]] = {}
+        headers_dict: dict[bytes, list[bytes]] = {}
         opentracing.inject_header_dict(headers_dict, request.destination)
 
         headers_dict[b"User-Agent"] = [self.version_string_bytes]
@@ -673,7 +683,7 @@ class MatrixFederationHttpClient:
                 (b"", b"", path_bytes, None, query_bytes, b"")
             )
 
-            while True:
+            while not self._is_shutdown:
                 try:
                     json = request.get_json()
                     if json:
@@ -731,9 +741,9 @@ class MatrixFederationHttpClient:
                                 bodyProducer=producer,
                             )
                             request_deferred = timeout_deferred(
-                                request_deferred,
+                                deferred=request_deferred,
                                 timeout=_sec_timeout,
-                                reactor=self.reactor,
+                                clock=self.clock,
                             )
 
                             response = await make_deferred_yieldable(request_deferred)
@@ -791,7 +801,9 @@ class MatrixFederationHttpClient:
                         # Update transactions table?
                         d = treq.content(response)
                         d = timeout_deferred(
-                            d, timeout=_sec_timeout, reactor=self.reactor
+                            deferred=d,
+                            timeout=_sec_timeout,
+                            clock=self.clock,
                         )
 
                         try:
@@ -860,6 +872,15 @@ class MatrixFederationHttpClient:
                             delay_seconds,
                         )
 
+                        if self._is_shutdown:
+                            # Immediately fail sending the request instead of starting a
+                            # potentially long sleep after the server has requested
+                            # shutdown.
+                            # This is the code path followed when the
+                            # `federation_transaction_transmission_loop` has been
+                            # cancelled.
+                            raise
+
                         # Sleep for the calculated delay, or wake up immediately
                         # if we get notified that the server is back up.
                         await self._sleeper.sleep(
@@ -883,12 +904,12 @@ class MatrixFederationHttpClient:
 
     def build_auth_headers(
         self,
-        destination: Optional[bytes],
+        destination: bytes | None,
         method: bytes,
         url_bytes: bytes,
-        content: Optional[JsonDict] = None,
-        destination_is: Optional[bytes] = None,
-    ) -> List[bytes]:
+        content: JsonDict | None = None,
+        destination_is: bytes | None = None,
+    ) -> list[bytes]:
         """
         Builds the Authorization headers for a federation request
         Args:
@@ -948,11 +969,11 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = None,
-        data: Optional[JsonDict] = None,
-        json_data_callback: Optional[Callable[[], JsonDict]] = None,
+        args: QueryParams | None = None,
+        data: JsonDict | None = None,
+        json_data_callback: Callable[[], JsonDict] | None = None,
         long_retries: bool = False,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
         backoff_on_404: bool = False,
         try_trailing_slash_on_400: bool = False,
@@ -965,15 +986,15 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = None,
-        data: Optional[JsonDict] = None,
-        json_data_callback: Optional[Callable[[], JsonDict]] = None,
+        args: QueryParams | None = None,
+        data: JsonDict | None = None,
+        json_data_callback: Callable[[], JsonDict] | None = None,
         long_retries: bool = False,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
         backoff_on_404: bool = False,
         try_trailing_slash_on_400: bool = False,
-        parser: Optional[ByteParser[T]] = None,
+        parser: ByteParser[T] | None = None,
         backoff_on_all_error_codes: bool = False,
     ) -> T: ...
 
@@ -981,17 +1002,17 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = None,
-        data: Optional[JsonDict] = None,
-        json_data_callback: Optional[Callable[[], JsonDict]] = None,
+        args: QueryParams | None = None,
+        data: JsonDict | None = None,
+        json_data_callback: Callable[[], JsonDict] | None = None,
         long_retries: bool = False,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
         backoff_on_404: bool = False,
         try_trailing_slash_on_400: bool = False,
-        parser: Optional[ByteParser[T]] = None,
+        parser: ByteParser[T] | None = None,
         backoff_on_all_error_codes: bool = False,
-    ) -> Union[JsonDict, T]:
+    ) -> JsonDict | T:
         """Sends the specified json data using PUT
 
         Args:
@@ -1072,6 +1093,7 @@ class MatrixFederationHttpClient:
             parser = cast(ByteParser[T], JsonParser())
 
         body = await _handle_response(
+            self.clock,
             self.reactor,
             _sec_timeout,
             request,
@@ -1086,11 +1108,11 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        data: Optional[JsonDict] = None,
+        data: JsonDict | None = None,
         long_retries: bool = False,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
     ) -> JsonDict:
         """Sends the specified json data using POST
 
@@ -1150,7 +1172,13 @@ class MatrixFederationHttpClient:
             _sec_timeout = self.default_timeout_seconds
 
         body = await _handle_response(
-            self.reactor, _sec_timeout, request, response, start_ms, parser=JsonParser()
+            self.clock,
+            self.reactor,
+            _sec_timeout,
+            request,
+            response,
+            start_ms,
+            parser=JsonParser(),
         )
         return body
 
@@ -1159,9 +1187,9 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
         retry_on_dns_fail: bool = True,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
         try_trailing_slash_on_400: bool = False,
         parser: Literal[None] = None,
@@ -1172,9 +1200,9 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = ...,
+        args: QueryParams | None = ...,
         retry_on_dns_fail: bool = ...,
-        timeout: Optional[int] = ...,
+        timeout: int | None = ...,
         ignore_backoff: bool = ...,
         try_trailing_slash_on_400: bool = ...,
         parser: ByteParser[T] = ...,
@@ -1184,13 +1212,13 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
         retry_on_dns_fail: bool = True,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
         try_trailing_slash_on_400: bool = False,
-        parser: Optional[ByteParser[T]] = None,
-    ) -> Union[JsonDict, T]:
+        parser: ByteParser[T] | None = None,
+    ) -> JsonDict | T:
         """GETs some json from the given host homeserver and path
 
         Args:
@@ -1253,38 +1281,38 @@ class MatrixFederationHttpClient:
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
         retry_on_dns_fail: bool = True,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
         try_trailing_slash_on_400: bool = False,
         parser: Literal[None] = None,
-    ) -> Tuple[JsonDict, Dict[bytes, List[bytes]]]: ...
+    ) -> tuple[JsonDict, dict[bytes, list[bytes]]]: ...
 
     @overload
     async def get_json_with_headers(
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = ...,
+        args: QueryParams | None = ...,
         retry_on_dns_fail: bool = ...,
-        timeout: Optional[int] = ...,
+        timeout: int | None = ...,
         ignore_backoff: bool = ...,
         try_trailing_slash_on_400: bool = ...,
         parser: ByteParser[T] = ...,
-    ) -> Tuple[T, Dict[bytes, List[bytes]]]: ...
+    ) -> tuple[T, dict[bytes, list[bytes]]]: ...
 
     async def get_json_with_headers(
         self,
         destination: str,
         path: str,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
         retry_on_dns_fail: bool = True,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
         try_trailing_slash_on_400: bool = False,
-        parser: Optional[ByteParser[T]] = None,
-    ) -> Tuple[Union[JsonDict, T], Dict[bytes, List[bytes]]]:
+        parser: ByteParser[T] | None = None,
+    ) -> tuple[JsonDict | T, dict[bytes, list[bytes]]]:
         """GETs some json from the given host homeserver and path
 
         Args:
@@ -1356,6 +1384,7 @@ class MatrixFederationHttpClient:
             parser = cast(ByteParser[T], JsonParser())
 
         body = await _handle_response(
+            self.clock,
             self.reactor,
             _sec_timeout,
             request,
@@ -1371,9 +1400,9 @@ class MatrixFederationHttpClient:
         destination: str,
         path: str,
         long_retries: bool = False,
-        timeout: Optional[int] = None,
+        timeout: int | None = None,
         ignore_backoff: bool = False,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
     ) -> JsonDict:
         """Send a DELETE request to the remote expecting some json response
 
@@ -1429,7 +1458,13 @@ class MatrixFederationHttpClient:
             _sec_timeout = self.default_timeout_seconds
 
         body = await _handle_response(
-            self.reactor, _sec_timeout, request, response, start_ms, parser=JsonParser()
+            self.clock,
+            self.reactor,
+            _sec_timeout,
+            request,
+            response,
+            start_ms,
+            parser=JsonParser(),
         )
         return body
 
@@ -1441,11 +1476,11 @@ class MatrixFederationHttpClient:
         download_ratelimiter: Ratelimiter,
         ip_address: str,
         max_size: int,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
         retry_on_dns_fail: bool = True,
         ignore_backoff: bool = False,
         follow_redirects: bool = False,
-    ) -> Tuple[int, Dict[bytes, List[bytes]]]:
+    ) -> tuple[int, dict[bytes, list[bytes]]]:
         """GETs a file from a given homeserver
         Args:
             destination: The remote server to send the HTTP request to.
@@ -1603,10 +1638,10 @@ class MatrixFederationHttpClient:
         download_ratelimiter: Ratelimiter,
         ip_address: str,
         max_size: int,
-        args: Optional[QueryParams] = None,
+        args: QueryParams | None = None,
         retry_on_dns_fail: bool = True,
         ignore_backoff: bool = False,
-    ) -> Tuple[int, Dict[bytes, List[bytes]], bytes]:
+    ) -> tuple[int, dict[bytes, list[bytes]], bytes]:
         """GETs a file from a given homeserver over the federation /download endpoint
         Args:
             destination: The remote server to send the HTTP request to.
@@ -1719,6 +1754,7 @@ class MatrixFederationHttpClient:
                     response, output_stream, boundary, expected_size + 1
                 )
                 deferred.addTimeout(self.default_timeout_seconds, self.reactor)
+                multipart_response = await make_deferred_yieldable(deferred)
         except BodyExceededMaxSize:
             msg = "Requested file is too large > %r bytes" % (expected_size,)
             logger.warning(
@@ -1755,7 +1791,6 @@ class MatrixFederationHttpClient:
             )
             raise
 
-        multipart_response = await make_deferred_yieldable(deferred)
         if not multipart_response.url:
             assert multipart_response.length is not None
             length = multipart_response.length
diff --git a/synapse/http/proxy.py b/synapse/http/proxy.py
index 9b044f3b0a..b3a2f84f29 100644
--- a/synapse/http/proxy.py
+++ b/synapse/http/proxy.py
@@ -22,7 +22,7 @@
 import json
 import logging
 import urllib.parse
-from typing import TYPE_CHECKING, Any, Optional, Set, Tuple, cast
+from typing import TYPE_CHECKING, Any, Optional, cast
 
 from twisted.internet import protocol
 from twisted.internet.interfaces import ITCPTransport
@@ -65,8 +65,8 @@ assert all(header.lower() == header for header in HOP_BY_HOP_HEADERS_LOWERCASE)
 
 
 def parse_connection_header_value(
-    connection_header_value: Optional[bytes],
-) -> Set[str]:
+    connection_header_value: bytes | None,
+) -> set[str]:
     """
     Parse the `Connection` header to determine which headers we should not be copied
     over from the remote response.
@@ -86,7 +86,7 @@ def parse_connection_header_value(
         The set of header names that should not be copied over from the remote response.
         The keys are lowercased.
     """
-    extra_headers_to_remove: Set[str] = set()
+    extra_headers_to_remove: set[str] = set()
     if connection_header_value:
         extra_headers_to_remove = {
             connection_option.decode("ascii").strip().lower()
@@ -140,7 +140,7 @@ class ProxyResource(_AsyncResource):
             "Invalid Proxy-Authorization header.", Codes.UNAUTHORIZED
         )
 
-    async def _async_render(self, request: "SynapseRequest") -> Tuple[int, Any]:
+    async def _async_render(self, request: "SynapseRequest") -> tuple[int, Any]:
         uri = urllib.parse.urlparse(request.uri)
         assert uri.scheme == b"matrix-federation"
 
@@ -161,12 +161,12 @@ class ProxyResource(_AsyncResource):
             bodyProducer=QuieterFileBodyProducer(request.content),
         )
         request_deferred = timeout_deferred(
-            request_deferred,
+            deferred=request_deferred,
             # This should be set longer than the timeout in `MatrixFederationHttpClient`
             # so that it has enough time to complete and pass us the data before we give
             # up.
             timeout=90,
-            reactor=self.reactor,
+            clock=self._clock,
         )
 
         response = await make_deferred_yieldable(request_deferred)
diff --git a/synapse/http/proxyagent.py b/synapse/http/proxyagent.py
index ab413990c5..1f8e58efbc 100644
--- a/synapse/http/proxyagent.py
+++ b/synapse/http/proxyagent.py
@@ -21,7 +21,7 @@
 import logging
 import random
 import re
-from typing import Any, Collection, Dict, List, Optional, Sequence, Tuple, Union, cast
+from typing import Any, Collection, Optional, Sequence, cast
 from urllib.parse import urlparse
 from urllib.request import (  # type: ignore[attr-defined]
     proxy_bypass_environment,
@@ -121,12 +121,12 @@ class ProxyAgent(_AgentBase):
         reactor: IReactorCore,
         proxy_reactor: Optional[IReactorCore] = None,
         contextFactory: Optional[IPolicyForHTTPS] = None,
-        connectTimeout: Optional[float] = None,
-        bindAddress: Optional[bytes] = None,
-        pool: Optional[HTTPConnectionPool] = None,
-        proxy_config: Optional[ProxyConfig] = None,
+        connectTimeout: float | None = None,
+        bindAddress: bytes | None = None,
+        pool: HTTPConnectionPool | None = None,
+        proxy_config: ProxyConfig | None = None,
         federation_proxy_locations: Collection[InstanceLocationConfig] = (),
-        federation_proxy_credentials: Optional[ProxyCredentials] = None,
+        federation_proxy_credentials: ProxyCredentials | None = None,
     ):
         contextFactory = contextFactory or BrowserLikePolicyForHTTPS()
 
@@ -139,7 +139,7 @@ class ProxyAgent(_AgentBase):
         else:
             self.proxy_reactor = proxy_reactor
 
-        self._endpoint_kwargs: Dict[str, Any] = {}
+        self._endpoint_kwargs: dict[str, Any] = {}
         if connectTimeout is not None:
             self._endpoint_kwargs["timeout"] = connectTimeout
         if bindAddress is not None:
@@ -176,13 +176,13 @@ class ProxyAgent(_AgentBase):
         self._reactor = cast(IReactorTime, reactor)
 
         self._federation_proxy_endpoint: Optional[IStreamClientEndpoint] = None
-        self._federation_proxy_credentials: Optional[ProxyCredentials] = None
+        self._federation_proxy_credentials: ProxyCredentials | None = None
         if federation_proxy_locations:
             assert federation_proxy_credentials is not None, (
                 "`federation_proxy_credentials` are required when using `federation_proxy_locations`"
             )
 
-            endpoints: List[IStreamClientEndpoint] = []
+            endpoints: list[IStreamClientEndpoint] = []
             for federation_proxy_location in federation_proxy_locations:
                 endpoint: IStreamClientEndpoint
                 if isinstance(federation_proxy_location, InstanceTcpLocationConfig):
@@ -220,7 +220,7 @@ class ProxyAgent(_AgentBase):
         self,
         method: bytes,
         uri: bytes,
-        headers: Optional[Headers] = None,
+        headers: Headers | None = None,
         bodyProducer: Optional[IBodyProducer] = None,
     ) -> "defer.Deferred[IResponse]":
         """
@@ -363,13 +363,13 @@ class ProxyAgent(_AgentBase):
 
 
 def http_proxy_endpoint(
-    proxy: Optional[bytes],
+    proxy: bytes | None,
     reactor: IReactorCore,
     tls_options_factory: Optional[IPolicyForHTTPS],
     timeout: float = 30,
-    bindAddress: Optional[Union[bytes, str, tuple[Union[bytes, str], int]]] = None,
-    attemptDelay: Optional[float] = None,
-) -> Tuple[Optional[IStreamClientEndpoint], Optional[ProxyCredentials]]:
+    bindAddress: bytes | str | tuple[bytes | str, int] | None = None,
+    attemptDelay: float | None = None,
+) -> tuple[Optional[IStreamClientEndpoint], ProxyCredentials | None]:
     """Parses an http proxy setting and returns an endpoint for the proxy
 
     Args:
@@ -418,7 +418,7 @@ def http_proxy_endpoint(
 
 def parse_proxy(
     proxy: bytes, default_scheme: bytes = b"http", default_port: int = 1080
-) -> Tuple[bytes, bytes, int, Optional[ProxyCredentials]]:
+) -> tuple[bytes, bytes, int, ProxyCredentials | None]:
     """
     Parse a proxy connection string.
 
@@ -487,7 +487,7 @@ class _RandomSampleEndpoints:
         return run_in_background(self._do_connect, protocol_factory)
 
     async def _do_connect(self, protocol_factory: IProtocolFactory) -> IProtocol:
-        failures: List[Failure] = []
+        failures: list[Failure] = []
         for endpoint in random.sample(self._endpoints, k=len(self._endpoints)):
             try:
                 return await endpoint.connect(protocol_factory)
diff --git a/synapse/http/replicationagent.py b/synapse/http/replicationagent.py
index d70575dbd5..3d47107cf2 100644
--- a/synapse/http/replicationagent.py
+++ b/synapse/http/replicationagent.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import Dict, Optional
+from typing import Optional
 
 from zope.interface import implementer
 
@@ -60,7 +60,7 @@ class ReplicationEndpointFactory:
     def __init__(
         self,
         reactor: ISynapseReactor,
-        instance_map: Dict[str, InstanceLocationConfig],
+        instance_map: dict[str, InstanceLocationConfig],
         context_factory: IPolicyForHTTPS,
     ) -> None:
         self.reactor = reactor
@@ -117,11 +117,11 @@ class ReplicationAgent(_AgentBase):
     def __init__(
         self,
         reactor: ISynapseReactor,
-        instance_map: Dict[str, InstanceLocationConfig],
+        instance_map: dict[str, InstanceLocationConfig],
         contextFactory: IPolicyForHTTPS,
-        connectTimeout: Optional[float] = None,
-        bindAddress: Optional[bytes] = None,
-        pool: Optional[HTTPConnectionPool] = None,
+        connectTimeout: float | None = None,
+        bindAddress: bytes | None = None,
+        pool: HTTPConnectionPool | None = None,
     ):
         """
         Create a ReplicationAgent.
@@ -149,7 +149,7 @@ class ReplicationAgent(_AgentBase):
         self,
         method: bytes,
         uri: bytes,
-        headers: Optional[Headers] = None,
+        headers: Headers | None = None,
         bodyProducer: Optional[IBodyProducer] = None,
     ) -> "defer.Deferred[IResponse]":
         """
diff --git a/synapse/http/request_metrics.py b/synapse/http/request_metrics.py
index a9b049f904..5cc8a2ebd8 100644
--- a/synapse/http/request_metrics.py
+++ b/synapse/http/request_metrics.py
@@ -22,7 +22,7 @@
 import logging
 import threading
 import traceback
-from typing import Dict, Mapping, Set, Tuple
+from typing import Mapping
 
 from prometheus_client.core import Counter, Histogram
 
@@ -133,13 +133,13 @@ in_flight_requests_db_sched_duration = Counter(
     labelnames=["method", "servlet", SERVER_NAME_LABEL],
 )
 
-_in_flight_requests: Set["RequestMetrics"] = set()
+_in_flight_requests: set["RequestMetrics"] = set()
 
 # Protects the _in_flight_requests set from concurrent access
 _in_flight_requests_lock = threading.Lock()
 
 
-def _get_in_flight_counts() -> Mapping[Tuple[str, ...], int]:
+def _get_in_flight_counts() -> Mapping[tuple[str, ...], int]:
     """Returns a count of all in flight requests by (method, server_name)"""
     # Cast to a list to prevent it changing while the Prometheus
     # thread is collecting metrics
@@ -152,7 +152,7 @@ def _get_in_flight_counts() -> Mapping[Tuple[str, ...], int]:
     # Map from (method, name) -> int, the number of in flight requests of that
     # type. The key type is Tuple[str, str], but we leave the length unspecified
     # for compatability with LaterGauge's annotations.
-    counts: Dict[Tuple[str, ...], int] = {}
+    counts: dict[tuple[str, ...], int] = {}
     for request_metric in request_metrics:
         key = (
             request_metric.method,
@@ -164,11 +164,13 @@ def _get_in_flight_counts() -> Mapping[Tuple[str, ...], int]:
     return counts
 
 
-LaterGauge(
+in_flight_requests = LaterGauge(
     name="synapse_http_server_in_flight_requests_count",
     desc="",
     labelnames=["method", "servlet", SERVER_NAME_LABEL],
-    caller=_get_in_flight_counts,
+)
+in_flight_requests.register_hook(
+    homeserver_instance_id=None, hook=_get_in_flight_counts
 )
 
 
diff --git a/synapse/http/server.py b/synapse/http/server.py
index e395f79894..2c235e04f4 100644
--- a/synapse/http/server.py
+++ b/synapse/http/server.py
@@ -33,15 +33,10 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
     Iterable,
     Iterator,
-    List,
-    Optional,
     Pattern,
     Protocol,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -52,10 +47,11 @@ from zope.interface import implementer
 
 from twisted.internet import defer, interfaces, reactor
 from twisted.internet.defer import CancelledError
-from twisted.internet.interfaces import IReactorTime
 from twisted.python import failure
 from twisted.web import resource
 
+from synapse.types import ISynapseThreadlessReactor
+
 try:
     from twisted.web.pages import notFound
 except ImportError:
@@ -77,10 +73,12 @@ from synapse.api.errors import (
 from synapse.config.homeserver import HomeServerConfig
 from synapse.logging.context import defer_to_thread, preserve_fn, run_in_background
 from synapse.logging.opentracing import active_span, start_active_span, trace_servlet
-from synapse.util import Clock, json_encoder
 from synapse.util.caches import intern_dict
 from synapse.util.cancellation import is_function_cancellable
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.iterutils import chunk_seq
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     import opentracing
@@ -112,7 +110,7 @@ HTTP_STATUS_REQUEST_CANCELLED = 499
 
 
 def return_json_error(
-    f: failure.Failure, request: "SynapseRequest", config: Optional[HomeServerConfig]
+    f: failure.Failure, request: "SynapseRequest", config: HomeServerConfig | None
 ) -> None:
     """Sends a JSON error response to clients."""
 
@@ -174,7 +172,7 @@ def return_json_error(
 def return_html_error(
     f: failure.Failure,
     request: Request,
-    error_template: Union[str, jinja2.Template],
+    error_template: str | jinja2.Template,
 ) -> None:
     """Sends an HTML error page corresponding to the given failure.
 
@@ -265,7 +263,7 @@ def wrap_async_request_handler(
 # it is actually called with a SynapseRequest and a kwargs dict for the params,
 # but I can't figure out how to represent that.
 ServletCallback = Callable[
-    ..., Union[None, Awaitable[None], Tuple[int, Any], Awaitable[Tuple[int, Any]]]
+    ..., None | Awaitable[None] | tuple[int, Any] | Awaitable[tuple[int, Any]]
 ]
 
 
@@ -337,7 +335,7 @@ class _AsyncResource(resource.Resource, metaclass=abc.ABCMeta):
                     callback_return = await self._async_render(request)
                 except LimitExceededError as e:
                     if e.pause:
-                        await self._clock.sleep(e.pause)
+                        await self._clock.sleep(Duration(seconds=e.pause))
                     raise
 
                 if callback_return is not None:
@@ -350,9 +348,7 @@ class _AsyncResource(resource.Resource, metaclass=abc.ABCMeta):
             f = failure.Failure()
             self._send_error_response(f, request)
 
-    async def _async_render(
-        self, request: "SynapseRequest"
-    ) -> Optional[Tuple[int, Any]]:
+    async def _async_render(self, request: "SynapseRequest") -> tuple[int, Any] | None:
         """Delegates to `_async_render_<METHOD>` methods, or returns a 400 if
         no appropriate method exists. Can be overridden in sub classes for
         different routing.
@@ -407,10 +403,28 @@ class DirectServeJsonResource(_AsyncResource):
         canonical_json: bool = False,
         extract_context: bool = False,
         # Clock is optional as this class is exposed to the module API.
-        clock: Optional[Clock] = None,
+        clock: Clock | None = None,
     ):
+        """
+        Args:
+            canonical_json: TODO
+            extract_context: TODO
+            clock: This is expected to be passed in by any Synapse code.
+                Only optional for the Module API.
+        """
+
         if clock is None:
-            clock = Clock(cast(IReactorTime, reactor))
+            # Ideally we wouldn't ignore the linter error here and instead enforce a
+            # required `Clock` be passed into the `__init__` function.
+            # However, this would change the function signature which is currently being
+            # exported to the module api. Since we don't want to break that api, we have
+            # to settle with ignoring the linter error here.
+            # As of the time of writing this, all Synapse internal usages of
+            # `DirectServeJsonResource` pass in the existing homeserver clock instance.
+            clock = Clock(  # type: ignore[multiple-internal-clocks]
+                cast(ISynapseThreadlessReactor, reactor),
+                server_name="synapse_module_running_from_unknown_server",
+            )
 
         super().__init__(clock, extract_context)
         self.canonical_json = canonical_json
@@ -471,7 +485,7 @@ class JsonResource(DirectServeJsonResource):
         self.clock = hs.get_clock()
         super().__init__(canonical_json, extract_context, clock=self.clock)
         # Map of path regex -> method -> callback.
-        self._routes: Dict[Pattern[str], Dict[bytes, _PathEntry]] = {}
+        self._routes: dict[Pattern[str], dict[bytes, _PathEntry]] = {}
         self.hs = hs
 
     def register_paths(
@@ -507,7 +521,7 @@ class JsonResource(DirectServeJsonResource):
 
     def _get_handler_for_request(
         self, request: "SynapseRequest"
-    ) -> Tuple[ServletCallback, str, Dict[str, str]]:
+    ) -> tuple[ServletCallback, str, dict[str, str]]:
         """Finds a callback method to handle the given request.
 
         Returns:
@@ -536,7 +550,7 @@ class JsonResource(DirectServeJsonResource):
         # Huh. No one wanted to handle that? Fiiiiiine.
         raise UnrecognizedRequestError(code=404)
 
-    async def _async_render(self, request: "SynapseRequest") -> Tuple[int, Any]:
+    async def _async_render(self, request: "SynapseRequest") -> tuple[int, Any]:
         callback, servlet_classname, group_dict = self._get_handler_for_request(request)
 
         request.is_render_cancellable = is_function_cancellable(callback)
@@ -586,10 +600,26 @@ class DirectServeHtmlResource(_AsyncResource):
         self,
         extract_context: bool = False,
         # Clock is optional as this class is exposed to the module API.
-        clock: Optional[Clock] = None,
+        clock: Clock | None = None,
     ):
+        """
+        Args:
+            extract_context: TODO
+            clock: This is expected to be passed in by any Synapse code.
+                Only optional for the Module API.
+        """
         if clock is None:
-            clock = Clock(cast(IReactorTime, reactor))
+            # Ideally we wouldn't ignore the linter error here and instead enforce a
+            # required `Clock` be passed into the `__init__` function.
+            # However, this would change the function signature which is currently being
+            # exported to the module api. Since we don't want to break that api, we have
+            # to settle with ignoring the linter error here.
+            # As of the time of writing this, all Synapse internal usages of
+            # `DirectServeHtmlResource` pass in the existing homeserver clock instance.
+            clock = Clock(  # type: ignore[multiple-internal-clocks]
+                cast(ISynapseThreadlessReactor, reactor),
+                server_name="synapse_module_running_from_unknown_server",
+            )
 
         super().__init__(clock, extract_context)
 
@@ -699,7 +729,7 @@ class _ByteProducer:
         request: Request,
         iterator: Iterator[bytes],
     ):
-        self._request: Optional[Request] = request
+        self._request: Request | None = request
         self._iterator = iterator
         self._paused = False
         self.tracing_scope = start_active_span(
@@ -722,7 +752,7 @@ class _ByteProducer:
             # Start producing if `registerProducer` was successful
             self.resumeProducing()
 
-    def _send_data(self, data: List[bytes]) -> None:
+    def _send_data(self, data: list[bytes]) -> None:
         """
         Send a list of bytes as a chunk of a response.
         """
@@ -798,7 +828,7 @@ def respond_with_json(
     json_object: Any,
     send_cors: bool = False,
     canonical_json: bool = True,
-) -> Optional[int]:
+) -> int | None:
     """Sends encoded JSON in response to the given request.
 
     Args:
@@ -831,7 +861,18 @@ def respond_with_json(
         encoder = _encode_json_bytes
 
     request.setHeader(b"Content-Type", b"application/json")
-    request.setHeader(b"Cache-Control", b"no-cache, no-store, must-revalidate")
+    # Insert a default Cache-Control header if the servlet hasn't already set one. The
+    # default directive tells both the client and any intermediary cache to not cache
+    # the response, which is a sensible default to have on most API endpoints.
+    # The absence `Cache-Control` header would mean that it's up to the clients and
+    # caching proxies mood to cache things if they want. This can be dangerous, which is
+    # why we explicitly set a "don't cache by default" policy.
+    # In practice, `no-store` should be enough, but having all three directives is more
+    # conservative in case we encounter weird, non-spec compliant caches.
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#directives
+    # for more details.
+    if not request.responseHeaders.hasHeader(b"Cache-Control"):
+        request.setHeader(b"Cache-Control", b"no-cache, no-store, must-revalidate")
 
     if send_cors:
         set_cors_headers(request)
@@ -847,7 +888,7 @@ def respond_with_json_bytes(
     code: int,
     json_bytes: bytes,
     send_cors: bool = False,
-) -> Optional[int]:
+) -> int | None:
     """Sends encoded JSON in response to the given request.
 
     Args:
@@ -871,7 +912,18 @@ def respond_with_json_bytes(
 
     request.setHeader(b"Content-Type", b"application/json")
     request.setHeader(b"Content-Length", b"%d" % (len(json_bytes),))
-    request.setHeader(b"Cache-Control", b"no-cache, no-store, must-revalidate")
+    # Insert a default Cache-Control header if the servlet hasn't already set one. The
+    # default directive tells both the client and any intermediary cache to not cache
+    # the response, which is a sensible default to have on most API endpoints.
+    # The absence `Cache-Control` header would mean that it's up to the clients and
+    # caching proxies mood to cache things if they want. This can be dangerous, which is
+    # why we explicitly set a "don't cache by default" policy.
+    # In practice, `no-store` should be enough, but having all three directives is more
+    # conservative in case we encounter weird, non-spec compliant caches.
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#directives
+    # for more details.
+    if not request.responseHeaders.hasHeader(b"Cache-Control"):
+        request.setHeader(b"Cache-Control", b"no-cache, no-store, must-revalidate")
 
     if send_cors:
         set_cors_headers(request)
@@ -896,7 +948,7 @@ async def _async_write_json_to_request_in_thread(
     expensive.
     """
 
-    def encode(opentracing_span: "Optional[opentracing.Span]") -> bytes:
+    def encode(opentracing_span: "opentracing.Span | None") -> bytes:
         # it might take a while for the threadpool to schedule us, so we write
         # opentracing logs once we actually get scheduled, so that we can see how
         # much that contributed.
diff --git a/synapse/http/servlet.py b/synapse/http/servlet.py
index 47d8bd5eaf..c182497f2d 100644
--- a/synapse/http/servlet.py
+++ b/synapse/http/servlet.py
@@ -27,31 +27,22 @@ import urllib.parse as urlparse
 from http import HTTPStatus
 from typing import (
     TYPE_CHECKING,
-    List,
     Literal,
     Mapping,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
     TypeVar,
     overload,
 )
 
+from pydantic import BaseModel, ValidationError
+
 from twisted.web.server import Request
 
-from synapse._pydantic_compat import (
-    BaseModel,
-    ErrorWrapper,
-    MissingError,
-    PydanticValueError,
-    ValidationError,
-)
 from synapse.api.errors import Codes, SynapseError
 from synapse.http import redact_uri
 from synapse.http.server import HttpServer
 from synapse.types import JsonDict, RoomAlias, RoomID, StrCollection
-from synapse.util import json_decoder
+from synapse.util.json import json_decoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -88,26 +79,26 @@ def parse_integer(
 
 
 @overload
-def parse_integer(request: Request, name: str, *, negative: bool) -> Optional[int]: ...
+def parse_integer(request: Request, name: str, *, negative: bool) -> int | None: ...
 
 
 @overload
 def parse_integer(
     request: Request,
     name: str,
-    default: Optional[int] = None,
+    default: int | None = None,
     required: bool = False,
     negative: bool = False,
-) -> Optional[int]: ...
+) -> int | None: ...
 
 
 def parse_integer(
     request: Request,
     name: str,
-    default: Optional[int] = None,
+    default: int | None = None,
     required: bool = False,
     negative: bool = False,
-) -> Optional[int]:
+) -> int | None:
     """Parse an integer parameter from the request string
 
     Args:
@@ -134,8 +125,18 @@ def parse_integer(
 def parse_integer_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[int] = None,
-) -> Optional[int]: ...
+    default: int,
+    required: Literal[False] = False,
+    negative: bool = False,
+) -> int: ...
+
+
+@overload
+def parse_integer_from_args(
+    args: Mapping[bytes, Sequence[bytes]],
+    name: str,
+    default: int | None = None,
+) -> int | None: ...
 
 
 @overload
@@ -151,19 +152,19 @@ def parse_integer_from_args(
 def parse_integer_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[int] = None,
+    default: int | None = None,
     required: bool = False,
     negative: bool = False,
-) -> Optional[int]: ...
+) -> int | None: ...
 
 
 def parse_integer_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[int] = None,
+    default: int | None = None,
     required: bool = False,
     negative: bool = False,
-) -> Optional[int]:
+) -> int | None:
     """Parse an integer parameter from the request string
 
     Args:
@@ -215,13 +216,13 @@ def parse_boolean(request: Request, name: str, *, required: Literal[True]) -> bo
 
 @overload
 def parse_boolean(
-    request: Request, name: str, default: Optional[bool] = None, required: bool = False
-) -> Optional[bool]: ...
+    request: Request, name: str, default: bool | None = None, required: bool = False
+) -> bool | None: ...
 
 
 def parse_boolean(
-    request: Request, name: str, default: Optional[bool] = None, required: bool = False
-) -> Optional[bool]:
+    request: Request, name: str, default: bool | None = None, required: bool = False
+) -> bool | None:
     """Parse a boolean parameter from the request query string
 
     Args:
@@ -263,17 +264,17 @@ def parse_boolean_from_args(
 def parse_boolean_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[bool] = None,
+    default: bool | None = None,
     required: bool = False,
-) -> Optional[bool]: ...
+) -> bool | None: ...
 
 
 def parse_boolean_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[bool] = None,
+    default: bool | None = None,
     required: bool = False,
-) -> Optional[bool]:
+) -> bool | None:
     """Parse a boolean parameter from the request query string
 
     Args:
@@ -316,8 +317,8 @@ def parse_boolean_from_args(
 def parse_bytes_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[bytes] = None,
-) -> Optional[bytes]: ...
+    default: bytes | None = None,
+) -> bytes | None: ...
 
 
 @overload
@@ -334,17 +335,17 @@ def parse_bytes_from_args(
 def parse_bytes_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[bytes] = None,
+    default: bytes | None = None,
     required: bool = False,
-) -> Optional[bytes]: ...
+) -> bytes | None: ...
 
 
 def parse_bytes_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[bytes] = None,
+    default: bytes | None = None,
     required: bool = False,
-) -> Optional[bytes]:
+) -> bytes | None:
     """
     Parse a string parameter as bytes from the request query string.
 
@@ -378,7 +379,7 @@ def parse_string(
     name: str,
     default: str,
     *,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
 ) -> str: ...
 
@@ -389,7 +390,7 @@ def parse_string(
     name: str,
     *,
     required: Literal[True],
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
 ) -> str: ...
 
@@ -399,21 +400,21 @@ def parse_string(
     request: Request,
     name: str,
     *,
-    default: Optional[str] = None,
+    default: str | None = None,
     required: bool = False,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[str]: ...
+) -> str | None: ...
 
 
 def parse_string(
     request: Request,
     name: str,
-    default: Optional[str] = None,
+    default: str | None = None,
     required: bool = False,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[str]:
+) -> str | None:
     """
     Parse a string parameter from the request query string.
 
@@ -453,10 +454,10 @@ def parse_string(
 def parse_json(
     request: Request,
     name: str,
-    default: Optional[dict] = None,
+    default: dict | None = None,
     required: bool = False,
     encoding: str = "ascii",
-) -> Optional[JsonDict]:
+) -> JsonDict | None:
     """
     Parse a JSON parameter from the request query string.
 
@@ -490,10 +491,10 @@ def parse_json(
 def parse_json_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[dict] = None,
+    default: dict | None = None,
     required: bool = False,
     encoding: str = "ascii",
-) -> Optional[JsonDict]:
+) -> JsonDict | None:
     """
     Parse a JSON parameter from the request query string.
 
@@ -538,7 +539,7 @@ EnumT = TypeVar("EnumT", bound=enum.Enum)
 def parse_enum(
     request: Request,
     name: str,
-    E: Type[EnumT],
+    E: type[EnumT],
     default: EnumT,
 ) -> EnumT: ...
 
@@ -547,7 +548,7 @@ def parse_enum(
 def parse_enum(
     request: Request,
     name: str,
-    E: Type[EnumT],
+    E: type[EnumT],
     *,
     required: Literal[True],
 ) -> EnumT: ...
@@ -556,10 +557,10 @@ def parse_enum(
 def parse_enum(
     request: Request,
     name: str,
-    E: Type[EnumT],
-    default: Optional[EnumT] = None,
+    E: type[EnumT],
+    default: EnumT | None = None,
     required: bool = False,
-) -> Optional[EnumT]:
+) -> EnumT | None:
     """
     Parse an enum parameter from the request query string.
 
@@ -599,7 +600,7 @@ def parse_enum(
 
 def _parse_string_value(
     value: bytes,
-    allowed_values: Optional[StrCollection],
+    allowed_values: StrCollection | None,
     name: str,
     encoding: str,
 ) -> str:
@@ -625,20 +626,20 @@ def parse_strings_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
     *,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[List[str]]: ...
+) -> list[str] | None: ...
 
 
 @overload
 def parse_strings_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: List[str],
+    default: list[str],
     *,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> List[str]: ...
+) -> list[str]: ...
 
 
 @overload
@@ -647,31 +648,31 @@ def parse_strings_from_args(
     name: str,
     *,
     required: Literal[True],
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> List[str]: ...
+) -> list[str]: ...
 
 
 @overload
 def parse_strings_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[List[str]] = None,
+    default: list[str] | None = None,
     *,
     required: bool = False,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[List[str]]: ...
+) -> list[str] | None: ...
 
 
 def parse_strings_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[List[str]] = None,
+    default: list[str] | None = None,
     required: bool = False,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[List[str]]:
+) -> list[str] | None:
     """
     Parse a string parameter from the request query string list.
 
@@ -718,21 +719,21 @@ def parse_strings_from_args(
 def parse_string_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[str] = None,
+    default: str | None = None,
     *,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[str]: ...
+) -> str | None: ...
 
 
 @overload
 def parse_string_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[str] = None,
+    default: str | None = None,
     *,
     required: Literal[True],
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
 ) -> str: ...
 
@@ -741,21 +742,21 @@ def parse_string_from_args(
 def parse_string_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[str] = None,
+    default: str | None = None,
     required: bool = False,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[str]: ...
+) -> str | None: ...
 
 
 def parse_string_from_args(
     args: Mapping[bytes, Sequence[bytes]],
     name: str,
-    default: Optional[str] = None,
+    default: str | None = None,
     required: bool = False,
-    allowed_values: Optional[StrCollection] = None,
+    allowed_values: StrCollection | None = None,
     encoding: str = "ascii",
-) -> Optional[str]:
+) -> str | None:
     """
     Parse the string parameter from the request query string list
     and return the first result.
@@ -810,12 +811,12 @@ def parse_json_value_from_request(
 @overload
 def parse_json_value_from_request(
     request: Request, allow_empty_body: bool = False
-) -> Optional[JsonDict]: ...
+) -> JsonDict | None: ...
 
 
 def parse_json_value_from_request(
     request: Request, allow_empty_body: bool = False
-) -> Optional[JsonDict]:
+) -> JsonDict | None:
     """Parse a JSON value from the body of a twisted HTTP request.
 
     Args:
@@ -882,7 +883,7 @@ def parse_json_object_from_request(
 Model = TypeVar("Model", bound=BaseModel)
 
 
-def validate_json_object(content: JsonDict, model_type: Type[Model]) -> Model:
+def validate_json_object(content: JsonDict, model_type: type[Model]) -> Model:
     """Validate a deserialized JSON object using the given pydantic model.
 
     Raises:
@@ -890,20 +891,20 @@ def validate_json_object(content: JsonDict, model_type: Type[Model]) -> Model:
             if it wasn't a JSON object.
     """
     try:
-        instance = model_type.parse_obj(content)
+        instance = model_type.model_validate(content)
     except ValidationError as e:
+        err_type = e.errors()[0]["type"]
+
         # Choose a matrix error code. The catch-all is BAD_JSON, but we try to find a
         # more specific error if possible (which occasionally helps us to be spec-
         # compliant) This is a bit awkward because the spec's error codes aren't very
         # clear-cut: BAD_JSON arguably overlaps with MISSING_PARAM and INVALID_PARAM.
         errcode = Codes.BAD_JSON
 
-        raw_errors = e.raw_errors
-        if len(raw_errors) == 1 and isinstance(raw_errors[0], ErrorWrapper):
-            raw_error = raw_errors[0].exc
-            if isinstance(raw_error, MissingError):
+        if e.error_count() == 1:
+            if err_type == "missing":
                 errcode = Codes.MISSING_PARAM
-            elif isinstance(raw_error, PydanticValueError):
+            elif err_type == "value_error":
                 errcode = Codes.INVALID_PARAM
 
         raise SynapseError(HTTPStatus.BAD_REQUEST, str(e), errcode=errcode)
@@ -912,7 +913,7 @@ def validate_json_object(content: JsonDict, model_type: Type[Model]) -> Model:
 
 
 def parse_and_validate_json_object_from_request(
-    request: Request, model_type: Type[Model]
+    request: Request, model_type: type[Model]
 ) -> Model:
     """Parse a JSON object from the body of a twisted HTTP request, then deserialise and
     validate using the given pydantic model.
@@ -978,8 +979,8 @@ class ResolveRoomIdMixin:
         self.room_member_handler = hs.get_room_member_handler()
 
     async def resolve_room_id(
-        self, room_identifier: str, remote_room_hosts: Optional[List[str]] = None
-    ) -> Tuple[str, Optional[List[str]]]:
+        self, room_identifier: str, remote_room_hosts: list[str] | None = None
+    ) -> tuple[str, list[str] | None]:
         """
         Resolve a room identifier to a room ID, if necessary.
 
diff --git a/synapse/http/site.py b/synapse/http/site.py
index 55088fc190..9b7fd5c936 100644
--- a/synapse/http/site.py
+++ b/synapse/http/site.py
@@ -19,10 +19,11 @@
 #
 #
 import contextlib
+import json
 import logging
 import time
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Any, Generator, Optional, Tuple, Union
+from typing import TYPE_CHECKING, Any, Generator
 
 import attr
 from zope.interface import implementer
@@ -30,11 +31,13 @@ from zope.interface import implementer
 from twisted.internet.address import UNIXAddress
 from twisted.internet.defer import Deferred
 from twisted.internet.interfaces import IAddress
+from twisted.internet.protocol import Protocol
 from twisted.python.failure import Failure
 from twisted.web.http import HTTPChannel
 from twisted.web.resource import IResource, Resource
 from twisted.web.server import Request
 
+from synapse.api.errors import Codes, SynapseError
 from synapse.config.server import ListenerConfig
 from synapse.http import get_request_user_agent, redact_uri
 from synapse.http.proxy import ProxySite
@@ -58,6 +61,10 @@ logger = logging.getLogger(__name__)
 _next_request_seq = 0
 
 
+class ContentLengthError(SynapseError):
+    """Raised when content-length validation fails."""
+
+
 class SynapseRequest(Request):
     """Class which encapsulates an HTTP request to synapse.
 
@@ -87,7 +94,7 @@ class SynapseRequest(Request):
         our_server_name: str,
         *args: Any,
         max_request_body_size: int = 1024,
-        request_id_header: Optional[str] = None,
+        request_id_header: str | None = None,
         **kw: Any,
     ):
         super().__init__(channel, *args, **kw)
@@ -101,18 +108,18 @@ class SynapseRequest(Request):
 
         # The requester, if authenticated. For federation requests this is the
         # server name, for client requests this is the Requester object.
-        self._requester: Optional[Union[Requester, str]] = None
+        self._requester: Requester | str | None = None
 
         # An opentracing span for this request. Will be closed when the request is
         # completely processed.
-        self._opentracing_span: "Optional[opentracing.Span]" = None
+        self._opentracing_span: "opentracing.Span | None" = None
 
         # we can't yet create the logcontext, as we don't know the method.
-        self.logcontext: Optional[LoggingContext] = None
+        self.logcontext: LoggingContext | None = None
 
         # The `Deferred` to cancel if the client disconnects early and
         # `is_render_cancellable` is set. Expected to be set by `Resource.render`.
-        self.render_deferred: Optional["Deferred[None]"] = None
+        self.render_deferred: "Deferred[None]" | None = None
         # A boolean indicating whether `render_deferred` should be cancelled if the
         # client disconnects early. Expected to be set by the coroutine started by
         # `Resource.render`, if rendering is asynchronous.
@@ -126,11 +133,11 @@ class SynapseRequest(Request):
         self._is_processing = False
 
         # the time when the asynchronous request handler completed its processing
-        self._processing_finished_time: Optional[float] = None
+        self._processing_finished_time: float | None = None
 
         # what time we finished sending the response to the client (or the connection
         # dropped)
-        self.finish_time: Optional[float] = None
+        self.finish_time: float | None = None
 
     def __repr__(self) -> str:
         # We overwrite this so that we don't log ``access_token``
@@ -143,36 +150,150 @@ class SynapseRequest(Request):
             self.synapse_site.site_tag,
         )
 
+    def _respond_with_error(self, synapse_error: SynapseError) -> None:
+        """Send an error response and close the connection."""
+        self.setResponseCode(synapse_error.code)
+        error_response_bytes = json.dumps(synapse_error.error_dict(None)).encode()
+
+        self.responseHeaders.setRawHeaders(b"Content-Type", [b"application/json"])
+        self.responseHeaders.setRawHeaders(
+            b"Content-Length", [f"{len(error_response_bytes)}"]
+        )
+        self.write(error_response_bytes)
+        self.loseConnection()
+
+    def _get_content_length_from_headers(self) -> int | None:
+        """Attempts to obtain the `Content-Length` value from the request's headers.
+
+        Returns:
+            Content length as `int` if present. Otherwise `None`.
+
+        Raises:
+            ContentLengthError: if multiple `Content-Length` headers are present or the
+                value is not an `int`.
+        """
+        content_length_headers = self.requestHeaders.getRawHeaders(b"Content-Length")
+        if content_length_headers is None:
+            return None
+
+        # If there are multiple `Content-Length` headers return an error.
+        # We don't want to even try to pick the right one if there are multiple
+        # as we could run into problems similar to request smuggling vulnerabilities
+        # which rely on the mismatch of how different systems interpret information.
+        if len(content_length_headers) != 1:
+            raise ContentLengthError(
+                HTTPStatus.BAD_REQUEST,
+                "Multiple Content-Length headers received",
+                Codes.UNKNOWN,
+            )
+
+        try:
+            return int(content_length_headers[0])
+        except (ValueError, TypeError):
+            raise ContentLengthError(
+                HTTPStatus.BAD_REQUEST,
+                "Content-Length header value is not a valid integer",
+                Codes.UNKNOWN,
+            )
+
+    def _validate_content_length(self) -> None:
+        """Validate Content-Length header and actual content size.
+
+        Raises:
+            ContentLengthError: If validation fails.
+        """
+        # we should have a `content` by now.
+        assert self.content, "_validate_content_length() called before gotLength()"
+        content_length = self._get_content_length_from_headers()
+
+        if content_length is None:
+            return
+
+        actual_content_length = self.content.tell()
+
+        if content_length > self._max_request_body_size:
+            logger.info(
+                "Rejecting request from %s because Content-Length %d exceeds maximum size %d: %s %s",
+                self.client,
+                content_length,
+                self._max_request_body_size,
+                self.get_method(),
+                self.get_redacted_uri(),
+            )
+            raise ContentLengthError(
+                HTTPStatus.REQUEST_ENTITY_TOO_LARGE,
+                f"Request content is too large (>{self._max_request_body_size})",
+                Codes.TOO_LARGE,
+            )
+
+        if content_length != actual_content_length:
+            comparison = (
+                "smaller" if content_length < actual_content_length else "larger"
+            )
+            logger.info(
+                "Rejecting request from %s because Content-Length %d is %s than the request content size %d: %s %s",
+                self.client,
+                content_length,
+                comparison,
+                actual_content_length,
+                self.get_method(),
+                self.get_redacted_uri(),
+            )
+            raise ContentLengthError(
+                HTTPStatus.BAD_REQUEST,
+                f"Rejecting request as the Content-Length header value {content_length} "
+                f"is {comparison} than the actual request content size {actual_content_length}",
+                Codes.UNKNOWN,
+            )
+
     # Twisted machinery: this method is called by the Channel once the full request has
     # been received, to dispatch the request to a resource.
-    #
-    # We're patching Twisted to bail/abort early when we see someone trying to upload
-    # `multipart/form-data` so we can avoid Twisted parsing the entire request body into
-    # in-memory (specific problem of this specific `Content-Type`). This protects us
-    # from an attacker uploading something bigger than the available RAM and crashing
-    # the server with a `MemoryError`, or carefully block just enough resources to cause
-    # all other requests to fail.
-    #
-    # FIXME: This can be removed once we Twisted releases a fix and we update to a
-    # version that is patched
     def requestReceived(self, command: bytes, path: bytes, version: bytes) -> None:
+        # In the case of a Content-Length header being present, and it's value being too
+        # large, throw a proper error to make debugging issues due to overly large requests much
+        # easier. Currently we handle such cases in `handleContentChunk` and abort the
+        # connection without providing a proper HTTP response.
+        #
+        # Attempting to write an HTTP response from within `handleContentChunk` does not
+        # work, so the code here has been added to at least provide a response in the
+        # case of the Content-Length header being present.
+        self.method, self.uri = command, path
+        self.clientproto = version
+
+        try:
+            self._validate_content_length()
+        except ContentLengthError as e:
+            self._respond_with_error(e)
+            return
+
+        # We're patching Twisted to bail/abort early when we see someone trying to upload
+        # `multipart/form-data` so we can avoid Twisted parsing the entire request body into
+        # in-memory (specific problem of this specific `Content-Type`). This protects us
+        # from an attacker uploading something bigger than the available RAM and crashing
+        # the server with a `MemoryError`, or carefully block just enough resources to cause
+        # all other requests to fail.
+        #
+        # FIXME: This can be removed once Twisted releases a fix and we update to a
+        # version that is patched
+        # See: https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2
         if command == b"POST":
             ctype = self.requestHeaders.getRawHeaders(b"content-type")
             if ctype and b"multipart/form-data" in ctype[0]:
-                self.method, self.uri = command, path
-                self.clientproto = version
+                logger.warning(
+                    "Aborting connection from %s because `content-type: multipart/form-data` is unsupported: %s %s",
+                    self.client,
+                    self.get_method(),
+                    self.get_redacted_uri(),
+                )
+
                 self.code = HTTPStatus.UNSUPPORTED_MEDIA_TYPE.value
                 self.code_message = bytes(
                     HTTPStatus.UNSUPPORTED_MEDIA_TYPE.phrase, "ascii"
                 )
-                self.responseHeaders.setRawHeaders(b"content-length", [b"0"])
 
-                logger.warning(
-                    "Aborting connection from %s because `content-type: multipart/form-data` is unsupported: %s %s",
-                    self.client,
-                    command,
-                    path,
-                )
+                # FIXME: Return a better error response here similar to the
+                # `error_response_json` returned in other code paths here.
+                self.responseHeaders.setRawHeaders(b"Content-Length", [b"0"])
                 self.write(b"")
                 self.loseConnection()
                 return
@@ -194,11 +315,11 @@ class SynapseRequest(Request):
         super().handleContentChunk(data)
 
     @property
-    def requester(self) -> Optional[Union[Requester, str]]:
+    def requester(self) -> Requester | str | None:
         return self._requester
 
     @requester.setter
-    def requester(self, value: Union[Requester, str]) -> None:
+    def requester(self, value: Requester | str) -> None:
         # Store the requester, and update some properties based on it.
 
         # This should only be called once.
@@ -245,7 +366,7 @@ class SynapseRequest(Request):
         Returns:
             The redacted URI as a string.
         """
-        uri: Union[bytes, str] = self.uri
+        uri: bytes | str = self.uri
         if isinstance(uri, bytes):
             uri = uri.decode("ascii", errors="replace")
         return redact_uri(uri)
@@ -260,12 +381,12 @@ class SynapseRequest(Request):
         Returns:
             The request method as a string.
         """
-        method: Union[bytes, str] = self.method
+        method: bytes | str = self.method
         if isinstance(method, bytes):
             return self.method.decode("ascii")
         return method
 
-    def get_authenticated_entity(self) -> Tuple[Optional[str], Optional[str]]:
+    def get_authenticated_entity(self) -> tuple[str | None, str | None]:
         """
         Get the "authenticated" entity of the request, which might be the user
         performing the action, or a user being puppeted by a server admin.
@@ -302,10 +423,15 @@ class SynapseRequest(Request):
         # this is called once a Resource has been found to serve the request; in our
         # case the Resource in question will normally be a JsonResource.
 
-        # create a LogContext for this request
+        # Create a LogContext for this request
+        #
+        # We only care about associating logs and tallying up metrics at the per-request
+        # level so we don't worry about setting the `parent_context`; preventing us from
+        # unnecessarily piling up metrics on the main process's context.
         request_id = self.get_request_id()
         self.logcontext = LoggingContext(
-            request_id,
+            name=request_id,
+            server_name=self.our_server_name,
             request=ContextRequest(
                 request_id=request_id,
                 ip_address=self.get_client_ip_if_available(),
@@ -397,7 +523,7 @@ class SynapseRequest(Request):
             with PreserveLoggingContext(self.logcontext):
                 self._finished_processing()
 
-    def connectionLost(self, reason: Union[Failure, Exception]) -> None:
+    def connectionLost(self, reason: Failure | Exception) -> None:
         """Called when the client connection is closed before the response is written.
 
         Overrides twisted.web.server.Request.connectionLost to record the finish time and
@@ -512,10 +638,12 @@ class SynapseRequest(Request):
         if authenticated_entity:
             requester = f"{authenticated_entity}|{requester}"
 
+        # Updates to this log line should also be reflected in our docs,
+        # `docs/usage/administration/request_log.md`
         self.synapse_site.access_logger.log(
             log_level,
             "%s - %s - {%s}"
-            " Processed request: %.3fsec/%.3fsec (%.3fsec, %.3fsec) (%.3fsec/%.3fsec/%d)"
+            " Processed request: %.3fsec/%.3fsec ru=(%.3fsec, %.3fsec) db=(%.3fsec/%.3fsec/%d)"
             ' %sB %s "%s %s %s" "%s" [%d dbevts]',
             self.get_client_ip_if_available(),
             self.synapse_site.site_tag,
@@ -589,7 +717,7 @@ class XForwardedForRequest(SynapseRequest):
     """
 
     # the client IP and ssl flag, as extracted from the headers.
-    _forwarded_for: "Optional[_XForwardedForAddress]" = None
+    _forwarded_for: "_XForwardedForAddress | None" = None
     _forwarded_https: bool = False
 
     def requestReceived(self, command: bytes, path: bytes, version: bytes) -> None:
@@ -655,6 +783,70 @@ class _XForwardedForAddress:
     host: str
 
 
+class SynapseProtocol(HTTPChannel):
+    """
+    Synapse-specific twisted http Protocol.
+
+    This is a small wrapper around the twisted HTTPChannel so we can track active
+    connections in order to close any outstanding connections on shutdown.
+    """
+
+    def __init__(
+        self,
+        site: "SynapseSite",
+        our_server_name: str,
+        max_request_body_size: int,
+        request_id_header: str | None,
+        request_class: type,
+    ):
+        super().__init__()
+        self.factory: SynapseSite = site
+        self.site = site
+        self.our_server_name = our_server_name
+        self.max_request_body_size = max_request_body_size
+        self.request_id_header = request_id_header
+        self.request_class = request_class
+
+    def connectionMade(self) -> None:
+        """
+        Called when a connection is made.
+
+        This may be considered the initializer of the protocol, because
+        it is called when the connection is completed.
+
+        Add the connection to the factory's connection list when it's established.
+        """
+        super().connectionMade()
+        self.factory.addConnection(self)
+
+    def connectionLost(self, reason: Failure) -> None:  # type: ignore[override]
+        """
+        Called when the connection is shut down.
+
+        Clear any circular references here, and any external references to this
+        Protocol. The connection has been closed. In our case, we need to remove the
+        connection from the factory's connection list, when it's lost.
+        """
+        super().connectionLost(reason)
+        self.factory.removeConnection(self)
+
+    def requestFactory(self, http_channel: HTTPChannel, queued: bool) -> SynapseRequest:  # type: ignore[override]
+        """
+        A callable used to build `twisted.web.iweb.IRequest` objects.
+
+        Use our own custom SynapseRequest type instead of the regular
+        twisted.web.server.Request.
+        """
+        return self.request_class(
+            self,
+            self.factory,
+            our_server_name=self.our_server_name,
+            max_request_body_size=self.max_request_body_size,
+            queued=queued,
+            request_id_header=self.request_id_header,
+        )
+
+
 class SynapseSite(ProxySite):
     """
     Synapse-specific twisted http Site
@@ -671,6 +863,7 @@ class SynapseSite(ProxySite):
 
     def __init__(
         self,
+        *,
         logger_name: str,
         site_tag: str,
         config: ListenerConfig,
@@ -705,23 +898,51 @@ class SynapseSite(ProxySite):
 
         assert config.http_options is not None
         proxied = config.http_options.x_forwarded
-        request_class = XForwardedForRequest if proxied else SynapseRequest
+        self.request_class = XForwardedForRequest if proxied else SynapseRequest
 
-        request_id_header = config.http_options.request_id_header
+        self.request_id_header = config.http_options.request_id_header
+        self.max_request_body_size = max_request_body_size
 
-        def request_factory(channel: HTTPChannel, queued: bool) -> Request:
-            return request_class(
-                channel,
-                self,
-                our_server_name=self.server_name,
-                max_request_body_size=max_request_body_size,
-                queued=queued,
-                request_id_header=request_id_header,
-            )
-
-        self.requestFactory = request_factory  # type: ignore
         self.access_logger = logging.getLogger(logger_name)
         self.server_version_string = server_version_string.encode("ascii")
+        self.connections: list[Protocol] = []
+
+    def buildProtocol(self, addr: IAddress) -> SynapseProtocol:
+        protocol = SynapseProtocol(
+            self,
+            self.server_name,
+            self.max_request_body_size,
+            self.request_id_header,
+            self.request_class,
+        )
+        return protocol
+
+    def addConnection(self, protocol: Protocol) -> None:
+        self.connections.append(protocol)
+
+    def removeConnection(self, protocol: Protocol) -> None:
+        if protocol in self.connections:
+            self.connections.remove(protocol)
+
+    def stopFactory(self) -> None:
+        super().stopFactory()
+
+        # Shutdown any connections which are still active.
+        # These can be long lived HTTP connections which wouldn't normally be closed
+        # when calling `shutdown` on the respective `Port`.
+        # Closing the connections here is required for us to fully shutdown the
+        # `SynapseHomeServer` in order for it to be garbage collected.
+        for protocol in self.connections[:]:
+            if protocol.transport is not None:
+                protocol.transport.loseConnection()
+        self.connections.clear()
+
+        # Replace the resource tree with an empty resource to break circular references
+        # to the resource tree which holds a bunch of homeserver references. This is
+        # important if we try to call `hs.shutdown()` after `start` fails. For some
+        # reason, this doesn't seem to be necessary in the normal case where `start`
+        # succeeds and we call `hs.shutdown()` later.
+        self.resource = Resource()
 
     def log(self, request: SynapseRequest) -> None:  # type: ignore[override]
         pass
@@ -729,5 +950,5 @@ class SynapseSite(ProxySite):
 
 @attr.s(auto_attribs=True, frozen=True, slots=True)
 class RequestInfo:
-    user_agent: Optional[str]
+    user_agent: str | None
     ip: str
diff --git a/synapse/http/types.py b/synapse/http/types.py
index dd954b6c20..a04a285397 100644
--- a/synapse/http/types.py
+++ b/synapse/http/types.py
@@ -18,10 +18,10 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Iterable, Mapping, Union
+from typing import Iterable, Mapping
 
 # the type of the query params, to be passed into `urlencode` with `doseq=True`.
-QueryParamValue = Union[str, bytes, Iterable[Union[str, bytes]]]
-QueryParams = Union[Mapping[str, QueryParamValue], Mapping[bytes, QueryParamValue]]
+QueryParamValue = str | bytes | Iterable[str | bytes]
+QueryParams = Mapping[str, QueryParamValue] | Mapping[bytes, QueryParamValue]
 
 __all__ = ["QueryParams"]
diff --git a/synapse/logging/_remote.py b/synapse/logging/_remote.py
index ac34fa6525..72faa3c746 100644
--- a/synapse/logging/_remote.py
+++ b/synapse/logging/_remote.py
@@ -25,7 +25,7 @@ import traceback
 from collections import deque
 from ipaddress import IPv4Address, IPv6Address, ip_address
 from math import floor
-from typing import Callable, Deque, Optional
+from typing import Callable, Optional
 
 import attr
 from zope.interface import implementer
@@ -66,7 +66,7 @@ class LogProducer:
     # (connected and registerProducer) which are part of the implementation.
     transport: Connection
     _format: Callable[[logging.LogRecord], str]
-    _buffer: Deque[logging.LogRecord]
+    _buffer: deque[logging.LogRecord]
     _paused: bool = attr.ib(default=False, init=False)
 
     def pauseProducing(self) -> None:
@@ -120,9 +120,9 @@ class RemoteHandler(logging.Handler):
         self.port = port
         self.maximum_buffer = maximum_buffer
 
-        self._buffer: Deque[logging.LogRecord] = deque()
-        self._connection_waiter: Optional[Deferred] = None
-        self._producer: Optional[LogProducer] = None
+        self._buffer: deque[logging.LogRecord] = deque()
+        self._connection_waiter: Deferred | None = None
+        self._producer: LogProducer | None = None
 
         # Connect without DNS lookups if it's a direct IP.
         if _reactor is None:
diff --git a/synapse/logging/context.py b/synapse/logging/context.py
index 7ea3f3d726..b6535be388 100644
--- a/synapse/logging/context.py
+++ b/synapse/logging/context.py
@@ -33,7 +33,6 @@ See doc/log_contexts.rst for details on how this works.
 import logging
 import threading
 import typing
-import warnings
 from types import TracebackType
 from typing import (
     TYPE_CHECKING,
@@ -41,9 +40,6 @@ from typing import (
     Awaitable,
     Callable,
     Literal,
-    Optional,
-    Tuple,
-    Type,
     TypeVar,
     Union,
     overload,
@@ -55,11 +51,29 @@ from typing_extensions import ParamSpec
 from twisted.internet import defer, threads
 from twisted.python.threadpool import ThreadPool
 
+from synapse.logging.loggers import ExplicitlyConfiguredLogger
+from synapse.util.stringutils import random_string_insecure_fast
+
 if TYPE_CHECKING:
+    from synapse.logging.scopecontextmanager import _LogContextScope
     from synapse.types import ISynapseReactor
 
 logger = logging.getLogger(__name__)
 
+original_logger_class = logging.getLoggerClass()
+logging.setLoggerClass(ExplicitlyConfiguredLogger)
+logcontext_debug_logger = logging.getLogger("synapse.logging.context.debug")
+"""
+A logger for debugging when the logcontext switches.
+
+Because this is very noisy and probably something only developers want to see when
+debugging logcontext problems, we want people to explictly opt-in before seeing anything
+in the logs. Requires explicitly setting `synapse.logging.context.debug` in the logging
+configuration and does not inherit the log level from the parent logger.
+"""
+# Restore the original logger class
+logging.setLoggerClass(original_logger_class)
+
 try:
     import resource
 
@@ -73,7 +87,7 @@ try:
 
     is_thread_resource_usage_supported = True
 
-    def get_thread_resource_usage() -> "Optional[resource.struct_rusage]":
+    def get_thread_resource_usage() -> "resource.struct_rusage | None":
         return resource.getrusage(RUSAGE_THREAD)
 
 except Exception:
@@ -81,7 +95,7 @@ except Exception:
     # won't track resource usage.
     is_thread_resource_usage_supported = False
 
-    def get_thread_resource_usage() -> "Optional[resource.struct_rusage]":
+    def get_thread_resource_usage() -> "resource.struct_rusage | None":
         return None
 
 
@@ -122,7 +136,7 @@ class ContextResourceUsage:
         "evt_db_fetch_count",
     ]
 
-    def __init__(self, copy_from: "Optional[ContextResourceUsage]" = None) -> None:
+    def __init__(self, copy_from: "ContextResourceUsage | None" = None) -> None:
         """Create a new ContextResourceUsage
 
         Args:
@@ -215,8 +229,8 @@ class ContextRequest:
     request_id: str
     ip_address: str
     site_tag: str
-    requester: Optional[str]
-    authenticated_entity: Optional[str]
+    requester: str | None
+    authenticated_entity: str | None
     method: str
     url: str
     protocol: str
@@ -227,24 +241,42 @@ LoggingContextOrSentinel = Union["LoggingContext", "_Sentinel"]
 
 
 class _Sentinel:
-    """Sentinel to represent the root context"""
+    """
+    Sentinel to represent the root context
 
-    __slots__ = ["previous_context", "finished", "request", "tag"]
+    This should only be used for tasks outside of Synapse like when we yield control
+    back to the Twisted reactor (event loop) so we don't leak the current logging
+    context to other tasks that are scheduled next in the event loop.
+
+    Nothing from the Synapse homeserver should be logged with the sentinel context. i.e.
+    we should always know which server the logs are coming from.
+    """
+
+    __slots__ = [
+        "previous_context",
+        "finished",
+        "scope",
+        "server_name",
+        "request",
+        "tag",
+    ]
 
     def __init__(self) -> None:
         # Minimal set for compatibility with LoggingContext
         self.previous_context = None
         self.finished = False
+        self.server_name = "unknown_server_from_sentinel_context"
         self.request = None
+        self.scope = None
         self.tag = None
 
     def __str__(self) -> str:
         return "sentinel"
 
-    def start(self, rusage: "Optional[resource.struct_rusage]") -> None:
+    def start(self, rusage: "resource.struct_rusage | None") -> None:
         pass
 
-    def stop(self, rusage: "Optional[resource.struct_rusage]") -> None:
+    def stop(self, rusage: "resource.struct_rusage | None") -> None:
         pass
 
     def add_database_transaction(self, duration_sec: float) -> None:
@@ -273,14 +305,19 @@ class LoggingContext:
           child to the parent
 
     Args:
-        name: Name for the context for logging. If this is omitted, it is
-           inherited from the parent context.
+        name: Name for the context for logging.
+        server_name: The name of the server this context is associated with
+            (`config.server.server_name` or `hs.hostname`)
         parent_context (LoggingContext|None): The parent of the new context
+        request: Synapse Request Context object. Useful to associate all the logs
+            happening to a given request.
+
     """
 
     __slots__ = [
         "previous_context",
         "name",
+        "server_name",
         "parent_context",
         "_resource_usage",
         "usage_start",
@@ -288,13 +325,16 @@ class LoggingContext:
         "finished",
         "request",
         "tag",
+        "scope",
     ]
 
     def __init__(
         self,
-        name: Optional[str] = None,
-        parent_context: "Optional[LoggingContext]" = None,
-        request: Optional[ContextRequest] = None,
+        *,
+        name: str,
+        server_name: str,
+        parent_context: "LoggingContext | None" = None,
+        request: ContextRequest | None = None,
     ) -> None:
         self.previous_context = current_context()
 
@@ -303,11 +343,14 @@ class LoggingContext:
 
         # The thread resource usage when the logcontext became active. None
         # if the context is not currently active.
-        self.usage_start: Optional[resource.struct_rusage] = None
+        self.usage_start: resource.struct_rusage | None = None
 
+        self.name = name
+        self.server_name = server_name
         self.main_thread = get_thread_id()
         self.request = None
         self.tag = ""
+        self.scope: "_LogContextScope" | None = None
 
         # keep track of whether we have hit the __exit__ block for this context
         # (suggesting that the the thing that created the context thinks it should
@@ -316,69 +359,24 @@ class LoggingContext:
 
         self.parent_context = parent_context
 
+        # Inherit some fields from the parent context
         if self.parent_context is not None:
-            # we track the current request_id
+            # which request this corresponds to
             self.request = self.parent_context.request
 
+            # we also track the current scope:
+            self.scope = self.parent_context.scope
+
         if request is not None:
             # the request param overrides the request from the parent context
             self.request = request
 
-        # if we don't have a `name`, but do have a parent context, use its name.
-        if self.parent_context and name is None:
-            name = str(self.parent_context)
-        if name is None:
-            raise ValueError(
-                "LoggingContext must be given either a name or a parent context"
-            )
-        self.name = name
-
     def __str__(self) -> str:
         return self.name
 
-    @classmethod
-    def current_context(cls) -> LoggingContextOrSentinel:
-        """Get the current logging context from thread local storage
-
-        This exists for backwards compatibility. ``current_context()`` should be
-        called directly.
-
-        Returns:
-            The current logging context
-        """
-        warnings.warn(
-            "synapse.logging.context.LoggingContext.current_context() is deprecated "
-            "in favor of synapse.logging.context.current_context().",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-        return current_context()
-
-    @classmethod
-    def set_current_context(
-        cls, context: LoggingContextOrSentinel
-    ) -> LoggingContextOrSentinel:
-        """Set the current logging context in thread local storage
-
-        This exists for backwards compatibility. ``set_current_context()`` should be
-        called directly.
-
-        Args:
-            context: The context to activate.
-
-        Returns:
-            The context that was previously active
-        """
-        warnings.warn(
-            "synapse.logging.context.LoggingContext.set_current_context() is deprecated "
-            "in favor of synapse.logging.context.set_current_context().",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-        return set_current_context(context)
-
     def __enter__(self) -> "LoggingContext":
         """Enters this logging context into thread local storage"""
+        logcontext_debug_logger.debug("LoggingContext(%s).__enter__", self.name)
         old_context = set_current_context(self)
         if self.previous_context != old_context:
             logcontext_error(
@@ -392,15 +390,18 @@ class LoggingContext:
 
     def __exit__(
         self,
-        type: Optional[Type[BaseException]],
-        value: Optional[BaseException],
-        traceback: Optional[TracebackType],
+        type: type[BaseException] | None,
+        value: BaseException | None,
+        traceback: TracebackType | None,
     ) -> None:
         """Restore the logging context in thread local storage to the state it
         was before this context was entered.
         Returns:
             None to avoid suppressing any exceptions that were thrown.
         """
+        logcontext_debug_logger.debug(
+            "LoggingContext(%s).__exit__ --> %s", self.name, self.previous_context
+        )
         current = set_current_context(self.previous_context)
         if current is not self:
             if current is SENTINEL_CONTEXT:
@@ -415,7 +416,7 @@ class LoggingContext:
         # recorded against the correct metrics.
         self.finished = True
 
-    def start(self, rusage: "Optional[resource.struct_rusage]") -> None:
+    def start(self, rusage: "resource.struct_rusage | None") -> None:
         """
         Record that this logcontext is currently running.
 
@@ -440,7 +441,7 @@ class LoggingContext:
         else:
             self.usage_start = rusage
 
-    def stop(self, rusage: "Optional[resource.struct_rusage]") -> None:
+    def stop(self, rusage: "resource.struct_rusage | None") -> None:
         """
         Record that this logcontext is no longer running.
 
@@ -494,13 +495,13 @@ class LoggingContext:
 
         return res
 
-    def _get_cputime(self, current: "resource.struct_rusage") -> Tuple[float, float]:
+    def _get_cputime(self, current: "resource.struct_rusage") -> tuple[float, float]:
         """Get the cpu usage time between start() and the given rusage
 
         Args:
             rusage: the current resource usage
 
-        Returns: Tuple[float, float]: seconds in user mode, seconds in system mode
+        Returns: tuple[float, float]: seconds in user mode, seconds in system mode
         """
         assert self.usage_start is not None
 
@@ -579,27 +580,85 @@ class LoggingContextFilter(logging.Filter):
     record.
     """
 
-    def __init__(self, request: str = ""):
+    def __init__(
+        self,
+        # `request` is here for backwards compatibility since we previously recommended
+        # people manually configure `LoggingContextFilter` like the following.
+        #
+        # ```yaml
+        # filters:
+        #   context:
+        #       (): synapse.logging.context.LoggingContextFilter
+        #       request: ""
+        # ```
+        #
+        # TODO: Since we now configure `LoggingContextFilter` automatically since #8051
+        # (2020-08-11), we could consider removing this useless parameter. This would
+        # require people to remove their own manual configuration of
+        # `LoggingContextFilter` as it would cause `TypeError: Filter.__init__() got an
+        # unexpected keyword argument 'request'` -> `ValueError: Unable to configure
+        # filter 'context'`
+        request: str = "",
+    ):
         self._default_request = request
 
     def filter(self, record: logging.LogRecord) -> Literal[True]:
-        """Add each fields from the logging contexts to the record.
+        """
+        Add each field from the logging context to the record.
+
+        Please be mindful of 3rd-party code outside of Synapse (like in the case of
+        Synapse Pro for small hosts) as this is running as a global log record filter.
+        Other code may have set their own attributes on the record and the log record
+        may not be relevant to Synapse at all so we should not mangle it.
+
+        We can have some defaults but we should avoid overwriting existing attributes on
+        any log record unless we actually have a Synapse logcontext (not just the
+        default sentinel logcontext).
+
         Returns:
             True to include the record in the log output.
         """
         context = current_context()
-        record.request = self._default_request
-
-        # context should never be None, but if it somehow ends up being, then
-        # we end up in a death spiral of infinite loops, so let's check, for
+        # type-ignore: `context` should never be `None`, but if it somehow ends up
+        # being, then we end up in a death spiral of infinite loops, so let's check, for
         # robustness' sake.
-        if context is not None:
+        #
+        # Add some default values to avoid log formatting errors.
+        if context is None:
+            record.request = self._default_request  # type: ignore[unreachable]
+
+            # Avoid overwriting an existing `server_name` on the record. This is running in
+            # the context of a global log record filter so there may be 3rd-party code that
+            # adds their own `server_name` and we don't want to interfere with that
+            # (clobber).
+            if not hasattr(record, "server_name"):
+                record.server_name = "unknown_server_from_no_logcontext"
+
+        # Otherwise, in the normal, expected case, fill in the log record attributes
+        # from the logcontext.
+        else:
+
+            def safe_set(attr: str, value: Any) -> None:
+                """
+                Only write the attribute if it hasn't already been set or we actually have
+                a Synapse logcontext (indicating that this log record is relevant to
+                Synapse).
+                """
+                if context is not SENTINEL_CONTEXT or not hasattr(record, attr):
+                    setattr(record, attr, value)
+
+            safe_set("server_name", context.server_name)
+
             # Logging is interested in the request ID. Note that for backwards
             # compatibility this is stored as the "request" on the record.
-            record.request = str(context)
+            safe_set("request", str(context))
 
             # Add some data from the HTTP request.
             request = context.request
+            # The sentinel logcontext has no request so if we get past this point, we
+            # know we have some actual Synapse logcontext and don't need to worry about
+            # using `safe_set`. We'll consider this an optimization since this is a
+            # pretty hot-path.
             if request is None:
                 return True
 
@@ -616,26 +675,47 @@ class LoggingContextFilter(logging.Filter):
 
 
 class PreserveLoggingContext:
-    """Context manager which replaces the logging context
+    """
+    Context manager which replaces the logging context
 
-    The previous logging context is restored on exit."""
+    The previous logging context is restored on exit.
 
-    __slots__ = ["_old_context", "_new_context"]
+    `make_deferred_yieldable` is pretty equivalent to using `with
+    PreserveLoggingContext():` (using the default sentinel context), i.e. it clears the
+    logcontext before awaiting (and so before execution passes back to the reactor) and
+    restores the old context once the awaitable completes (execution passes from the
+    reactor back to the code).
+    """
+
+    __slots__ = ["_old_context", "_new_context", "_instance_id"]
 
     def __init__(
         self, new_context: LoggingContextOrSentinel = SENTINEL_CONTEXT
     ) -> None:
         self._new_context = new_context
+        self._instance_id = random_string_insecure_fast(5)
 
     def __enter__(self) -> None:
+        logcontext_debug_logger.debug(
+            "PreserveLoggingContext(%s).__enter__ %s --> %s",
+            self._instance_id,
+            current_context(),
+            self._new_context,
+        )
         self._old_context = set_current_context(self._new_context)
 
     def __exit__(
         self,
-        type: Optional[Type[BaseException]],
-        value: Optional[BaseException],
-        traceback: Optional[TracebackType],
+        type: type[BaseException] | None,
+        value: BaseException | None,
+        traceback: TracebackType | None,
     ) -> None:
+        logcontext_debug_logger.debug(
+            "PreserveLoggingContext(%s).__exit %s --> %s",
+            self._instance_id,
+            current_context(),
+            self._old_context,
+        )
         context = set_current_context(self._old_context)
 
         if context != self._new_context:
@@ -711,12 +791,15 @@ def nested_logging_context(suffix: str) -> LoggingContext:
             "Starting nested logging context from sentinel context: metrics will be lost"
         )
         parent_context = None
+        server_name = "unknown_server_from_sentinel_context"
     else:
         assert isinstance(curr_context, LoggingContext)
         parent_context = curr_context
+        server_name = parent_context.server_name
     prefix = str(curr_context)
     return LoggingContext(
-        prefix + "-" + suffix,
+        name=prefix + "-" + suffix,
+        server_name=server_name,
         parent_context=parent_context,
     )
 
@@ -744,10 +827,7 @@ def preserve_fn(f: Callable[P, R]) -> Callable[P, "defer.Deferred[R]"]: ...
 
 
 def preserve_fn(
-    f: Union[
-        Callable[P, R],
-        Callable[P, Awaitable[R]],
-    ],
+    f: Callable[P, R] | Callable[P, Awaitable[R]],
 ) -> Callable[P, "defer.Deferred[R]"]:
     """Function decorator which wraps the function with run_in_background"""
 
@@ -773,10 +853,7 @@ def run_in_background(
 
 
 def run_in_background(
-    f: Union[
-        Callable[P, R],
-        Callable[P, Awaitable[R]],
-    ],
+    f: Callable[P, R] | Callable[P, Awaitable[R]],
     *args: P.args,
     **kwargs: P.kwargs,
 ) -> "defer.Deferred[R]":
@@ -784,6 +861,17 @@ def run_in_background(
     return from the function, and that the sentinel context is set once the
     deferred returned by the function completes.
 
+    To explain how the log contexts work here:
+     - When `run_in_background` is called, the calling logcontext is stored
+       ("original"), we kick off the background task in the current context, and we
+       restore that original context before returning.
+     - For a completed deferred, that's the end of the story.
+     - For an incomplete deferred, when the background task finishes, we don't want to
+       leak our context into the reactor which would erroneously get attached to the
+       next operation picked up by the event loop. We add a callback to the deferred
+       which will clear the logging context after it finishes and yields control back to
+       the reactor.
+
     Useful for wrapping functions that return a deferred or coroutine, which you don't
     yield or await on (for instance because you want to pass it to
     deferred.gatherResults()).
@@ -795,9 +883,19 @@ def run_in_background(
     `f` doesn't raise any deferred exceptions, otherwise a scary-looking
     CRITICAL error about an unhandled error will be logged without much
     indication about where it came from.
+
+    Returns:
+        Deferred which returns the result of func, or `None` if func raises.
+        Note that the returned Deferred does not follow the synapse logcontext
+        rules.
     """
-    current = current_context()
+    instance_id = random_string_insecure_fast(5)
+    calling_context = current_context()
+    logcontext_debug_logger.debug(
+        "run_in_background(%s): called with logcontext=%s", instance_id, calling_context
+    )
     try:
+        # (kick off the task in the current context)
         res = f(*args, **kwargs)
     except Exception:
         # the assumption here is that the caller doesn't want to be disturbed
@@ -806,6 +904,9 @@ def run_in_background(
 
     # `res` may be a coroutine, `Deferred`, some other kind of awaitable, or a plain
     # value. Convert it to a `Deferred`.
+    #
+    # Wrapping the value in a deferred has the side effect of executing the coroutine,
+    # if it is one. If it's already a deferred, then we can just use that.
     d: "defer.Deferred[R]"
     if isinstance(res, typing.Coroutine):
         # Wrap the coroutine in a `Deferred`.
@@ -820,20 +921,58 @@ def run_in_background(
         # `res` is a plain value. Wrap it in a `Deferred`.
         d = defer.succeed(res)
 
+    # The deferred has already completed
     if d.called and not d.paused:
-        # The function should have maintained the logcontext, so we can
-        # optimise out the messing about
+        # If the function messes with logcontexts, we can assume it follows the Synapse
+        # logcontext rules (Rules for functions returning awaitables: "If the awaitable
+        # is already complete, the function returns with the same logcontext it started
+        # with."). If the function doesn't touch logcontexts at all, we can also assume
+        # the logcontext is unchanged.
+        #
+        # Either way, the function should have maintained the calling logcontext, so we
+        # can avoid messing with it further. Additionally, if the deferred has already
+        # completed, then it would be a mistake to then add a deferred callback (below)
+        # to reset the logcontext to the sentinel logcontext as that would run
+        # immediately (remember our goal is to maintain the calling logcontext when we
+        # return).
+        if current_context() != calling_context:
+            logcontext_error(
+                "run_in_background(%s): deferred already completed but the function did not maintain the calling logcontext %s (found %s)"
+                % (
+                    instance_id,
+                    calling_context,
+                    current_context(),
+                )
+            )
+        else:
+            logcontext_debug_logger.debug(
+                "run_in_background(%s): deferred already completed (maintained the calling logcontext %s)",
+                instance_id,
+                calling_context,
+            )
         return d
 
-    # The function may have reset the context before returning, so
-    # we need to restore it now.
-    ctx = set_current_context(current)
+    # Since the function we called may follow the Synapse logcontext rules (Rules for
+    # functions returning awaitables: "If the awaitable is incomplete, the function
+    # clears the logcontext before returning"), the function may have reset the
+    # logcontext before returning, so we need to restore the calling logcontext now
+    # before we return ourselves.
+    #
+    # Our goal is to have the caller logcontext unchanged after firing off the
+    # background task and returning.
+    logcontext_debug_logger.debug(
+        "run_in_background(%s): restoring calling logcontext %s",
+        instance_id,
+        calling_context,
+    )
+    set_current_context(calling_context)
 
-    # The original context will be restored when the deferred
-    # completes, but there is nothing waiting for it, so it will
-    # get leaked into the reactor or some other function which
-    # wasn't expecting it. We therefore need to reset the context
-    # here.
+    # If the function we called is playing nice and following the Synapse logcontext
+    # rules, it will restore original calling logcontext when the deferred completes;
+    # but there is nothing waiting for it, so it will get leaked into the reactor (which
+    # would then get picked up by the next thing the reactor does). We therefore need to
+    # reset the logcontext here (set the `sentinel` logcontext) before yielding control
+    # back to the reactor.
     #
     # (If this feels asymmetric, consider it this way: we are
     # effectively forking a new thread of execution. We are
@@ -841,7 +980,23 @@ def run_in_background(
     # which is supposed to have a single entry and exit point. But
     # by spawning off another deferred, we are effectively
     # adding a new exit point.)
-    d.addBoth(_set_context_cb, ctx)
+    if logcontext_debug_logger.isEnabledFor(logging.DEBUG):
+
+        def _log_set_context_cb(
+            result: ResultT, context: LoggingContextOrSentinel
+        ) -> ResultT:
+            logcontext_debug_logger.debug(
+                "run_in_background(%s): resetting logcontext to %s",
+                instance_id,
+                context,
+            )
+            set_current_context(context)
+            return result
+
+        d.addBoth(_log_set_context_cb, SENTINEL_CONTEXT)
+    else:
+        d.addBoth(_set_context_cb, SENTINEL_CONTEXT)
+
     return d
 
 
@@ -855,59 +1010,99 @@ def run_coroutine_in_background(
     Useful for wrapping coroutines that you don't yield or await on (for
     instance because you want to pass it to deferred.gatherResults()).
 
-    This is a special case of `run_in_background` where we can accept a
-    coroutine directly rather than a function. We can do this because coroutines
-    do not run until called, and so calling an async function without awaiting
-    cannot change the log contexts.
+    This is a special case of `run_in_background` where we can accept a coroutine
+    directly rather than a function. We can do this because coroutines do not continue
+    running once they have yielded.
+
+    This is an ergonomic helper so we can do this:
+    ```python
+    run_coroutine_in_background(func1(arg1))
+    ```
+    Rather than having to do this:
+    ```python
+    run_in_background(lambda: func1(arg1))
+    ```
     """
-
-    current = current_context()
-    d = defer.ensureDeferred(coroutine)
-
-    # The function may have reset the context before returning, so
-    # we need to restore it now.
-    ctx = set_current_context(current)
-
-    # The original context will be restored when the deferred
-    # completes, but there is nothing waiting for it, so it will
-    # get leaked into the reactor or some other function which
-    # wasn't expecting it. We therefore need to reset the context
-    # here.
-    #
-    # (If this feels asymmetric, consider it this way: we are
-    # effectively forking a new thread of execution. We are
-    # probably currently within a ``with LoggingContext()`` block,
-    # which is supposed to have a single entry and exit point. But
-    # by spawning off another deferred, we are effectively
-    # adding a new exit point.)
-    d.addBoth(_set_context_cb, ctx)
-    return d
+    return run_in_background(lambda: coroutine)
 
 
 T = TypeVar("T")
 
 
 def make_deferred_yieldable(deferred: "defer.Deferred[T]") -> "defer.Deferred[T]":
-    """Given a deferred, make it follow the Synapse logcontext rules:
-
-    If the deferred has completed, essentially does nothing (just returns another
-    completed deferred with the result/failure).
-
-    If the deferred has not yet completed, resets the logcontext before
-    returning a deferred. Then, when the deferred completes, restores the
-    current logcontext before running callbacks/errbacks.
-
-    (This is more-or-less the opposite operation to run_in_background.)
     """
+    Given a deferred, make it follow the Synapse logcontext rules:
+
+    - If the deferred has completed, essentially does nothing (just returns another
+      completed deferred with the result/failure).
+    - If the deferred has not yet completed, resets the logcontext before returning a
+      incomplete deferred. Then, when the deferred completes, restores the current
+      logcontext before running callbacks/errbacks.
+
+    This means the resultant deferred can be awaited without leaking the current
+    logcontext to the reactor (which would then get erroneously picked up by the next
+    thing the reactor does), and also means that the logcontext is preserved when the
+    deferred completes.
+
+    (This is more-or-less the opposite operation to run_in_background in terms of how it
+    handles log contexts.)
+
+    Pretty much equivalent to using `with PreserveLoggingContext():`, i.e. it clears the
+    logcontext before awaiting (and so before execution passes back to the reactor) and
+    restores the old context once the awaitable completes (execution passes from the
+    reactor back to the code).
+    """
+    instance_id = random_string_insecure_fast(5)
+    logcontext_debug_logger.debug(
+        "make_deferred_yieldable(%s): called with logcontext=%s",
+        instance_id,
+        current_context(),
+    )
+
+    # The deferred has already completed
     if deferred.called and not deferred.paused:
         # it looks like this deferred is ready to run any callbacks we give it
         # immediately. We may as well optimise out the logcontext faffery.
+        logcontext_debug_logger.debug(
+            "make_deferred_yieldable(%s): deferred already completed and the function should have maintained the logcontext",
+            instance_id,
+        )
         return deferred
 
-    # ok, we can't be sure that a yield won't block, so let's reset the
-    # logcontext, and add a callback to the deferred to restore it.
-    prev_context = set_current_context(SENTINEL_CONTEXT)
-    deferred.addBoth(_set_context_cb, prev_context)
+    # Our goal is to have the caller logcontext unchanged after they yield/await the
+    # returned deferred.
+    #
+    # When the caller yield/await's the returned deferred, it may yield
+    # control back to the reactor. To avoid leaking the current logcontext to the
+    # reactor (which would then get erroneously picked up by the next thing the reactor
+    # does) while the deferred runs in the reactor event loop, we reset the logcontext
+    # and add a callback to the deferred to restore it so the caller's logcontext is
+    # active when the deferred completes.
+
+    logcontext_debug_logger.debug(
+        "make_deferred_yieldable(%s): resetting logcontext to %s",
+        instance_id,
+        SENTINEL_CONTEXT,
+    )
+    calling_context = set_current_context(SENTINEL_CONTEXT)
+
+    if logcontext_debug_logger.isEnabledFor(logging.DEBUG):
+
+        def _log_set_context_cb(
+            result: ResultT, context: LoggingContextOrSentinel
+        ) -> ResultT:
+            logcontext_debug_logger.debug(
+                "make_deferred_yieldable(%s): restoring calling logcontext to %s",
+                instance_id,
+                context,
+            )
+            set_current_context(context)
+            return result
+
+        deferred.addBoth(_log_set_context_cb, calling_context)
+    else:
+        deferred.addBoth(_set_context_cb, calling_context)
+
     return deferred
 
 
@@ -997,12 +1192,18 @@ def defer_to_threadpool(
             "Calling defer_to_threadpool from sentinel context: metrics will be lost"
         )
         parent_context = None
+        server_name = "unknown_server_from_sentinel_context"
     else:
         assert isinstance(curr_context, LoggingContext)
         parent_context = curr_context
+        server_name = parent_context.server_name
 
     def g() -> R:
-        with LoggingContext(str(curr_context), parent_context=parent_context):
+        with LoggingContext(
+            name=str(curr_context),
+            server_name=server_name,
+            parent_context=parent_context,
+        ):
             return f(*args, **kwargs)
 
     return make_deferred_yieldable(threads.deferToThreadPool(reactor, threadpool, g))
diff --git a/synapse/logging/filter.py b/synapse/logging/filter.py
deleted file mode 100644
index 16de488dbc..0000000000
--- a/synapse/logging/filter.py
+++ /dev/null
@@ -1,38 +0,0 @@
-#
-# This file is licensed under the Affero General Public License (AGPL) version 3.
-#
-# Copyright 2020 The Matrix.org Foundation C.I.C.
-# Copyright (C) 2023 New Vector, Ltd
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# See the GNU Affero General Public License for more details:
-# <https://www.gnu.org/licenses/agpl-3.0.html>.
-#
-# Originally licensed under the Apache License, Version 2.0:
-# <http://www.apache.org/licenses/LICENSE-2.0>.
-#
-# [This file includes modifications made by New Vector Limited]
-#
-#
-import logging
-from typing import Literal
-
-
-class MetadataFilter(logging.Filter):
-    """Logging filter that adds constant values to each record.
-
-    Args:
-        metadata: Key-value pairs to add to each record.
-    """
-
-    def __init__(self, metadata: dict):
-        self._metadata = metadata
-
-    def filter(self, record: logging.LogRecord) -> Literal[True]:
-        for key, value in self._metadata.items():
-            setattr(record, key, value)
-        return True
diff --git a/synapse/logging/formatter.py b/synapse/logging/formatter.py
index 228e5ed278..70b6d7f6a1 100644
--- a/synapse/logging/formatter.py
+++ b/synapse/logging/formatter.py
@@ -23,7 +23,6 @@ import logging
 import traceback
 from io import StringIO
 from types import TracebackType
-from typing import Optional, Tuple, Type
 
 
 class LogFormatter(logging.Formatter):
@@ -38,10 +37,10 @@ class LogFormatter(logging.Formatter):
 
     def formatException(
         self,
-        ei: Tuple[
-            Optional[Type[BaseException]],
-            Optional[BaseException],
-            Optional[TracebackType],
+        ei: tuple[
+            type[BaseException] | None,
+            BaseException | None,
+            TracebackType | None,
         ],
     ) -> str:
         sio = StringIO()
diff --git a/synapse/logging/handlers.py b/synapse/logging/handlers.py
index dec2a2c3dd..984d7c2238 100644
--- a/synapse/logging/handlers.py
+++ b/synapse/logging/handlers.py
@@ -23,7 +23,7 @@ class PeriodicallyFlushingMemoryHandler(MemoryHandler):
         self,
         capacity: int,
         flushLevel: int = logging.ERROR,
-        target: Optional[Handler] = None,
+        target: Handler | None = None,
         flushOnClose: bool = True,
         period: float = 5.0,
         reactor: Optional[IReactorCore] = None,
@@ -60,8 +60,18 @@ class PeriodicallyFlushingMemoryHandler(MemoryHandler):
         else:
             reactor_to_use = reactor
 
-        # call our hook when the reactor start up
-        reactor_to_use.callWhenRunning(on_reactor_running)
+        # Call our hook when the reactor start up
+        #
+        # type-ignore: Ideally, we'd use `Clock.call_when_running(...)`, but
+        # `PeriodicallyFlushingMemoryHandler` is instantiated via Python logging
+        # configuration, so it's not straightforward to pass in the homeserver's clock
+        # (and we don't want to burden other peoples logging config with the details).
+        #
+        # The important reason why we want to use `Clock.call_when_running` is so that
+        # the callback runs with a logcontext as we want to know which server the logs
+        # came from. But since we don't log anything in the callback, it's safe to
+        # ignore the lint here.
+        reactor_to_use.callWhenRunning(on_reactor_running)  # type: ignore[prefer-synapse-clock-call-when-running]
 
     def shouldFlush(self, record: LogRecord) -> bool:
         """
diff --git a/synapse/logging/opentracing.py b/synapse/logging/opentracing.py
index b596b1abdb..6e4e029163 100644
--- a/synapse/logging/opentracing.py
+++ b/synapse/logging/opentracing.py
@@ -183,13 +183,10 @@ from typing import (
     Callable,
     Collection,
     ContextManager,
-    Dict,
     Generator,
     Iterable,
-    List,
     Optional,
     Pattern,
-    Type,
     TypeVar,
     Union,
     cast,
@@ -204,7 +201,7 @@ from twisted.web.http import Request
 from twisted.web.http_headers import Headers
 
 from synapse.config import ConfigError
-from synapse.util import json_decoder, json_encoder
+from synapse.util.json import json_decoder, json_encoder
 
 if TYPE_CHECKING:
     from synapse.http.site import SynapseRequest
@@ -251,17 +248,18 @@ class _DummyTagNames:
 try:
     import opentracing
     import opentracing.tags
-    from opentracing.scope_managers.contextvars import ContextVarsScopeManager
 
     tags = opentracing.tags
 except ImportError:
     opentracing = None  # type: ignore[assignment]
     tags = _DummyTagNames  # type: ignore[assignment]
-    ContextVarsScopeManager = None  # type: ignore
 try:
     from jaeger_client import Config as JaegerConfig
+
+    from synapse.logging.scopecontextmanager import LogContextScopeManager
 except ImportError:
     JaegerConfig = None  # type: ignore
+    LogContextScopeManager = None  # type: ignore
 
 
 try:
@@ -291,7 +289,7 @@ try:
             except Exception:
                 logger.exception("Failed to report span")
 
-    RustReporter: Optional[Type[_WrappedRustReporter]] = _WrappedRustReporter
+    RustReporter: type[_WrappedRustReporter] | None = _WrappedRustReporter
 except ImportError:
     RustReporter = None
 
@@ -356,7 +354,7 @@ class SynapseBaggage:
 # Block everything by default
 # A regex which matches the server_names to expose traces for.
 # None means 'block everything'.
-_homeserver_whitelist: Optional[Pattern[str]] = None
+_homeserver_whitelist: Pattern[str] | None = None
 
 # Util methods
 
@@ -372,11 +370,11 @@ R = TypeVar("R")
 T = TypeVar("T")
 
 
-def only_if_tracing(func: Callable[P, R]) -> Callable[P, Optional[R]]:
+def only_if_tracing(func: Callable[P, R]) -> Callable[P, R | None]:
     """Executes the function only if we're tracing. Otherwise returns None."""
 
     @wraps(func)
-    def _only_if_tracing_inner(*args: P.args, **kwargs: P.kwargs) -> Optional[R]:
+    def _only_if_tracing_inner(*args: P.args, **kwargs: P.kwargs) -> R | None:
         if opentracing:
             return func(*args, **kwargs)
         else:
@@ -388,18 +386,18 @@ def only_if_tracing(func: Callable[P, R]) -> Callable[P, Optional[R]]:
 @overload
 def ensure_active_span(
     message: str,
-) -> Callable[[Callable[P, R]], Callable[P, Optional[R]]]: ...
+) -> Callable[[Callable[P, R]], Callable[P, R | None]]: ...
 
 
 @overload
 def ensure_active_span(
     message: str, ret: T
-) -> Callable[[Callable[P, R]], Callable[P, Union[T, R]]]: ...
+) -> Callable[[Callable[P, R]], Callable[P, T | R]]: ...
 
 
 def ensure_active_span(
-    message: str, ret: Optional[T] = None
-) -> Callable[[Callable[P, R]], Callable[P, Union[Optional[T], R]]]:
+    message: str, ret: T | None = None
+) -> Callable[[Callable[P, R]], Callable[P, T | None | R]]:
     """Executes the operation only if opentracing is enabled and there is an active span.
     If there is no active span it logs message at the error level.
 
@@ -415,11 +413,11 @@ def ensure_active_span(
 
     def ensure_active_span_inner_1(
         func: Callable[P, R],
-    ) -> Callable[P, Union[Optional[T], R]]:
+    ) -> Callable[P, T | None | R]:
         @wraps(func)
         def ensure_active_span_inner_2(
             *args: P.args, **kwargs: P.kwargs
-        ) -> Union[Optional[T], R]:
+        ) -> T | None | R:
             if not opentracing:
                 return ret
 
@@ -483,7 +481,7 @@ def init_tracer(hs: "HomeServer") -> None:
     config = JaegerConfig(
         config=jaeger_config,
         service_name=f"{hs.config.server.server_name} {instance_name_by_type}",
-        scope_manager=ContextVarsScopeManager(),
+        scope_manager=LogContextScopeManager(),
         metrics_factory=PrometheusMetricsFactory(),
     )
 
@@ -534,10 +532,10 @@ def whitelisted_homeserver(destination: str) -> bool:
 # Could use kwargs but I want these to be explicit
 def start_active_span(
     operation_name: str,
-    child_of: Optional[Union["opentracing.Span", "opentracing.SpanContext"]] = None,
-    references: Optional[List["opentracing.Reference"]] = None,
-    tags: Optional[Dict[str, str]] = None,
-    start_time: Optional[float] = None,
+    child_of: Union["opentracing.Span", "opentracing.SpanContext"] | None = None,
+    references: list["opentracing.Reference"] | None = None,
+    tags: dict[str, str] | None = None,
+    start_time: float | None = None,
     ignore_active_span: bool = False,
     finish_on_close: bool = True,
     *,
@@ -575,8 +573,10 @@ def start_active_span(
 def start_active_span_follows_from(
     operation_name: str,
     contexts: Collection,
-    child_of: Optional[Union["opentracing.Span", "opentracing.SpanContext"]] = None,
-    start_time: Optional[float] = None,
+    child_of: Union["opentracing.Span", "opentracing.SpanContext"] | None = None,
+    tags: dict[str, str] | None = None,
+    start_time: float | None = None,
+    ignore_active_span: bool = False,
     *,
     inherit_force_tracing: bool = False,
     tracer: Optional["opentracing.Tracer"] = None,
@@ -591,9 +591,16 @@ def start_active_span_follows_from(
            span will be the parent. (If there is no currently active span, the first
            span in `contexts` will be the parent.)
 
+        tags: an optional dictionary of span tags. The caller gives up ownership of that
+            dictionary, because the :class:`Tracer` may use it as-is to avoid extra data
+            copying.
+
         start_time: optional override for the start time of the created span. Seconds
             since the epoch.
 
+        ignore_active_span: an explicit flag that ignores the current active
+            scope and creates a root span.
+
         inherit_force_tracing: if set, and any of the previous contexts have had tracing
            forced, the new span will also have tracing forced.
         tracer: override the opentracing tracer. By default the global tracer is used.
@@ -606,7 +613,9 @@ def start_active_span_follows_from(
         operation_name,
         child_of=child_of,
         references=references,
+        tags=tags,
         start_time=start_time,
+        ignore_active_span=ignore_active_span,
         tracer=tracer,
     )
 
@@ -619,11 +628,11 @@ def start_active_span_follows_from(
 
 
 def start_active_span_from_edu(
-    edu_content: Dict[str, Any],
+    edu_content: dict[str, Any],
     operation_name: str,
-    references: Optional[List["opentracing.Reference"]] = None,
-    tags: Optional[Dict[str, str]] = None,
-    start_time: Optional[float] = None,
+    references: list["opentracing.Reference"] | None = None,
+    tags: dict[str, str] | None = None,
+    start_time: float | None = None,
     ignore_active_span: bool = False,
     finish_on_close: bool = True,
 ) -> "opentracing.Scope":
@@ -672,20 +681,32 @@ def start_active_span_from_edu(
 
 # Opentracing setters for tags, logs, etc
 @only_if_tracing
-def active_span() -> Optional["opentracing.Span"]:
-    """Get the currently active span, if any"""
-    return opentracing.tracer.active_span
+def active_span(
+    *,
+    tracer: Optional["opentracing.Tracer"] = None,
+) -> Optional["opentracing.Span"]:
+    """
+    Get the currently active span, if any
+
+    Args:
+        tracer: override the opentracing tracer. By default the global tracer is used.
+    """
+    if tracer is None:
+        # use the global tracer by default
+        tracer = opentracing.tracer
+
+    return tracer.active_span
 
 
 @ensure_active_span("set a tag")
-def set_tag(key: str, value: Union[str, bool, int, float]) -> None:
+def set_tag(key: str, value: str | bool | int | float) -> None:
     """Sets a tag on the active span"""
     assert opentracing.tracer.active_span is not None
     opentracing.tracer.active_span.set_tag(key, value)
 
 
 @ensure_active_span("log")
-def log_kv(key_values: Dict[str, Any], timestamp: Optional[float] = None) -> None:
+def log_kv(key_values: dict[str, Any], timestamp: float | None = None) -> None:
     """Log to the active span"""
     assert opentracing.tracer.active_span is not None
     opentracing.tracer.active_span.log_kv(key_values, timestamp)
@@ -736,8 +757,8 @@ def is_context_forced_tracing(
 
 @ensure_active_span("inject the span into a header dict")
 def inject_header_dict(
-    headers: Dict[bytes, List[bytes]],
-    destination: Optional[str] = None,
+    headers: dict[bytes, list[bytes]],
+    destination: str | None = None,
     check_destination: bool = True,
 ) -> None:
     """
@@ -768,7 +789,7 @@ def inject_header_dict(
 
     span = opentracing.tracer.active_span
 
-    carrier: Dict[str, str] = {}
+    carrier: dict[str, str] = {}
     assert span is not None
     opentracing.tracer.inject(span.context, opentracing.Format.HTTP_HEADERS, carrier)
 
@@ -796,16 +817,16 @@ def inject_response_headers(response_headers: Headers) -> None:
 
 
 @ensure_active_span("inject the span into a header dict")
-def inject_request_headers(headers: Dict[str, str]) -> None:
+def inject_request_headers(headers: dict[str, str]) -> None:
     span = opentracing.tracer.active_span
     assert span is not None
     opentracing.tracer.inject(span.context, opentracing.Format.HTTP_HEADERS, headers)
 
 
 @ensure_active_span(
-    "get the active span context as a dict", ret=cast(Dict[str, str], {})
+    "get the active span context as a dict", ret=cast(dict[str, str], {})
 )
-def get_active_span_text_map(destination: Optional[str] = None) -> Dict[str, str]:
+def get_active_span_text_map(destination: str | None = None) -> dict[str, str]:
     """
     Gets a span context as a dict. This can be used instead of manually
     injecting a span into an empty carrier.
@@ -820,7 +841,7 @@ def get_active_span_text_map(destination: Optional[str] = None) -> Dict[str, str
     if destination and not whitelisted_homeserver(destination):
         return {}
 
-    carrier: Dict[str, str] = {}
+    carrier: dict[str, str] = {}
     assert opentracing.tracer.active_span is not None
     opentracing.tracer.inject(
         opentracing.tracer.active_span.context, opentracing.Format.TEXT_MAP, carrier
@@ -835,7 +856,7 @@ def active_span_context_as_string() -> str:
     Returns:
         The active span context encoded as a string.
     """
-    carrier: Dict[str, str] = {}
+    carrier: dict[str, str] = {}
     if opentracing:
         assert opentracing.tracer.active_span is not None
         opentracing.tracer.inject(
@@ -844,7 +865,7 @@ def active_span_context_as_string() -> str:
     return json_encoder.encode(carrier)
 
 
-def span_context_from_request(request: Request) -> "Optional[opentracing.SpanContext]":
+def span_context_from_request(request: Request) -> "opentracing.SpanContext | None":
     """Extract an opentracing context from the headers on an HTTP request
 
     This is useful when we have received an HTTP request from another part of our
@@ -864,12 +885,12 @@ def span_context_from_string(carrier: str) -> Optional["opentracing.SpanContext"
     Returns:
         The active span context decoded from a string.
     """
-    payload: Dict[str, str] = json_decoder.decode(carrier)
+    payload: dict[str, str] = json_decoder.decode(carrier)
     return opentracing.tracer.extract(opentracing.Format.TEXT_MAP, payload)
 
 
 @only_if_tracing
-def extract_text_map(carrier: Dict[str, str]) -> Optional["opentracing.SpanContext"]:
+def extract_text_map(carrier: dict[str, str]) -> Optional["opentracing.SpanContext"]:
     """
     Wrapper method for opentracing's tracer.extract for TEXT_MAP.
     Args:
@@ -1098,7 +1119,7 @@ def trace_servlet(
             # with JsonResource).
             scope.span.set_operation_name(request.request_metrics.name)
 
-            # Mypy seems to think that start_context.tag below can be Optional[str], but
+            # Mypy seems to think that start_context.tag below can be str | None, but
             # that doesn't appear to be correct and works in practice.
 
             request_tags[SynapseTags.REQUEST_TAG] = (
diff --git a/synapse/logging/scopecontextmanager.py b/synapse/logging/scopecontextmanager.py
new file mode 100644
index 0000000000..f3ec07eecf
--- /dev/null
+++ b/synapse/logging/scopecontextmanager.py
@@ -0,0 +1,160 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright 2019 The Matrix.org Foundation C.I.C.
+# Copyright (C) 2023 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+# Originally licensed under the Apache License, Version 2.0:
+# <http://www.apache.org/licenses/LICENSE-2.0>.
+#
+# [This file includes modifications made by New Vector Limited]
+#
+#
+
+import logging
+
+from opentracing import Scope, ScopeManager, Span
+
+from synapse.logging.context import (
+    LoggingContext,
+    current_context,
+    nested_logging_context,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class LogContextScopeManager(ScopeManager):
+    """
+    The LogContextScopeManager tracks the active scope in opentracing
+    by using the log contexts which are native to synapse. This is so
+    that the basic opentracing api can be used across twisted defereds.
+
+    It would be nice just to use opentracing's ContextVarsScopeManager,
+    but currently that doesn't work due to https://twistedmatrix.com/trac/ticket/10301.
+    """
+
+    def __init__(self) -> None:
+        pass
+
+    @property
+    def active(self) -> Scope | None:
+        """
+        Returns the currently active Scope which can be used to access the
+        currently active Scope.span.
+        If there is a non-null Scope, its wrapped Span
+        becomes an implicit parent of any newly-created Span at
+        Tracer.start_active_span() time.
+
+        Return:
+            The Scope that is active, or None if not available.
+        """
+        ctx = current_context()
+        return ctx.scope
+
+    def activate(self, span: Span, finish_on_close: bool) -> Scope:
+        """
+        Makes a Span active.
+        Args
+            span: the span that should become active.
+            finish_on_close: whether Span should be automatically finished when
+                Scope.close() is called.
+
+        Returns:
+            Scope to control the end of the active period for
+            *span*. It is a programming error to neglect to call
+            Scope.close() on the returned instance.
+        """
+
+        ctx = current_context()
+
+        if not ctx:
+            logger.error("Tried to activate scope outside of loggingcontext")
+            return Scope(None, span)  # type: ignore[arg-type]
+
+        if ctx.scope is not None:
+            # start a new logging context as a child of the existing one.
+            # Doing so -- rather than updating the existing logcontext -- means that
+            # creating several concurrent spans under the same logcontext works
+            # correctly.
+            ctx = nested_logging_context("")
+            enter_logcontext = True
+        else:
+            # if there is no span currently associated with the current logcontext, we
+            # just store the scope in it.
+            #
+            # This feels a bit dubious, but it does hack around a problem where a
+            # span outlasts its parent logcontext (which would otherwise lead to
+            # "Re-starting finished log context" errors).
+            enter_logcontext = False
+
+        scope = _LogContextScope(self, span, ctx, enter_logcontext, finish_on_close)
+        ctx.scope = scope
+        if enter_logcontext:
+            ctx.__enter__()
+
+        return scope
+
+
+class _LogContextScope(Scope):
+    """
+    A custom opentracing scope, associated with a LogContext
+
+      * When the scope is closed, the logcontext's active scope is reset to None.
+        and - if enter_logcontext was set - the logcontext is finished too.
+    """
+
+    def __init__(
+        self,
+        manager: LogContextScopeManager,
+        span: Span,
+        logcontext: LoggingContext,
+        enter_logcontext: bool,
+        finish_on_close: bool,
+    ):
+        """
+        Args:
+            manager:
+                the manager that is responsible for this scope.
+            span:
+                the opentracing span which this scope represents the local
+                lifetime for.
+            logcontext:
+                the log context to which this scope is attached.
+            enter_logcontext:
+                if True the log context will be exited when the scope is finished
+            finish_on_close:
+                if True finish the span when the scope is closed
+        """
+        super().__init__(manager, span)
+        self.logcontext = logcontext
+        self._finish_on_close = finish_on_close
+        self._enter_logcontext = enter_logcontext
+
+    def __str__(self) -> str:
+        return f"Scope<{self.span}>"
+
+    def close(self) -> None:
+        active_scope = self.manager.active
+        if active_scope is not self:
+            logger.error(
+                "Closing scope %s which is not the currently-active one %s",
+                self,
+                active_scope,
+            )
+
+        if self._finish_on_close:
+            self.span.finish()
+
+        self.logcontext.scope = None
+
+        if self._enter_logcontext:
+            self.logcontext.__exit__(None, None, None)
diff --git a/synapse/media/_base.py b/synapse/media/_base.py
index 29911dab77..7884930876 100644
--- a/synapse/media/_base.py
+++ b/synapse/media/_base.py
@@ -29,12 +29,8 @@ from typing import (
     TYPE_CHECKING,
     Awaitable,
     BinaryIO,
-    Dict,
     Generator,
-    List,
     Optional,
-    Tuple,
-    Type,
 )
 
 import attr
@@ -50,12 +46,13 @@ from synapse.api.errors import Codes, cs_error
 from synapse.http.server import finish_request, respond_with_json
 from synapse.http.site import SynapseRequest
 from synapse.logging.context import (
+    PreserveLoggingContext,
     defer_to_threadpool,
     make_deferred_yieldable,
     run_in_background,
 )
-from synapse.util import Clock
 from synapse.util.async_helpers import DeferredEvent
+from synapse.util.clock import Clock
 from synapse.util.stringutils import is_ascii
 
 if TYPE_CHECKING:
@@ -137,8 +134,8 @@ async def respond_with_file(
     request: SynapseRequest,
     media_type: str,
     file_path: str,
-    file_size: Optional[int] = None,
-    upload_name: Optional[str] = None,
+    file_size: int | None = None,
+    upload_name: str | None = None,
 ) -> None:
     logger.debug("Responding with %r", file_path)
 
@@ -160,8 +157,8 @@ async def respond_with_file(
 def add_file_headers(
     request: Request,
     media_type: str,
-    file_size: Optional[int],
-    upload_name: Optional[str],
+    file_size: int | None,
+    upload_name: str | None,
 ) -> None:
     """Adds the correct response headers in preparation for responding with the
     media.
@@ -305,10 +302,10 @@ def _can_encode_filename_as_token(x: str) -> bool:
 async def respond_with_multipart_responder(
     clock: Clock,
     request: SynapseRequest,
-    responder: "Optional[Responder]",
+    responder: "Responder | None",
     media_type: str,
-    media_length: Optional[int],
-    upload_name: Optional[str],
+    media_length: int | None,
+    upload_name: str | None,
 ) -> None:
     """
     Responds to requests originating from the federation media `/download` endpoint by
@@ -396,10 +393,10 @@ async def respond_with_multipart_responder(
 
 async def respond_with_responder(
     request: SynapseRequest,
-    responder: "Optional[Responder]",
+    responder: "Responder | None",
     media_type: str,
-    file_size: Optional[int],
-    upload_name: Optional[str] = None,
+    file_size: int | None,
+    upload_name: str | None = None,
 ) -> None:
     """Responds to the request with given responder. If responder is None then
     returns 404.
@@ -505,9 +502,9 @@ class Responder(ABC):
 
     def __exit__(  # noqa: B027
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_val: Optional[BaseException],
-        exc_tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
     ) -> None:
         pass
 
@@ -530,47 +527,47 @@ class FileInfo:
     """Details about a requested/uploaded file."""
 
     # The server name where the media originated from, or None if local.
-    server_name: Optional[str]
+    server_name: str | None
     # The local ID of the file. For local files this is the same as the media_id
     file_id: str
     # If the file is for the url preview cache
     url_cache: bool = False
     # Whether the file is a thumbnail or not.
-    thumbnail: Optional[ThumbnailInfo] = None
+    thumbnail: ThumbnailInfo | None = None
 
     # The below properties exist to maintain compatibility with third-party modules.
     @property
-    def thumbnail_width(self) -> Optional[int]:
+    def thumbnail_width(self) -> int | None:
         if not self.thumbnail:
             return None
         return self.thumbnail.width
 
     @property
-    def thumbnail_height(self) -> Optional[int]:
+    def thumbnail_height(self) -> int | None:
         if not self.thumbnail:
             return None
         return self.thumbnail.height
 
     @property
-    def thumbnail_method(self) -> Optional[str]:
+    def thumbnail_method(self) -> str | None:
         if not self.thumbnail:
             return None
         return self.thumbnail.method
 
     @property
-    def thumbnail_type(self) -> Optional[str]:
+    def thumbnail_type(self) -> str | None:
         if not self.thumbnail:
             return None
         return self.thumbnail.type
 
     @property
-    def thumbnail_length(self) -> Optional[int]:
+    def thumbnail_length(self) -> int | None:
         if not self.thumbnail:
             return None
         return self.thumbnail.length
 
 
-def get_filename_from_headers(headers: Dict[bytes, List[bytes]]) -> Optional[str]:
+def get_filename_from_headers(headers: dict[bytes, list[bytes]]) -> str | None:
     """
     Get the filename of the downloaded file by inspecting the
     Content-Disposition HTTP header.
@@ -618,7 +615,7 @@ def get_filename_from_headers(headers: Dict[bytes, List[bytes]]) -> Optional[str
     return upload_name
 
 
-def _parse_header(line: bytes) -> Tuple[bytes, Dict[bytes, bytes]]:
+def _parse_header(line: bytes) -> tuple[bytes, dict[bytes, bytes]]:
     """Parse a Content-type like header.
 
     Cargo-culted from `cgi`, but works on bytes rather than strings.
@@ -704,15 +701,16 @@ class ThreadedFileSender:
 
     def __init__(self, hs: "HomeServer") -> None:
         self.reactor = hs.get_reactor()
+        self.clock = hs.get_clock()
         self.thread_pool = hs.get_media_sender_thread_pool()
 
-        self.file: Optional[BinaryIO] = None
+        self.file: BinaryIO | None = None
         self.deferred: "Deferred[None]" = Deferred()
-        self.consumer: Optional[interfaces.IConsumer] = None
+        self.consumer: Optional[IConsumer] = None
 
         # Signals if the thread should keep reading/sending data. Set means
         # continue, clear means pause.
-        self.wakeup_event = DeferredEvent(self.reactor)
+        self.wakeup_event = DeferredEvent(self.clock)
 
         # Signals if the thread should terminate, e.g. because the consumer has
         # gone away.
@@ -757,9 +755,10 @@ class ThreadedFileSender:
         self.wakeup_event.set()
 
         if not self.deferred.called:
-            self.deferred.errback(
-                ConsumerRequestedStopError("Consumer asked us to stop producing")
-            )
+            with PreserveLoggingContext():
+                self.deferred.errback(
+                    ConsumerRequestedStopError("Consumer asked us to stop producing")
+                )
 
     async def start_read_loop(self) -> None:
         """This is the loop that drives reading/writing"""
@@ -813,7 +812,8 @@ class ThreadedFileSender:
             self.consumer = None
 
         if not self.deferred.called:
-            self.deferred.errback(failure)
+            with PreserveLoggingContext():
+                self.deferred.errback(failure)
 
     def _finish(self) -> None:
         """Called when we have finished writing (either on success or
@@ -827,4 +827,5 @@ class ThreadedFileSender:
             self.consumer = None
 
         if not self.deferred.called:
-            self.deferred.callback(None)
+            with PreserveLoggingContext():
+                self.deferred.callback(None)
diff --git a/synapse/media/filepath.py b/synapse/media/filepath.py
index 3d7863e2fb..df637f3be3 100644
--- a/synapse/media/filepath.py
+++ b/synapse/media/filepath.py
@@ -24,7 +24,7 @@ import functools
 import os
 import re
 import string
-from typing import Any, Callable, List, TypeVar, Union, cast
+from typing import Any, Callable, TypeVar, cast
 
 NEW_FORMAT_ID_RE = re.compile(r"^\d\d\d\d-\d\d-\d\d")
 
@@ -46,7 +46,7 @@ def _wrap_in_base_path(func: F) -> F:
 
 
 GetPathMethod = TypeVar(
-    "GetPathMethod", bound=Union[Callable[..., str], Callable[..., List[str]]]
+    "GetPathMethod", bound=Callable[..., str] | Callable[..., list[str]]
 )
 
 
@@ -73,7 +73,7 @@ def _wrap_with_jail_check(relative: bool) -> Callable[[GetPathMethod], GetPathMe
         @functools.wraps(func)
         def _wrapped(
             self: "MediaFilePaths", *args: Any, **kwargs: Any
-        ) -> Union[str, List[str]]:
+        ) -> str | list[str]:
             path_or_paths = func(self, *args, **kwargs)
 
             if isinstance(path_or_paths, list):
@@ -303,7 +303,7 @@ class MediaFilePaths:
     url_cache_filepath = _wrap_in_base_path(url_cache_filepath_rel)
 
     @_wrap_with_jail_check(relative=False)
-    def url_cache_filepath_dirs_to_delete(self, media_id: str) -> List[str]:
+    def url_cache_filepath_dirs_to_delete(self, media_id: str) -> list[str]:
         "The dirs to try and remove if we delete the media_id file"
         if NEW_FORMAT_ID_RE.match(media_id):
             return [
@@ -376,7 +376,7 @@ class MediaFilePaths:
     )
 
     @_wrap_with_jail_check(relative=False)
-    def url_cache_thumbnail_dirs_to_delete(self, media_id: str) -> List[str]:
+    def url_cache_thumbnail_dirs_to_delete(self, media_id: str) -> list[str]:
         "The dirs to try and remove if we delete the media_id thumbnails"
         # Media id is of the form <DATE><RANDOM_STRING>
         # E.g.: 2017-09-28-fsdRDt24DS234dsf
diff --git a/synapse/media/media_repository.py b/synapse/media/media_repository.py
index aae88d25c9..3344e4c7be 100644
--- a/synapse/media/media_repository.py
+++ b/synapse/media/media_repository.py
@@ -24,7 +24,7 @@ import logging
 import os
 import shutil
 from io import BytesIO
-from typing import IO, TYPE_CHECKING, Dict, List, Optional, Set, Tuple
+from typing import IO, TYPE_CHECKING
 
 import attr
 from matrix_common.types.mxc_uri import MXCUri
@@ -64,13 +64,16 @@ from synapse.media.media_storage import (
     SHA256TransparentIOReader,
     SHA256TransparentIOWriter,
 )
-from synapse.media.storage_provider import StorageProviderWrapper
+from synapse.media.storage_provider import (
+    FileStorageProviderBackend,
+    StorageProviderWrapper,
+)
 from synapse.media.thumbnailer import Thumbnailer, ThumbnailError
 from synapse.media.url_previewer import UrlPreviewer
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.storage.databases.main.media_repository import LocalMedia, RemoteMedia
 from synapse.types import UserID
 from synapse.util.async_helpers import Linearizer
+from synapse.util.duration import Duration
 from synapse.util.retryutils import NotRetryingDestination
 from synapse.util.stringutils import random_string
 
@@ -81,10 +84,10 @@ logger = logging.getLogger(__name__)
 
 # How often to run the background job to update the "recently accessed"
 # attribute of local and remote media.
-UPDATE_RECENTLY_ACCESSED_TS = 60 * 1000  # 1 minute
+UPDATE_RECENTLY_ACCESSED_TS = Duration(minutes=1)
 # How often to run the background job to check for local and remote media
 # that should be purged according to the configured media retention settings.
-MEDIA_RETENTION_CHECK_PERIOD_MS = 60 * 60 * 1000  # 1 hour
+MEDIA_RETENTION_CHECK_PERIOD = Duration(hours=1)
 
 
 class MediaRepository:
@@ -108,10 +111,10 @@ class MediaRepository:
         self.dynamic_thumbnails = hs.config.media.dynamic_thumbnails
         self.thumbnail_requirements = hs.config.media.thumbnail_requirements
 
-        self.remote_media_linearizer = Linearizer(name="media_remote")
+        self.remote_media_linearizer = Linearizer(name="media_remote", clock=self.clock)
 
-        self.recently_accessed_remotes: Set[Tuple[str, str]] = set()
-        self.recently_accessed_locals: Set[str] = set()
+        self.recently_accessed_remotes: set[tuple[str, str]] = set()
+        self.recently_accessed_locals: set[str] = set()
 
         self.federation_domain_whitelist = (
             hs.config.federation.federation_domain_whitelist
@@ -142,10 +145,23 @@ class MediaRepository:
             )
             storage_providers.append(provider)
 
+        # If local media storage is enabled, create the local provider
+        local_provider: FileStorageProviderBackend | None = None
+        if hs.config.media.enable_local_media_storage and self.primary_base_path:
+            local_provider = FileStorageProviderBackend(hs, self.primary_base_path)
+
         self.media_storage: MediaStorage = MediaStorage(
-            self.hs, self.primary_base_path, self.filepaths, storage_providers
+            self.hs, self.filepaths, storage_providers, local_provider
         )
 
+        # Log a warning if there are no storage backends configured
+        if not hs.config.media.enable_local_media_storage and not storage_providers:
+            logger.warning(
+                "Local media storage is disabled and no media_storage_providers are "
+                "configured. All media requests will return 404 errors as there is "
+                "no storage backend available."
+            )
+
         self.clock.looping_call(
             self._start_update_recently_accessed, UPDATE_RECENTLY_ACCESSED_TS
         )
@@ -167,11 +183,11 @@ class MediaRepository:
             # with the duration between runs dictated by the homeserver config.
             self.clock.looping_call(
                 self._start_apply_media_retention_rules,
-                MEDIA_RETENTION_CHECK_PERIOD_MS,
+                MEDIA_RETENTION_CHECK_PERIOD,
             )
 
         if hs.config.media.url_preview_enabled:
-            self.url_previewer: Optional[UrlPreviewer] = UrlPreviewer(
+            self.url_previewer: UrlPreviewer | None = UrlPreviewer(
                 hs, self, self.media_storage
             )
         else:
@@ -179,22 +195,22 @@ class MediaRepository:
 
         # We get the media upload limits and sort them in descending order of
         # time period, so that we can apply some optimizations.
-        self.media_upload_limits = hs.config.media.media_upload_limits
-        self.media_upload_limits.sort(
+        self.default_media_upload_limits = hs.config.media.media_upload_limits
+        self.default_media_upload_limits.sort(
             key=lambda limit: limit.time_period_ms, reverse=True
         )
 
+        self.media_repository_callbacks = hs.get_module_api_callbacks().media_repository
+
     def _start_update_recently_accessed(self) -> Deferred:
-        return run_as_background_process(
+        return self.hs.run_as_background_process(
             "update_recently_accessed_media",
-            self.server_name,
             self._update_recently_accessed,
         )
 
     def _start_apply_media_retention_rules(self) -> Deferred:
-        return run_as_background_process(
+        return self.hs.run_as_background_process(
             "apply_media_retention_rules",
-            self.server_name,
             self._apply_media_retention_rules,
         )
 
@@ -209,7 +225,7 @@ class MediaRepository:
             local_media, remote_media, self.clock.time_msec()
         )
 
-    def mark_recently_accessed(self, server_name: Optional[str], media_id: str) -> None:
+    def mark_recently_accessed(self, server_name: str | None, media_id: str) -> None:
         """Mark the given media as recently accessed.
 
         Args:
@@ -222,7 +238,7 @@ class MediaRepository:
             self.recently_accessed_locals.add(media_id)
 
     @trace
-    async def create_media_id(self, auth_user: UserID) -> Tuple[str, int]:
+    async def create_media_id(self, auth_user: UserID) -> tuple[str, int]:
         """Create and store a media ID for a local user and return the MXC URI and its
         expiration.
 
@@ -243,7 +259,7 @@ class MediaRepository:
         return f"mxc://{self.server_name}/{media_id}", now + self.unused_expiration_time
 
     @trace
-    async def reached_pending_media_limit(self, auth_user: UserID) -> Tuple[bool, int]:
+    async def reached_pending_media_limit(self, auth_user: UserID) -> tuple[bool, int]:
         """Check if the user is over the limit for pending media uploads.
 
         Args:
@@ -299,11 +315,11 @@ class MediaRepository:
     async def create_or_update_content(
         self,
         media_type: str,
-        upload_name: Optional[str],
+        upload_name: str | None,
         content: IO,
         content_length: int,
         auth_user: UserID,
-        media_id: Optional[str] = None,
+        media_id: str | None = None,
     ) -> MXCUri:
         """Create or update the content of the given media ID.
 
@@ -340,16 +356,27 @@ class MediaRepository:
 
         # Check that the user has not exceeded any of the media upload limits.
 
+        # Use limits from module API if provided
+        media_upload_limits = (
+            await self.media_repository_callbacks.get_media_upload_limits_for_user(
+                auth_user.to_string()
+            )
+        )
+
+        # Otherwise use the default limits from config
+        if media_upload_limits is None:
+            # Note: the media upload limits are sorted so larger time periods are
+            # first.
+            media_upload_limits = self.default_media_upload_limits
+
         # This is the total size of media uploaded by the user in the last
         # `time_period_ms` milliseconds, or None if we haven't checked yet.
-        uploaded_media_size: Optional[int] = None
+        uploaded_media_size: int | None = None
 
-        # Note: the media upload limits are sorted so larger time periods are
-        # first.
-        for limit in self.media_upload_limits:
+        for limit in media_upload_limits:
             # We only need to check the amount of media uploaded by the user in
             # this latest (smaller) time period if the amount of media uploaded
-            # in a previous (larger) time period is above the limit.
+            # in a previous (larger) time period is below the limit.
             #
             # This optimization means that in the common case where the user
             # hasn't uploaded much media, we only need to query the database
@@ -363,6 +390,12 @@ class MediaRepository:
                 )
 
             if uploaded_media_size + content_length > limit.max_bytes:
+                await self.media_repository_callbacks.on_media_upload_limit_exceeded(
+                    user_id=auth_user.to_string(),
+                    limit=limit,
+                    sent_bytes=uploaded_media_size,
+                    attempted_bytes=content_length,
+                )
                 raise SynapseError(
                     400, "Media upload limit exceeded", Codes.RESOURCE_LIMIT_EXCEEDED
                 )
@@ -404,9 +437,30 @@ class MediaRepository:
             send_cors=True,
         )
 
+    async def get_cached_remote_media_info(
+        self, origin: str, media_id: str
+    ) -> RemoteMedia | None:
+        """
+        Get cached remote media info for a given origin/media ID combo. If the requested
+        media is not found locally, it will not be requested over federation and the
+        call will return None.
+
+        Args:
+            origin: The origin of the remote media
+            media_id: The media ID of the requested content
+
+        Returns:
+            The info for the cached remote media or None if it was not found
+        """
+        return await self.store.get_cached_remote_media(origin, media_id)
+
     async def get_local_media_info(
-        self, request: SynapseRequest, media_id: str, max_timeout_ms: int
-    ) -> Optional[LocalMedia]:
+        self,
+        request: SynapseRequest,
+        media_id: str,
+        max_timeout_ms: int,
+        bypass_quarantine: bool = False,
+    ) -> LocalMedia | None:
         """Gets the info dictionary for given local media ID. If the media has
         not been uploaded yet, this function will wait up to ``max_timeout_ms``
         milliseconds for the media to be uploaded.
@@ -417,6 +471,7 @@ class MediaRepository:
                 the file_id for local content.)
             max_timeout_ms: the maximum number of milliseconds to wait for the
                 media to be uploaded.
+            bypass_quarantine: whether to bypass quarantine checks
 
         Returns:
             Either the info dictionary for the given local media ID or
@@ -432,7 +487,7 @@ class MediaRepository:
                 respond_404(request)
                 return None
 
-            if media_info.quarantined_by:
+            if media_info.quarantined_by and not bypass_quarantine:
                 logger.info("Media %s is quarantined", media_id)
                 respond_404(request)
                 return None
@@ -452,7 +507,7 @@ class MediaRepository:
             if now >= wait_until:
                 break
 
-            await self.clock.sleep(0.5)
+            await self.clock.sleep(Duration(milliseconds=500))
 
         logger.info("Media %s has not yet been uploaded", media_id)
         self.respond_not_yet_uploaded(request)
@@ -462,10 +517,11 @@ class MediaRepository:
         self,
         request: SynapseRequest,
         media_id: str,
-        name: Optional[str],
+        name: str | None,
         max_timeout_ms: int,
         allow_authenticated: bool = True,
         federation: bool = False,
+        bypass_quarantine: bool = False,
     ) -> None:
         """Responds to requests for local media, if exists, or returns 404.
 
@@ -479,11 +535,14 @@ class MediaRepository:
                 media to be uploaded.
             allow_authenticated: whether media marked as authenticated may be served to this request
             federation: whether the local media being fetched is for a federation request
+            bypass_quarantine: whether to bypass quarantine checks
 
         Returns:
             Resolves once a response has successfully been written to request
         """
-        media_info = await self.get_local_media_info(request, media_id, max_timeout_ms)
+        media_info = await self.get_local_media_info(
+            request, media_id, max_timeout_ms, bypass_quarantine=bypass_quarantine
+        )
         if not media_info:
             return
 
@@ -522,11 +581,12 @@ class MediaRepository:
         request: SynapseRequest,
         server_name: str,
         media_id: str,
-        name: Optional[str],
+        name: str | None,
         max_timeout_ms: int,
         ip_address: str,
         use_federation_endpoint: bool,
         allow_authenticated: bool = True,
+        bypass_quarantine: bool = False,
     ) -> None:
         """Respond to requests for remote media.
 
@@ -543,6 +603,7 @@ class MediaRepository:
                 federation `/download` endpoint
             allow_authenticated: whether media marked as authenticated may be served to this
                 request
+            bypass_quarantine: whether to bypass quarantine checks
 
         Returns:
             Resolves once a response has successfully been written to request
@@ -575,6 +636,7 @@ class MediaRepository:
                 ip_address,
                 use_federation_endpoint,
                 allow_authenticated,
+                bypass_quarantine=bypass_quarantine,
             )
 
         # Check if the media is cached on the client, if so return 304. We need
@@ -663,7 +725,8 @@ class MediaRepository:
         ip_address: str,
         use_federation_endpoint: bool,
         allow_authenticated: bool,
-    ) -> Tuple[Optional[Responder], RemoteMedia]:
+        bypass_quarantine: bool = False,
+    ) -> tuple[Responder | None, RemoteMedia]:
         """Looks for media in local cache, if not there then attempt to
         download from remote server.
 
@@ -678,6 +741,7 @@ class MediaRepository:
             ip_address: the IP address of the requester
             use_federation_endpoint: whether to request the remote media over the new federation
             /download endpoint
+            bypass_quarantine: whether to bypass quarantine checks
 
         Returns:
             A tuple of responder and the media info of the file.
@@ -698,7 +762,7 @@ class MediaRepository:
             file_id = media_info.filesystem_id
             file_info = FileInfo(server_name, file_id)
 
-            if media_info.quarantined_by:
+            if media_info.quarantined_by and not bypass_quarantine:
                 logger.info("Media is quarantined")
                 raise NotFoundError()
 
@@ -734,10 +798,18 @@ class MediaRepository:
         except SynapseError:
             raise
         except Exception as e:
-            # An exception may be because we downloaded media in another
-            # process, so let's check if we magically have the media.
-            media_info = await self.store.get_cached_remote_media(server_name, media_id)
-            if not media_info:
+            # If this is a constraint violation, it means another worker
+            # downloaded the media first. We should fetch the existing media info.
+            if isinstance(e, self.store.database_engine.module.IntegrityError):
+                # The file has already been cleaned up in _download_remote_file
+                # Just fetch the existing media info
+                media_info = await self.store.get_cached_remote_media(
+                    server_name, media_id
+                )
+                if not media_info:
+                    # This shouldn't happen, but let's raise an error if it does
+                    raise SynapseError(500, "Failed to fetch remote media")
+            else:
                 raise e
 
         file_id = media_info.filesystem_id
@@ -758,6 +830,39 @@ class MediaRepository:
         responder = await self.media_storage.fetch_media(file_info)
         return responder, media_info
 
+    async def _store_remote_media_with_cleanup(
+        self,
+        server_name: str,
+        media_id: str,
+        media_type: str,
+        time_now_ms: int,
+        upload_name: str | None,
+        media_length: int,
+        filesystem_id: str,
+        sha256: str,
+        fname: str,
+    ) -> None:
+        """Store remote media in database and clean up file on constraint violation."""
+        try:
+            await self.store.store_cached_remote_media(
+                origin=server_name,
+                media_id=media_id,
+                media_type=media_type,
+                time_now_ms=time_now_ms,
+                upload_name=upload_name,
+                media_length=media_length,
+                filesystem_id=filesystem_id,
+                sha256=sha256,
+            )
+        except self.store.database_engine.module.IntegrityError:
+            # Another worker downloaded the media first. Clean up our file.
+            try:
+                os.remove(fname)
+            except Exception:
+                pass
+            # Re-raise so the caller can handle it
+            raise
+
     async def _download_remote_file(
         self,
         server_name: str,
@@ -842,26 +947,21 @@ class MediaRepository:
             upload_name = get_filename_from_headers(headers)
             time_now_ms = self.clock.time_msec()
 
-            # Multiple remote media download requests can race (when using
-            # multiple media repos), so this may throw a violation constraint
-            # exception. If it does we'll delete the newly downloaded file from
-            # disk (as we're in the ctx manager).
-            #
-            # However: we've already called `finish()` so we may have also
-            # written to the storage providers. This is preferable to the
-            # alternative where we call `finish()` *after* this, where we could
-            # end up having an entry in the DB but fail to write the files to
-            # the storage providers.
-            await self.store.store_cached_remote_media(
-                origin=server_name,
-                media_id=media_id,
-                media_type=media_type,
-                time_now_ms=time_now_ms,
-                upload_name=upload_name,
-                media_length=length,
-                filesystem_id=file_id,
-                sha256=sha256writer.hexdigest(),
-            )
+        # Multiple remote media download requests can race (when using
+        # multiple media repos), so this may throw a violation constraint
+        # exception. If it does we'll delete the newly downloaded file from
+        # disk.
+        await self._store_remote_media_with_cleanup(
+            server_name=server_name,
+            media_id=media_id,
+            media_type=media_type,
+            time_now_ms=time_now_ms,
+            upload_name=upload_name,
+            media_length=length,
+            filesystem_id=file_id,
+            sha256=sha256writer.hexdigest(),
+            fname=fname,
+        )
 
         logger.info("Stored remote media in file %r", fname)
 
@@ -975,26 +1075,21 @@ class MediaRepository:
             upload_name = get_filename_from_headers(headers)
             time_now_ms = self.clock.time_msec()
 
-            # Multiple remote media download requests can race (when using
-            # multiple media repos), so this may throw a violation constraint
-            # exception. If it does we'll delete the newly downloaded file from
-            # disk (as we're in the ctx manager).
-            #
-            # However: we've already called `finish()` so we may have also
-            # written to the storage providers. This is preferable to the
-            # alternative where we call `finish()` *after* this, where we could
-            # end up having an entry in the DB but fail to write the files to
-            # the storage providers.
-            await self.store.store_cached_remote_media(
-                origin=server_name,
-                media_id=media_id,
-                media_type=media_type,
-                time_now_ms=time_now_ms,
-                upload_name=upload_name,
-                media_length=length,
-                filesystem_id=file_id,
-                sha256=sha256writer.hexdigest(),
-            )
+        # Multiple remote media download requests can race (when using
+        # multiple media repos), so this may throw a violation constraint
+        # exception. If it does we'll delete the newly downloaded file from
+        # disk.
+        await self._store_remote_media_with_cleanup(
+            server_name=server_name,
+            media_id=media_id,
+            media_type=media_type,
+            time_now_ms=time_now_ms,
+            upload_name=upload_name,
+            media_length=length,
+            filesystem_id=file_id,
+            sha256=sha256writer.hexdigest(),
+            fname=fname,
+        )
 
         logger.debug("Stored remote media in file %r", fname)
 
@@ -1019,7 +1114,7 @@ class MediaRepository:
 
     def _get_thumbnail_requirements(
         self, media_type: str
-    ) -> Tuple[ThumbnailRequirement, ...]:
+    ) -> tuple[ThumbnailRequirement, ...]:
         scpos = media_type.find(";")
         if scpos > 0:
             media_type = media_type[:scpos]
@@ -1032,7 +1127,7 @@ class MediaRepository:
         t_height: int,
         t_method: str,
         t_type: str,
-    ) -> Optional[BytesIO]:
+    ) -> BytesIO | None:
         m_width = thumbnailer.width
         m_height = thumbnailer.height
 
@@ -1066,33 +1161,32 @@ class MediaRepository:
         t_method: str,
         t_type: str,
         url_cache: bool,
-    ) -> Optional[Tuple[str, FileInfo]]:
-        input_path = await self.media_storage.ensure_media_is_in_local_cache(
+    ) -> tuple[str, FileInfo] | None:
+        async with self.media_storage.ensure_media_is_in_local_cache(
             FileInfo(None, media_id, url_cache=url_cache)
-        )
+        ) as input_path:
+            try:
+                thumbnailer = Thumbnailer(input_path)
+            except ThumbnailError as e:
+                logger.warning(
+                    "Unable to generate a thumbnail for local media %s using a method of %s and type of %s: %s",
+                    media_id,
+                    t_method,
+                    t_type,
+                    e,
+                )
+                return None
 
-        try:
-            thumbnailer = Thumbnailer(input_path)
-        except ThumbnailError as e:
-            logger.warning(
-                "Unable to generate a thumbnail for local media %s using a method of %s and type of %s: %s",
-                media_id,
-                t_method,
-                t_type,
-                e,
-            )
-            return None
-
-        with thumbnailer:
-            t_byte_source = await defer_to_thread(
-                self.hs.get_reactor(),
-                self._generate_thumbnail,
-                thumbnailer,
-                t_width,
-                t_height,
-                t_method,
-                t_type,
-            )
+            with thumbnailer:
+                t_byte_source = await defer_to_thread(
+                    self.hs.get_reactor(),
+                    self._generate_thumbnail,
+                    thumbnailer,
+                    t_width,
+                    t_height,
+                    t_method,
+                    t_type,
+                )
 
         if t_byte_source:
             try:
@@ -1142,34 +1236,33 @@ class MediaRepository:
         t_height: int,
         t_method: str,
         t_type: str,
-    ) -> Optional[str]:
-        input_path = await self.media_storage.ensure_media_is_in_local_cache(
+    ) -> str | None:
+        async with self.media_storage.ensure_media_is_in_local_cache(
             FileInfo(server_name, file_id)
-        )
+        ) as input_path:
+            try:
+                thumbnailer = Thumbnailer(input_path)
+            except ThumbnailError as e:
+                logger.warning(
+                    "Unable to generate a thumbnail for remote media %s from %s using a method of %s and type of %s: %s",
+                    media_id,
+                    server_name,
+                    t_method,
+                    t_type,
+                    e,
+                )
+                return None
 
-        try:
-            thumbnailer = Thumbnailer(input_path)
-        except ThumbnailError as e:
-            logger.warning(
-                "Unable to generate a thumbnail for remote media %s from %s using a method of %s and type of %s: %s",
-                media_id,
-                server_name,
-                t_method,
-                t_type,
-                e,
-            )
-            return None
-
-        with thumbnailer:
-            t_byte_source = await defer_to_thread(
-                self.hs.get_reactor(),
-                self._generate_thumbnail,
-                thumbnailer,
-                t_width,
-                t_height,
-                t_method,
-                t_type,
-            )
+            with thumbnailer:
+                t_byte_source = await defer_to_thread(
+                    self.hs.get_reactor(),
+                    self._generate_thumbnail,
+                    thumbnailer,
+                    t_width,
+                    t_height,
+                    t_method,
+                    t_type,
+                )
 
         if t_byte_source:
             try:
@@ -1214,12 +1307,12 @@ class MediaRepository:
     @trace
     async def _generate_thumbnails(
         self,
-        server_name: Optional[str],
+        server_name: str | None,
         media_id: str,
         file_id: str,
         media_type: str,
         url_cache: bool = False,
-    ) -> Optional[dict]:
+    ) -> dict | None:
         """Generate and store thumbnails for an image.
 
         Args:
@@ -1239,151 +1332,157 @@ class MediaRepository:
         if not requirements:
             return None
 
-        input_path = await self.media_storage.ensure_media_is_in_local_cache(
+        async with self.media_storage.ensure_media_is_in_local_cache(
             FileInfo(server_name, file_id, url_cache=url_cache)
-        )
-
-        try:
-            thumbnailer = Thumbnailer(input_path)
-        except ThumbnailError as e:
-            logger.warning(
-                "Unable to generate thumbnails for remote media %s from %s of type %s: %s",
-                media_id,
-                server_name,
-                media_type,
-                e,
-            )
-            return None
-
-        with thumbnailer:
-            m_width = thumbnailer.width
-            m_height = thumbnailer.height
-
-            if m_width * m_height >= self.max_image_pixels:
-                logger.info(
-                    "Image too large to thumbnail %r x %r > %r",
-                    m_width,
-                    m_height,
-                    self.max_image_pixels,
+        ) as input_path:
+            try:
+                thumbnailer = Thumbnailer(input_path)
+            except ThumbnailError as e:
+                logger.warning(
+                    "Unable to generate thumbnails for remote media %s from %s of type %s: %s",
+                    media_id,
+                    server_name,
+                    media_type,
+                    e,
                 )
                 return None
 
-            if thumbnailer.transpose_method is not None:
-                m_width, m_height = await defer_to_thread(
-                    self.hs.get_reactor(), thumbnailer.transpose
-                )
+            with thumbnailer:
+                m_width = thumbnailer.width
+                m_height = thumbnailer.height
 
-            # We deduplicate the thumbnail sizes by ignoring the cropped versions if
-            # they have the same dimensions of a scaled one.
-            thumbnails: Dict[Tuple[int, int, str], str] = {}
-            for requirement in requirements:
-                if requirement.method == "crop":
-                    thumbnails.setdefault(
-                        (requirement.width, requirement.height, requirement.media_type),
-                        requirement.method,
+                if m_width * m_height >= self.max_image_pixels:
+                    logger.info(
+                        "Image too large to thumbnail %r x %r > %r",
+                        m_width,
+                        m_height,
+                        self.max_image_pixels,
                     )
-                elif requirement.method == "scale":
-                    t_width, t_height = thumbnailer.aspect(
-                        requirement.width, requirement.height
-                    )
-                    t_width = min(m_width, t_width)
-                    t_height = min(m_height, t_height)
-                    thumbnails[(t_width, t_height, requirement.media_type)] = (
-                        requirement.method
+                    return None
+
+                if thumbnailer.transpose_method is not None:
+                    m_width, m_height = await defer_to_thread(
+                        self.hs.get_reactor(), thumbnailer.transpose
                     )
 
-            # Now we generate the thumbnails for each dimension, store it
-            for (t_width, t_height, t_type), t_method in thumbnails.items():
-                # Generate the thumbnail
-                if t_method == "crop":
-                    t_byte_source = await defer_to_thread(
-                        self.hs.get_reactor(),
-                        thumbnailer.crop,
-                        t_width,
-                        t_height,
-                        t_type,
+                # We deduplicate the thumbnail sizes by ignoring the cropped versions if
+                # they have the same dimensions of a scaled one.
+                thumbnails: dict[tuple[int, int, str], str] = {}
+                for requirement in requirements:
+                    if requirement.method == "crop":
+                        thumbnails.setdefault(
+                            (
+                                requirement.width,
+                                requirement.height,
+                                requirement.media_type,
+                            ),
+                            requirement.method,
+                        )
+                    elif requirement.method == "scale":
+                        t_width, t_height = thumbnailer.aspect(
+                            requirement.width, requirement.height
+                        )
+                        t_width = min(m_width, t_width)
+                        t_height = min(m_height, t_height)
+                        thumbnails[(t_width, t_height, requirement.media_type)] = (
+                            requirement.method
+                        )
+
+                # Now we generate the thumbnails for each dimension, store it
+                for (t_width, t_height, t_type), t_method in thumbnails.items():
+                    # Generate the thumbnail
+                    if t_method == "crop":
+                        t_byte_source = await defer_to_thread(
+                            self.hs.get_reactor(),
+                            thumbnailer.crop,
+                            t_width,
+                            t_height,
+                            t_type,
+                        )
+                    elif t_method == "scale":
+                        t_byte_source = await defer_to_thread(
+                            self.hs.get_reactor(),
+                            thumbnailer.scale,
+                            t_width,
+                            t_height,
+                            t_type,
+                        )
+                    else:
+                        logger.error("Unrecognized method: %r", t_method)
+                        continue
+
+                    if not t_byte_source:
+                        continue
+
+                    file_info = FileInfo(
+                        server_name=server_name,
+                        file_id=file_id,
+                        url_cache=url_cache,
+                        thumbnail=ThumbnailInfo(
+                            width=t_width,
+                            height=t_height,
+                            method=t_method,
+                            type=t_type,
+                            length=t_byte_source.tell(),
+                        ),
                     )
-                elif t_method == "scale":
-                    t_byte_source = await defer_to_thread(
-                        self.hs.get_reactor(),
-                        thumbnailer.scale,
-                        t_width,
-                        t_height,
-                        t_type,
-                    )
-                else:
-                    logger.error("Unrecognized method: %r", t_method)
-                    continue
 
-                if not t_byte_source:
-                    continue
-
-                file_info = FileInfo(
-                    server_name=server_name,
-                    file_id=file_id,
-                    url_cache=url_cache,
-                    thumbnail=ThumbnailInfo(
-                        width=t_width,
-                        height=t_height,
-                        method=t_method,
-                        type=t_type,
-                        length=t_byte_source.tell(),
-                    ),
-                )
-
-                async with self.media_storage.store_into_file(file_info) as (f, fname):
-                    try:
-                        await self.media_storage.write_to_file(t_byte_source, f)
-                    finally:
-                        t_byte_source.close()
-
-                    # We flush and close the file to ensure that the bytes have
-                    # been written before getting the size.
-                    f.flush()
-                    f.close()
-
-                    t_len = os.path.getsize(fname)
-
-                    # Write to database
-                    if server_name:
-                        # Multiple remote media download requests can race (when
-                        # using multiple media repos), so this may throw a violation
-                        # constraint exception. If it does we'll delete the newly
-                        # generated thumbnail from disk (as we're in the ctx
-                        # manager).
-                        #
-                        # However: we've already called `finish()` so we may have
-                        # also written to the storage providers. This is preferable
-                        # to the alternative where we call `finish()` *after* this,
-                        # where we could end up having an entry in the DB but fail
-                        # to write the files to the storage providers.
+                    async with self.media_storage.store_into_file(file_info) as (
+                        f,
+                        fname,
+                    ):
                         try:
-                            await self.store.store_remote_media_thumbnail(
-                                server_name,
-                                media_id,
-                                file_id,
-                                t_width,
-                                t_height,
-                                t_type,
-                                t_method,
-                                t_len,
-                            )
-                        except Exception as e:
-                            thumbnail_exists = (
-                                await self.store.get_remote_media_thumbnail(
+                            await self.media_storage.write_to_file(t_byte_source, f)
+                        finally:
+                            t_byte_source.close()
+
+                        # We flush and close the file to ensure that the bytes have
+                        # been written before getting the size.
+                        f.flush()
+                        f.close()
+
+                        t_len = os.path.getsize(fname)
+
+                        # Write to database
+                        if server_name:
+                            # Multiple remote media download requests can race (when
+                            # using multiple media repos), so this may throw a violation
+                            # constraint exception. If it does we'll delete the newly
+                            # generated thumbnail from disk (as we're in the ctx
+                            # manager).
+                            #
+                            # However: we've already called `finish()` so we may have
+                            # also written to the storage providers. This is preferable
+                            # to the alternative where we call `finish()` *after* this,
+                            # where we could end up having an entry in the DB but fail
+                            # to write the files to the storage providers.
+                            try:
+                                await self.store.store_remote_media_thumbnail(
                                     server_name,
                                     media_id,
+                                    file_id,
                                     t_width,
                                     t_height,
                                     t_type,
+                                    t_method,
+                                    t_len,
                                 )
+                            except Exception as e:
+                                thumbnail_exists = (
+                                    await self.store.get_remote_media_thumbnail(
+                                        server_name,
+                                        media_id,
+                                        t_width,
+                                        t_height,
+                                        t_type,
+                                    )
+                                )
+                                if not thumbnail_exists:
+                                    raise e
+                        else:
+                            await self.store.store_local_thumbnail(
+                                media_id, t_width, t_height, t_type, t_method, t_len
                             )
-                            if not thumbnail_exists:
-                                raise e
-                    else:
-                        await self.store.store_local_thumbnail(
-                            media_id, t_width, t_height, t_type, t_method, t_len
-                        )
 
         return {"width": m_width, "height": m_height}
 
@@ -1428,7 +1527,7 @@ class MediaRepository:
                 delete_protected_media=False,
             )
 
-    async def delete_old_remote_media(self, before_ts: int) -> Dict[str, int]:
+    async def delete_old_remote_media(self, before_ts: int) -> dict[str, int]:
         old_media = await self.store.get_remote_media_ids(
             before_ts, include_quarantined_media=False
         )
@@ -1464,8 +1563,8 @@ class MediaRepository:
         return {"deleted": deleted}
 
     async def delete_local_media_ids(
-        self, media_ids: List[str]
-    ) -> Tuple[List[str], int]:
+        self, media_ids: list[str]
+    ) -> tuple[list[str], int]:
         """
         Delete the given local or remote media ID from this server
 
@@ -1483,7 +1582,7 @@ class MediaRepository:
         keep_profiles: bool = True,
         delete_quarantined_media: bool = False,
         delete_protected_media: bool = False,
-    ) -> Tuple[List[str], int]:
+    ) -> tuple[list[str], int]:
         """
         Delete local or remote media from this server by size and timestamp. Removes
         media files, any thumbnails and cached URLs.
@@ -1510,8 +1609,8 @@ class MediaRepository:
         return await self._remove_local_media_from_disk(old_media)
 
     async def _remove_local_media_from_disk(
-        self, media_ids: List[str]
-    ) -> Tuple[List[str], int]:
+        self, media_ids: list[str]
+    ) -> tuple[list[str], int]:
         """
         Delete local or remote media from this server. Removes media files,
         any thumbnails and cached URLs.
diff --git a/synapse/media/media_storage.py b/synapse/media/media_storage.py
index afd33c02a1..4c942f07f8 100644
--- a/synapse/media/media_storage.py
+++ b/synapse/media/media_storage.py
@@ -24,6 +24,7 @@ import json
 import logging
 import os
 import shutil
+import tempfile
 from contextlib import closing
 from io import BytesIO
 from types import TracebackType
@@ -34,12 +35,7 @@ from typing import (
     AsyncIterator,
     BinaryIO,
     Callable,
-    List,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
-    Union,
     cast,
 )
 from uuid import uuid4
@@ -54,12 +50,13 @@ from twisted.internet.interfaces import IConsumer
 from synapse.api.errors import NotFoundError
 from synapse.logging.context import defer_to_thread, run_in_background
 from synapse.logging.opentracing import start_active_span, trace, trace_with_opname
-from synapse.media._base import ThreadedFileSender
-from synapse.util import Clock
+from synapse.media.storage_provider import FileStorageProviderBackend
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.file_consumer import BackgroundFileConsumer
 
 from ..types import JsonDict
-from ._base import FileInfo, Responder
+from ._base import FileInfo, Responder, ThreadedFileSender
 from .filepath import MediaFilePaths
 
 if TYPE_CHECKING:
@@ -82,7 +79,7 @@ class SHA256TransparentIOWriter:
         self._hash = hashlib.sha256()
         self._source = source
 
-    def write(self, buffer: Union[bytes, bytearray]) -> int:
+    def write(self, buffer: bytes | bytearray) -> int:
         """Wrapper for source.write()
 
         Args:
@@ -154,27 +151,30 @@ class SHA256TransparentIOReader:
 
 
 class MediaStorage:
-    """Responsible for storing/fetching files from local sources.
+    """Responsible for storing/fetching files from storage providers.
 
     Args:
         hs
-        local_media_directory: Base path where we store media on disk
         filepaths
         storage_providers: List of StorageProvider that are used to fetch and store files.
+        local_provider: Optional local file storage provider for caching media on disk.
     """
 
     def __init__(
         self,
         hs: "HomeServer",
-        local_media_directory: str,
         filepaths: MediaFilePaths,
         storage_providers: Sequence["StorageProvider"],
+        local_provider: "FileStorageProviderBackend | None" = None,
     ):
         self.hs = hs
         self.reactor = hs.get_reactor()
-        self.local_media_directory = local_media_directory
         self.filepaths = filepaths
         self.storage_providers = storage_providers
+        self.local_provider = local_provider
+        self.local_media_directory: str | None = None
+        if local_provider is not None:
+            self.local_media_directory = local_provider.base_directory
         self._spam_checker_module_callbacks = hs.get_module_api_callbacks().spam_checker
         self.clock = hs.get_clock()
 
@@ -205,15 +205,15 @@ class MediaStorage:
     @contextlib.asynccontextmanager
     async def store_into_file(
         self, file_info: FileInfo
-    ) -> AsyncIterator[Tuple[BinaryIO, str]]:
+    ) -> AsyncIterator[tuple[BinaryIO, str]]:
         """Async Context manager used to get a file like object to write into, as
         described by file_info.
 
-        Actually yields a 2-tuple (file, fname,), where file is a file
-        like object that can be written to and fname is the absolute path of file
-        on disk.
+        Actually yields a 2-tuple (file, media_filepath,), where file is a file
+        like object that can be written to and media_filepath is the absolute path
+        of the file on disk.
 
-        fname can be used to read the contents from after upload, e.g. to
+        media_filepath can be used to read the contents from after upload, e.g. to
         generate thumbnails.
 
         Args:
@@ -221,25 +221,33 @@ class MediaStorage:
 
         Example:
 
-            async with media_storage.store_into_file(info) as (f, fname,):
+            async with media_storage.store_into_file(info) as (f, media_filepath,):
                 # .. write into f ...
         """
 
         path = self._file_info_to_path(file_info)
-        fname = os.path.join(self.local_media_directory, path)
+        is_temp_file = False
 
-        dirname = os.path.dirname(fname)
-        os.makedirs(dirname, exist_ok=True)
+        if self.local_provider:
+            media_filepath = os.path.join(self.local_media_directory, path)  # type: ignore[arg-type]
+            os.makedirs(os.path.dirname(media_filepath), exist_ok=True)
 
-        try:
             with start_active_span("writing to main media repo"):
-                with open(fname, "wb") as f:
-                    yield f, fname
+                with open(media_filepath, "wb") as f:
+                    yield f, media_filepath
+        else:
+            # No local provider, write to temp file
+            is_temp_file = True
+            with tempfile.NamedTemporaryFile(delete=False) as f:
+                media_filepath = f.name
+                yield cast(BinaryIO, f), media_filepath
 
-            with start_active_span("writing to other storage providers"):
+        # Spam check and store to other providers (runs for both local and temp file cases)
+        try:
+            with start_active_span("spam checking and writing to storage providers"):
                 spam_check = (
                     await self._spam_checker_module_callbacks.check_media_file_for_spam(
-                        ReadableFileWrapper(self.clock, fname), file_info
+                        ReadableFileWrapper(self.clock, media_filepath), file_info
                     )
                 )
                 if spam_check != self._spam_checker_module_callbacks.NOT_SPAM:
@@ -255,17 +263,23 @@ class MediaStorage:
                     with start_active_span(str(provider)):
                         await provider.store_file(path, file_info)
 
+                # If using a temp file, delete it after uploading to storage providers
+                if is_temp_file:
+                    try:
+                        os.remove(media_filepath)
+                    except Exception:
+                        pass
+
         except Exception as e:
             try:
-                os.remove(fname)
+                os.remove(media_filepath)
             except Exception:
                 pass
 
             raise e from None
 
-    async def fetch_media(self, file_info: FileInfo) -> Optional[Responder]:
-        """Attempts to fetch media described by file_info from the local cache
-        and configured storage providers.
+    async def fetch_media(self, file_info: FileInfo) -> Responder | None:
+        """Attempts to fetch media described by file_info from the configured storage providers.
 
         Args:
             file_info: Metadata about the media file
@@ -273,6 +287,18 @@ class MediaStorage:
         Returns:
             Returns a Responder if the file was found, otherwise None.
         """
+        # URL cache files are stored locally and should not go through storage providers
+        if file_info.url_cache:
+            path = self._file_info_to_path(file_info)
+            if self.local_provider:
+                local_path = os.path.join(self.local_media_directory, path)  # type: ignore[arg-type]
+                if os.path.isfile(local_path):
+                    # Import here to avoid circular import
+                    from .media_storage import FileResponder
+
+                    return FileResponder(self.hs, open(local_path, "rb"))
+            return None
+
         paths = [self._file_info_to_path(file_info)]
 
         # fallback for remote thumbnails with no method in the filename
@@ -287,16 +313,18 @@ class MediaStorage:
                 )
             )
 
-        for path in paths:
-            local_path = os.path.join(self.local_media_directory, path)
-            if os.path.exists(local_path):
-                logger.debug("responding with local file %s", local_path)
-                return FileResponder(self.hs, open(local_path, "rb"))
-            logger.debug("local file %s did not exist", local_path)
+        # Check local provider first, then other storage providers
+        if self.local_provider:
+            for path in paths:
+                res: Any = await self.local_provider.fetch(path, file_info)
+                if res:
+                    logger.debug("Streaming %s from %s", path, self.local_provider)
+                    return res
+                logger.debug("%s not found on %s", path, self.local_provider)
 
         for provider in self.storage_providers:
             for path in paths:
-                res: Any = await provider.fetch(path, file_info)
+                res = await provider.fetch(path, file_info)
                 if res:
                     logger.debug("Streaming %s from %s", path, provider)
                     return res
@@ -305,50 +333,93 @@ class MediaStorage:
         return None
 
     @trace
-    async def ensure_media_is_in_local_cache(self, file_info: FileInfo) -> str:
-        """Ensures that the given file is in the local cache. Attempts to
-        download it from storage providers if it isn't.
+    @contextlib.asynccontextmanager
+    async def ensure_media_is_in_local_cache(
+        self, file_info: FileInfo
+    ) -> AsyncIterator[str]:
+        """Async context manager that ensures the given file is in the local cache.
+        Attempts to download it from storage providers if it isn't.
+
+        When no local provider is configured, the file is downloaded to a temporary
+        location and automatically cleaned up when the context manager exits.
 
         Args:
             file_info
 
-        Returns:
+        Yields:
             Full path to local file
+
+        Example:
+            async with media_storage.ensure_media_is_in_local_cache(file_info) as path:
+                # use path to read the file
         """
         path = self._file_info_to_path(file_info)
-        local_path = os.path.join(self.local_media_directory, path)
-        if os.path.exists(local_path):
-            return local_path
+        if self.local_provider:
+            local_path = os.path.join(self.local_media_directory, path)  # type: ignore[arg-type]
+            if os.path.exists(local_path):
+                yield local_path
+                return
 
-        # Fallback for paths without method names
-        # Should be removed in the future
-        if file_info.thumbnail and file_info.server_name:
-            legacy_path = self.filepaths.remote_media_thumbnail_rel_legacy(
-                server_name=file_info.server_name,
-                file_id=file_info.file_id,
-                width=file_info.thumbnail.width,
-                height=file_info.thumbnail.height,
-                content_type=file_info.thumbnail.type,
-            )
-            legacy_local_path = os.path.join(self.local_media_directory, legacy_path)
-            if os.path.exists(legacy_local_path):
-                return legacy_local_path
+            # Fallback for paths without method names
+            # Should be removed in the future
+            if file_info.thumbnail and file_info.server_name:
+                legacy_path = self.filepaths.remote_media_thumbnail_rel_legacy(
+                    server_name=file_info.server_name,
+                    file_id=file_info.file_id,
+                    width=file_info.thumbnail.width,
+                    height=file_info.thumbnail.height,
+                    content_type=file_info.thumbnail.type,
+                )
+                legacy_local_path = os.path.join(
+                    self.local_media_directory,  # type: ignore[arg-type]
+                    legacy_path,
+                )
+                if os.path.exists(legacy_local_path):
+                    yield legacy_local_path
+                    return
 
-        dirname = os.path.dirname(local_path)
-        os.makedirs(dirname, exist_ok=True)
+            os.makedirs(os.path.dirname(local_path), exist_ok=True)
 
-        for provider in self.storage_providers:
-            res: Any = await provider.fetch(path, file_info)
-            if res:
-                with res:
-                    consumer = BackgroundFileConsumer(
-                        open(local_path, "wb"), self.reactor
-                    )
-                    await res.write_to_consumer(consumer)
-                    await consumer.wait()
-                return local_path
+            for provider in self.storage_providers:
+                remote_res: Any = await provider.fetch(path, file_info)
+                if remote_res:
+                    with remote_res:
+                        consumer = BackgroundFileConsumer(
+                            open(local_path, "wb"), self.reactor
+                        )
+                        await remote_res.write_to_consumer(consumer)
+                        await consumer.wait()
+                    yield local_path
+                    return
 
-        raise NotFoundError()
+            raise NotFoundError()
+        else:
+            # No local provider, download to temp file and clean up after use
+            for provider in self.storage_providers:
+                res: Any = await provider.fetch(path, file_info)
+                if res:
+                    temp_path = None
+                    try:
+                        with tempfile.NamedTemporaryFile(
+                            delete=False, suffix=os.path.splitext(path)[1]
+                        ) as tmp:
+                            temp_path = tmp.name
+                        with res:
+                            consumer = BackgroundFileConsumer(
+                                open(temp_path, "wb"), self.reactor
+                            )
+                            await res.write_to_consumer(consumer)
+                            await consumer.wait()
+                        yield temp_path
+                    finally:
+                        if temp_path:
+                            try:
+                                os.remove(temp_path)
+                            except Exception:
+                                pass
+                    return
+
+            raise NotFoundError()
 
     @trace
     def _file_info_to_path(self, file_info: FileInfo) -> str:
@@ -423,9 +494,9 @@ class FileResponder(Responder):
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_val: Optional[BaseException],
-        exc_tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
     ) -> None:
         self.open_file.close()
 
@@ -462,7 +533,7 @@ class ReadableFileWrapper:
                 callback(chunk)
 
                 # We yield to the reactor by sleeping for 0 seconds.
-                await self.clock.sleep(0)
+                await self.clock.sleep(Duration(seconds=0))
 
 
 @implementer(interfaces.IConsumer)
@@ -479,7 +550,7 @@ class MultipartFileConsumer:
         file_content_type: str,
         json_object: JsonDict,
         disposition: str,
-        content_length: Optional[int],
+        content_length: int | None,
     ) -> None:
         self.clock = clock
         self.wrapped_consumer = wrapped_consumer
@@ -491,8 +562,8 @@ class MultipartFileConsumer:
 
         # The producer that registered with us, and if it's a push or pull
         # producer.
-        self.producer: Optional["interfaces.IProducer"] = None
-        self.streaming: Optional[bool] = None
+        self.producer: "interfaces.IProducer" | None = None
+        self.streaming: bool | None = None
 
         # Whether the wrapped consumer has asked us to pause.
         self.paused = False
@@ -621,7 +692,7 @@ class MultipartFileConsumer:
             # repeatedly calling  `resumeProducing` in a loop.
             run_in_background(self._resumeProducingRepeatedly)
 
-    def content_length(self) -> Optional[int]:
+    def content_length(self) -> int | None:
         """
         Calculate the content length of the multipart response
         in bytes.
@@ -657,7 +728,7 @@ class MultipartFileConsumer:
         self.paused = False
         while not self.paused:
             producer.resumeProducing()
-            await self.clock.sleep(0)
+            await self.clock.sleep(Duration(seconds=0))
 
 
 class Header:
@@ -674,7 +745,7 @@ class Header:
         self,
         name: bytes,
         value: Any,
-        params: Optional[List[Tuple[Any, Any]]] = None,
+        params: list[tuple[Any, Any]] | None = None,
     ):
         self.name = name
         self.value = value
@@ -696,7 +767,7 @@ class Header:
             return h.read()
 
 
-def escape(value: Union[str, bytes]) -> str:
+def escape(value: str | bytes) -> str:
     """
     This function prevents header values from corrupting the request,
     a newline in the file name parameter makes form-data request unreadable
diff --git a/synapse/media/oembed.py b/synapse/media/oembed.py
index 16d613d271..7e44072130 100644
--- a/synapse/media/oembed.py
+++ b/synapse/media/oembed.py
@@ -21,13 +21,13 @@
 import html
 import logging
 import urllib.parse
-from typing import TYPE_CHECKING, List, Optional, cast
+from typing import TYPE_CHECKING, cast
 
 import attr
 
 from synapse.media.preview_html import parse_html_description
 from synapse.types import JsonDict
-from synapse.util import json_decoder
+from synapse.util.json import json_decoder
 
 if TYPE_CHECKING:
     from lxml import etree
@@ -42,12 +42,12 @@ class OEmbedResult:
     # The Open Graph result (converted from the oEmbed result).
     open_graph_result: JsonDict
     # The author_name of the oEmbed result
-    author_name: Optional[str]
+    author_name: str | None
     # Number of milliseconds to cache the content, according to the oEmbed response.
     #
     # This will be None if no cache-age is provided in the oEmbed response (or
     # if the oEmbed response cannot be turned into an Open Graph response).
-    cache_age: Optional[int]
+    cache_age: int | None
 
 
 class OEmbedProvider:
@@ -80,7 +80,7 @@ class OEmbedProvider:
             for pattern in oembed_endpoint.url_patterns:
                 self._oembed_patterns[pattern] = api_endpoint
 
-    def get_oembed_url(self, url: str) -> Optional[str]:
+    def get_oembed_url(self, url: str) -> str | None:
         """
         Check whether the URL should be downloaded as oEmbed content instead.
 
@@ -105,7 +105,7 @@ class OEmbedProvider:
         # No match.
         return None
 
-    def autodiscover_from_html(self, tree: "etree._Element") -> Optional[str]:
+    def autodiscover_from_html(self, tree: "etree._Element") -> str | None:
         """
         Search an HTML document for oEmbed autodiscovery information.
 
@@ -118,7 +118,7 @@ class OEmbedProvider:
         # Search for link elements with the proper rel and type attributes.
         # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
         for tag in cast(
-            List["etree._Element"],
+            list["etree._Element"],
             tree.xpath("//link[@rel='alternate'][@type='application/json+oembed']"),
         ):
             if "href" in tag.attrib:
@@ -127,7 +127,7 @@ class OEmbedProvider:
         # Some providers (e.g. Flickr) use alternative instead of alternate.
         # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
         for tag in cast(
-            List["etree._Element"],
+            list["etree._Element"],
             tree.xpath("//link[@rel='alternative'][@type='application/json+oembed']"),
         ):
             if "href" in tag.attrib:
@@ -223,10 +223,10 @@ class OEmbedProvider:
         return OEmbedResult(open_graph_response, author_name, cache_age)
 
 
-def _fetch_urls(tree: "etree._Element", tag_name: str) -> List[str]:
+def _fetch_urls(tree: "etree._Element", tag_name: str) -> list[str]:
     results = []
     # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
-    for tag in cast(List["etree._Element"], tree.xpath("//*/" + tag_name)):
+    for tag in cast(list["etree._Element"], tree.xpath("//*/" + tag_name)):
         if "src" in tag.attrib:
             results.append(cast(str, tag.attrib["src"]))
     return results
diff --git a/synapse/media/preview_html.py b/synapse/media/preview_html.py
index 38ae126a23..22ad581f82 100644
--- a/synapse/media/preview_html.py
+++ b/synapse/media/preview_html.py
@@ -24,13 +24,9 @@ import re
 from typing import (
     TYPE_CHECKING,
     Callable,
-    Dict,
     Generator,
     Iterable,
-    List,
     Optional,
-    Set,
-    Union,
     cast,
 )
 
@@ -51,7 +47,7 @@ _content_type_match = re.compile(r'.*; *charset="?(.*?)"?(;|$)', flags=re.I)
 ARIA_ROLES_TO_IGNORE = {"directory", "menu", "menubar", "toolbar"}
 
 
-def _normalise_encoding(encoding: str) -> Optional[str]:
+def _normalise_encoding(encoding: str) -> str | None:
     """Use the Python codec's name as the normalised entry."""
     try:
         return codecs.lookup(encoding).name
@@ -59,9 +55,7 @@ def _normalise_encoding(encoding: str) -> Optional[str]:
         return None
 
 
-def _get_html_media_encodings(
-    body: bytes, content_type: Optional[str]
-) -> Iterable[str]:
+def _get_html_media_encodings(body: bytes, content_type: str | None) -> Iterable[str]:
     """
     Get potential encoding of the body based on the (presumably) HTML body or the content-type header.
 
@@ -83,7 +77,7 @@ def _get_html_media_encodings(
         The character encoding of the body, as a string.
     """
     # There's no point in returning an encoding more than once.
-    attempted_encodings: Set[str] = set()
+    attempted_encodings: set[str] = set()
 
     # Limit searches to the first 1kb, since it ought to be at the top.
     body_start = body[:1024]
@@ -122,7 +116,7 @@ def _get_html_media_encodings(
 
 
 def decode_body(
-    body: bytes, uri: str, content_type: Optional[str] = None
+    body: bytes, uri: str, content_type: str | None = None
 ) -> Optional["etree._Element"]:
     """
     This uses lxml to parse the HTML document.
@@ -189,8 +183,8 @@ def _get_meta_tags(
     tree: "etree._Element",
     property: str,
     prefix: str,
-    property_mapper: Optional[Callable[[str], Optional[str]]] = None,
-) -> Dict[str, Optional[str]]:
+    property_mapper: Callable[[str], str | None] | None = None,
+) -> dict[str, str | None]:
     """
     Search for meta tags prefixed with a particular string.
 
@@ -205,12 +199,12 @@ def _get_meta_tags(
     Returns:
         A map of tag name to value.
     """
-    # This actually returns Dict[str, str], but the caller sets this as a variable
-    # which is Dict[str, Optional[str]].
-    results: Dict[str, Optional[str]] = {}
+    # This actually returns dict[str, str], but the caller sets this as a variable
+    # which is dict[str, str | None].
+    results: dict[str, str | None] = {}
     # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
     for tag in cast(
-        List["etree._Element"],
+        list["etree._Element"],
         tree.xpath(
             f"//*/meta[starts-with(@{property}, '{prefix}:')][@content][not(@content='')]"
         ),
@@ -236,7 +230,7 @@ def _get_meta_tags(
     return results
 
 
-def _map_twitter_to_open_graph(key: str) -> Optional[str]:
+def _map_twitter_to_open_graph(key: str) -> str | None:
     """
     Map a Twitter card property to the analogous Open Graph property.
 
@@ -256,7 +250,7 @@ def _map_twitter_to_open_graph(key: str) -> Optional[str]:
     return "og" + key[7:]
 
 
-def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]:
+def parse_html_to_open_graph(tree: "etree._Element") -> dict[str, str | None]:
     """
     Parse the HTML document into an Open Graph response.
 
@@ -315,7 +309,7 @@ def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]
         # Attempt to find a title from the title tag, or the biggest header on the page.
         # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
         title = cast(
-            List["etree._ElementUnicodeResult"],
+            list["etree._ElementUnicodeResult"],
             tree.xpath("((//title)[1] | (//h1)[1] | (//h2)[1] | (//h3)[1])/text()"),
         )
         if title:
@@ -326,7 +320,7 @@ def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]
     if "og:image" not in og:
         # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
         meta_image = cast(
-            List["etree._ElementUnicodeResult"],
+            list["etree._ElementUnicodeResult"],
             tree.xpath(
                 "//*/meta[translate(@itemprop, 'IMAGE', 'image')='image'][not(@content='')]/@content[1]"
             ),
@@ -340,7 +334,7 @@ def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]
             #
             # TODO: consider inlined CSS styles as well as width & height attribs
             images = cast(
-                List["etree._Element"],
+                list["etree._Element"],
                 tree.xpath("//img[@src][number(@width)>10][number(@height)>10]"),
             )
             images = sorted(
@@ -352,7 +346,7 @@ def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]
             # If no images were found, try to find *any* images.
             if not images:
                 # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
-                images = cast(List["etree._Element"], tree.xpath("//img[@src][1]"))
+                images = cast(list["etree._Element"], tree.xpath("//img[@src][1]"))
             if images:
                 og["og:image"] = cast(str, images[0].attrib["src"])
 
@@ -360,7 +354,7 @@ def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]
             else:
                 # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
                 favicons = cast(
-                    List["etree._ElementUnicodeResult"],
+                    list["etree._ElementUnicodeResult"],
                     tree.xpath("//link[@href][contains(@rel, 'icon')]/@href[1]"),
                 )
                 if favicons:
@@ -370,7 +364,7 @@ def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]
         # Check the first meta description tag for content.
         # Cast: the type returned by xpath depends on the xpath expression: mypy can't deduce this.
         meta_description = cast(
-            List["etree._ElementUnicodeResult"],
+            list["etree._ElementUnicodeResult"],
             tree.xpath(
                 "//*/meta[translate(@name, 'DESCRIPTION', 'description')='description'][not(@content='')]/@content[1]"
             ),
@@ -390,7 +384,7 @@ def parse_html_to_open_graph(tree: "etree._Element") -> Dict[str, Optional[str]]
     return og
 
 
-def parse_html_description(tree: "etree._Element") -> Optional[str]:
+def parse_html_description(tree: "etree._Element") -> str | None:
     """
     Calculate a text description based on an HTML document.
 
@@ -443,7 +437,7 @@ def parse_html_description(tree: "etree._Element") -> Optional[str]:
 
 def _iterate_over_text(
     tree: Optional["etree._Element"],
-    tags_to_ignore: Set[object],
+    tags_to_ignore: set[object],
     stack_limit: int = 1024,
 ) -> Generator[str, None, None]:
     """Iterate over the tree returning text nodes in a depth first fashion,
@@ -463,7 +457,7 @@ def _iterate_over_text(
 
     # This is a stack whose items are elements to iterate over *or* strings
     # to be returned.
-    elements: List[Union[str, "etree._Element"]] = [tree]
+    elements: list[str | "etree._Element"] = [tree]
     while elements:
         el = elements.pop()
 
@@ -499,7 +493,7 @@ def _iterate_over_text(
 
 def summarize_paragraphs(
     text_nodes: Iterable[str], min_size: int = 200, max_size: int = 500
-) -> Optional[str]:
+) -> str | None:
     """
     Try to get a summary respecting first paragraph and then word boundaries.
 
diff --git a/synapse/media/storage_provider.py b/synapse/media/storage_provider.py
index 300952025a..c5faa25b96 100644
--- a/synapse/media/storage_provider.py
+++ b/synapse/media/storage_provider.py
@@ -23,7 +23,7 @@ import abc
 import logging
 import os
 import shutil
-from typing import TYPE_CHECKING, Callable, Optional
+from typing import TYPE_CHECKING, Callable
 
 from synapse.config._base import Config
 from synapse.logging.context import defer_to_thread, run_in_background
@@ -31,7 +31,6 @@ from synapse.logging.opentracing import start_active_span, trace_with_opname
 from synapse.util.async_helpers import maybe_awaitable
 
 from ._base import FileInfo, Responder
-from .media_storage import FileResponder
 
 logger = logging.getLogger(__name__)
 
@@ -55,7 +54,7 @@ class StorageProvider(metaclass=abc.ABCMeta):
         """
 
     @abc.abstractmethod
-    async def fetch(self, path: str, file_info: FileInfo) -> Optional[Responder]:
+    async def fetch(self, path: str, file_info: FileInfo) -> Responder | None:
         """Attempt to fetch the file described by file_info and stream it
         into writer.
 
@@ -124,7 +123,7 @@ class StorageProviderWrapper(StorageProvider):
             run_in_background(store)
 
     @trace_with_opname("StorageProviderWrapper.fetch")
-    async def fetch(self, path: str, file_info: FileInfo) -> Optional[Responder]:
+    async def fetch(self, path: str, file_info: FileInfo) -> Responder | None:
         if file_info.url_cache:
             # Files in the URL preview cache definitely aren't stored here,
             # so avoid any potentially slow I/O or network access.
@@ -173,11 +172,14 @@ class FileStorageProviderBackend(StorageProvider):
             )
 
     @trace_with_opname("FileStorageProviderBackend.fetch")
-    async def fetch(self, path: str, file_info: FileInfo) -> Optional[Responder]:
+    async def fetch(self, path: str, file_info: FileInfo) -> Responder | None:
         """See StorageProvider.fetch"""
 
         backup_fname = os.path.join(self.base_directory, path)
         if os.path.isfile(backup_fname):
+            # Import here to avoid circular import
+            from .media_storage import FileResponder
+
             return FileResponder(self.hs, open(backup_fname, "rb"))
 
         return None
diff --git a/synapse/media/thumbnailer.py b/synapse/media/thumbnailer.py
index 5d9afda322..cb86a0ff66 100644
--- a/synapse/media/thumbnailer.py
+++ b/synapse/media/thumbnailer.py
@@ -22,7 +22,7 @@
 import logging
 from io import BytesIO
 from types import TracebackType
-from typing import TYPE_CHECKING, List, Optional, Tuple, Type
+from typing import TYPE_CHECKING
 
 from PIL import Image
 
@@ -97,16 +97,7 @@ class Thumbnailer:
         self.transpose_method = None
         try:
             # We don't use ImageOps.exif_transpose since it crashes with big EXIF
-            #
-            # Ignore safety: Pillow seems to acknowledge that this method is
-            # "private, experimental, but generally widely used". Pillow 6
-            # includes a public getexif() method (no underscore) that we might
-            # consider using instead when we can bump that dependency.
-            #
-            # At the time of writing, Debian buster (currently oldstable)
-            # provides version 5.4.1. It's expected to EOL in mid-2022, see
-            # https://wiki.debian.org/DebianReleases#Production_Releases
-            image_exif = self.image._getexif()  # type: ignore
+            image_exif = self.image.getexif()
             if image_exif is not None:
                 image_orientation = image_exif.get(EXIF_ORIENTATION_TAG)
                 assert type(image_orientation) is int  # noqa: E721
@@ -116,7 +107,7 @@ class Thumbnailer:
             logger.info("Error parsing image EXIF information: %s", e)
 
     @trace
-    def transpose(self) -> Tuple[int, int]:
+    def transpose(self) -> tuple[int, int]:
         """Transpose the image using its EXIF Orientation tag
 
         Returns:
@@ -134,7 +125,7 @@ class Thumbnailer:
             self.image.info["exif"] = None
         return self.image.size
 
-    def aspect(self, max_width: int, max_height: int) -> Tuple[int, int]:
+    def aspect(self, max_width: int, max_height: int) -> tuple[int, int]:
         """Calculate the largest size that preserves aspect ratio which
         fits within the given rectangle::
 
@@ -246,9 +237,9 @@ class Thumbnailer:
 
     def __exit__(
         self,
-        type: Optional[Type[BaseException]],
-        value: Optional[BaseException],
-        traceback: Optional[TracebackType],
+        type: type[BaseException] | None,
+        value: BaseException | None,
+        traceback: TracebackType | None,
     ) -> None:
         self.close()
 
@@ -553,13 +544,13 @@ class ThumbnailProvider:
         desired_height: int,
         desired_method: str,
         desired_type: str,
-        thumbnail_infos: List[ThumbnailInfo],
+        thumbnail_infos: list[ThumbnailInfo],
         media_id: str,
         file_id: str,
         url_cache: bool,
         for_federation: bool,
-        media_info: Optional[LocalMedia] = None,
-        server_name: Optional[str] = None,
+        media_info: LocalMedia | None = None,
+        server_name: str | None = None,
     ) -> None:
         """
         Respond to a request with an appropriate thumbnail from the previously generated thumbnails.
@@ -642,13 +633,6 @@ class ThumbnailProvider:
             # width/height/method so we can just call the "generate exact"
             # methods.
 
-            # First let's check that we do actually have the original image
-            # still. This will throw a 404 if we don't.
-            # TODO: We should refetch the thumbnails for remote media.
-            await self.media_storage.ensure_media_is_in_local_cache(
-                FileInfo(server_name, file_id, url_cache=url_cache)
-            )
-
             if server_name:
                 await self.media_repo.generate_remote_exact_thumbnail(
                     server_name,
@@ -719,11 +703,11 @@ class ThumbnailProvider:
         desired_height: int,
         desired_method: str,
         desired_type: str,
-        thumbnail_infos: List[ThumbnailInfo],
+        thumbnail_infos: list[ThumbnailInfo],
         file_id: str,
         url_cache: bool,
-        server_name: Optional[str],
-    ) -> Optional[FileInfo]:
+        server_name: str | None,
+    ) -> FileInfo | None:
         """
         Choose an appropriate thumbnail from the previously generated thumbnails.
 
@@ -750,12 +734,12 @@ class ThumbnailProvider:
 
         if desired_method == "crop":
             # Thumbnails that match equal or larger sizes of desired width/height.
-            crop_info_list: List[
-                Tuple[int, int, int, bool, Optional[int], ThumbnailInfo]
+            crop_info_list: list[
+                tuple[int, int, int, bool, int | None, ThumbnailInfo]
             ] = []
             # Other thumbnails.
-            crop_info_list2: List[
-                Tuple[int, int, int, bool, Optional[int], ThumbnailInfo]
+            crop_info_list2: list[
+                tuple[int, int, int, bool, int | None, ThumbnailInfo]
             ] = []
             for info in thumbnail_infos:
                 # Skip thumbnails generated with different methods.
@@ -801,9 +785,9 @@ class ThumbnailProvider:
                 thumbnail_info = min(crop_info_list2, key=lambda t: t[:-1])[-1]
         elif desired_method == "scale":
             # Thumbnails that match equal or larger sizes of desired width/height.
-            info_list: List[Tuple[int, bool, int, ThumbnailInfo]] = []
+            info_list: list[tuple[int, bool, int, ThumbnailInfo]] = []
             # Other thumbnails.
-            info_list2: List[Tuple[int, bool, int, ThumbnailInfo]] = []
+            info_list2: list[tuple[int, bool, int, ThumbnailInfo]] = []
 
             for info in thumbnail_infos:
                 # Skip thumbnails generated with different methods.
diff --git a/synapse/media/url_previewer.py b/synapse/media/url_previewer.py
index 8f106a3d5f..7782905a7a 100644
--- a/synapse/media/url_previewer.py
+++ b/synapse/media/url_previewer.py
@@ -28,7 +28,7 @@ import re
 import shutil
 import sys
 import traceback
-from typing import TYPE_CHECKING, BinaryIO, Iterable, Optional, Tuple
+from typing import TYPE_CHECKING, BinaryIO, Iterable
 from urllib.parse import urljoin, urlparse, urlsplit
 from urllib.request import urlopen
 
@@ -44,11 +44,11 @@ from synapse.media._base import FileInfo, get_filename_from_headers
 from synapse.media.media_storage import MediaStorage, SHA256TransparentIOWriter
 from synapse.media.oembed import OEmbedProvider
 from synapse.media.preview_html import decode_body, parse_html_to_open_graph
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.types import JsonDict, UserID
-from synapse.util import json_encoder
 from synapse.util.async_helpers import ObservableDeferred
 from synapse.util.caches.expiringcache import ExpiringCache
+from synapse.util.duration import Duration
+from synapse.util.json import json_encoder
 from synapse.util.stringutils import random_string
 
 if TYPE_CHECKING:
@@ -71,9 +71,9 @@ class DownloadResult:
     uri: str
     response_code: int
     media_type: str
-    download_name: Optional[str]
+    download_name: str | None
     expires: int
-    etag: Optional[str]
+    etag: str | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -88,7 +88,7 @@ class MediaInfo:
     media_length: int
     # The media filename, according to the server. This is parsed from the
     # returned headers, if possible.
-    download_name: Optional[str]
+    download_name: str | None
     # The time of the preview.
     created_ts_ms: int
     # Information from the media storage provider about where the file is stored
@@ -102,7 +102,7 @@ class MediaInfo:
     # The timestamp (in milliseconds) of when this preview expires.
     expires: int
     # The ETag header of the response.
-    etag: Optional[str]
+    etag: str | None
 
 
 class UrlPreviewer:
@@ -167,6 +167,7 @@ class UrlPreviewer:
         media_storage: MediaStorage,
     ):
         self.clock = hs.get_clock()
+        self.hs = hs
         self.filepaths = media_repo.filepaths
         self.max_spider_size = hs.config.media.max_spider_size
         self.server_name = hs.hostname
@@ -201,14 +202,15 @@ class UrlPreviewer:
         self._cache: ExpiringCache[str, ObservableDeferred] = ExpiringCache(
             cache_name="url_previews",
             server_name=self.server_name,
+            hs=self.hs,
             clock=self.clock,
             # don't spider URLs more often than once an hour
             expiry_ms=ONE_HOUR,
         )
 
         if self._worker_run_media_background_jobs:
-            self._cleaner_loop = self.clock.looping_call(
-                self._start_expire_url_cache_data, 10 * 1000
+            self.clock.looping_call(
+                self._start_expire_url_cache_data, Duration(seconds=10)
             )
 
     async def preview(self, url: str, user: UserID, ts: int) -> bytes:
@@ -269,7 +271,7 @@ class UrlPreviewer:
 
         # The number of milliseconds that the response should be considered valid.
         expiration_ms = media_info.expires
-        author_name: Optional[str] = None
+        author_name: str | None = None
 
         if _is_media(media_info.media_type):
             file_id = media_info.filesystem_id
@@ -329,10 +331,16 @@ class UrlPreviewer:
                 # response failed or is incomplete.
                 og_from_html = parse_html_to_open_graph(tree)
 
-                # Compile the Open Graph response by using the scraped
-                # information from the HTML and overlaying any information
-                # from the oEmbed response.
-                og = {**og_from_html, **og_from_oembed}
+                # Compile an Open Graph response by combining the oEmbed response
+                # and the information from the HTML, with information in the HTML
+                # preferred.
+                #
+                # The ordering here is intentional: certain websites (especially
+                # SPA JavaScript-based ones) including Mastodon and YouTube provide
+                # almost complete OpenGraph descriptions but only stubs for oEmbed,
+                # with further oEmbed information being populated with JavaScript,
+                # that Synapse won't execute.
+                og = og_from_oembed | og_from_html
 
                 await self._precache_image_url(user, media_info, og)
             else:
@@ -706,7 +714,7 @@ class UrlPreviewer:
 
     async def _handle_oembed_response(
         self, url: str, media_info: MediaInfo, expiration_ms: int
-    ) -> Tuple[JsonDict, Optional[str], int]:
+    ) -> tuple[JsonDict, str | None, int]:
         """
         Parse the downloaded oEmbed info.
 
@@ -739,8 +747,8 @@ class UrlPreviewer:
         return open_graph_result, oembed_response.author_name, expiration_ms
 
     def _start_expire_url_cache_data(self) -> Deferred:
-        return run_as_background_process(
-            "expire_url_cache_data", self.server_name, self._expire_url_cache_data
+        return self.hs.run_as_background_process(
+            "expire_url_cache_data", self._expire_url_cache_data
         )
 
     async def _expire_url_cache_data(self) -> None:
diff --git a/synapse/metrics/__init__.py b/synapse/metrics/__init__.py
index 11e2551a16..cf9aaa7f2d 100644
--- a/synapse/metrics/__init__.py
+++ b/synapse/metrics/__init__.py
@@ -27,23 +27,19 @@ import platform
 import threading
 from importlib import metadata
 from typing import (
+    TYPE_CHECKING,
+    Any,
     Callable,
-    Dict,
     Generic,
     Iterable,
     Mapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     cast,
 )
 
 import attr
-from pkg_resources import parse_version
+from packaging.version import parse as parse_version
 from prometheus_client import (
     CollectorRegistry,
     Counter,
@@ -66,6 +62,7 @@ from twisted.web.server import Request
 import synapse.metrics._reactor_metrics  # noqa: F401
 from synapse.metrics._gc import MIN_TIME_BETWEEN_GCS, install_gc_manager
 from synapse.metrics._types import Collector
+from synapse.synapse_rust import get_rustc_version
 from synapse.types import StrSequence
 from synapse.util import SYNAPSE_VERSION
 
@@ -73,7 +70,8 @@ logger = logging.getLogger(__name__)
 
 METRICS_PREFIX = "/_synapse/metrics"
 
-all_gauges: Dict[str, Collector] = {}
+# Rust version used for compilation
+RUSTC_VERSION = get_rustc_version()
 
 HAVE_PROC_SELF_STAT = os.path.exists("/proc/self/stat")
 
@@ -162,43 +160,107 @@ class LaterGauge(Collector):
 
     name: str
     desc: str
-    labelnames: Optional[StrSequence] = attr.ib(hash=False)
-    # callback: should either return a value (if there are no labels for this metric),
-    # or dict mapping from a label tuple to a value
-    caller: Callable[
-        [], Union[Mapping[Tuple[str, ...], Union[int, float]], Union[int, float]]
-    ]
+    labelnames: StrSequence | None = attr.ib(hash=False)
+    _instance_id_to_hook_map: dict[
+        str | None,  # instance_id
+        Callable[[], Mapping[tuple[str, ...], int | float] | int | float],
+    ] = attr.ib(factory=dict, hash=False)
+    """
+    Map from homeserver instance_id to a callback. Each callback should either return a
+    value (if there are no labels for this metric), or dict mapping from a label tuple
+    to a value.
+
+    We use `instance_id` instead of `server_name` because it's possible to have multiple
+    workers running in the same process with the same `server_name`.
+    """
 
     def collect(self) -> Iterable[Metric]:
         # The decision to add `SERVER_NAME_LABEL` is from the `LaterGauge` usage itself
         # (we don't enforce it here, one level up).
         g = GaugeMetricFamily(self.name, self.desc, labels=self.labelnames)  # type: ignore[missing-server-name-label]
 
-        try:
-            calls = self.caller()
-        except Exception:
-            logger.exception("Exception running callback for LaterGauge(%s)", self.name)
-            yield g
-            return
+        for homeserver_instance_id, hook in self._instance_id_to_hook_map.items():
+            try:
+                hook_result = hook()
+            except Exception:
+                logger.exception(
+                    "Exception running callback for LaterGauge(%s) for homeserver_instance_id=%s",
+                    self.name,
+                    homeserver_instance_id,
+                )
+                # Continue to return the rest of the metrics that aren't broken
+                continue
 
-        if isinstance(calls, (int, float)):
-            g.add_metric([], calls)
-        else:
-            for k, v in calls.items():
-                g.add_metric(k, v)
+            if isinstance(hook_result, (int, float)):
+                g.add_metric([], hook_result)
+            else:
+                for k, v in hook_result.items():
+                    g.add_metric(k, v)
 
         yield g
 
+    def register_hook(
+        self,
+        *,
+        homeserver_instance_id: str | None,
+        hook: Callable[[], Mapping[tuple[str, ...], int | float] | int | float],
+    ) -> None:
+        """
+        Register a callback/hook that will be called to generate a metric samples for
+        the gauge.
+
+        Args:
+            homeserver_instance_id: The unique ID for this Synapse process instance
+                (`hs.get_instance_id()`) that this hook is associated with. This can be used
+                later to lookup all hooks associated with a given server name in order to
+                unregister them. This should only be omitted for global hooks that work
+                across all homeservers.
+            hook: A callback that should either return a value (if there are no
+                labels for this metric), or dict mapping from a label tuple to a value
+        """
+        # We shouldn't have multiple hooks registered for the same homeserver `instance_id`.
+        existing_hook = self._instance_id_to_hook_map.get(homeserver_instance_id)
+        assert existing_hook is None, (
+            f"LaterGauge(name={self.name}) hook already registered for homeserver_instance_id={homeserver_instance_id}. "
+            "This is likely a Synapse bug and you forgot to unregister the previous hooks for "
+            "the server (especially in tests)."
+        )
+
+        self._instance_id_to_hook_map[homeserver_instance_id] = hook
+
+    def unregister_hooks_for_homeserver_instance_id(
+        self, homeserver_instance_id: str
+    ) -> None:
+        """
+        Unregister all hooks associated with the given homeserver `instance_id`. This should be
+        called when a homeserver is shutdown to avoid extra hooks sitting around.
+
+        Args:
+            homeserver_instance_id: The unique ID for this Synapse process instance to
+                unregister hooks for (`hs.get_instance_id()`).
+        """
+        self._instance_id_to_hook_map.pop(homeserver_instance_id, None)
+
     def __attrs_post_init__(self) -> None:
-        self._register()
-
-    def _register(self) -> None:
-        if self.name in all_gauges.keys():
-            logger.warning("%s already registered, reregistering", self.name)
-            REGISTRY.unregister(all_gauges.pop(self.name))
-
         REGISTRY.register(self)
-        all_gauges[self.name] = self
+
+        # We shouldn't have multiple metrics with the same name. Typically, metrics
+        # should be created globally so you shouldn't be running into this and this will
+        # catch any stupid mistakes. The `REGISTRY.register(self)` call above will also
+        # raise an error if the metric already exists but to make things explicit, we'll
+        # also check here.
+        existing_gauge = all_later_gauges_to_clean_up_on_shutdown.get(self.name)
+        assert existing_gauge is None, f"LaterGauge(name={self.name}) already exists. "
+
+        # Keep track of the gauge so we can clean it up later.
+        all_later_gauges_to_clean_up_on_shutdown[self.name] = self
+
+
+all_later_gauges_to_clean_up_on_shutdown: dict[str, LaterGauge] = {}
+"""
+Track all `LaterGauge` instances so we can remove any associated hooks during homeserver
+shutdown.
+"""
 
 
 # `MetricsEntry` only makes sense when it is a `Protocol`,
@@ -206,8 +268,12 @@ class LaterGauge(Collector):
 MetricsEntry = TypeVar("MetricsEntry")
 
 
-class InFlightGauge(Generic[MetricsEntry], Collector):
-    """Tracks number of things (e.g. requests, Measure blocks, etc) in flight
+class _InFlightGaugeRuntime(Collector):
+    """
+    Runtime class for InFlightGauge. Contains all actual logic.
+    Does not inherit from Generic to avoid method resolution order (MRO) conflicts.
+
+    Tracks number of things (e.g. requests, Measure blocks, etc) in flight
     at any given time.
 
     Each InFlightGauge will create a metric called `<name>_total` that counts
@@ -236,25 +302,29 @@ class InFlightGauge(Generic[MetricsEntry], Collector):
 
         # Create a class which have the sub_metrics values as attributes, which
         # default to 0 on initialization. Used to pass to registered callbacks.
-        self._metrics_class: Type[MetricsEntry] = attr.make_class(
+        self._metrics_class = attr.make_class(
             "_MetricsEntry",
             attrs={x: attr.ib(default=0) for x in sub_metrics},
             slots=True,
         )
 
         # Counts number of in flight blocks for a given set of label values
-        self._registrations: Dict[
-            Tuple[str, ...], Set[Callable[[MetricsEntry], None]]
-        ] = {}
+        # `Callable` should be of type `Callable[[MetricsEntry], None]`, but
+        # `MetricsEntry` has no meaning in this context without the higher level
+        # `InFlightGauge` typing information.
+        # Instead, the typing is enforced by having `_registrations` be private and all
+        # accessor functions have proper `Callable[[MetricsEntry], None]` type
+        # annotations.
+        self._registrations: dict[tuple[str, ...], set[Callable[[Any], None]]] = {}
 
         # Protects access to _registrations
         self._lock = threading.Lock()
 
-        self._register_with_collector()
+        REGISTRY.register(self)
 
     def register(
         self,
-        key: Tuple[str, ...],
+        key: tuple[str, ...],
         callback: Callable[[MetricsEntry], None],
     ) -> None:
         """Registers that we've entered a new block with labels `key`.
@@ -283,7 +353,7 @@ class InFlightGauge(Generic[MetricsEntry], Collector):
 
     def unregister(
         self,
-        key: Tuple[str, ...],
+        key: tuple[str, ...],
         callback: Callable[[MetricsEntry], None],
     ) -> None:
         """
@@ -341,13 +411,16 @@ class InFlightGauge(Generic[MetricsEntry], Collector):
                 gauge.add_metric(labels=key, value=getattr(metrics, name))
             yield gauge
 
-    def _register_with_collector(self) -> None:
-        if self.name in all_gauges.keys():
-            logger.warning("%s already registered, reregistering", self.name)
-            REGISTRY.unregister(all_gauges.pop(self.name))
 
-        REGISTRY.register(self)
-        all_gauges[self.name] = self
+if TYPE_CHECKING:
+
+    class InFlightGauge(_InFlightGaugeRuntime, Generic[MetricsEntry]):
+        """
+        Typing-only generic wrapper.
+        Provides InFlightGauge[T] support to type checkers.
+        """
+else:
+    InFlightGauge = _InFlightGaugeRuntime
 
 
 class GaugeHistogramMetricFamilyWithLabels(GaugeHistogramMetricFamily):
@@ -366,7 +439,7 @@ class GaugeHistogramMetricFamilyWithLabels(GaugeHistogramMetricFamily):
         name: str,
         documentation: str,
         gsum_value: float,
-        buckets: Optional[Sequence[Tuple[str, float]]] = None,
+        buckets: Sequence[tuple[str, float]] | None = None,
         labelnames: StrSequence = (),
         labelvalues: StrSequence = (),
         unit: str = "",
@@ -417,7 +490,7 @@ class GaugeBucketCollector(Collector):
         *,
         name: str,
         documentation: str,
-        labelnames: Optional[StrSequence],
+        labelnames: StrSequence | None,
         buckets: Iterable[float],
         registry: CollectorRegistry = REGISTRY,
     ):
@@ -443,7 +516,7 @@ class GaugeBucketCollector(Collector):
 
         # We initially set this to None. We won't report metrics until
         # this has been initialised after a successful data update
-        self._metric: Optional[GaugeHistogramMetricFamilyWithLabels] = None
+        self._metric: GaugeHistogramMetricFamilyWithLabels | None = None
 
         registry.register(self)
 
@@ -603,14 +676,36 @@ event_processing_lag_by_event = Histogram(
 # consider this process-level because all Synapse homeservers running in the process
 # will use the same Synapse version.
 build_info = Gauge(  # type: ignore[missing-server-name-label]
-    "synapse_build_info", "Build information", ["pythonversion", "version", "osversion"]
+    "synapse_build_info",
+    "Build information",
+    ["pythonversion", "version", "osversion", "rustcversion"],
 )
 build_info.labels(
     " ".join([platform.python_implementation(), platform.python_version()]),
     SYNAPSE_VERSION,
     " ".join([platform.system(), platform.release()]),
+    RUSTC_VERSION,
 ).set(1)
 
+synapse_server_name_info = Gauge(
+    "synapse_server_name_info",
+    "Maps Synapse `server_name`s to the `instance`s they're hosted on",
+    # `instance` will automatically be set by Prometheus
+    labelnames=[SERVER_NAME_LABEL],
+)
+"""
+Maps Synapse `server_name`s to the `instance`s they're hosted on.
+
+This is an info-style metric where the value is always 1, and labels carry metadata:
+
+ - `server_name`: The Synapse `server_name`
+ - `instance`: Automatically be set by Prometheus and is the `<host>:<port>` part
+    of the target's URL that was scraped.
+
+This is useful as it allows us to correlate process-level metrics (like `process_*`,
+`python_*`, etc) with homeservers.
+"""
+
 # 3PID send info
 threepid_send_requests = Histogram(
     "synapse_threepid_send_requests_with_tries",
diff --git a/synapse/metrics/_gc.py b/synapse/metrics/_gc.py
index e7783b05e6..1da871f18f 100644
--- a/synapse/metrics/_gc.py
+++ b/synapse/metrics/_gc.py
@@ -138,7 +138,9 @@ def install_gc_manager() -> None:
                 gc_time.labels(i).observe(end - start)
                 gc_unreachable.labels(i).set(unreachable)
 
-    gc_task = task.LoopingCall(_maybe_gc)
+    # We can ignore the lint here since this looping call does not hold a `HomeServer`
+    # reference so can be cleaned up by other means on shutdown.
+    gc_task = task.LoopingCall(_maybe_gc)  # type: ignore[prefer-synapse-clock-looping-call]
     gc_task.start(0.1)
 
 
diff --git a/synapse/metrics/_reactor_metrics.py b/synapse/metrics/_reactor_metrics.py
index 9852d0b932..d528b7c5e5 100644
--- a/synapse/metrics/_reactor_metrics.py
+++ b/synapse/metrics/_reactor_metrics.py
@@ -30,6 +30,7 @@ from prometheus_client.core import REGISTRY, GaugeMetricFamily
 from twisted.internet import reactor, selectreactor
 from twisted.internet.asyncioreactor import AsyncioSelectorReactor
 
+from synapse.app.complement_fork_proxied_reactor import ProxiedReactor
 from synapse.metrics._types import Collector
 
 try:
@@ -124,48 +125,65 @@ class ReactorLastSeenMetric(Collector):
         yield cm
 
 
-# Twisted has already select a reasonable reactor for us, so assumptions can be
-# made about the shape.
-wrapper = None
-try:
-    if isinstance(reactor, (PollReactor, EPollReactor)):
-        reactor._poller = ObjWrapper(reactor._poller, "poll")  # type: ignore[attr-defined]
-        wrapper = reactor._poller._wrapped_method  # type: ignore[attr-defined]
+def install_reactor_metrics(target_reactor: Any) -> None:
+    # Twisted has already select a reasonable reactor for us, so assumptions can be
+    # made about the shape.
+    wrapper = None
+    try:
+        if isinstance(target_reactor, (PollReactor, EPollReactor)):
+            target_reactor._poller = ObjWrapper(reactor._poller, "poll")  # type: ignore[attr-defined]
+            wrapper = target_reactor._poller._wrapped_method  # type: ignore[attr-defined]
 
-    elif isinstance(reactor, selectreactor.SelectReactor):
-        # Twisted uses a module-level _select function.
-        wrapper = selectreactor._select = CallWrapper(selectreactor._select)
+        elif isinstance(target_reactor, selectreactor.SelectReactor):
+            # Twisted uses a module-level _select function.
+            wrapper = selectreactor._select = CallWrapper(selectreactor._select)
 
-    elif isinstance(reactor, AsyncioSelectorReactor):
-        # For asyncio look at the underlying asyncio event loop.
-        asyncio_loop = reactor._asyncioEventloop  # A sub-class of BaseEventLoop,
+        elif isinstance(target_reactor, AsyncioSelectorReactor):
+            # For asyncio look at the underlying asyncio event loop.
+            asyncio_loop = (
+                target_reactor._asyncioEventloop
+            )  # A sub-class of BaseEventLoop,
 
-        # A sub-class of BaseSelector.
-        selector = asyncio_loop._selector  # type: ignore[attr-defined]
+            # A sub-class of BaseSelector.
+            selector = asyncio_loop._selector  # type: ignore[attr-defined]
 
-        if isinstance(selector, SelectSelector):
-            wrapper = selector._select = CallWrapper(selector._select)  # type: ignore[attr-defined]
+            if isinstance(selector, SelectSelector):
+                wrapper = selector._select = CallWrapper(selector._select)  # type: ignore[attr-defined]
 
-        # poll, epoll, and /dev/poll.
-        elif isinstance(selector, _PollLikeSelector):
-            selector._selector = ObjWrapper(selector._selector, "poll")  # type: ignore[attr-defined]
-            wrapper = selector._selector._wrapped_method  # type: ignore[attr-defined]
+            # poll, epoll, and /dev/poll.
+            elif isinstance(selector, _PollLikeSelector):
+                selector._selector = ObjWrapper(selector._selector, "poll")  # type: ignore[attr-defined]
+                wrapper = selector._selector._wrapped_method  # type: ignore[attr-defined]
 
-        elif isinstance(selector, KqueueSelector):
-            selector._selector = ObjWrapper(selector._selector, "control")  # type: ignore[attr-defined]
-            wrapper = selector._selector._wrapped_method  # type: ignore[attr-defined]
+            elif isinstance(selector, KqueueSelector):
+                selector._selector = ObjWrapper(selector._selector, "control")  # type: ignore[attr-defined]
+                wrapper = selector._selector._wrapped_method  # type: ignore[attr-defined]
 
+            else:
+                # E.g. this does not support the (Windows-only) ProactorEventLoop.
+                logger.warning(
+                    "Skipping configuring reactor metrics: unexpected asyncio loop selector: %r via %r",
+                    selector,
+                    asyncio_loop,
+                )
         else:
-            # E.g. this does not support the (Windows-only) ProactorEventLoop.
             logger.warning(
-                "Skipping configuring ReactorLastSeenMetric: unexpected asyncio loop selector: %r via %r",
-                selector,
-                asyncio_loop,
+                "Skipping configuring reactor metrics: unexpected reactor type: %r",
+                target_reactor,
             )
-except Exception as e:
-    logger.warning("Configuring ReactorLastSeenMetric failed: %r", e)
+    except Exception as e:
+        logger.warning("Configuring reactor metrics failed: %r", e)
+
+    if wrapper:
+        # This is a process-level metric, so it does not have the `SERVER_NAME_LABEL`.
+        REGISTRY.register(ReactorLastSeenMetric(wrapper))  # type: ignore[missing-server-name-label]
 
 
-if wrapper:
-    # This is a process-level metric, so it does not have the `SERVER_NAME_LABEL`.
-    REGISTRY.register(ReactorLastSeenMetric(wrapper))  # type: ignore[missing-server-name-label]
+# Install reactor metrics for the global reactor.
+#
+# Skip installation if using `ProxiedReactor` (used by `complement_fork_starter.py`).
+# The `ProxiedReactor` will handle calling `install_reactor_metrics(...)` itself when
+# ready. Skipping allows us to avoid seeing confusing `Skipping configuring reactor
+# metrics: unexpected reactor type: ProxiedReactor` warnings.
+if not isinstance(reactor, ProxiedReactor):
+    install_reactor_metrics(reactor)
diff --git a/synapse/metrics/background_process_metrics.py b/synapse/metrics/background_process_metrics.py
index f7f2d88885..8ff2803455 100644
--- a/synapse/metrics/background_process_metrics.py
+++ b/synapse/metrics/background_process_metrics.py
@@ -20,7 +20,7 @@
 
 import logging
 import threading
-from contextlib import nullcontext
+from contextlib import contextmanager, nullcontext
 from functools import wraps
 from types import TracebackType
 from typing import (
@@ -28,14 +28,12 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
+    ContextManager,
+    Generator,
     Iterable,
     Optional,
     Protocol,
-    Set,
-    Type,
     TypeVar,
-    Union,
 )
 
 from prometheus_client import Metric
@@ -49,7 +47,12 @@ from synapse.logging.context import (
     LoggingContext,
     PreserveLoggingContext,
 )
-from synapse.logging.opentracing import SynapseTags, start_active_span
+from synapse.logging.opentracing import (
+    SynapseTags,
+    active_span,
+    start_active_span,
+    start_active_span_follows_from,
+)
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.metrics._types import Collector
 
@@ -59,6 +62,13 @@ if TYPE_CHECKING:
     # Old versions don't have `LiteralString`
     from typing_extensions import LiteralString
 
+    from synapse.server import HomeServer
+
+    try:
+        import opentracing
+    except ImportError:
+        opentracing = None  # type: ignore[assignment]
+
 
 logger = logging.getLogger(__name__)
 
@@ -120,7 +130,7 @@ _background_process_db_sched_duration = Counter(
 # map from description to a counter, so that we can name our logcontexts
 # incrementally. (It actually duplicates _background_process_start_count, but
 # it's much simpler to do so than to try to combine them.)
-_background_process_counts: Dict[str, int] = {}
+_background_process_counts: dict[str, int] = {}
 
 # Set of all running background processes that became active active since the
 # last time metrics were scraped (i.e. background processes that performed some
@@ -130,7 +140,7 @@ _background_process_counts: Dict[str, int] = {}
 # background processes stacking up behind a lock or linearizer, where we then
 # only need to iterate over and update metrics for the process that have
 # actually been active and can ignore the idle ones.
-_background_processes_active_since_last_scrape: "Set[_BackgroundProcess]" = set()
+_background_processes_active_since_last_scrape: "set[_BackgroundProcess]" = set()
 
 # A lock that covers the above set and dict
 _bg_metrics_lock = threading.Lock()
@@ -177,7 +187,7 @@ class _BackgroundProcess:
         self.desc = desc
         self.server_name = server_name
         self._context = ctx
-        self._reported_stats: Optional[ContextResourceUsage] = None
+        self._reported_stats: ContextResourceUsage | None = None
 
     def update_metrics(self) -> None:
         """Updates the metrics with values from this process."""
@@ -213,11 +223,12 @@ R = TypeVar("R")
 def run_as_background_process(
     desc: "LiteralString",
     server_name: str,
-    func: Callable[..., Awaitable[Optional[R]]],
+    func: Callable[..., Awaitable[R | None]],
     *args: Any,
     bg_start_span: bool = True,
+    test_only_tracer: Optional["opentracing.Tracer"] = None,
     **kwargs: Any,
-) -> "defer.Deferred[Optional[R]]":
+) -> "defer.Deferred[R | None]":
     """Run the given function in its own logcontext, with resource metrics
 
     This should be used to wrap processes which are fired off to run in the
@@ -228,6 +239,11 @@ def run_as_background_process(
     clock.looping_call and friends (or for firing-and-forgetting in the middle of a
     normal synapse async function).
 
+    Because the returned Deferred does not follow the synapse logcontext rules, awaiting
+    the result of this function will result in the log context being cleared (bad). In
+    order to properly await the result of this function and maintain the current log
+    context, use `make_deferred_yieldable`.
+
     Args:
         desc: a description for this background process type
         server_name: The homeserver name that this background process is being run for
@@ -236,6 +252,8 @@ def run_as_background_process(
         bg_start_span: Whether to start an opentracing span. Defaults to True.
             Should only be disabled for processes that will not log to or tag
             a span.
+        test_only_tracer: Set the OpenTracing tracer to use. This is only useful for
+            tests.
         args: positional args for func
         kwargs: keyword args for func
 
@@ -245,7 +263,13 @@ def run_as_background_process(
         rules.
     """
 
-    async def run() -> Optional[R]:
+    # Since we track the tracing scope in the `LoggingContext`, before we move to the
+    # sentinel logcontext (or a new `LoggingContext`), grab the currently active
+    # tracing span (if any) so that we can create a cross-link to the background process
+    # trace.
+    original_active_tracing_span = active_span(tracer=test_only_tracer)
+
+    async def run() -> R | None:
         with _bg_metrics_lock:
             count = _background_process_counts.get(desc, 0)
             _background_process_counts[desc] = count + 1
@@ -259,15 +283,101 @@ def run_as_background_process(
 
         with BackgroundProcessLoggingContext(
             name=desc, server_name=server_name, instance_id=count
-        ) as context:
+        ) as logging_context:
             try:
                 if bg_start_span:
-                    ctx = start_active_span(
-                        f"bgproc.{desc}", tags={SynapseTags.REQUEST_ID: str(context)}
-                    )
+                    # If there is already an active span (e.g. because this background
+                    # process was started as part of handling a request for example),
+                    # because this is a long-running background task that may serve a
+                    # broader purpose than the request that kicked it off, we don't want
+                    # it to be a direct child of the currently active trace connected to
+                    # the request. We only want a loose reference to jump between the
+                    # traces.
+                    #
+                    # For example, when making a `/messages` request, when approaching a
+                    # gap, we may kick off a background process to fetch missing events
+                    # from federation. The `/messages` request trace should't include
+                    # the entire time taken and details around fetching the missing
+                    # events since the request doesn't rely on the result, it was just
+                    # part of the heuristic to initiate things.
+                    #
+                    # We don't care about the value from the context manager as it's not
+                    # used (so we just use `Any` for the type). Ideally, we'd be able to
+                    # mark this as unused like an `assert_never` of sorts.
+                    tracing_scope: ContextManager[Any]
+                    if original_active_tracing_span is not None:
+                        # With the OpenTracing client that we're using, it's impossible to
+                        # create a disconnected root span while also providing `references`
+                        # so we first create a bare root span, then create a child span that
+                        # includes the references that we want.
+                        root_tracing_scope = start_active_span(
+                            f"bgproc.{desc}",
+                            tags={SynapseTags.REQUEST_ID: str(logging_context)},
+                            # Create a root span for the background process (disconnected
+                            # from other spans)
+                            ignore_active_span=True,
+                            tracer=test_only_tracer,
+                        )
+
+                        # Also add a span in the original request trace that cross-links
+                        # to background process trace. We immediately finish the span as
+                        # this is just a marker to follow where the real work is being
+                        # done.
+                        #
+                        # In OpenTracing, `FOLLOWS_FROM` indicates parent-child
+                        # relationship whereas we just want a cross-link to the
+                        # downstream trace. This is a bit hacky, but the closest we
+                        # can get to in OpenTracing land. If we ever migrate to
+                        # OpenTelemetry, we should use a normal `Link` for this.
+                        with start_active_span_follows_from(
+                            f"start_bgproc.{desc}",
+                            child_of=original_active_tracing_span,
+                            ignore_active_span=True,
+                            # Create the `FOLLOWS_FROM` reference to the background
+                            # process span so there is a loose coupling between the two
+                            # traces and it's easy to jump between.
+                            contexts=[root_tracing_scope.span.context],
+                            tracer=test_only_tracer,
+                        ):
+                            pass
+
+                        # Then start the tracing scope that we're going to use for
+                        # the duration of the background process within the root
+                        # span we just created.
+                        child_tracing_scope = start_active_span_follows_from(
+                            f"bgproc_child.{desc}",
+                            child_of=root_tracing_scope.span,
+                            ignore_active_span=True,
+                            tags={SynapseTags.REQUEST_ID: str(logging_context)},
+                            # Create the `FOLLOWS_FROM` reference to the request's
+                            # span so there is a loose coupling between the two
+                            # traces and it's easy to jump between.
+                            contexts=[original_active_tracing_span.context],
+                            tracer=test_only_tracer,
+                        )
+
+                        # For easy usage down below, we create a context manager that
+                        # combines both scopes.
+                        @contextmanager
+                        def combined_context_manager() -> Generator[None, None, None]:
+                            with root_tracing_scope, child_tracing_scope:
+                                yield
+
+                        tracing_scope = combined_context_manager()
+
+                    else:
+                        # Otherwise, when there is no active span, we will be creating
+                        # a disconnected root span already and we don't have to
+                        # worry about cross-linking to anything.
+                        tracing_scope = start_active_span(
+                            f"bgproc.{desc}",
+                            tags={SynapseTags.REQUEST_ID: str(logging_context)},
+                            tracer=test_only_tracer,
+                        )
                 else:
-                    ctx = nullcontext()  # type: ignore[assignment]
-                with ctx:
+                    tracing_scope = nullcontext()
+
+                with tracing_scope:
                     return await func(*args, **kwargs)
             except Exception:
                 logger.exception(
@@ -280,6 +390,20 @@ def run_as_background_process(
                     name=desc, **{SERVER_NAME_LABEL: server_name}
                 ).dec()
 
+    # To explain how the log contexts work here:
+    #  - When `run_as_background_process` is called, the current context is stored
+    #    (using `PreserveLoggingContext`), we kick off the background task, and we
+    #    restore the original context before returning (also part of
+    #    `PreserveLoggingContext`).
+    #  - The background task runs in its own new logcontext named after `desc`
+    #  - When the background task finishes, we don't want to leak our background context
+    #    into the reactor which would erroneously get attached to the next operation
+    #    picked up by the event loop. We use `PreserveLoggingContext` to set the
+    #    `sentinel` context and means the new `BackgroundProcessLoggingContext` will
+    #    remember the `sentinel` context as its previous context to return to when it
+    #    exits and yields control back to the reactor.
+    #
+    # TODO: Why can't we simplify to using `return run_in_background(run)`?
     with PreserveLoggingContext():
         # Note that we return a Deferred here so that it can be used in a
         # looping_call and other places that expect a Deferred.
@@ -289,19 +413,19 @@ def run_as_background_process(
 P = ParamSpec("P")
 
 
-class HasServerName(Protocol):
-    server_name: str
+class HasHomeServer(Protocol):
+    hs: "HomeServer"
     """
-    The homeserver name that this cache is associated with (used to label the metric)
-    (`hs.hostname`).
+    The homeserver that this cache is associated with (used to label the metric and
+    track backgroun processes for clean shutdown).
     """
 
 
 def wrap_as_background_process(
     desc: "LiteralString",
 ) -> Callable[
-    [Callable[P, Awaitable[Optional[R]]]],
-    Callable[P, "defer.Deferred[Optional[R]]"],
+    [Callable[P, Awaitable[R | None]]],
+    Callable[P, "defer.Deferred[R | None]"],
 ]:
     """Decorator that wraps an asynchronous function `func`, returning a synchronous
     decorated function. Calling the decorated version runs `func` as a background
@@ -323,27 +447,22 @@ def wrap_as_background_process(
     """
 
     def wrapper(
-        func: Callable[Concatenate[HasServerName, P], Awaitable[Optional[R]]],
-    ) -> Callable[P, "defer.Deferred[Optional[R]]"]:
+        func: Callable[Concatenate[HasHomeServer, P], Awaitable[R | None]],
+    ) -> Callable[P, "defer.Deferred[R | None]"]:
         @wraps(func)
         def wrapped_func(
-            self: HasServerName, *args: P.args, **kwargs: P.kwargs
-        ) -> "defer.Deferred[Optional[R]]":
-            assert self.server_name is not None, (
-                "The `server_name` attribute must be set on the object where `@wrap_as_background_process` decorator is used."
+            self: HasHomeServer, *args: P.args, **kwargs: P.kwargs
+        ) -> "defer.Deferred[R | None]":
+            assert self.hs is not None, (
+                "The `hs` attribute must be set on the object where `@wrap_as_background_process` decorator is used."
             )
 
-            return run_as_background_process(
+            return self.hs.run_as_background_process(
                 desc,
-                self.server_name,
                 func,
                 self,
                 *args,
-                # type-ignore: mypy is confusing kwargs with the bg_start_span kwarg.
-                #     Argument 4 to "run_as_background_process" has incompatible type
-                #     "**P.kwargs"; expected "bool"
-                # See https://github.com/python/mypy/issues/8862
-                **kwargs,  # type: ignore[arg-type]
+                **kwargs,
             )
 
         # There are some shenanigans here, because we're decorating a method but
@@ -367,7 +486,7 @@ class BackgroundProcessLoggingContext(LoggingContext):
         *,
         name: str,
         server_name: str,
-        instance_id: Optional[Union[int, str]] = None,
+        instance_id: int | str | None = None,
     ):
         """
 
@@ -382,12 +501,12 @@ class BackgroundProcessLoggingContext(LoggingContext):
         """
         if instance_id is None:
             instance_id = id(self)
-        super().__init__("%s-%s" % (name, instance_id))
-        self._proc: Optional[_BackgroundProcess] = _BackgroundProcess(
+        super().__init__(name="%s-%s" % (name, instance_id), server_name=server_name)
+        self._proc: _BackgroundProcess | None = _BackgroundProcess(
             desc=name, server_name=server_name, ctx=self
         )
 
-    def start(self, rusage: "Optional[resource.struct_rusage]") -> None:
+    def start(self, rusage: "resource.struct_rusage | None") -> None:
         """Log context has started running (again)."""
 
         super().start(rusage)
@@ -408,9 +527,9 @@ class BackgroundProcessLoggingContext(LoggingContext):
 
     def __exit__(
         self,
-        type: Optional[Type[BaseException]],
-        value: Optional[BaseException],
-        traceback: Optional[TracebackType],
+        type: type[BaseException] | None,
+        value: BaseException | None,
+        traceback: TracebackType | None,
     ) -> None:
         """Log context has finished."""
 
diff --git a/synapse/metrics/common_usage_metrics.py b/synapse/metrics/common_usage_metrics.py
index cd1c3c8649..bd27a9ca9f 100644
--- a/synapse/metrics/common_usage_metrics.py
+++ b/synapse/metrics/common_usage_metrics.py
@@ -23,7 +23,7 @@ from typing import TYPE_CHECKING
 import attr
 
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -52,6 +52,7 @@ class CommonUsageMetricsManager:
         self.server_name = hs.hostname
         self._store = hs.get_datastores().main
         self._clock = hs.get_clock()
+        self._hs = hs
 
     async def get_metrics(self) -> CommonUsageMetrics:
         """Get the CommonUsageMetrics object. If no collection has happened yet, do it
@@ -62,18 +63,16 @@ class CommonUsageMetricsManager:
         """
         return await self._collect()
 
-    async def setup(self) -> None:
+    def setup(self) -> None:
         """Keep the gauges for common usage metrics up to date."""
-        run_as_background_process(
+        self._hs.run_as_background_process(
             desc="common_usage_metrics_update_gauges",
-            server_name=self.server_name,
             func=self._update_gauges,
         )
         self._clock.looping_call(
-            run_as_background_process,
-            5 * 60 * 1000,
+            self._hs.run_as_background_process,
+            Duration(minutes=5),
             desc="common_usage_metrics_update_gauges",
-            server_name=self.server_name,
             func=self._update_gauges,
         )
 
diff --git a/synapse/metrics/jemalloc.py b/synapse/metrics/jemalloc.py
index fb8adbe060..03cecec3ca 100644
--- a/synapse/metrics/jemalloc.py
+++ b/synapse/metrics/jemalloc.py
@@ -23,7 +23,7 @@ import ctypes
 import logging
 import os
 import re
-from typing import Iterable, Literal, Optional, overload
+from typing import Iterable, Literal, overload
 
 import attr
 from prometheus_client import REGISTRY, Metric
@@ -40,17 +40,17 @@ class JemallocStats:
 
     @overload
     def _mallctl(
-        self, name: str, read: Literal[True] = True, write: Optional[int] = None
+        self, name: str, read: Literal[True] = True, write: int | None = None
     ) -> int: ...
 
     @overload
     def _mallctl(
-        self, name: str, read: Literal[False], write: Optional[int] = None
+        self, name: str, read: Literal[False], write: int | None = None
     ) -> None: ...
 
     def _mallctl(
-        self, name: str, read: bool = True, write: Optional[int] = None
-    ) -> Optional[int]:
+        self, name: str, read: bool = True, write: int | None = None
+    ) -> int | None:
         """Wrapper around `mallctl` for reading and writing integers to
         jemalloc.
 
@@ -131,10 +131,10 @@ class JemallocStats:
         return self._mallctl(f"stats.{name}")
 
 
-_JEMALLOC_STATS: Optional[JemallocStats] = None
+_JEMALLOC_STATS: JemallocStats | None = None
 
 
-def get_jemalloc_stats() -> Optional[JemallocStats]:
+def get_jemalloc_stats() -> JemallocStats | None:
     """Returns an interface to jemalloc, if it is being used.
 
     Note that this will always return None until `setup_jemalloc_stats` has been
diff --git a/synapse/module_api/__init__.py b/synapse/module_api/__init__.py
index 9309aa9394..947be24d3e 100644
--- a/synapse/module_api/__init__.py
+++ b/synapse/module_api/__init__.py
@@ -26,15 +26,10 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
     Generator,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Tuple,
     TypeVar,
-    Union,
 )
 
 import attr
@@ -43,6 +38,7 @@ from typing_extensions import Concatenate, ParamSpec
 
 from twisted.internet import defer
 from twisted.internet.interfaces import IDelayedCall
+from twisted.python.threadpool import ThreadPool
 from twisted.web.resource import Resource
 
 from synapse.api import errors
@@ -50,6 +46,7 @@ from synapse.api.constants import ProfileFields
 from synapse.api.errors import SynapseError
 from synapse.api.presence import UserPresenceState
 from synapse.config import ConfigError
+from synapse.config.repository import MediaUploadLimit
 from synapse.events import EventBase
 from synapse.events.presence_router import (
     GET_INTERESTED_USERS_CALLBACK,
@@ -78,6 +75,7 @@ from synapse.http.servlet import parse_json_object_from_request
 from synapse.http.site import SynapseRequest
 from synapse.logging.context import (
     defer_to_thread,
+    defer_to_threadpool,
     make_deferred_yieldable,
     run_in_background,
 )
@@ -94,7 +92,9 @@ from synapse.module_api.callbacks.account_validity_callbacks import (
 )
 from synapse.module_api.callbacks.media_repository_callbacks import (
     GET_MEDIA_CONFIG_FOR_USER_CALLBACK,
+    GET_MEDIA_UPLOAD_LIMITS_FOR_USER_CALLBACK,
     IS_USER_ALLOWED_TO_UPLOAD_MEDIA_OF_SIZE_CALLBACK,
+    ON_MEDIA_UPLOAD_LIMIT_EXCEEDED_CALLBACK,
 )
 from synapse.module_api.callbacks.ratelimit_callbacks import (
     GET_RATELIMIT_OVERRIDE_FOR_USER_CALLBACK,
@@ -155,10 +155,12 @@ from synapse.types import (
     create_requester,
 )
 from synapse.types.state import StateFilter
-from synapse.util import Clock
 from synapse.util.async_helpers import maybe_awaitable
 from synapse.util.caches.descriptors import CachedFunction, cached as _cached
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.frozenutils import freeze
+from synapse.util.sentinel import Sentinel
 
 if TYPE_CHECKING:
     # Old versions don't have `LiteralString`
@@ -205,6 +207,7 @@ __all__ = [
     "RoomAlias",
     "UserProfile",
     "RatelimitOverride",
+    "MediaUploadLimit",
 ]
 
 logger = logging.getLogger(__name__)
@@ -224,11 +227,11 @@ class UserIpAndAgent:
 
 def run_as_background_process(
     desc: "LiteralString",
-    func: Callable[..., Awaitable[Optional[T]]],
+    func: Callable[..., Awaitable[T | None]],
     *args: Any,
     bg_start_span: bool = True,
     **kwargs: Any,
-) -> "defer.Deferred[Optional[T]]":
+) -> "defer.Deferred[T | None]":
     """
     XXX: Deprecated: use `ModuleApi.run_as_background_process` instead.
 
@@ -271,7 +274,15 @@ def run_as_background_process(
     # function instead.
     stub_server_name = "synapse_module_running_from_unknown_server"
 
-    return _run_as_background_process(
+    # Ignore the linter error here. Since this is leveraging the
+    # `run_as_background_process` function directly and we don't want to break the
+    # module api, we need to keep the function signature the same. This means we don't
+    # have access to the running `HomeServer` and cannot track this background process
+    # for cleanup during shutdown.
+    # This is not an issue during runtime and is only potentially problematic if the
+    # application cares about being able to garbage collect `HomeServer` instances
+    # during runtime.
+    return _run_as_background_process(  # type: ignore[untracked-background-process]
         desc,
         stub_server_name,
         func,
@@ -284,8 +295,8 @@ def run_as_background_process(
 def cached(
     *,
     max_entries: int = 1000,
-    num_args: Optional[int] = None,
-    uncached_args: Optional[Collection[str]] = None,
+    num_args: int | None = None,
+    uncached_args: Collection[str] | None = None,
 ) -> Callable[[F], CachedFunction[F]]:
     """Returns a decorator that applies a memoizing cache around the function. This
     decorator behaves similarly to functools.lru_cache.
@@ -327,7 +338,7 @@ class ModuleApi:
 
         # TODO: Fix this type hint once the types for the data stores have been ironed
         #       out.
-        self._store: Union[DataStore, "GenericWorkerStore"] = hs.get_datastores().main
+        self._store: DataStore | "GenericWorkerStore" = hs.get_datastores().main
         self._storage_controllers = hs.get_storage_controllers()
         self._auth = hs.get_auth()
         self._auth_handler = auth_handler
@@ -376,26 +387,20 @@ class ModuleApi:
     def register_spam_checker_callbacks(
         self,
         *,
-        check_event_for_spam: Optional[CHECK_EVENT_FOR_SPAM_CALLBACK] = None,
-        should_drop_federated_event: Optional[
-            SHOULD_DROP_FEDERATED_EVENT_CALLBACK
-        ] = None,
-        user_may_join_room: Optional[USER_MAY_JOIN_ROOM_CALLBACK] = None,
-        user_may_invite: Optional[USER_MAY_INVITE_CALLBACK] = None,
-        federated_user_may_invite: Optional[FEDERATED_USER_MAY_INVITE_CALLBACK] = None,
-        user_may_send_3pid_invite: Optional[USER_MAY_SEND_3PID_INVITE_CALLBACK] = None,
-        user_may_create_room: Optional[USER_MAY_CREATE_ROOM_CALLBACK] = None,
-        user_may_create_room_alias: Optional[
-            USER_MAY_CREATE_ROOM_ALIAS_CALLBACK
-        ] = None,
-        user_may_publish_room: Optional[USER_MAY_PUBLISH_ROOM_CALLBACK] = None,
-        user_may_send_state_event: Optional[USER_MAY_SEND_STATE_EVENT_CALLBACK] = None,
-        check_username_for_spam: Optional[CHECK_USERNAME_FOR_SPAM_CALLBACK] = None,
-        check_registration_for_spam: Optional[
-            CHECK_REGISTRATION_FOR_SPAM_CALLBACK
-        ] = None,
-        check_media_file_for_spam: Optional[CHECK_MEDIA_FILE_FOR_SPAM_CALLBACK] = None,
-        check_login_for_spam: Optional[CHECK_LOGIN_FOR_SPAM_CALLBACK] = None,
+        check_event_for_spam: CHECK_EVENT_FOR_SPAM_CALLBACK | None = None,
+        should_drop_federated_event: SHOULD_DROP_FEDERATED_EVENT_CALLBACK | None = None,
+        user_may_join_room: USER_MAY_JOIN_ROOM_CALLBACK | None = None,
+        user_may_invite: USER_MAY_INVITE_CALLBACK | None = None,
+        federated_user_may_invite: FEDERATED_USER_MAY_INVITE_CALLBACK | None = None,
+        user_may_send_3pid_invite: USER_MAY_SEND_3PID_INVITE_CALLBACK | None = None,
+        user_may_create_room: USER_MAY_CREATE_ROOM_CALLBACK | None = None,
+        user_may_create_room_alias: USER_MAY_CREATE_ROOM_ALIAS_CALLBACK | None = None,
+        user_may_publish_room: USER_MAY_PUBLISH_ROOM_CALLBACK | None = None,
+        user_may_send_state_event: USER_MAY_SEND_STATE_EVENT_CALLBACK | None = None,
+        check_username_for_spam: CHECK_USERNAME_FOR_SPAM_CALLBACK | None = None,
+        check_registration_for_spam: CHECK_REGISTRATION_FOR_SPAM_CALLBACK | None = None,
+        check_media_file_for_spam: CHECK_MEDIA_FILE_FOR_SPAM_CALLBACK | None = None,
+        check_login_for_spam: CHECK_LOGIN_FOR_SPAM_CALLBACK | None = None,
     ) -> None:
         """Registers callbacks for spam checking capabilities.
 
@@ -421,12 +426,12 @@ class ModuleApi:
     def register_account_validity_callbacks(
         self,
         *,
-        is_user_expired: Optional[IS_USER_EXPIRED_CALLBACK] = None,
-        on_user_registration: Optional[ON_USER_REGISTRATION_CALLBACK] = None,
-        on_user_login: Optional[ON_USER_LOGIN_CALLBACK] = None,
-        on_legacy_send_mail: Optional[ON_LEGACY_SEND_MAIL_CALLBACK] = None,
-        on_legacy_renew: Optional[ON_LEGACY_RENEW_CALLBACK] = None,
-        on_legacy_admin_request: Optional[ON_LEGACY_ADMIN_REQUEST] = None,
+        is_user_expired: IS_USER_EXPIRED_CALLBACK | None = None,
+        on_user_registration: ON_USER_REGISTRATION_CALLBACK | None = None,
+        on_user_login: ON_USER_LOGIN_CALLBACK | None = None,
+        on_legacy_send_mail: ON_LEGACY_SEND_MAIL_CALLBACK | None = None,
+        on_legacy_renew: ON_LEGACY_RENEW_CALLBACK | None = None,
+        on_legacy_admin_request: ON_LEGACY_ADMIN_REQUEST | None = None,
     ) -> None:
         """Registers callbacks for account validity capabilities.
 
@@ -444,9 +449,8 @@ class ModuleApi:
     def register_ratelimit_callbacks(
         self,
         *,
-        get_ratelimit_override_for_user: Optional[
-            GET_RATELIMIT_OVERRIDE_FOR_USER_CALLBACK
-        ] = None,
+        get_ratelimit_override_for_user: GET_RATELIMIT_OVERRIDE_FOR_USER_CALLBACK
+        | None = None,
     ) -> None:
         """Registers callbacks for ratelimit capabilities.
         Added in Synapse v1.132.0.
@@ -458,10 +462,13 @@ class ModuleApi:
     def register_media_repository_callbacks(
         self,
         *,
-        get_media_config_for_user: Optional[GET_MEDIA_CONFIG_FOR_USER_CALLBACK] = None,
-        is_user_allowed_to_upload_media_of_size: Optional[
-            IS_USER_ALLOWED_TO_UPLOAD_MEDIA_OF_SIZE_CALLBACK
-        ] = None,
+        get_media_config_for_user: GET_MEDIA_CONFIG_FOR_USER_CALLBACK | None = None,
+        is_user_allowed_to_upload_media_of_size: IS_USER_ALLOWED_TO_UPLOAD_MEDIA_OF_SIZE_CALLBACK
+        | None = None,
+        get_media_upload_limits_for_user: GET_MEDIA_UPLOAD_LIMITS_FOR_USER_CALLBACK
+        | None = None,
+        on_media_upload_limit_exceeded: ON_MEDIA_UPLOAD_LIMIT_EXCEEDED_CALLBACK
+        | None = None,
     ) -> None:
         """Registers callbacks for media repository capabilities.
         Added in Synapse v1.132.0.
@@ -469,33 +476,30 @@ class ModuleApi:
         return self._callbacks.media_repository.register_callbacks(
             get_media_config_for_user=get_media_config_for_user,
             is_user_allowed_to_upload_media_of_size=is_user_allowed_to_upload_media_of_size,
+            get_media_upload_limits_for_user=get_media_upload_limits_for_user,
+            on_media_upload_limit_exceeded=on_media_upload_limit_exceeded,
         )
 
     def register_third_party_rules_callbacks(
         self,
         *,
-        check_event_allowed: Optional[CHECK_EVENT_ALLOWED_CALLBACK] = None,
-        on_create_room: Optional[ON_CREATE_ROOM_CALLBACK] = None,
-        check_threepid_can_be_invited: Optional[
-            CHECK_THREEPID_CAN_BE_INVITED_CALLBACK
-        ] = None,
-        check_visibility_can_be_modified: Optional[
-            CHECK_VISIBILITY_CAN_BE_MODIFIED_CALLBACK
-        ] = None,
-        on_new_event: Optional[ON_NEW_EVENT_CALLBACK] = None,
-        check_can_shutdown_room: Optional[CHECK_CAN_SHUTDOWN_ROOM_CALLBACK] = None,
-        check_can_deactivate_user: Optional[CHECK_CAN_DEACTIVATE_USER_CALLBACK] = None,
-        on_profile_update: Optional[ON_PROFILE_UPDATE_CALLBACK] = None,
-        on_user_deactivation_status_changed: Optional[
-            ON_USER_DEACTIVATION_STATUS_CHANGED_CALLBACK
-        ] = None,
-        on_threepid_bind: Optional[ON_THREEPID_BIND_CALLBACK] = None,
-        on_add_user_third_party_identifier: Optional[
-            ON_ADD_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
-        ] = None,
-        on_remove_user_third_party_identifier: Optional[
-            ON_REMOVE_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
-        ] = None,
+        check_event_allowed: CHECK_EVENT_ALLOWED_CALLBACK | None = None,
+        on_create_room: ON_CREATE_ROOM_CALLBACK | None = None,
+        check_threepid_can_be_invited: CHECK_THREEPID_CAN_BE_INVITED_CALLBACK
+        | None = None,
+        check_visibility_can_be_modified: CHECK_VISIBILITY_CAN_BE_MODIFIED_CALLBACK
+        | None = None,
+        on_new_event: ON_NEW_EVENT_CALLBACK | None = None,
+        check_can_shutdown_room: CHECK_CAN_SHUTDOWN_ROOM_CALLBACK | None = None,
+        check_can_deactivate_user: CHECK_CAN_DEACTIVATE_USER_CALLBACK | None = None,
+        on_profile_update: ON_PROFILE_UPDATE_CALLBACK | None = None,
+        on_user_deactivation_status_changed: ON_USER_DEACTIVATION_STATUS_CHANGED_CALLBACK
+        | None = None,
+        on_threepid_bind: ON_THREEPID_BIND_CALLBACK | None = None,
+        on_add_user_third_party_identifier: ON_ADD_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
+        | None = None,
+        on_remove_user_third_party_identifier: ON_REMOVE_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
+        | None = None,
     ) -> None:
         """Registers callbacks for third party event rules capabilities.
 
@@ -519,8 +523,8 @@ class ModuleApi:
     def register_presence_router_callbacks(
         self,
         *,
-        get_users_for_states: Optional[GET_USERS_FOR_STATES_CALLBACK] = None,
-        get_interested_users: Optional[GET_INTERESTED_USERS_CALLBACK] = None,
+        get_users_for_states: GET_USERS_FOR_STATES_CALLBACK | None = None,
+        get_interested_users: GET_INTERESTED_USERS_CALLBACK | None = None,
     ) -> None:
         """Registers callbacks for presence router capabilities.
 
@@ -534,18 +538,15 @@ class ModuleApi:
     def register_password_auth_provider_callbacks(
         self,
         *,
-        check_3pid_auth: Optional[CHECK_3PID_AUTH_CALLBACK] = None,
-        on_logged_out: Optional[ON_LOGGED_OUT_CALLBACK] = None,
-        auth_checkers: Optional[
-            Dict[Tuple[str, Tuple[str, ...]], CHECK_AUTH_CALLBACK]
-        ] = None,
-        is_3pid_allowed: Optional[IS_3PID_ALLOWED_CALLBACK] = None,
-        get_username_for_registration: Optional[
-            GET_USERNAME_FOR_REGISTRATION_CALLBACK
-        ] = None,
-        get_displayname_for_registration: Optional[
-            GET_DISPLAYNAME_FOR_REGISTRATION_CALLBACK
-        ] = None,
+        check_3pid_auth: CHECK_3PID_AUTH_CALLBACK | None = None,
+        on_logged_out: ON_LOGGED_OUT_CALLBACK | None = None,
+        auth_checkers: dict[tuple[str, tuple[str, ...]], CHECK_AUTH_CALLBACK]
+        | None = None,
+        is_3pid_allowed: IS_3PID_ALLOWED_CALLBACK | None = None,
+        get_username_for_registration: GET_USERNAME_FOR_REGISTRATION_CALLBACK
+        | None = None,
+        get_displayname_for_registration: GET_DISPLAYNAME_FOR_REGISTRATION_CALLBACK
+        | None = None,
     ) -> None:
         """Registers callbacks for password auth provider capabilities.
 
@@ -569,8 +570,8 @@ class ModuleApi:
         self,
         *,
         on_update: ON_UPDATE_CALLBACK,
-        default_batch_size: Optional[DEFAULT_BATCH_SIZE_CALLBACK] = None,
-        min_batch_size: Optional[MIN_BATCH_SIZE_CALLBACK] = None,
+        default_batch_size: DEFAULT_BATCH_SIZE_CALLBACK | None = None,
+        min_batch_size: MIN_BATCH_SIZE_CALLBACK | None = None,
     ) -> None:
         """Registers background update controller callbacks.
 
@@ -587,7 +588,7 @@ class ModuleApi:
     def register_account_data_callbacks(
         self,
         *,
-        on_account_data_updated: Optional[ON_ACCOUNT_DATA_UPDATED_CALLBACK] = None,
+        on_account_data_updated: ON_ACCOUNT_DATA_UPDATED_CALLBACK | None = None,
     ) -> None:
         """Registers account data callbacks.
 
@@ -616,9 +617,8 @@ class ModuleApi:
     def register_add_extra_fields_to_unsigned_client_event_callbacks(
         self,
         *,
-        add_field_to_unsigned_callback: Optional[
-            ADD_EXTRA_FIELDS_TO_UNSIGNED_CLIENT_EVENT_CALLBACK
-        ] = None,
+        add_field_to_unsigned_callback: ADD_EXTRA_FIELDS_TO_UNSIGNED_CLIENT_EVENT_CALLBACK
+        | None = None,
     ) -> None:
         """Registers a callback that can be used to add fields to the unsigned
         section of events.
@@ -689,7 +689,7 @@ class ModuleApi:
         return self._server_name
 
     @property
-    def worker_name(self) -> Optional[str]:
+    def worker_name(self) -> str | None:
         """The name of the worker this specific instance is running as per the
         "worker_name" configuration setting, or None if it's the main process.
 
@@ -698,7 +698,7 @@ class ModuleApi:
         return self._hs.config.worker.worker_name
 
     @property
-    def worker_app(self) -> Optional[str]:
+    def worker_app(self) -> str | None:
         """The name of the worker app this specific instance is running as per the
         "worker_app" configuration setting, or None if it's the main process.
 
@@ -706,7 +706,7 @@ class ModuleApi:
         """
         return self._hs.config.worker.worker_app
 
-    async def get_userinfo_by_id(self, user_id: str) -> Optional[UserInfo]:
+    async def get_userinfo_by_id(self, user_id: str) -> UserInfo | None:
         """Get user info by user_id
 
         Added in Synapse v1.41.0.
@@ -807,7 +807,7 @@ class ModuleApi:
         user_id = UserID.from_string(f"@{localpart}:{server_name}")
         return await self._store.get_profileinfo(user_id)
 
-    async def get_threepids_for_user(self, user_id: str) -> List[Dict[str, str]]:
+    async def get_threepids_for_user(self, user_id: str) -> list[dict[str, str]]:
         """Look up the threepids (email addresses and phone numbers) associated with the
         given Matrix user ID.
 
@@ -824,7 +824,7 @@ class ModuleApi:
         """
         return [attr.asdict(t) for t in await self._store.user_get_threepids(user_id)]
 
-    def check_user_exists(self, user_id: str) -> "defer.Deferred[Optional[str]]":
+    def check_user_exists(self, user_id: str) -> "defer.Deferred[str | None]":
         """Check if user exists.
 
         Added in Synapse v0.25.0.
@@ -842,9 +842,9 @@ class ModuleApi:
     def register(
         self,
         localpart: str,
-        displayname: Optional[str] = None,
-        emails: Optional[List[str]] = None,
-    ) -> Generator["defer.Deferred[Any]", Any, Tuple[str, str]]:
+        displayname: str | None = None,
+        emails: list[str] | None = None,
+    ) -> Generator["defer.Deferred[Any]", Any, tuple[str, str]]:
         """Registers a new user with given localpart and optional displayname, emails.
 
         Also returns an access token for the new user.
@@ -873,8 +873,8 @@ class ModuleApi:
     def register_user(
         self,
         localpart: str,
-        displayname: Optional[str] = None,
-        emails: Optional[List[str]] = None,
+        displayname: str | None = None,
+        emails: list[str] | None = None,
         admin: bool = False,
     ) -> "defer.Deferred[str]":
         """Registers a new user with given localpart and optional displayname, emails.
@@ -907,9 +907,9 @@ class ModuleApi:
     def register_device(
         self,
         user_id: str,
-        device_id: Optional[str] = None,
-        initial_display_name: Optional[str] = None,
-    ) -> "defer.Deferred[Tuple[str, str, Optional[int], Optional[str]]]":
+        device_id: str | None = None,
+        initial_display_name: str | None = None,
+    ) -> "defer.Deferred[tuple[str, str, int | None, str | None]]":
         """Register a device for a user and generate an access token.
 
         Added in Synapse v1.2.0.
@@ -959,8 +959,8 @@ class ModuleApi:
         self,
         user_id: str,
         duration_in_ms: int = (2 * 60 * 1000),
-        auth_provider_id: Optional[str] = None,
-        auth_provider_session_id: Optional[str] = None,
+        auth_provider_id: str | None = None,
+        auth_provider_session_id: str | None = None,
     ) -> str:
         """Create a login token suitable for m.login.token authentication
 
@@ -1063,7 +1063,7 @@ class ModuleApi:
         )
 
     async def invalidate_cache(
-        self, cached_func: CachedFunction, keys: Tuple[Any, ...]
+        self, cached_func: CachedFunction, keys: tuple[Any, ...]
     ) -> None:
         """Invalidate a cache entry of a cached function across workers. The cached function
         needs to be registered on all workers first with `register_cached_function`.
@@ -1116,7 +1116,7 @@ class ModuleApi:
 
     @defer.inlineCallbacks
     def get_state_events_in_room(
-        self, room_id: str, types: Iterable[Tuple[str, Optional[str]]]
+        self, room_id: str, types: Iterable[tuple[str, str | None]]
     ) -> Generator[defer.Deferred, Any, Iterable[EventBase]]:
         """Gets current state events for the given room.
 
@@ -1147,8 +1147,8 @@ class ModuleApi:
         target: str,
         room_id: str,
         new_membership: str,
-        content: Optional[JsonDict] = None,
-        remote_room_hosts: Optional[List[str]] = None,
+        content: JsonDict | None = None,
+        remote_room_hosts: list[str] | None = None,
     ) -> EventBase:
         """Updates the membership of a user to the given value.
 
@@ -1324,7 +1324,7 @@ class ModuleApi:
             )
 
     async def set_presence_for_users(
-        self, users: Mapping[str, Tuple[str, Optional[str]]]
+        self, users: Mapping[str, tuple[str, str | None]]
     ) -> None:
         """
         Update the internal presence state of users.
@@ -1359,7 +1359,7 @@ class ModuleApi:
         f: Callable,
         msec: float,
         *args: object,
-        desc: Optional[str] = None,
+        desc: str | None = None,
         run_on_all_instances: bool = False,
         **kwargs: object,
     ) -> None:
@@ -1390,8 +1390,8 @@ class ModuleApi:
 
         if self._hs.config.worker.run_background_tasks or run_on_all_instances:
             self._clock.looping_call(
-                self.run_as_background_process,
-                msec,
+                self._hs.run_as_background_process,
+                Duration(milliseconds=msec),
                 desc,
                 lambda: maybe_awaitable(f(*args, **kwargs)),
             )
@@ -1418,7 +1418,7 @@ class ModuleApi:
         msec: float,
         f: Callable,
         *args: object,
-        desc: Optional[str] = None,
+        desc: str | None = None,
         **kwargs: object,
     ) -> IDelayedCall:
         """Wraps a function as a background process and calls it in a given number of milliseconds.
@@ -1446,9 +1446,8 @@ class ModuleApi:
             desc = f.__name__
 
         return self._clock.call_later(
-            # convert ms to seconds as needed by call_later.
-            msec * 0.001,
-            self.run_as_background_process,
+            Duration(milliseconds=msec),
+            self._hs.run_as_background_process,
             desc,
             lambda: maybe_awaitable(f(*args, **kwargs)),
         )
@@ -1459,16 +1458,16 @@ class ModuleApi:
         Added in Synapse v1.49.0.
         """
 
-        await self._clock.sleep(seconds)
+        await self._clock.sleep(Duration(seconds=seconds))
 
     async def send_http_push_notification(
         self,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         content: JsonDict,
-        tweaks: Optional[JsonMapping] = None,
-        default_payload: Optional[JsonMapping] = None,
-    ) -> Dict[str, bool]:
+        tweaks: JsonMapping | None = None,
+        default_payload: JsonMapping | None = None,
+    ) -> dict[str, bool]:
         """Send an HTTP push notification that is forwarded to the registered push gateway
         for the specified user/device.
 
@@ -1532,9 +1531,9 @@ class ModuleApi:
 
     def read_templates(
         self,
-        filenames: List[str],
-        custom_template_directory: Optional[str] = None,
-    ) -> List[jinja2.Template]:
+        filenames: list[str],
+        custom_template_directory: str | None = None,
+    ) -> list[jinja2.Template]:
         """Read and load the content of the template files at the given location.
         By default, Synapse will look for these templates in its configured template
         directory, but another directory to search in can be provided.
@@ -1554,7 +1553,7 @@ class ModuleApi:
             (td for td in (self.custom_template_dir, custom_template_directory) if td),
         )
 
-    def is_mine(self, id: Union[str, DomainSpecificString]) -> bool:
+    def is_mine(self, id: str | DomainSpecificString) -> bool:
         """
         Checks whether an ID (user id, room, ...) comes from this homeserver.
 
@@ -1573,7 +1572,7 @@ class ModuleApi:
 
     async def get_user_ip_and_agents(
         self, user_id: str, since_ts: int = 0
-    ) -> List[UserIpAndAgent]:
+    ) -> list[UserIpAndAgent]:
         """
         Return the list of user IPs and agents for a user.
 
@@ -1616,7 +1615,7 @@ class ModuleApi:
     async def get_room_state(
         self,
         room_id: str,
-        event_filter: Optional[Iterable[Tuple[str, Optional[str]]]] = None,
+        event_filter: Iterable[tuple[str, str | None]] | None = None,
     ) -> StateMap[EventBase]:
         """Returns the current state of the given room.
 
@@ -1658,11 +1657,11 @@ class ModuleApi:
     def run_as_background_process(
         self,
         desc: "LiteralString",
-        func: Callable[..., Awaitable[Optional[T]]],
+        func: Callable[..., Awaitable[T | None]],
         *args: Any,
         bg_start_span: bool = True,
         **kwargs: Any,
-    ) -> "defer.Deferred[Optional[T]]":
+    ) -> "defer.Deferred[T | None]":
         """Run the given function in its own logcontext, with resource metrics
 
         This should be used to wrap processes which are fired off to run in the
@@ -1689,8 +1688,8 @@ class ModuleApi:
             Note that the returned Deferred does not follow the synapse logcontext
             rules.
         """
-        return _run_as_background_process(
-            desc, self.server_name, func, *args, bg_start_span=bg_start_span, **kwargs
+        return self._hs.run_as_background_process(
+            desc, func, *args, bg_start_span=bg_start_span, **kwargs
         )
 
     async def defer_to_thread(
@@ -1713,6 +1712,33 @@ class ModuleApi:
         """
         return await defer_to_thread(self._hs.get_reactor(), f, *args, **kwargs)
 
+    async def defer_to_threadpool(
+        self,
+        threadpool: ThreadPool,
+        f: Callable[P, T],
+        *args: P.args,
+        **kwargs: P.kwargs,
+    ) -> T:
+        """Runs the given function in a separate thread from the given thread pool.
+
+        Allows specifying a custom thread pool instead of using the default Synapse
+        one. To use the default Synapse threadpool, use `defer_to_thread` instead.
+
+        Added in Synapse v1.140.0.
+
+        Args:
+            threadpool: The thread pool to use.
+            f: The function to run.
+            args: The function's arguments.
+            kwargs: The function's keyword arguments.
+
+        Returns:
+            The return value of the function once ran in a thread.
+        """
+        return await defer_to_threadpool(
+            self._hs.get_reactor(), threadpool, f, *args, **kwargs
+        )
+
     async def check_username(self, username: str) -> None:
         """Checks if the provided username uses the grammar defined in the Matrix
         specification, and is already being used by an existing user.
@@ -1753,9 +1779,7 @@ class ModuleApi:
         """
         await self._store.add_user_bound_threepid(user_id, medium, address, id_server)
 
-    def check_push_rule_actions(
-        self, actions: List[Union[str, Dict[str, str]]]
-    ) -> None:
+    def check_push_rule_actions(self, actions: list[str | dict[str, str]]) -> None:
         """Checks if the given push rule actions are valid according to the Matrix
         specification.
 
@@ -1778,7 +1802,7 @@ class ModuleApi:
         scope: str,
         kind: str,
         rule_id: str,
-        actions: List[Union[str, Dict[str, str]]],
+        actions: list[str | dict[str, str]],
     ) -> None:
         """Changes the actions of an existing push rule for the given user.
 
@@ -1816,8 +1840,8 @@ class ModuleApi:
         )
 
     async def get_monthly_active_users_by_service(
-        self, start_timestamp: Optional[int] = None, end_timestamp: Optional[int] = None
-    ) -> List[Tuple[str, str]]:
+        self, start_timestamp: int | None = None, end_timestamp: int | None = None
+    ) -> list[tuple[str, str]]:
         """Generates list of monthly active users and their services.
         Please see corresponding storage docstring for more details.
 
@@ -1837,7 +1861,7 @@ class ModuleApi:
             start_timestamp, end_timestamp
         )
 
-    async def get_canonical_room_alias(self, room_id: RoomID) -> Optional[RoomAlias]:
+    async def get_canonical_room_alias(self, room_id: RoomID) -> RoomAlias | None:
         """
         Retrieve the given room's current canonical alias.
 
@@ -1863,7 +1887,7 @@ class ModuleApi:
             return RoomAlias.from_string(room_alias_str)
         return None
 
-    async def lookup_room_alias(self, room_alias: str) -> Tuple[str, List[str]]:
+    async def lookup_room_alias(self, room_alias: str) -> tuple[str, list[str]]:
         """
         Get the room ID associated with a room alias.
 
@@ -1892,8 +1916,8 @@ class ModuleApi:
         user_id: str,
         config: JsonDict,
         ratelimit: bool = True,
-        creator_join_profile: Optional[JsonDict] = None,
-    ) -> Tuple[str, Optional[str]]:
+        creator_join_profile: JsonDict | None = None,
+    ) -> tuple[str, str | None]:
         """Creates a new room.
 
         Added in Synapse v1.65.0.
@@ -1966,27 +1990,47 @@ class ModuleApi:
         self,
         user_id: UserID,
         new_displayname: str,
-        deactivation: bool = False,
+        deactivation: bool | Sentinel = Sentinel.UNSET_SENTINEL,
     ) -> None:
         """Sets a user's display name.
 
         Added in Synapse v1.76.0.
 
+        (Synapse Developer note: All future arguments should be kwargs-only
+        due to https://github.com/element-hq/synapse/issues/19546)
+
         Args:
             user_id:
                 The user whose display name is to be changed.
             new_displayname:
                 The new display name to give the user.
             deactivation:
+                **deprecated since v1.150.0**
+                Callers should NOT pass this argument. Instead, omit it and leave it to the default.
+                Will log an error if it is passed.
+                Remove after 2027-01-01
+                Tracked by https://github.com/element-hq/synapse/issues/19546
+
                 Whether this change was made while deactivating the user.
+
+                Should be omitted, will produce a logged error if set to True.
+                It's likely that this flag should have stayed internal-only and
+                was accidentally exposed to the Module API.
+                It no longer has any function.
         """
         requester = create_requester(user_id)
+
+        if deactivation is not Sentinel.UNSET_SENTINEL:
+            logger.error(
+                "Deprecated `deactivation` parameter passed to `set_displayname` Module API (value: %r). This will break in 2027.",
+                deactivation,
+            )
+
         await self._hs.get_profile_handler().set_displayname(
             target_user=user_id,
             requester=requester,
             new_displayname=new_displayname,
             by_admin=True,
-            deactivation=deactivation,
         )
 
     def get_current_time_msec(self) -> int:
@@ -2063,7 +2107,7 @@ class AccountDataManager:
                 f"{user_id} is not local to this homeserver; can't access account data for remote users."
             )
 
-    async def get_global(self, user_id: str, data_type: str) -> Optional[JsonMapping]:
+    async def get_global(self, user_id: str, data_type: str) -> JsonMapping | None:
         """
         Gets some global account data, of a specified type, for the specified user.
 
diff --git a/synapse/module_api/callbacks/account_validity_callbacks.py b/synapse/module_api/callbacks/account_validity_callbacks.py
index a989249280..892e9c8ecb 100644
--- a/synapse/module_api/callbacks/account_validity_callbacks.py
+++ b/synapse/module_api/callbacks/account_validity_callbacks.py
@@ -20,43 +20,43 @@
 #
 
 import logging
-from typing import Awaitable, Callable, List, Optional, Tuple
+from typing import Awaitable, Callable
 
 from twisted.web.http import Request
 
 logger = logging.getLogger(__name__)
 
 # Types for callbacks to be registered via the module api
-IS_USER_EXPIRED_CALLBACK = Callable[[str], Awaitable[Optional[bool]]]
+IS_USER_EXPIRED_CALLBACK = Callable[[str], Awaitable[bool | None]]
 ON_USER_REGISTRATION_CALLBACK = Callable[[str], Awaitable]
-ON_USER_LOGIN_CALLBACK = Callable[[str, Optional[str], Optional[str]], Awaitable]
+ON_USER_LOGIN_CALLBACK = Callable[[str, str | None, str | None], Awaitable]
 # Temporary hooks to allow for a transition from `/_matrix/client` endpoints
 # to `/_synapse/client/account_validity`. See `register_callbacks` below.
 ON_LEGACY_SEND_MAIL_CALLBACK = Callable[[str], Awaitable]
-ON_LEGACY_RENEW_CALLBACK = Callable[[str], Awaitable[Tuple[bool, bool, int]]]
+ON_LEGACY_RENEW_CALLBACK = Callable[[str], Awaitable[tuple[bool, bool, int]]]
 ON_LEGACY_ADMIN_REQUEST = Callable[[Request], Awaitable]
 
 
 class AccountValidityModuleApiCallbacks:
     def __init__(self) -> None:
-        self.is_user_expired_callbacks: List[IS_USER_EXPIRED_CALLBACK] = []
-        self.on_user_registration_callbacks: List[ON_USER_REGISTRATION_CALLBACK] = []
-        self.on_user_login_callbacks: List[ON_USER_LOGIN_CALLBACK] = []
-        self.on_legacy_send_mail_callback: Optional[ON_LEGACY_SEND_MAIL_CALLBACK] = None
-        self.on_legacy_renew_callback: Optional[ON_LEGACY_RENEW_CALLBACK] = None
+        self.is_user_expired_callbacks: list[IS_USER_EXPIRED_CALLBACK] = []
+        self.on_user_registration_callbacks: list[ON_USER_REGISTRATION_CALLBACK] = []
+        self.on_user_login_callbacks: list[ON_USER_LOGIN_CALLBACK] = []
+        self.on_legacy_send_mail_callback: ON_LEGACY_SEND_MAIL_CALLBACK | None = None
+        self.on_legacy_renew_callback: ON_LEGACY_RENEW_CALLBACK | None = None
 
         # The legacy admin requests callback isn't a protected attribute because we need
         # to access it from the admin servlet, which is outside of this handler.
-        self.on_legacy_admin_request_callback: Optional[ON_LEGACY_ADMIN_REQUEST] = None
+        self.on_legacy_admin_request_callback: ON_LEGACY_ADMIN_REQUEST | None = None
 
     def register_callbacks(
         self,
-        is_user_expired: Optional[IS_USER_EXPIRED_CALLBACK] = None,
-        on_user_registration: Optional[ON_USER_REGISTRATION_CALLBACK] = None,
-        on_user_login: Optional[ON_USER_LOGIN_CALLBACK] = None,
-        on_legacy_send_mail: Optional[ON_LEGACY_SEND_MAIL_CALLBACK] = None,
-        on_legacy_renew: Optional[ON_LEGACY_RENEW_CALLBACK] = None,
-        on_legacy_admin_request: Optional[ON_LEGACY_ADMIN_REQUEST] = None,
+        is_user_expired: IS_USER_EXPIRED_CALLBACK | None = None,
+        on_user_registration: ON_USER_REGISTRATION_CALLBACK | None = None,
+        on_user_login: ON_USER_LOGIN_CALLBACK | None = None,
+        on_legacy_send_mail: ON_LEGACY_SEND_MAIL_CALLBACK | None = None,
+        on_legacy_renew: ON_LEGACY_RENEW_CALLBACK | None = None,
+        on_legacy_admin_request: ON_LEGACY_ADMIN_REQUEST | None = None,
     ) -> None:
         """Register callbacks from module for each hook."""
         if is_user_expired is not None:
diff --git a/synapse/module_api/callbacks/media_repository_callbacks.py b/synapse/module_api/callbacks/media_repository_callbacks.py
index 2ab65f9fd6..f1e6ea4c38 100644
--- a/synapse/module_api/callbacks/media_repository_callbacks.py
+++ b/synapse/module_api/callbacks/media_repository_callbacks.py
@@ -13,8 +13,9 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Awaitable, Callable, List, Optional
+from typing import TYPE_CHECKING, Awaitable, Callable
 
+from synapse.config.repository import MediaUploadLimit
 from synapse.types import JsonDict
 from synapse.util.async_helpers import delay_cancellation
 from synapse.util.metrics import Measure
@@ -24,28 +25,45 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
-GET_MEDIA_CONFIG_FOR_USER_CALLBACK = Callable[[str], Awaitable[Optional[JsonDict]]]
+GET_MEDIA_CONFIG_FOR_USER_CALLBACK = Callable[[str], Awaitable[JsonDict | None]]
 
 IS_USER_ALLOWED_TO_UPLOAD_MEDIA_OF_SIZE_CALLBACK = Callable[[str, int], Awaitable[bool]]
 
+GET_MEDIA_UPLOAD_LIMITS_FOR_USER_CALLBACK = Callable[
+    [str], Awaitable[list[MediaUploadLimit] | None]
+]
+
+ON_MEDIA_UPLOAD_LIMIT_EXCEEDED_CALLBACK = Callable[
+    [str, MediaUploadLimit, int, int], Awaitable[None]
+]
+
 
 class MediaRepositoryModuleApiCallbacks:
     def __init__(self, hs: "HomeServer") -> None:
         self.server_name = hs.hostname
         self.clock = hs.get_clock()
-        self._get_media_config_for_user_callbacks: List[
+        self._get_media_config_for_user_callbacks: list[
             GET_MEDIA_CONFIG_FOR_USER_CALLBACK
         ] = []
-        self._is_user_allowed_to_upload_media_of_size_callbacks: List[
+        self._is_user_allowed_to_upload_media_of_size_callbacks: list[
             IS_USER_ALLOWED_TO_UPLOAD_MEDIA_OF_SIZE_CALLBACK
         ] = []
+        self._get_media_upload_limits_for_user_callbacks: list[
+            GET_MEDIA_UPLOAD_LIMITS_FOR_USER_CALLBACK
+        ] = []
+        self._on_media_upload_limit_exceeded_callbacks: list[
+            ON_MEDIA_UPLOAD_LIMIT_EXCEEDED_CALLBACK
+        ] = []
 
     def register_callbacks(
         self,
-        get_media_config_for_user: Optional[GET_MEDIA_CONFIG_FOR_USER_CALLBACK] = None,
-        is_user_allowed_to_upload_media_of_size: Optional[
-            IS_USER_ALLOWED_TO_UPLOAD_MEDIA_OF_SIZE_CALLBACK
-        ] = None,
+        get_media_config_for_user: GET_MEDIA_CONFIG_FOR_USER_CALLBACK | None = None,
+        is_user_allowed_to_upload_media_of_size: IS_USER_ALLOWED_TO_UPLOAD_MEDIA_OF_SIZE_CALLBACK
+        | None = None,
+        get_media_upload_limits_for_user: GET_MEDIA_UPLOAD_LIMITS_FOR_USER_CALLBACK
+        | None = None,
+        on_media_upload_limit_exceeded: ON_MEDIA_UPLOAD_LIMIT_EXCEEDED_CALLBACK
+        | None = None,
     ) -> None:
         """Register callbacks from module for each hook."""
         if get_media_config_for_user is not None:
@@ -56,14 +74,24 @@ class MediaRepositoryModuleApiCallbacks:
                 is_user_allowed_to_upload_media_of_size
             )
 
-    async def get_media_config_for_user(self, user_id: str) -> Optional[JsonDict]:
+        if get_media_upload_limits_for_user is not None:
+            self._get_media_upload_limits_for_user_callbacks.append(
+                get_media_upload_limits_for_user
+            )
+
+        if on_media_upload_limit_exceeded is not None:
+            self._on_media_upload_limit_exceeded_callbacks.append(
+                on_media_upload_limit_exceeded
+            )
+
+    async def get_media_config_for_user(self, user_id: str) -> JsonDict | None:
         for callback in self._get_media_config_for_user_callbacks:
             with Measure(
                 self.clock,
                 name=f"{callback.__module__}.{callback.__qualname__}",
                 server_name=self.server_name,
             ):
-                res: Optional[JsonDict] = await delay_cancellation(callback(user_id))
+                res: JsonDict | None = await delay_cancellation(callback(user_id))
             if res:
                 return res
 
@@ -83,3 +111,47 @@ class MediaRepositoryModuleApiCallbacks:
                 return res
 
         return True
+
+    async def get_media_upload_limits_for_user(
+        self, user_id: str
+    ) -> list[MediaUploadLimit] | None:
+        """
+        Get the first non-None list of MediaUploadLimits for the user from the registered callbacks.
+        If a list is returned it will be sorted in descending order of duration.
+        """
+        for callback in self._get_media_upload_limits_for_user_callbacks:
+            with Measure(
+                self.clock,
+                name=f"{callback.__module__}.{callback.__qualname__}",
+                server_name=self.server_name,
+            ):
+                res: list[MediaUploadLimit] | None = await delay_cancellation(
+                    callback(user_id)
+                )
+            if res is not None:  # to allow [] to be returned meaning no limit
+                # We sort them in descending order of time period
+                res.sort(key=lambda limit: limit.time_period_ms, reverse=True)
+                return res
+
+        return None
+
+    async def on_media_upload_limit_exceeded(
+        self,
+        user_id: str,
+        limit: MediaUploadLimit,
+        sent_bytes: int,
+        attempted_bytes: int,
+    ) -> None:
+        for callback in self._on_media_upload_limit_exceeded_callbacks:
+            with Measure(
+                self.clock,
+                name=f"{callback.__module__}.{callback.__qualname__}",
+                server_name=self.server_name,
+            ):
+                # Use a copy of the data in case the module modifies it
+                limit_copy = MediaUploadLimit(
+                    max_bytes=limit.max_bytes, time_period_ms=limit.time_period_ms
+                )
+                await delay_cancellation(
+                    callback(user_id, limit_copy, sent_bytes, attempted_bytes)
+                )
diff --git a/synapse/module_api/callbacks/ratelimit_callbacks.py b/synapse/module_api/callbacks/ratelimit_callbacks.py
index a580ea7d7c..0f4080dcd6 100644
--- a/synapse/module_api/callbacks/ratelimit_callbacks.py
+++ b/synapse/module_api/callbacks/ratelimit_callbacks.py
@@ -13,7 +13,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Awaitable, Callable, List, Optional
+from typing import TYPE_CHECKING, Awaitable, Callable
 
 import attr
 
@@ -37,7 +37,7 @@ class RatelimitOverride:
 
 
 GET_RATELIMIT_OVERRIDE_FOR_USER_CALLBACK = Callable[
-    [str, str], Awaitable[Optional[RatelimitOverride]]
+    [str, str], Awaitable[RatelimitOverride | None]
 ]
 
 
@@ -45,15 +45,14 @@ class RatelimitModuleApiCallbacks:
     def __init__(self, hs: "HomeServer") -> None:
         self.server_name = hs.hostname
         self.clock = hs.get_clock()
-        self._get_ratelimit_override_for_user_callbacks: List[
+        self._get_ratelimit_override_for_user_callbacks: list[
             GET_RATELIMIT_OVERRIDE_FOR_USER_CALLBACK
         ] = []
 
     def register_callbacks(
         self,
-        get_ratelimit_override_for_user: Optional[
-            GET_RATELIMIT_OVERRIDE_FOR_USER_CALLBACK
-        ] = None,
+        get_ratelimit_override_for_user: GET_RATELIMIT_OVERRIDE_FOR_USER_CALLBACK
+        | None = None,
     ) -> None:
         """Register callbacks from module for each hook."""
         if get_ratelimit_override_for_user is not None:
@@ -63,14 +62,14 @@ class RatelimitModuleApiCallbacks:
 
     async def get_ratelimit_override_for_user(
         self, user_id: str, limiter_name: str
-    ) -> Optional[RatelimitOverride]:
+    ) -> RatelimitOverride | None:
         for callback in self._get_ratelimit_override_for_user_callbacks:
             with Measure(
                 self.clock,
                 name=f"{callback.__module__}.{callback.__qualname__}",
                 server_name=self.server_name,
             ):
-                res: Optional[RatelimitOverride] = await delay_cancellation(
+                res: RatelimitOverride | None = await delay_cancellation(
                     callback(user_id, limiter_name)
                 )
             if res:
diff --git a/synapse/module_api/callbacks/spamchecker_callbacks.py b/synapse/module_api/callbacks/spamchecker_callbacks.py
index 428e733979..8b34f7ef6c 100644
--- a/synapse/module_api/callbacks/spamchecker_callbacks.py
+++ b/synapse/module_api/callbacks/spamchecker_callbacks.py
@@ -29,11 +29,7 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    List,
     Literal,
-    Optional,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -55,210 +51,96 @@ logger = logging.getLogger(__name__)
 
 CHECK_EVENT_FOR_SPAM_CALLBACK = Callable[
     ["synapse.events.EventBase"],
-    Awaitable[
-        Union[
-            str,
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[str | Codes | tuple[Codes, JsonDict] | bool],
 ]
 SHOULD_DROP_FEDERATED_EVENT_CALLBACK = Callable[
     ["synapse.events.EventBase"],
-    Awaitable[Union[bool, str]],
+    Awaitable[bool | str],
 ]
 USER_MAY_JOIN_ROOM_CALLBACK = Callable[
     [str, str, bool],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict] | bool],
 ]
 USER_MAY_INVITE_CALLBACK = Callable[
     [str, str, str],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict] | bool],
 ]
 FEDERATED_USER_MAY_INVITE_CALLBACK = Callable[
     ["synapse.events.EventBase"],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict] | bool],
 ]
 USER_MAY_SEND_3PID_INVITE_CALLBACK = Callable[
     [str, str, str, str],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict] | bool],
 ]
-USER_MAY_CREATE_ROOM_CALLBACK_RETURN_VALUE = Union[
-    Literal["NOT_SPAM"],
-    Codes,
+USER_MAY_CREATE_ROOM_CALLBACK_RETURN_VALUE = (
+    Literal["NOT_SPAM"]
+    | Codes
+    |
     # Highly experimental, not officially part of the spamchecker API, may
     # disappear without warning depending on the results of ongoing
     # experiments.
     # Use this to return additional information as part of an error.
-    Tuple[Codes, JsonDict],
+    tuple[Codes, JsonDict]
+    |
     # Deprecated
-    bool,
-]
-USER_MAY_CREATE_ROOM_CALLBACK = Union[
+    bool
+)
+USER_MAY_CREATE_ROOM_CALLBACK = (
     Callable[
         [str, JsonDict],
         Awaitable[USER_MAY_CREATE_ROOM_CALLBACK_RETURN_VALUE],
-    ],
-    Callable[  # Single argument variant for backwards compatibility
+    ]
+    | Callable[  # Single argument variant for backwards compatibility
         [str], Awaitable[USER_MAY_CREATE_ROOM_CALLBACK_RETURN_VALUE]
-    ],
-]
+    ]
+)
 USER_MAY_CREATE_ROOM_ALIAS_CALLBACK = Callable[
     [str, RoomAlias],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict] | bool],
 ]
 USER_MAY_PUBLISH_ROOM_CALLBACK = Callable[
     [str, str],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict] | bool],
 ]
 USER_MAY_SEND_STATE_EVENT_CALLBACK = Callable[
     [str, str, str, str, JsonDict],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-        ]
-    ],
-]
-CHECK_USERNAME_FOR_SPAM_CALLBACK = Union[
-    Callable[[UserProfile], Awaitable[bool]],
-    Callable[[UserProfile, str], Awaitable[bool]],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict]],
 ]
+CHECK_USERNAME_FOR_SPAM_CALLBACK = (
+    Callable[[UserProfile], Awaitable[bool]]
+    | Callable[[UserProfile, str], Awaitable[bool]]
+)
 LEGACY_CHECK_REGISTRATION_FOR_SPAM_CALLBACK = Callable[
     [
-        Optional[dict],
-        Optional[str],
-        Collection[Tuple[str, str]],
+        dict | None,
+        str | None,
+        Collection[tuple[str, str]],
     ],
     Awaitable[RegistrationBehaviour],
 ]
 CHECK_REGISTRATION_FOR_SPAM_CALLBACK = Callable[
     [
-        Optional[dict],
-        Optional[str],
-        Collection[Tuple[str, str]],
-        Optional[str],
+        dict | None,
+        str | None,
+        Collection[tuple[str, str]],
+        str | None,
     ],
     Awaitable[RegistrationBehaviour],
 ]
 CHECK_MEDIA_FILE_FOR_SPAM_CALLBACK = Callable[
     [ReadableFileWrapper, FileInfo],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-            # Deprecated
-            bool,
-        ]
-    ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict] | bool],
 ]
 CHECK_LOGIN_FOR_SPAM_CALLBACK = Callable[
     [
         str,
-        Optional[str],
-        Optional[str],
-        Collection[Tuple[Optional[str], str]],
-        Optional[str],
-    ],
-    Awaitable[
-        Union[
-            Literal["NOT_SPAM"],
-            Codes,
-            # Highly experimental, not officially part of the spamchecker API, may
-            # disappear without warning depending on the results of ongoing
-            # experiments.
-            # Use this to return additional information as part of an error.
-            Tuple[Codes, JsonDict],
-        ]
+        str | None,
+        str | None,
+        Collection[tuple[str | None, str]],
+        str | None,
     ],
+    Awaitable[Literal["NOT_SPAM"] | Codes | tuple[Codes, JsonDict]],
 ]
 
 
@@ -266,7 +148,7 @@ def load_legacy_spam_checkers(hs: "synapse.server.HomeServer") -> None:
     """Wrapper that loads spam checkers configured using the old configuration, and
     registers the spam checker hooks they implement.
     """
-    spam_checkers: List[Any] = []
+    spam_checkers: list[Any] = []
     api = hs.get_module_api()
     for module, config in hs.config.spamchecker.spam_checkers:
         # Older spam checkers don't accept the `api` argument, so we
@@ -294,7 +176,7 @@ def load_legacy_spam_checkers(hs: "synapse.server.HomeServer") -> None:
     for spam_checker in spam_checkers:
         # Methods on legacy spam checkers might not be async, so we wrap them around a
         # wrapper that will call maybe_awaitable on the result.
-        def async_wrapper(f: Optional[Callable]) -> Optional[Callable[..., Awaitable]]:
+        def async_wrapper(f: Callable | None) -> Callable[..., Awaitable] | None:
             # f might be None if the callback isn't implemented by the module. In this
             # case we don't want to register a callback at all so we return None.
             if f is None:
@@ -310,11 +192,11 @@ def load_legacy_spam_checkers(hs: "synapse.server.HomeServer") -> None:
                     # that gives it only 3 arguments and drops the auth_provider_id on
                     # the floor.
                     def wrapper(
-                        email_threepid: Optional[dict],
-                        username: Optional[str],
-                        request_info: Collection[Tuple[str, str]],
-                        auth_provider_id: Optional[str],
-                    ) -> Union[Awaitable[RegistrationBehaviour], RegistrationBehaviour]:
+                        email_threepid: dict | None,
+                        username: str | None,
+                        request_info: Collection[tuple[str, str]],
+                        auth_provider_id: str | None,
+                    ) -> Awaitable[RegistrationBehaviour] | RegistrationBehaviour:
                         # Assertion required because mypy can't prove we won't
                         # change `f` back to `None`. See
                         # https://mypy.readthedocs.io/en/latest/common_issues.html#narrowing-and-inner-functions
@@ -359,59 +241,53 @@ class SpamCheckerModuleApiCallbacks:
         self.server_name = hs.hostname
         self.clock = hs.get_clock()
 
-        self._check_event_for_spam_callbacks: List[CHECK_EVENT_FOR_SPAM_CALLBACK] = []
-        self._should_drop_federated_event_callbacks: List[
+        self._check_event_for_spam_callbacks: list[CHECK_EVENT_FOR_SPAM_CALLBACK] = []
+        self._should_drop_federated_event_callbacks: list[
             SHOULD_DROP_FEDERATED_EVENT_CALLBACK
         ] = []
-        self._user_may_join_room_callbacks: List[USER_MAY_JOIN_ROOM_CALLBACK] = []
-        self._user_may_invite_callbacks: List[USER_MAY_INVITE_CALLBACK] = []
-        self._federated_user_may_invite_callbacks: List[
+        self._user_may_join_room_callbacks: list[USER_MAY_JOIN_ROOM_CALLBACK] = []
+        self._user_may_invite_callbacks: list[USER_MAY_INVITE_CALLBACK] = []
+        self._federated_user_may_invite_callbacks: list[
             FEDERATED_USER_MAY_INVITE_CALLBACK
         ] = []
-        self._user_may_send_3pid_invite_callbacks: List[
+        self._user_may_send_3pid_invite_callbacks: list[
             USER_MAY_SEND_3PID_INVITE_CALLBACK
         ] = []
-        self._user_may_create_room_callbacks: List[USER_MAY_CREATE_ROOM_CALLBACK] = []
-        self._user_may_send_state_event_callbacks: List[
+        self._user_may_create_room_callbacks: list[USER_MAY_CREATE_ROOM_CALLBACK] = []
+        self._user_may_send_state_event_callbacks: list[
             USER_MAY_SEND_STATE_EVENT_CALLBACK
         ] = []
-        self._user_may_create_room_alias_callbacks: List[
+        self._user_may_create_room_alias_callbacks: list[
             USER_MAY_CREATE_ROOM_ALIAS_CALLBACK
         ] = []
-        self._user_may_publish_room_callbacks: List[USER_MAY_PUBLISH_ROOM_CALLBACK] = []
-        self._check_username_for_spam_callbacks: List[
+        self._user_may_publish_room_callbacks: list[USER_MAY_PUBLISH_ROOM_CALLBACK] = []
+        self._check_username_for_spam_callbacks: list[
             CHECK_USERNAME_FOR_SPAM_CALLBACK
         ] = []
-        self._check_registration_for_spam_callbacks: List[
+        self._check_registration_for_spam_callbacks: list[
             CHECK_REGISTRATION_FOR_SPAM_CALLBACK
         ] = []
-        self._check_media_file_for_spam_callbacks: List[
+        self._check_media_file_for_spam_callbacks: list[
             CHECK_MEDIA_FILE_FOR_SPAM_CALLBACK
         ] = []
-        self._check_login_for_spam_callbacks: List[CHECK_LOGIN_FOR_SPAM_CALLBACK] = []
+        self._check_login_for_spam_callbacks: list[CHECK_LOGIN_FOR_SPAM_CALLBACK] = []
 
     def register_callbacks(
         self,
-        check_event_for_spam: Optional[CHECK_EVENT_FOR_SPAM_CALLBACK] = None,
-        should_drop_federated_event: Optional[
-            SHOULD_DROP_FEDERATED_EVENT_CALLBACK
-        ] = None,
-        user_may_join_room: Optional[USER_MAY_JOIN_ROOM_CALLBACK] = None,
-        user_may_invite: Optional[USER_MAY_INVITE_CALLBACK] = None,
-        federated_user_may_invite: Optional[FEDERATED_USER_MAY_INVITE_CALLBACK] = None,
-        user_may_send_3pid_invite: Optional[USER_MAY_SEND_3PID_INVITE_CALLBACK] = None,
-        user_may_create_room: Optional[USER_MAY_CREATE_ROOM_CALLBACK] = None,
-        user_may_create_room_alias: Optional[
-            USER_MAY_CREATE_ROOM_ALIAS_CALLBACK
-        ] = None,
-        user_may_publish_room: Optional[USER_MAY_PUBLISH_ROOM_CALLBACK] = None,
-        check_username_for_spam: Optional[CHECK_USERNAME_FOR_SPAM_CALLBACK] = None,
-        check_registration_for_spam: Optional[
-            CHECK_REGISTRATION_FOR_SPAM_CALLBACK
-        ] = None,
-        check_media_file_for_spam: Optional[CHECK_MEDIA_FILE_FOR_SPAM_CALLBACK] = None,
-        check_login_for_spam: Optional[CHECK_LOGIN_FOR_SPAM_CALLBACK] = None,
-        user_may_send_state_event: Optional[USER_MAY_SEND_STATE_EVENT_CALLBACK] = None,
+        check_event_for_spam: CHECK_EVENT_FOR_SPAM_CALLBACK | None = None,
+        should_drop_federated_event: SHOULD_DROP_FEDERATED_EVENT_CALLBACK | None = None,
+        user_may_join_room: USER_MAY_JOIN_ROOM_CALLBACK | None = None,
+        user_may_invite: USER_MAY_INVITE_CALLBACK | None = None,
+        federated_user_may_invite: FEDERATED_USER_MAY_INVITE_CALLBACK | None = None,
+        user_may_send_3pid_invite: USER_MAY_SEND_3PID_INVITE_CALLBACK | None = None,
+        user_may_create_room: USER_MAY_CREATE_ROOM_CALLBACK | None = None,
+        user_may_create_room_alias: USER_MAY_CREATE_ROOM_ALIAS_CALLBACK | None = None,
+        user_may_publish_room: USER_MAY_PUBLISH_ROOM_CALLBACK | None = None,
+        check_username_for_spam: CHECK_USERNAME_FOR_SPAM_CALLBACK | None = None,
+        check_registration_for_spam: CHECK_REGISTRATION_FOR_SPAM_CALLBACK | None = None,
+        check_media_file_for_spam: CHECK_MEDIA_FILE_FOR_SPAM_CALLBACK | None = None,
+        check_login_for_spam: CHECK_LOGIN_FOR_SPAM_CALLBACK | None = None,
+        user_may_send_state_event: USER_MAY_SEND_STATE_EVENT_CALLBACK | None = None,
     ) -> None:
         """Register callbacks from module for each hook."""
         if check_event_for_spam is not None:
@@ -471,7 +347,7 @@ class SpamCheckerModuleApiCallbacks:
     @trace
     async def check_event_for_spam(
         self, event: "synapse.events.EventBase"
-    ) -> Union[Tuple[Codes, JsonDict], str]:
+    ) -> tuple[Codes, JsonDict] | str:
         """Checks if a given event is considered "spammy" by this server.
 
         If the server considers an event spammy, then it will be rejected if
@@ -534,7 +410,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def should_drop_federated_event(
         self, event: "synapse.events.EventBase"
-    ) -> Union[bool, str]:
+    ) -> bool | str:
         """Checks if a given federated event is considered "spammy" by this
         server.
 
@@ -553,7 +429,7 @@ class SpamCheckerModuleApiCallbacks:
                 name=f"{callback.__module__}.{callback.__qualname__}",
                 server_name=self.server_name,
             ):
-                res: Union[bool, str] = await delay_cancellation(callback(event))
+                res: bool | str = await delay_cancellation(callback(event))
             if res:
                 return res
 
@@ -561,7 +437,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def user_may_join_room(
         self, user_id: str, room_id: str, is_invited: bool
-    ) -> Union[Tuple[Codes, JsonDict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, JsonDict] | Literal["NOT_SPAM"]:
         """Checks if a given users is allowed to join a room.
         Not called when a user creates a room.
 
@@ -605,7 +481,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def user_may_invite(
         self, inviter_userid: str, invitee_userid: str, room_id: str
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a given user may send an invite
 
         Args:
@@ -650,7 +526,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def federated_user_may_invite(
         self, event: "synapse.events.EventBase"
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a given user may send an invite
 
         Args:
@@ -691,7 +567,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def user_may_send_3pid_invite(
         self, inviter_userid: str, medium: str, address: str, room_id: str
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a given user may invite a given threepid into the room
 
         Note that if the threepid is already associated with a Matrix user ID, Synapse
@@ -739,7 +615,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def user_may_create_room(
         self, userid: str, room_config: JsonDict
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a given user may create a room
 
         Args:
@@ -805,7 +681,7 @@ class SpamCheckerModuleApiCallbacks:
         event_type: str,
         state_key: str,
         content: JsonDict,
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a given user may create a room with a given visibility
         Args:
             user_id: The ID of the user attempting to create a room
@@ -838,7 +714,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def user_may_create_room_alias(
         self, userid: str, room_alias: RoomAlias
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a given user may create a room alias
 
         Args:
@@ -876,7 +752,7 @@ class SpamCheckerModuleApiCallbacks:
 
     async def user_may_publish_room(
         self, userid: str, room_id: str
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a given user may publish a room to the directory
 
         Args:
@@ -962,10 +838,10 @@ class SpamCheckerModuleApiCallbacks:
 
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
-        auth_provider_id: Optional[str] = None,
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
+        auth_provider_id: str | None = None,
     ) -> RegistrationBehaviour:
         """Checks if we should allow the given registration request.
 
@@ -1000,7 +876,7 @@ class SpamCheckerModuleApiCallbacks:
     @trace
     async def check_media_file_for_spam(
         self, file_wrapper: ReadableFileWrapper, file_info: FileInfo
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if a piece of newly uploaded media should be blocked.
 
         This will be called for local uploads, downloads of remote media, each
@@ -1013,7 +889,7 @@ class SpamCheckerModuleApiCallbacks:
 
             async def check_media_file_for_spam(
                 self, file: ReadableFileWrapper, file_info: FileInfo
-            ) -> Union[Codes, Literal["NOT_SPAM"]]:
+            ) -> Codes | Literal["NOT_SPAM"]:
                 buffer = BytesIO()
                 await file.write_chunks_to(buffer.write)
 
@@ -1060,11 +936,11 @@ class SpamCheckerModuleApiCallbacks:
     async def check_login_for_spam(
         self,
         user_id: str,
-        device_id: Optional[str],
-        initial_display_name: Optional[str],
-        request_info: Collection[Tuple[Optional[str], str]],
-        auth_provider_id: Optional[str] = None,
-    ) -> Union[Tuple[Codes, dict], Literal["NOT_SPAM"]]:
+        device_id: str | None,
+        initial_display_name: str | None,
+        request_info: Collection[tuple[str | None, str]],
+        auth_provider_id: str | None = None,
+    ) -> tuple[Codes, dict] | Literal["NOT_SPAM"]:
         """Checks if we should allow the given registration request.
 
         Args:
diff --git a/synapse/module_api/callbacks/third_party_event_rules_callbacks.py b/synapse/module_api/callbacks/third_party_event_rules_callbacks.py
index 9f7a04372d..65f5a6b183 100644
--- a/synapse/module_api/callbacks/third_party_event_rules_callbacks.py
+++ b/synapse/module_api/callbacks/third_party_event_rules_callbacks.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Any, Awaitable, Callable, List, Optional, Tuple
+from typing import TYPE_CHECKING, Any, Awaitable, Callable
 
 from twisted.internet.defer import CancelledError
 
@@ -37,7 +37,7 @@ logger = logging.getLogger(__name__)
 
 
 CHECK_EVENT_ALLOWED_CALLBACK = Callable[
-    [EventBase, StateMap[EventBase]], Awaitable[Tuple[bool, Optional[dict]]]
+    [EventBase, StateMap[EventBase]], Awaitable[tuple[bool, dict | None]]
 ]
 ON_CREATE_ROOM_CALLBACK = Callable[[Requester, dict, bool], Awaitable]
 CHECK_THREEPID_CAN_BE_INVITED_CALLBACK = Callable[
@@ -47,7 +47,7 @@ CHECK_VISIBILITY_CAN_BE_MODIFIED_CALLBACK = Callable[
     [str, StateMap[EventBase], str], Awaitable[bool]
 ]
 ON_NEW_EVENT_CALLBACK = Callable[[EventBase, StateMap[EventBase]], Awaitable]
-CHECK_CAN_SHUTDOWN_ROOM_CALLBACK = Callable[[Optional[str], str], Awaitable[bool]]
+CHECK_CAN_SHUTDOWN_ROOM_CALLBACK = Callable[[str | None, str], Awaitable[bool]]
 CHECK_CAN_DEACTIVATE_USER_CALLBACK = Callable[[str, bool], Awaitable[bool]]
 ON_PROFILE_UPDATE_CALLBACK = Callable[[str, ProfileInfo, bool, bool], Awaitable]
 ON_USER_DEACTIVATION_STATUS_CHANGED_CALLBACK = Callable[[str, bool, bool], Awaitable]
@@ -77,7 +77,7 @@ def load_legacy_third_party_event_rules(hs: "HomeServer") -> None:
         "check_visibility_can_be_modified",
     }
 
-    def async_wrapper(f: Optional[Callable]) -> Optional[Callable[..., Awaitable]]:
+    def async_wrapper(f: Callable | None) -> Callable[..., Awaitable] | None:
         # f might be None if the callback isn't implemented by the module. In this
         # case we don't want to register a callback at all so we return None.
         if f is None:
@@ -93,7 +93,7 @@ def load_legacy_third_party_event_rules(hs: "HomeServer") -> None:
             async def wrap_check_event_allowed(
                 event: EventBase,
                 state_events: StateMap[EventBase],
-            ) -> Tuple[bool, Optional[dict]]:
+            ) -> tuple[bool, dict | None]:
                 # Assertion required because mypy can't prove we won't change
                 # `f` back to `None`. See
                 # https://mypy.readthedocs.io/en/latest/common_issues.html#narrowing-and-inner-functions
@@ -159,57 +159,52 @@ class ThirdPartyEventRulesModuleApiCallbacks:
         self.store = hs.get_datastores().main
         self._storage_controllers = hs.get_storage_controllers()
 
-        self._check_event_allowed_callbacks: List[CHECK_EVENT_ALLOWED_CALLBACK] = []
-        self._on_create_room_callbacks: List[ON_CREATE_ROOM_CALLBACK] = []
-        self._check_threepid_can_be_invited_callbacks: List[
+        self._check_event_allowed_callbacks: list[CHECK_EVENT_ALLOWED_CALLBACK] = []
+        self._on_create_room_callbacks: list[ON_CREATE_ROOM_CALLBACK] = []
+        self._check_threepid_can_be_invited_callbacks: list[
             CHECK_THREEPID_CAN_BE_INVITED_CALLBACK
         ] = []
-        self._check_visibility_can_be_modified_callbacks: List[
+        self._check_visibility_can_be_modified_callbacks: list[
             CHECK_VISIBILITY_CAN_BE_MODIFIED_CALLBACK
         ] = []
-        self._on_new_event_callbacks: List[ON_NEW_EVENT_CALLBACK] = []
-        self._check_can_shutdown_room_callbacks: List[
+        self._on_new_event_callbacks: list[ON_NEW_EVENT_CALLBACK] = []
+        self._check_can_shutdown_room_callbacks: list[
             CHECK_CAN_SHUTDOWN_ROOM_CALLBACK
         ] = []
-        self._check_can_deactivate_user_callbacks: List[
+        self._check_can_deactivate_user_callbacks: list[
             CHECK_CAN_DEACTIVATE_USER_CALLBACK
         ] = []
-        self._on_profile_update_callbacks: List[ON_PROFILE_UPDATE_CALLBACK] = []
-        self._on_user_deactivation_status_changed_callbacks: List[
+        self._on_profile_update_callbacks: list[ON_PROFILE_UPDATE_CALLBACK] = []
+        self._on_user_deactivation_status_changed_callbacks: list[
             ON_USER_DEACTIVATION_STATUS_CHANGED_CALLBACK
         ] = []
-        self._on_threepid_bind_callbacks: List[ON_THREEPID_BIND_CALLBACK] = []
-        self._on_add_user_third_party_identifier_callbacks: List[
+        self._on_threepid_bind_callbacks: list[ON_THREEPID_BIND_CALLBACK] = []
+        self._on_add_user_third_party_identifier_callbacks: list[
             ON_ADD_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
         ] = []
-        self._on_remove_user_third_party_identifier_callbacks: List[
+        self._on_remove_user_third_party_identifier_callbacks: list[
             ON_REMOVE_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
         ] = []
 
     def register_third_party_rules_callbacks(
         self,
-        check_event_allowed: Optional[CHECK_EVENT_ALLOWED_CALLBACK] = None,
-        on_create_room: Optional[ON_CREATE_ROOM_CALLBACK] = None,
-        check_threepid_can_be_invited: Optional[
-            CHECK_THREEPID_CAN_BE_INVITED_CALLBACK
-        ] = None,
-        check_visibility_can_be_modified: Optional[
-            CHECK_VISIBILITY_CAN_BE_MODIFIED_CALLBACK
-        ] = None,
-        on_new_event: Optional[ON_NEW_EVENT_CALLBACK] = None,
-        check_can_shutdown_room: Optional[CHECK_CAN_SHUTDOWN_ROOM_CALLBACK] = None,
-        check_can_deactivate_user: Optional[CHECK_CAN_DEACTIVATE_USER_CALLBACK] = None,
-        on_profile_update: Optional[ON_PROFILE_UPDATE_CALLBACK] = None,
-        on_user_deactivation_status_changed: Optional[
-            ON_USER_DEACTIVATION_STATUS_CHANGED_CALLBACK
-        ] = None,
-        on_threepid_bind: Optional[ON_THREEPID_BIND_CALLBACK] = None,
-        on_add_user_third_party_identifier: Optional[
-            ON_ADD_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
-        ] = None,
-        on_remove_user_third_party_identifier: Optional[
-            ON_REMOVE_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
-        ] = None,
+        check_event_allowed: CHECK_EVENT_ALLOWED_CALLBACK | None = None,
+        on_create_room: ON_CREATE_ROOM_CALLBACK | None = None,
+        check_threepid_can_be_invited: CHECK_THREEPID_CAN_BE_INVITED_CALLBACK
+        | None = None,
+        check_visibility_can_be_modified: CHECK_VISIBILITY_CAN_BE_MODIFIED_CALLBACK
+        | None = None,
+        on_new_event: ON_NEW_EVENT_CALLBACK | None = None,
+        check_can_shutdown_room: CHECK_CAN_SHUTDOWN_ROOM_CALLBACK | None = None,
+        check_can_deactivate_user: CHECK_CAN_DEACTIVATE_USER_CALLBACK | None = None,
+        on_profile_update: ON_PROFILE_UPDATE_CALLBACK | None = None,
+        on_user_deactivation_status_changed: ON_USER_DEACTIVATION_STATUS_CHANGED_CALLBACK
+        | None = None,
+        on_threepid_bind: ON_THREEPID_BIND_CALLBACK | None = None,
+        on_add_user_third_party_identifier: ON_ADD_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
+        | None = None,
+        on_remove_user_third_party_identifier: ON_REMOVE_USER_THIRD_PARTY_IDENTIFIER_CALLBACK
+        | None = None,
     ) -> None:
         """Register callbacks from modules for each hook."""
         if check_event_allowed is not None:
@@ -261,7 +256,7 @@ class ThirdPartyEventRulesModuleApiCallbacks:
         self,
         event: EventBase,
         context: UnpersistedEventContextBase,
-    ) -> Tuple[bool, Optional[dict]]:
+    ) -> tuple[bool, dict | None]:
         """Check if a provided event should be allowed in the given context.
 
         The module can return:
@@ -443,9 +438,7 @@ class ThirdPartyEventRulesModuleApiCallbacks:
                     "Failed to run module API callback %s: %s", callback, e
                 )
 
-    async def check_can_shutdown_room(
-        self, user_id: Optional[str], room_id: str
-    ) -> bool:
+    async def check_can_shutdown_room(self, user_id: str | None, room_id: str) -> bool:
         """Intercept requests to shutdown a room. If `False` is returned, the
          room must not be shut down.
 
diff --git a/synapse/notifier.py b/synapse/notifier.py
index 448a715e2a..93d438def7 100644
--- a/synapse/notifier.py
+++ b/synapse/notifier.py
@@ -25,16 +25,10 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
     Iterable,
-    List,
     Literal,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
     overload,
 )
 
@@ -67,8 +61,9 @@ from synapse.types import (
 from synapse.util.async_helpers import (
     timeout_deferred,
 )
+from synapse.util.duration import Duration
 from synapse.util.stringutils import shortstr
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -86,6 +81,24 @@ users_woken_by_stream_counter = Counter(
     labelnames=["stream", SERVER_NAME_LABEL],
 )
 
+
+notifier_listeners_gauge = LaterGauge(
+    name="synapse_notifier_listeners",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
+notifier_rooms_gauge = LaterGauge(
+    name="synapse_notifier_rooms",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+notifier_users_gauge = LaterGauge(
+    name="synapse_notifier_users",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
 T = TypeVar("T")
 
 
@@ -130,7 +143,7 @@ class _NotifierUserStream:
         self.last_notified_ms = time_now_ms
 
         # Set of listeners that we need to wake up when there has been a change.
-        self.listeners: Set[Deferred[StreamToken]] = set()
+        self.listeners: set[Deferred[StreamToken]] = set()
 
     def update_and_fetch_deferreds(
         self,
@@ -197,7 +210,7 @@ class _NotifierUserStream:
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class EventStreamResult:
-    events: List[Union[JsonDict, EventBase]]
+    events: list[JsonDict | EventBase]
     start_token: StreamToken
     end_token: StreamToken
 
@@ -212,8 +225,8 @@ class _PendingRoomEventEntry:
 
     room_id: str
     type: str
-    state_key: Optional[str]
-    membership: Optional[str]
+    state_key: str | None
+    membership: str | None
 
 
 class Notifier:
@@ -223,28 +236,28 @@ class Notifier:
     Primarily used from the /events stream.
     """
 
-    UNUSED_STREAM_EXPIRY_MS = 10 * 60 * 1000
+    UNUSED_STREAM_EXPIRY = Duration(minutes=10)
 
     def __init__(self, hs: "HomeServer"):
-        self.user_to_user_stream: Dict[str, _NotifierUserStream] = {}
-        self.room_to_user_streams: Dict[str, Set[_NotifierUserStream]] = {}
+        self.user_to_user_stream: dict[str, _NotifierUserStream] = {}
+        self.room_to_user_streams: dict[str, set[_NotifierUserStream]] = {}
 
         self.hs = hs
         self.server_name = hs.hostname
         self._storage_controllers = hs.get_storage_controllers()
         self.event_sources = hs.get_event_sources()
         self.store = hs.get_datastores().main
-        self.pending_new_room_events: List[_PendingRoomEventEntry] = []
+        self.pending_new_room_events: list[_PendingRoomEventEntry] = []
 
         self._replication_notifier = hs.get_replication_notifier()
-        self._new_join_in_room_callbacks: List[Callable[[str, str], None]] = []
+        self._new_join_in_room_callbacks: list[Callable[[str, str], None]] = []
 
         self._federation_client = hs.get_federation_http_client()
 
         self._third_party_rules = hs.get_module_api_callbacks().third_party_event_rules
 
         # List of callbacks to be notified when a lock is released
-        self._lock_released_callback: List[Callable[[str, str, str], None]] = []
+        self._lock_released_callback: list[Callable[[str, str, str], None]] = []
 
         self.reactor = hs.get_reactor()
         self.clock = hs.get_clock()
@@ -257,18 +270,16 @@ class Notifier:
 
         self.state_handler = hs.get_state_handler()
 
-        self.clock.looping_call(
-            self.remove_expired_streams, self.UNUSED_STREAM_EXPIRY_MS
-        )
+        self.clock.looping_call(self.remove_expired_streams, self.UNUSED_STREAM_EXPIRY)
 
         # This is not a very cheap test to perform, but it's only executed
         # when rendering the metrics page, which is likely once per minute at
         # most when scraping it.
         #
-        # Ideally, we'd use `Mapping[Tuple[str], int]` here but mypy doesn't like it.
+        # Ideally, we'd use `Mapping[tuple[str], int]` here but mypy doesn't like it.
         # This is close enough and better than a type ignore.
-        def count_listeners() -> Mapping[Tuple[str, ...], int]:
-            all_user_streams: Set[_NotifierUserStream] = set()
+        def count_listeners() -> Mapping[tuple[str, ...], int]:
+            all_user_streams: set[_NotifierUserStream] = set()
 
             for streams in list(self.room_to_user_streams.values()):
                 all_user_streams |= streams
@@ -281,28 +292,20 @@ class Notifier:
                 )
             }
 
-        LaterGauge(
-            name="synapse_notifier_listeners",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=count_listeners,
+        notifier_listeners_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(), hook=count_listeners
         )
-
-        LaterGauge(
-            name="synapse_notifier_rooms",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {
+        notifier_rooms_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {
                 (self.server_name,): count(
                     bool, list(self.room_to_user_streams.values())
                 )
             },
         )
-        LaterGauge(
-            name="synapse_notifier_users",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {(self.server_name,): len(self.user_to_user_stream)},
+        notifier_users_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {(self.server_name,): len(self.user_to_user_stream)},
         )
 
     def add_replication_callback(self, cb: Callable[[], None]) -> None:
@@ -328,9 +331,9 @@ class Notifier:
 
     async def on_new_room_events(
         self,
-        events_and_pos: List[Tuple[EventBase, PersistedEventPosition]],
+        events_and_pos: list[tuple[EventBase, PersistedEventPosition]],
         max_room_stream_token: RoomStreamToken,
-        extra_users: Optional[Collection[UserID]] = None,
+        extra_users: Collection[UserID] | None = None,
     ) -> None:
         """Creates a _PendingRoomEventEntry for each of the listed events and calls
         notify_new_room_events with the results."""
@@ -363,7 +366,7 @@ class Notifier:
         time_now_ms = self.clock.time_msec()
         current_token = self.event_sources.get_current_token()
 
-        listeners: List["Deferred[StreamToken]"] = []
+        listeners: list["Deferred[StreamToken]"] = []
         for user_stream in user_streams:
             try:
                 listeners.extend(
@@ -387,7 +390,7 @@ class Notifier:
 
     async def notify_new_room_events(
         self,
-        event_entries: List[Tuple[_PendingRoomEventEntry, str]],
+        event_entries: list[tuple[_PendingRoomEventEntry, str]],
         max_room_stream_token: RoomStreamToken,
     ) -> None:
         """Used by handlers to inform the notifier something has happened
@@ -415,11 +418,11 @@ class Notifier:
     def create_pending_room_event_entry(
         self,
         event_pos: PersistedEventPosition,
-        extra_users: Optional[Collection[UserID]],
+        extra_users: Collection[UserID] | None,
         room_id: str,
         event_type: str,
-        state_key: Optional[str],
-        membership: Optional[str],
+        state_key: str | None,
+        membership: str | None,
     ) -> _PendingRoomEventEntry:
         """Creates and returns a _PendingRoomEventEntry"""
         return _PendingRoomEventEntry(
@@ -443,8 +446,8 @@ class Notifier:
         pending = self.pending_new_room_events
         self.pending_new_room_events = []
 
-        users: Set[UserID] = set()
-        rooms: Set[str] = set()
+        users: set[UserID] = set()
+        rooms: set[str] = set()
 
         for entry in pending:
             if entry.event_pos.persisted_after(max_room_stream_token):
@@ -498,8 +501,8 @@ class Notifier:
         self,
         stream_key: Literal[StreamKeyType.ROOM],
         new_token: RoomStreamToken,
-        users: Optional[Collection[Union[str, UserID]]] = None,
-        rooms: Optional[StrCollection] = None,
+        users: Collection[str | UserID] | None = None,
+        rooms: StrCollection | None = None,
     ) -> None: ...
 
     @overload
@@ -507,8 +510,8 @@ class Notifier:
         self,
         stream_key: Literal[StreamKeyType.RECEIPT],
         new_token: MultiWriterStreamToken,
-        users: Optional[Collection[Union[str, UserID]]] = None,
-        rooms: Optional[StrCollection] = None,
+        users: Collection[str | UserID] | None = None,
+        rooms: StrCollection | None = None,
     ) -> None: ...
 
     @overload
@@ -522,18 +525,20 @@ class Notifier:
             StreamKeyType.TO_DEVICE,
             StreamKeyType.TYPING,
             StreamKeyType.UN_PARTIAL_STATED_ROOMS,
+            StreamKeyType.THREAD_SUBSCRIPTIONS,
+            StreamKeyType.STICKY_EVENTS,
         ],
         new_token: int,
-        users: Optional[Collection[Union[str, UserID]]] = None,
-        rooms: Optional[StrCollection] = None,
+        users: Collection[str | UserID] | None = None,
+        rooms: StrCollection | None = None,
     ) -> None: ...
 
     def on_new_event(
         self,
         stream_key: StreamKeyType,
-        new_token: Union[int, RoomStreamToken, MultiWriterStreamToken],
-        users: Optional[Collection[Union[str, UserID]]] = None,
-        rooms: Optional[StrCollection] = None,
+        new_token: int | RoomStreamToken | MultiWriterStreamToken,
+        users: Collection[str | UserID] | None = None,
+        rooms: StrCollection | None = None,
     ) -> None:
         """Used to inform listeners that something has happened event wise.
 
@@ -549,7 +554,7 @@ class Notifier:
         users = users or []
         rooms = rooms or []
 
-        user_streams: Set[_NotifierUserStream] = set()
+        user_streams: set[_NotifierUserStream] = set()
 
         log_kv(
             {
@@ -582,7 +587,7 @@ class Notifier:
 
             time_now_ms = self.clock.time_msec()
             current_token = self.event_sources.get_current_token()
-            listeners: List["Deferred[StreamToken]"] = []
+            listeners: list["Deferred[StreamToken]"] = []
             for user_stream in user_streams:
                 try:
                     listeners.extend(
@@ -629,7 +634,7 @@ class Notifier:
         user_id: str,
         timeout: int,
         callback: Callable[[StreamToken, StreamToken], Awaitable[T]],
-        room_ids: Optional[StrCollection] = None,
+        room_ids: StrCollection | None = None,
         from_token: StreamToken = StreamToken.START,
     ) -> T:
         """Wait until the callback returns a non empty response or the
@@ -665,9 +670,16 @@ class Notifier:
                         # is a new token.
                         listener = user_stream.new_listener(prev_token)
                         listener = timeout_deferred(
-                            listener,
-                            (end_time - now) / 1000.0,
-                            self.hs.get_reactor(),
+                            deferred=listener,
+                            timeout=(end_time - now) / 1000.0,
+                            # We don't track these calls since they are constantly being
+                            # overridden by new calls to /sync and they don't hold the
+                            # `HomeServer` in memory on shutdown. It is safe to let them
+                            # timeout of their own accord after shutting down since it
+                            # won't delay shutdown and there won't be any adverse
+                            # behaviour.
+                            cancel_on_shutdown=False,
+                            clock=self.hs.get_clock(),
                         )
 
                         log_kv(
@@ -723,7 +735,7 @@ class Notifier:
         pagination_config: PaginationConfig,
         timeout: int,
         is_guest: bool = False,
-        explicit_room_id: Optional[str] = None,
+        explicit_room_id: str | None = None,
     ) -> EventStreamResult:
         """For the given user and rooms, return any new events for them. If
         there are no new events wait for up to `timeout` milliseconds for any
@@ -753,7 +765,7 @@ class Notifier:
             # The events fetched from each source are a JsonDict, EventBase, or
             # UserPresenceState, but see below for UserPresenceState being
             # converted to JsonDict.
-            events: List[Union[JsonDict, EventBase]] = []
+            events: list[JsonDict | EventBase] = []
             end_token = from_token
 
             for keyname, source in self.event_sources.sources.get_sources():
@@ -772,7 +784,7 @@ class Notifier:
                 )
 
                 if keyname == StreamKeyType.ROOM:
-                    new_events = await filter_events_for_client(
+                    new_events = await filter_and_transform_events_for_client(
                         self._storage_controllers,
                         user.to_string(),
                         new_events,
@@ -849,11 +861,11 @@ class Notifier:
                 logged = True
 
             # TODO: be better
-            await self.clock.sleep(0.5)
+            await self.clock.sleep(Duration(milliseconds=500))
 
     async def _get_room_ids(
-        self, user: UserID, explicit_room_id: Optional[str]
-    ) -> Tuple[StrCollection, bool]:
+        self, user: UserID, explicit_room_id: str | None
+    ) -> tuple[StrCollection, bool]:
         joined_room_ids = await self.store.get_rooms_for_user(user.to_string())
         if explicit_room_id:
             if explicit_room_id in joined_room_ids:
@@ -877,7 +889,7 @@ class Notifier:
     def remove_expired_streams(self) -> None:
         time_now_ms = self.clock.time_msec()
         expired_streams = []
-        expire_before_ts = time_now_ms - self.UNUSED_STREAM_EXPIRY_MS
+        expire_before_ts = time_now_ms - self.UNUSED_STREAM_EXPIRY.as_millis()
         for stream in self.user_to_user_stream.values():
             if stream.count_listeners():
                 continue
@@ -942,7 +954,7 @@ class ReplicationNotifier:
     This is separate from the notifier to avoid circular dependencies.
     """
 
-    _replication_callbacks: List[Callable[[], None]] = attr.Factory(list)
+    _replication_callbacks: list[Callable[[], None]] = attr.Factory(list)
 
     def add_replication_callback(self, cb: Callable[[], None]) -> None:
         """Add a callback that will be called when some new data is available.
diff --git a/synapse/push/__init__.py b/synapse/push/__init__.py
index 7bc99bd785..58c58fbdbf 100644
--- a/synapse/push/__init__.py
+++ b/synapse/push/__init__.py
@@ -94,7 +94,7 @@ The Pusher instance also calls out to various utilities for generating payloads
 """
 
 import abc
-from typing import TYPE_CHECKING, Any, Dict, Optional
+from typing import TYPE_CHECKING, Any
 
 import attr
 
@@ -108,7 +108,7 @@ if TYPE_CHECKING:
 class PusherConfig:
     """Parameters necessary to configure a pusher."""
 
-    id: Optional[int]
+    id: int | None
     user_name: str
 
     profile_tag: str
@@ -118,20 +118,20 @@ class PusherConfig:
     device_display_name: str
     pushkey: str
     ts: int
-    lang: Optional[str]
-    data: Optional[JsonDict]
+    lang: str | None
+    data: JsonDict | None
     last_stream_ordering: int
-    last_success: Optional[int]
-    failing_since: Optional[int]
+    last_success: int | None
+    failing_since: int | None
     enabled: bool
-    device_id: Optional[str]
+    device_id: str | None
 
     # XXX(quenting): The access_token is not persisted anymore for new pushers, but we
     # keep it when reading from the database, so that we don't get stale pushers
     # while the "set_device_id_for_pushers" background update is running.
-    access_token: Optional[int]
+    access_token: int | None
 
-    def as_dict(self) -> Dict[str, Any]:
+    def as_dict(self) -> dict[str, Any]:
         """Information that can be retrieved about a pusher after creation."""
         return {
             "app_display_name": self.app_display_name,
diff --git a/synapse/push/bulk_push_rule_evaluator.py b/synapse/push/bulk_push_rule_evaluator.py
index ea9169aef0..7cf89200a8 100644
--- a/synapse/push/bulk_push_rule_evaluator.py
+++ b/synapse/push/bulk_push_rule_evaluator.py
@@ -24,14 +24,8 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
-    FrozenSet,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -237,7 +231,7 @@ class BulkPushRuleEvaluator:
         event: EventBase,
         context: EventContext,
         event_id_to_event: Mapping[str, EventBase],
-    ) -> Tuple[dict, Optional[int]]:
+    ) -> tuple[dict, int | None]:
         """
         Given an event and an event context, get the power level event relevant to the event
         and the power level of the sender of the event.
@@ -309,13 +303,13 @@ class BulkPushRuleEvaluator:
 
     async def _related_events(
         self, event: EventBase
-    ) -> Dict[str, Dict[str, JsonValue]]:
+    ) -> dict[str, dict[str, JsonValue]]:
         """Fetches the related events for 'event'. Sets the im.vector.is_falling_back key if the event is from a fallback relation
 
         Returns:
             Mapping of relation type to flattened events.
         """
-        related_events: Dict[str, Dict[str, JsonValue]] = {}
+        related_events: dict[str, dict[str, JsonValue]] = {}
         if self._related_event_match_enabled:
             related_event_id = event.content.get("m.relates_to", {}).get("event_id")
             relation_type = event.content.get("m.relates_to", {}).get("rel_type")
@@ -352,7 +346,7 @@ class BulkPushRuleEvaluator:
         return related_events
 
     async def action_for_events_by_user(
-        self, events_and_context: List[EventPersistencePair]
+        self, events_and_context: list[EventPersistencePair]
     ) -> None:
         """Given a list of events and their associated contexts, evaluate the push rules
         for each event, check if the message should increment the unread count, and
@@ -394,7 +388,7 @@ class BulkPushRuleEvaluator:
             count_as_unread = _should_count_as_unread(event, context)
 
         rules_by_user = await self._get_rules_for_event(event)
-        actions_by_user: Dict[str, Collection[Union[Mapping, str]]] = {}
+        actions_by_user: dict[str, Collection[Mapping | str]] = {}
 
         # Gather a bunch of info in parallel.
         #
@@ -409,7 +403,7 @@ class BulkPushRuleEvaluator:
             profiles,
         ) = await make_deferred_yieldable(
             cast(
-                "Deferred[Tuple[int, Tuple[dict, Optional[int]], Dict[str, Dict[str, JsonValue]], Mapping[str, ProfileInfo]]]",
+                "Deferred[tuple[int, tuple[dict, int | None], dict[str, dict[str, JsonValue]], Mapping[str, ProfileInfo]]]",
                 gather_results(
                     (
                         run_in_background(  # type: ignore[call-overload]
@@ -481,7 +475,7 @@ class BulkPushRuleEvaluator:
             self.hs.config.experimental.msc4306_enabled,
         )
 
-        msc4306_thread_subscribers: Optional[FrozenSet[str]] = None
+        msc4306_thread_subscribers: frozenset[str] | None = None
         if self.hs.config.experimental.msc4306_enabled and thread_id != MAIN_TIMELINE:
             # pull out, in batch, all local subscribers to this thread
             # (in the common case, they will all be getting processed for push
@@ -514,7 +508,7 @@ class BulkPushRuleEvaluator:
                 # current user, it'll be added to the dict later.
                 actions_by_user[uid] = []
 
-            msc4306_thread_subscription_state: Optional[bool] = None
+            msc4306_thread_subscription_state: bool | None = None
             if msc4306_thread_subscribers is not None:
                 msc4306_thread_subscription_state = uid in msc4306_thread_subscribers
 
@@ -556,10 +550,10 @@ class BulkPushRuleEvaluator:
         )
 
 
-MemberMap = Dict[str, Optional[EventIdMembership]]
-Rule = Dict[str, dict]
-RulesByUser = Dict[str, List[Rule]]
-StateGroup = Union[object, int]
+MemberMap = dict[str, EventIdMembership | None]
+Rule = dict[str, dict]
+RulesByUser = dict[str, list[Rule]]
+StateGroup = object | int
 
 
 def _is_simple_value(value: Any) -> bool:
@@ -571,10 +565,10 @@ def _is_simple_value(value: Any) -> bool:
 
 
 def _flatten_dict(
-    d: Union[EventBase, Mapping[str, Any]],
-    prefix: Optional[List[str]] = None,
-    result: Optional[Dict[str, JsonValue]] = None,
-) -> Dict[str, JsonValue]:
+    d: EventBase | Mapping[str, Any],
+    prefix: list[str] | None = None,
+    result: dict[str, JsonValue] | None = None,
+) -> dict[str, JsonValue]:
     """
     Given a JSON dictionary (or event) which might contain sub dictionaries,
     flatten it into a single layer dictionary by combining the keys & sub-keys.
diff --git a/synapse/push/clientformat.py b/synapse/push/clientformat.py
index b4afcfd85b..db082e295d 100644
--- a/synapse/push/clientformat.py
+++ b/synapse/push/clientformat.py
@@ -20,7 +20,7 @@
 #
 
 import copy
-from typing import Any, Dict, List, Optional
+from typing import Any
 
 from synapse.push.rulekinds import PRIORITY_CLASS_INVERSE_MAP, PRIORITY_CLASS_MAP
 from synapse.synapse_rust.push import FilteredPushRules, PushRule
@@ -29,11 +29,11 @@ from synapse.types import UserID
 
 def format_push_rules_for_user(
     user: UserID, ruleslist: FilteredPushRules
-) -> Dict[str, Dict[str, List[Dict[str, Any]]]]:
+) -> dict[str, dict[str, list[dict[str, Any]]]]:
     """Converts a list of rawrules and a enabled map into nested dictionaries
     to match the Matrix client-server format for push rules"""
 
-    rules: Dict[str, Dict[str, List[Dict[str, Any]]]] = {"global": {}}
+    rules: dict[str, dict[str, list[dict[str, Any]]]] = {"global": {}}
 
     rules["global"] = _add_empty_priority_class_arrays(rules["global"])
 
@@ -70,7 +70,7 @@ def format_push_rules_for_user(
     return rules
 
 
-def _convert_type_to_value(rule_or_cond: Dict[str, Any], user: UserID) -> None:
+def _convert_type_to_value(rule_or_cond: dict[str, Any], user: UserID) -> None:
     for type_key in ("pattern", "value"):
         type_value = rule_or_cond.pop(f"{type_key}_type", None)
         if type_value == "user_id":
@@ -79,19 +79,19 @@ def _convert_type_to_value(rule_or_cond: Dict[str, Any], user: UserID) -> None:
             rule_or_cond[type_key] = user.localpart
 
 
-def _add_empty_priority_class_arrays(d: Dict[str, list]) -> Dict[str, list]:
+def _add_empty_priority_class_arrays(d: dict[str, list]) -> dict[str, list]:
     for pc in PRIORITY_CLASS_MAP.keys():
         d[pc] = []
     return d
 
 
-def _rule_to_template(rule: PushRule) -> Optional[Dict[str, Any]]:
-    templaterule: Dict[str, Any]
+def _rule_to_template(rule: PushRule) -> dict[str, Any] | None:
+    templaterule: dict[str, Any]
 
     unscoped_rule_id = _rule_id_from_namespaced(rule.rule_id)
 
     template_name = _priority_class_to_template_name(rule.priority_class)
-    if template_name in ["override", "underride"]:
+    if template_name in ["override", "underride", "postcontent"]:
         templaterule = {"conditions": rule.conditions, "actions": rule.actions}
     elif template_name in ["sender", "room"]:
         templaterule = {"actions": rule.actions}
diff --git a/synapse/push/emailpusher.py b/synapse/push/emailpusher.py
index 09ca14584a..c44222f6ea 100644
--- a/synapse/push/emailpusher.py
+++ b/synapse/push/emailpusher.py
@@ -20,16 +20,16 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Dict, List, Optional
+from typing import TYPE_CHECKING, Optional
 
 from twisted.internet.error import AlreadyCalled, AlreadyCancelled
 from twisted.internet.interfaces import IDelayedCall
 
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.push import Pusher, PusherConfig, PusherConfigException, ThrottleParams
 from synapse.push.mailer import Mailer
 from synapse.push.push_types import EmailReason
 from synapse.storage.databases.main.event_push_actions import EmailPushAction
+from synapse.util.duration import Duration
 from synapse.util.threepids import validate_email
 
 if TYPE_CHECKING:
@@ -72,7 +72,7 @@ class EmailPusher(Pusher):
         self.store = self.hs.get_datastores().main
         self.email = pusher_config.pushkey
         self.timed_call: Optional[IDelayedCall] = None
-        self.throttle_params: Dict[str, ThrottleParams] = {}
+        self.throttle_params: dict[str, ThrottleParams] = {}
         self._inited = False
 
         self._is_processing = False
@@ -118,7 +118,7 @@ class EmailPusher(Pusher):
         if self._is_processing:
             return
 
-        run_as_background_process("emailpush.process", self.server_name, self._process)
+        self.hs.run_as_background_process("emailpush.process", self._process)
 
     def _pause_processing(self) -> None:
         """Used by tests to temporarily pause processing of events.
@@ -175,7 +175,7 @@ class EmailPusher(Pusher):
             )
         )
 
-        soonest_due_at: Optional[int] = None
+        soonest_due_at: int | None = None
 
         if not unprocessed:
             await self.save_last_stream_ordering_and_success(self.max_stream_ordering)
@@ -228,8 +228,10 @@ class EmailPusher(Pusher):
                     self.timed_call = None
 
         if soonest_due_at is not None:
-            self.timed_call = self.hs.get_reactor().callLater(
-                self.seconds_until(soonest_due_at), self.on_timer
+            delay = self.seconds_until(soonest_due_at)
+            self.timed_call = self.hs.get_clock().call_later(
+                Duration(seconds=delay),
+                self.on_timer,
             )
 
     async def save_last_stream_ordering_and_success(
@@ -323,7 +325,7 @@ class EmailPusher(Pusher):
         )
 
     async def send_notification(
-        self, push_actions: List[EmailPushAction], reason: EmailReason
+        self, push_actions: list[EmailPushAction], reason: EmailReason
     ) -> None:
         logger.info("Sending notif email for user %r", self.user_id)
 
diff --git a/synapse/push/httppusher.py b/synapse/push/httppusher.py
index 5946a6e972..fdfae234be 100644
--- a/synapse/push/httppusher.py
+++ b/synapse/push/httppusher.py
@@ -21,7 +21,7 @@
 import logging
 import random
 import urllib.parse
-from typing import TYPE_CHECKING, Dict, List, Optional, Union
+from typing import TYPE_CHECKING, Optional
 
 from prometheus_client import Counter
 
@@ -32,7 +32,6 @@ from synapse.api.constants import EventTypes
 from synapse.events import EventBase
 from synapse.logging import opentracing
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.push import Pusher, PusherConfig, PusherConfigException
 from synapse.storage.databases.main.event_push_actions import HttpPushAction
 from synapse.types import JsonDict, JsonMapping
@@ -41,6 +40,7 @@ from . import push_tools
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
+from synapse.util.duration import Duration
 
 logger = logging.getLogger(__name__)
 
@@ -69,7 +69,7 @@ http_badges_failed_counter = Counter(
 )
 
 
-def tweaks_for_actions(actions: List[Union[str, Dict]]) -> JsonMapping:
+def tweaks_for_actions(actions: list[str | dict]) -> JsonMapping:
     """
     Converts a list of actions into a `tweaks` dict (which can then be passed to
         the push gateway).
@@ -164,7 +164,7 @@ class HttpPusher(Pusher):
         self.data_minus_url = {}
         self.data_minus_url.update(self.data)
         del self.data_minus_url["url"]
-        self.badge_count_last_call: Optional[int] = None
+        self.badge_count_last_call: int | None = None
 
     def on_started(self, should_check_for_notifs: bool) -> None:
         """Called when this pusher has been started.
@@ -182,8 +182,8 @@ class HttpPusher(Pusher):
 
         # We could check the receipts are actually m.read receipts here,
         # but currently that's the only type of receipt anyway...
-        run_as_background_process(
-            "http_pusher.on_new_receipts", self.server_name, self._update_badge
+        self.hs.run_as_background_process(
+            "http_pusher.on_new_receipts", self._update_badge
         )
 
     async def _update_badge(self) -> None:
@@ -219,7 +219,7 @@ class HttpPusher(Pusher):
         if self.failing_since and self.timed_call and self.timed_call.active():
             return
 
-        run_as_background_process("httppush.process", self.server_name, self._process)
+        self.hs.run_as_background_process("httppush.process", self._process)
 
     async def _process(self) -> None:
         # we should never get here if we are already processing
@@ -336,8 +336,9 @@ class HttpPusher(Pusher):
                     )
                 else:
                     logger.info("Push failed: delaying for %ds", self.backoff_delay)
-                    self.timed_call = self.hs.get_reactor().callLater(
-                        self.backoff_delay, self.on_timer
+                    self.timed_call = self.hs.get_clock().call_later(
+                        Duration(seconds=self.backoff_delay),
+                        self.on_timer,
                     )
                     self.backoff_delay = min(
                         self.backoff_delay * 2, self.MAX_BACKOFF_SEC
@@ -371,7 +372,7 @@ class HttpPusher(Pusher):
             delay_ms = random.randint(1, self.push_jitter_delay_ms)
             diff_ms = event.origin_server_ts + delay_ms - self.clock.time_msec()
             if diff_ms > 0:
-                await self.clock.sleep(diff_ms / 1000)
+                await self.clock.sleep(Duration(milliseconds=diff_ms))
 
         rejected = await self.dispatch_push_event(event, tweaks, badge)
         if rejected is False:
@@ -394,9 +395,9 @@ class HttpPusher(Pusher):
     async def dispatch_push(
         self,
         content: JsonDict,
-        tweaks: Optional[JsonMapping] = None,
-        default_payload: Optional[JsonMapping] = None,
-    ) -> Union[bool, List[str]]:
+        tweaks: JsonMapping | None = None,
+        default_payload: JsonMapping | None = None,
+    ) -> bool | list[str]:
         """Send a notification to the registered push gateway, with `content` being
         the content of the `notification` top property specified in the spec.
         Note that the `devices` property will be added with device-specific
@@ -453,7 +454,7 @@ class HttpPusher(Pusher):
         event: EventBase,
         tweaks: JsonMapping,
         badge: int,
-    ) -> Union[bool, List[str]]:
+    ) -> bool | list[str]:
         """Send a notification to the registered push gateway by building it
         from an event.
 
diff --git a/synapse/push/mailer.py b/synapse/push/mailer.py
index d76cc8237b..d18630e80b 100644
--- a/synapse/push/mailer.py
+++ b/synapse/push/mailer.py
@@ -21,7 +21,7 @@
 
 import logging
 import urllib.parse
-from typing import TYPE_CHECKING, Dict, Iterable, List, Optional, TypeVar
+from typing import TYPE_CHECKING, Iterable, TypeVar
 
 import bleach
 import jinja2
@@ -49,7 +49,7 @@ from synapse.storage.databases.main.event_push_actions import EmailPushAction
 from synapse.types import StateMap, UserID
 from synapse.types.state import StateFilter
 from synapse.util.async_helpers import concurrently_execute
-from synapse.visibility import filter_events_for_client
+from synapse.visibility import filter_and_transform_events_for_client
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -287,7 +287,7 @@ class Mailer:
 
         notif_events = await self.store.get_events([pa.event_id for pa in push_actions])
 
-        notifs_by_room: Dict[str, List[EmailPushAction]] = {}
+        notifs_by_room: dict[str, list[EmailPushAction]] = {}
         for pa in push_actions:
             notifs_by_room.setdefault(pa.room_id, []).append(pa)
 
@@ -317,7 +317,7 @@ class Mailer:
         # actually sort our so-called rooms_in_order list, most recent room first
         rooms_in_order.sort(key=lambda r: -(notifs_by_room[r][-1].received_ts or 0))
 
-        rooms: List[RoomVars] = []
+        rooms: list[RoomVars] = []
 
         for r in rooms_in_order:
             roomvars = await self._get_room_vars(
@@ -372,7 +372,7 @@ class Mailer:
         email_address: str,
         subject: str,
         extra_template_vars: TemplateVars,
-        unsubscribe_link: Optional[str] = None,
+        unsubscribe_link: str | None = None,
     ) -> None:
         """Send an email with the given information and template text"""
         template_vars: TemplateVars = {
@@ -417,7 +417,7 @@ class Mailer:
         room_id: str,
         user_id: str,
         notifs: Iterable[EmailPushAction],
-        notif_events: Dict[str, EventBase],
+        notif_events: dict[str, EventBase],
         room_state_ids: StateMap[str],
     ) -> RoomVars:
         """
@@ -486,7 +486,7 @@ class Mailer:
     async def _get_room_avatar(
         self,
         room_state_ids: StateMap[str],
-    ) -> Optional[str]:
+    ) -> str | None:
         """
         Retrieve the avatar url for this room---if it exists.
 
@@ -537,12 +537,11 @@ class Mailer:
             "messages": [],
         }
 
-        the_events = await filter_events_for_client(
+        the_events = await filter_and_transform_events_for_client(
             self._storage_controllers,
             user_id,
-            results.events_before,
+            results.events_before + [notif_event],
         )
-        the_events.append(notif_event)
 
         for event in the_events:
             messagevars = await self._get_message_vars(notif, event, room_state_ids)
@@ -553,7 +552,7 @@ class Mailer:
 
     async def _get_message_vars(
         self, notif: EmailPushAction, event: EventBase, room_state_ids: StateMap[str]
-    ) -> Optional[MessageVars]:
+    ) -> MessageVars | None:
         """
         Generate the variables for a single event, if possible.
 
@@ -573,7 +572,7 @@ class Mailer:
         type_state_key = ("m.room.member", event.sender)
         sender_state_event_id = room_state_ids.get(type_state_key)
         if sender_state_event_id:
-            sender_state_event: Optional[EventBase] = await self.store.get_event(
+            sender_state_event: EventBase | None = await self.store.get_event(
                 sender_state_event_id
             )
         else:
@@ -585,9 +584,7 @@ class Mailer:
 
         if sender_state_event:
             sender_name = name_from_member_event(sender_state_event)
-            sender_avatar_url: Optional[str] = sender_state_event.content.get(
-                "avatar_url"
-            )
+            sender_avatar_url: str | None = sender_state_event.content.get("avatar_url")
         else:
             # No state could be found, fallback to the MXID.
             sender_name = event.sender
@@ -665,9 +662,9 @@ class Mailer:
     async def _make_summary_text_single_room(
         self,
         room_id: str,
-        notifs: List[EmailPushAction],
+        notifs: list[EmailPushAction],
         room_state_ids: StateMap[str],
-        notif_events: Dict[str, EventBase],
+        notif_events: dict[str, EventBase],
         user_id: str,
     ) -> str:
         """
@@ -781,9 +778,9 @@ class Mailer:
 
     async def _make_summary_text(
         self,
-        notifs_by_room: Dict[str, List[EmailPushAction]],
-        room_state_ids: Dict[str, StateMap[str]],
-        notif_events: Dict[str, EventBase],
+        notifs_by_room: dict[str, list[EmailPushAction]],
+        room_state_ids: dict[str, StateMap[str]],
+        notif_events: dict[str, EventBase],
         reason: EmailReason,
     ) -> str:
         """
@@ -814,9 +811,9 @@ class Mailer:
     async def _make_summary_text_from_member_events(
         self,
         room_id: str,
-        notifs: List[EmailPushAction],
+        notifs: list[EmailPushAction],
         room_state_ids: StateMap[str],
-        notif_events: Dict[str, EventBase],
+        notif_events: dict[str, EventBase],
     ) -> str:
         """
         Make a summary text for the email when only a single room has notifications.
@@ -995,7 +992,7 @@ def safe_text(raw_text: str) -> Markup:
     )
 
 
-def deduped_ordered_list(it: Iterable[T]) -> List[T]:
+def deduped_ordered_list(it: Iterable[T]) -> list[T]:
     seen = set()
     ret = []
     for item in it:
diff --git a/synapse/push/presentable_names.py b/synapse/push/presentable_names.py
index 1faa57e9f5..d8000dd607 100644
--- a/synapse/push/presentable_names.py
+++ b/synapse/push/presentable_names.py
@@ -21,7 +21,7 @@
 
 import logging
 import re
-from typing import TYPE_CHECKING, Dict, Iterable, Optional
+from typing import TYPE_CHECKING, Iterable
 
 from synapse.api.constants import EventTypes, Membership
 from synapse.events import EventBase
@@ -45,7 +45,7 @@ async def calculate_room_name(
     user_id: str,
     fallback_to_members: bool = True,
     fallback_to_single_member: bool = True,
-) -> Optional[str]:
+) -> str | None:
     """
     Works out a user-facing name for the given room as per Matrix
     spec recommendations.
@@ -205,8 +205,8 @@ def name_from_member_event(member_event: EventBase) -> str:
     return member_event.state_key
 
 
-def _state_as_two_level_dict(state: StateMap[str]) -> Dict[str, Dict[str, str]]:
-    ret: Dict[str, Dict[str, str]] = {}
+def _state_as_two_level_dict(state: StateMap[str]) -> dict[str, dict[str, str]]:
+    ret: dict[str, dict[str, str]] = {}
     for k, v in state.items():
         ret.setdefault(k[0], {})[k[1]] = v
     return ret
diff --git a/synapse/push/push_tools.py b/synapse/push/push_tools.py
index 3f3e4a9234..8e2ff2bcb4 100644
--- a/synapse/push/push_tools.py
+++ b/synapse/push/push_tools.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict
 
 from synapse.api.constants import EventTypes, Membership
 from synapse.events import EventBase
@@ -56,8 +55,8 @@ async def get_badge_count(store: DataStore, user_id: str, group_by_room: bool) -
 
 async def get_context_for_event(
     storage: StorageControllers, ev: EventBase, user_id: str
-) -> Dict[str, str]:
-    ctx: Dict[str, str] = {}
+) -> dict[str, str]:
+    ctx: dict[str, str] = {}
 
     if ev.internal_metadata.outlier:
         # We don't have state for outliers, so we can't compute the context
diff --git a/synapse/push/push_types.py b/synapse/push/push_types.py
index 57fa926a46..7553b4bf10 100644
--- a/synapse/push/push_types.py
+++ b/synapse/push/push_types.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional, TypedDict
+from typing import TypedDict
 
 
 class EmailReason(TypedDict, total=False):
@@ -40,7 +40,7 @@ class EmailReason(TypedDict, total=False):
 
     room_id: str
     now: int
-    room_name: Optional[str]
+    room_name: str | None
     received_at: int
     delay_before_mail_ms: int
     last_sent_ts: int
@@ -71,9 +71,9 @@ class MessageVars(TypedDict, total=False):
     id: str
     ts: int
     sender_name: str
-    sender_avatar_url: Optional[str]
+    sender_avatar_url: str | None
     sender_hash: int
-    msgtype: Optional[str]
+    msgtype: str | None
     body_text_html: str
     body_text_plain: str
     image_url: str
@@ -90,8 +90,8 @@ class NotifVars(TypedDict):
     """
 
     link: str
-    ts: Optional[int]
-    messages: List[MessageVars]
+    ts: int | None
+    messages: list[MessageVars]
 
 
 class RoomVars(TypedDict):
@@ -107,12 +107,12 @@ class RoomVars(TypedDict):
     avator_url: url to the room's avator
     """
 
-    title: Optional[str]
+    title: str | None
     hash: int
     invite: bool
-    notifs: List[NotifVars]
+    notifs: list[NotifVars]
     link: str
-    avatar_url: Optional[str]
+    avatar_url: str | None
 
 
 class TemplateVars(TypedDict, total=False):
@@ -137,5 +137,5 @@ class TemplateVars(TypedDict, total=False):
     user_display_name: str
     unsubscribe_link: str
     summary_text: str
-    rooms: List[RoomVars]
+    rooms: list[RoomVars]
     reason: EmailReason
diff --git a/synapse/push/pusher.py b/synapse/push/pusher.py
index 9a5dd7a9d4..948465cad1 100644
--- a/synapse/push/pusher.py
+++ b/synapse/push/pusher.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Callable, Dict, Optional
+from typing import TYPE_CHECKING, Callable
 
 from synapse.push import Pusher, PusherConfig
 from synapse.push.emailpusher import EmailPusher
@@ -38,13 +38,13 @@ class PusherFactory:
         self.hs = hs
         self.config = hs.config
 
-        self.pusher_types: Dict[str, Callable[[HomeServer, PusherConfig], Pusher]] = {
+        self.pusher_types: dict[str, Callable[[HomeServer, PusherConfig], Pusher]] = {
             "http": HttpPusher
         }
 
         logger.info("email enable notifs: %r", hs.config.email.email_enable_notifs)
         if hs.config.email.email_enable_notifs:
-            self.mailers: Dict[str, Mailer] = {}
+            self.mailers: dict[str, Mailer] = {}
 
             self._notif_template_html = hs.config.email.email_notif_template_html
             self._notif_template_text = hs.config.email.email_notif_template_text
@@ -53,7 +53,7 @@ class PusherFactory:
 
             logger.info("defined email pusher type")
 
-    def create_pusher(self, pusher_config: PusherConfig) -> Optional[Pusher]:
+    def create_pusher(self, pusher_config: PusherConfig) -> Pusher | None:
         kind = pusher_config.kind
         f = self.pusher_types.get(kind, None)
         if not f:
diff --git a/synapse/push/pusherpool.py b/synapse/push/pusherpool.py
index d1f79ec999..7b5b06db83 100644
--- a/synapse/push/pusherpool.py
+++ b/synapse/push/pusherpool.py
@@ -20,14 +20,13 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Dict, Iterable, Optional
+from typing import TYPE_CHECKING, Iterable
 
 from prometheus_client import Gauge
 
 from synapse.api.errors import Codes, SynapseError
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.push import Pusher, PusherConfig, PusherConfigException
@@ -70,10 +69,8 @@ class PusherPool:
     """
 
     def __init__(self, hs: "HomeServer"):
-        self.hs = hs
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
         self.pusher_factory = PusherFactory(hs)
         self.store = self.hs.get_datastores().main
         self.clock = self.hs.get_clock()
@@ -103,7 +100,7 @@ class PusherPool:
         self._last_room_stream_id_seen = self.store.get_room_max_stream_ordering()
 
         # map from user id to app_id:pushkey to pusher
-        self.pushers: Dict[str, Dict[str, Pusher]] = {}
+        self.pushers: dict[str, dict[str, Pusher]] = {}
 
         self._account_validity_handler = hs.get_account_validity_handler()
 
@@ -112,9 +109,7 @@ class PusherPool:
         if not self._should_start_pushers:
             logger.info("Not starting pushers because they are disabled in the config")
             return
-        run_as_background_process(
-            "start_pushers", self.server_name, self._start_pushers
-        )
+        self.hs.run_as_background_process("start_pushers", self._start_pushers)
 
     async def add_or_update_pusher(
         self,
@@ -124,12 +119,12 @@ class PusherPool:
         app_display_name: str,
         device_display_name: str,
         pushkey: str,
-        lang: Optional[str],
+        lang: str | None,
         data: JsonDict,
         profile_tag: str = "",
         enabled: bool = True,
-        device_id: Optional[str] = None,
-    ) -> Optional[Pusher]:
+        device_id: str | None = None,
+    ) -> Pusher | None:
         """Creates a new pusher and adds it to the pool
 
         Returns:
@@ -335,7 +330,7 @@ class PusherPool:
 
     async def _get_pusher_config_for_user_by_app_id_and_pushkey(
         self, user_id: str, app_id: str, pushkey: str
-    ) -> Optional[PusherConfig]:
+    ) -> PusherConfig | None:
         resultlist = await self.store.get_pushers_by_app_id_and_pushkey(app_id, pushkey)
 
         pusher_config = None
@@ -347,7 +342,7 @@ class PusherPool:
 
     async def process_pusher_change_by_id(
         self, app_id: str, pushkey: str, user_id: str
-    ) -> Optional[Pusher]:
+    ) -> Pusher | None:
         """Look up the details for the given pusher, and either start it if its
         "enabled" flag is True, or try to stop it otherwise.
 
@@ -386,7 +381,7 @@ class PusherPool:
 
         logger.info("Started pushers")
 
-    async def _start_pusher(self, pusher_config: PusherConfig) -> Optional[Pusher]:
+    async def _start_pusher(self, pusher_config: PusherConfig) -> Pusher | None:
         """Start the given pusher
 
         Args:
diff --git a/synapse/push/rulekinds.py b/synapse/push/rulekinds.py
index 781ecc7fae..2eff626f92 100644
--- a/synapse/push/rulekinds.py
+++ b/synapse/push/rulekinds.py
@@ -19,10 +19,14 @@
 #
 #
 
+# Integer literals for push rule `kind`s
+# This is used to store them in the database.
 PRIORITY_CLASS_MAP = {
     "underride": 1,
     "sender": 2,
     "room": 3,
+    # MSC4306
+    "postcontent": 6,
     "content": 4,
     "override": 5,
 }
diff --git a/synapse/replication/http/_base.py b/synapse/replication/http/_base.py
index 0850a99e0c..87d6e80898 100644
--- a/synapse/replication/http/_base.py
+++ b/synapse/replication/http/_base.py
@@ -23,7 +23,7 @@ import logging
 import re
 import urllib.parse
 from inspect import signature
-from typing import TYPE_CHECKING, Any, Awaitable, Callable, ClassVar, Dict, List, Tuple
+from typing import TYPE_CHECKING, Any, Awaitable, Callable, ClassVar
 
 from prometheus_client import Counter, Gauge
 
@@ -42,6 +42,7 @@ from synapse.metrics import SERVER_NAME_LABEL
 from synapse.types import JsonDict
 from synapse.util.caches.response_cache import ResponseCache
 from synapse.util.cancellation import is_function_cancellable
+from synapse.util.duration import Duration
 from synapse.util.stringutils import random_string
 
 if TYPE_CHECKING:
@@ -112,7 +113,7 @@ class ReplicationEndpoint(metaclass=abc.ABCMeta):
     """
 
     NAME: str = abc.abstractproperty()  # type: ignore
-    PATH_ARGS: Tuple[str, ...] = abc.abstractproperty()  # type: ignore
+    PATH_ARGS: tuple[str, ...] = abc.abstractproperty()  # type: ignore
     METHOD = "POST"
     CACHE = True
     RETRY_ON_TIMEOUT = True
@@ -129,7 +130,7 @@ class ReplicationEndpoint(metaclass=abc.ABCMeta):
                 clock=hs.get_clock(),
                 name="repl." + self.NAME,
                 server_name=self.server_name,
-                timeout_ms=30 * 60 * 1000,
+                timeout=Duration(minutes=30),
             )
 
         # We reserve `instance_name` as a parameter to sending requests, so we
@@ -187,7 +188,7 @@ class ReplicationEndpoint(metaclass=abc.ABCMeta):
     @abc.abstractmethod
     async def _handle_request(
         self, request: Request, content: JsonDict, **kwargs: Any
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """Handle incoming request.
 
         This is called with the request object and PATH_ARGS.
@@ -292,7 +293,7 @@ class ReplicationEndpoint(metaclass=abc.ABCMeta):
                     "/".join(url_args),
                 )
 
-                headers: Dict[bytes, List[bytes]] = {}
+                headers: dict[bytes, list[bytes]] = {}
                 # Add an authorization header, if configured.
                 if replication_secret:
                     headers[b"Authorization"] = [b"Bearer " + replication_secret]
@@ -317,7 +318,7 @@ class ReplicationEndpoint(metaclass=abc.ABCMeta):
 
                             # If we timed out we probably don't need to worry about backing
                             # off too much, but lets just wait a little anyway.
-                            await clock.sleep(1)
+                            await clock.sleep(Duration(seconds=1))
                         except (ConnectError, DNSLookupError) as e:
                             if not cls.RETRY_ON_CONNECT_ERROR:
                                 raise
@@ -332,7 +333,7 @@ class ReplicationEndpoint(metaclass=abc.ABCMeta):
                                 e,
                             )
 
-                            await clock.sleep(delay)
+                            await clock.sleep(Duration(seconds=delay))
                             attempts += 1
                 except HttpResponseException as e:
                     # We convert to SynapseError as we know that it was a SynapseError
@@ -403,7 +404,7 @@ class ReplicationEndpoint(metaclass=abc.ABCMeta):
 
     async def _check_auth_and_handle(
         self, request: SynapseRequest, **kwargs: Any
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """Called on new incoming requests when caching is enabled. Checks
         if there is a cached response for the request and returns that,
         otherwise calls `_handle_request` and caches its response.
diff --git a/synapse/replication/http/account_data.py b/synapse/replication/http/account_data.py
index b6eac153ba..560973b916 100644
--- a/synapse/replication/http/account_data.py
+++ b/synapse/replication/http/account_data.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -68,7 +68,7 @@ class ReplicationAddUserAccountDataRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str, account_data_type: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         max_stream_id = await self.handler.add_account_data_for_user(
             user_id, account_data_type, content["content"]
         )
@@ -106,7 +106,7 @@ class ReplicationRemoveUserAccountDataRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str, account_data_type: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         max_stream_id = await self.handler.remove_account_data_for_user(
             user_id, account_data_type
         )
@@ -153,7 +153,7 @@ class ReplicationAddRoomAccountDataRestServlet(ReplicationEndpoint):
         user_id: str,
         room_id: str,
         account_data_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         max_stream_id = await self.handler.add_account_data_to_room(
             user_id, room_id, account_data_type, content["content"]
         )
@@ -196,7 +196,7 @@ class ReplicationRemoveRoomAccountDataRestServlet(ReplicationEndpoint):
         user_id: str,
         room_id: str,
         account_data_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         max_stream_id = await self.handler.remove_account_data_for_room(
             user_id, room_id, account_data_type
         )
@@ -238,7 +238,7 @@ class ReplicationAddTagRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str, room_id: str, tag: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         max_stream_id = await self.handler.add_tag_to_room(
             user_id, room_id, tag, content["content"]
         )
@@ -276,7 +276,7 @@ class ReplicationRemoveTagRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str, room_id: str, tag: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         max_stream_id = await self.handler.remove_tag_from_room(
             user_id,
             room_id,
diff --git a/synapse/replication/http/deactivate_account.py b/synapse/replication/http/deactivate_account.py
index 89658350a5..82df1e1322 100644
--- a/synapse/replication/http/deactivate_account.py
+++ b/synapse/replication/http/deactivate_account.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -69,7 +69,7 @@ class ReplicationNotifyAccountDeactivatedServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         by_admin = content["by_admin"]
         await self.deactivate_account_handler.notify_account_deactivated(
             user_id, by_admin=by_admin
diff --git a/synapse/replication/http/delayed_events.py b/synapse/replication/http/delayed_events.py
index 229022070c..26eaf68dae 100644
--- a/synapse/replication/http/delayed_events.py
+++ b/synapse/replication/http/delayed_events.py
@@ -13,7 +13,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Dict, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -52,7 +52,7 @@ class ReplicationAddedDelayedEventRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict
-    ) -> Tuple[int, Dict[str, Optional[JsonMapping]]]:
+    ) -> tuple[int, dict[str, JsonMapping | None]]:
         self.handler.on_added(int(content["next_send_ts"]))
 
         return 200, {}
diff --git a/synapse/replication/http/devices.py b/synapse/replication/http/devices.py
index 974d83bb8b..7a11537f9e 100644
--- a/synapse/replication/http/devices.py
+++ b/synapse/replication/http/devices.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Dict, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -59,13 +59,13 @@ class ReplicationNotifyDeviceUpdateRestServlet(ReplicationEndpoint):
 
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
-        user_id: str, device_ids: List[str]
+        user_id: str, device_ids: list[str]
     ) -> JsonDict:
         return {"device_ids": device_ids}
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         device_ids = content["device_ids"]
 
         span = active_span()
@@ -102,12 +102,12 @@ class ReplicationNotifyUserSignatureUpdateRestServlet(ReplicationEndpoint):
         self.clock = hs.get_clock()
 
     @staticmethod
-    async def _serialize_payload(from_user_id: str, user_ids: List[str]) -> JsonDict:  # type: ignore[override]
+    async def _serialize_payload(from_user_id: str, user_ids: list[str]) -> JsonDict:  # type: ignore[override]
         return {"user_ids": user_ids}
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, from_user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         user_ids = content["user_ids"]
 
         span = active_span()
@@ -165,13 +165,13 @@ class ReplicationMultiUserDevicesResyncRestServlet(ReplicationEndpoint):
         self.clock = hs.get_clock()
 
     @staticmethod
-    async def _serialize_payload(user_ids: List[str]) -> JsonDict:  # type: ignore[override]
+    async def _serialize_payload(user_ids: list[str]) -> JsonDict:  # type: ignore[override]
         return {"user_ids": user_ids}
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict
-    ) -> Tuple[int, Dict[str, Optional[JsonMapping]]]:
-        user_ids: List[str] = content["user_ids"]
+    ) -> tuple[int, dict[str, JsonMapping | None]]:
+        user_ids: list[str] = content["user_ids"]
 
         logger.info("Resync for %r", user_ids)
         span = active_span()
@@ -185,46 +185,6 @@ class ReplicationMultiUserDevicesResyncRestServlet(ReplicationEndpoint):
         return 200, multi_user_devices
 
 
-# FIXME(2025-07-22): Remove this on the next release, this will only get used
-# during rollout to Synapse 1.135 and can be removed after that release.
-class ReplicationUploadKeysForUserRestServlet(ReplicationEndpoint):
-    """Unused endpoint, kept for backwards compatibility during rollout."""
-
-    NAME = "upload_keys_for_user"
-    PATH_ARGS = ()
-    CACHE = False
-
-    def __init__(self, hs: "HomeServer"):
-        super().__init__(hs)
-
-        self.e2e_keys_handler = hs.get_e2e_keys_handler()
-        self.store = hs.get_datastores().main
-        self.clock = hs.get_clock()
-
-    @staticmethod
-    async def _serialize_payload(  # type: ignore[override]
-        user_id: str, device_id: str, keys: JsonDict
-    ) -> JsonDict:
-        return {
-            "user_id": user_id,
-            "device_id": device_id,
-            "keys": keys,
-        }
-
-    async def _handle_request(  # type: ignore[override]
-        self, request: Request, content: JsonDict
-    ) -> Tuple[int, JsonDict]:
-        user_id = content["user_id"]
-        device_id = content["device_id"]
-        keys = content["keys"]
-
-        results = await self.e2e_keys_handler.upload_keys_for_user(
-            user_id, device_id, keys
-        )
-
-        return 200, results
-
-
 class ReplicationHandleNewDeviceUpdateRestServlet(ReplicationEndpoint):
     """Wake up a device writer to send local device list changes as federation outbound pokes.
 
@@ -250,7 +210,7 @@ class ReplicationHandleNewDeviceUpdateRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self.device_handler.handle_new_device_update()
         return 200, {}
 
@@ -281,7 +241,7 @@ class ReplicationDeviceHandleRoomUnPartialStated(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self.device_handler.handle_room_un_partial_stated(room_id)
         return 200, {}
 
@@ -291,5 +251,4 @@ def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
     ReplicationNotifyUserSignatureUpdateRestServlet(hs).register(http_server)
     ReplicationMultiUserDevicesResyncRestServlet(hs).register(http_server)
     ReplicationHandleNewDeviceUpdateRestServlet(hs).register(http_server)
-    ReplicationUploadKeysForUserRestServlet(hs).register(http_server)
     ReplicationDeviceHandleRoomUnPartialStated(hs).register(http_server)
diff --git a/synapse/replication/http/federation.py b/synapse/replication/http/federation.py
index 1e302ef59f..448a1f8a71 100644
--- a/synapse/replication/http/federation.py
+++ b/synapse/replication/http/federation.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -86,7 +86,7 @@ class ReplicationFederationSendEventsRestServlet(ReplicationEndpoint):
     async def _serialize_payload(  # type: ignore[override]
         store: "DataStore",
         room_id: str,
-        event_and_contexts: List[EventPersistencePair],
+        event_and_contexts: list[EventPersistencePair],
         backfilled: bool,
     ) -> JsonDict:
         """
@@ -122,7 +122,7 @@ class ReplicationFederationSendEventsRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         with Measure(
             self.clock, name="repl_fed_send_events_parse", server_name=self.server_name
         ):
@@ -194,7 +194,7 @@ class ReplicationFederationSendEduRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, edu_type: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         origin = content["origin"]
         edu_content = content["content"]
 
@@ -243,7 +243,7 @@ class ReplicationGetQueryRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, query_type: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         args = content["args"]
         args["origin"] = content["origin"]
 
@@ -285,7 +285,7 @@ class ReplicationCleanRoomRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self.store.clean_room_for_join(room_id)
 
         return 200, {}
@@ -320,7 +320,7 @@ class ReplicationStoreRoomOnOutlierMembershipRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         room_version = KNOWN_ROOM_VERSIONS[content["room_version"]]
         await self.store.maybe_store_room_on_outlier_membership(room_id, room_version)
         return 200, {}
diff --git a/synapse/replication/http/login.py b/synapse/replication/http/login.py
index 8b5b7f755a..fc21c20ca2 100644
--- a/synapse/replication/http/login.py
+++ b/synapse/replication/http/login.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional, Tuple, cast
+from typing import TYPE_CHECKING, cast
 
 from twisted.web.server import Request
 
@@ -50,13 +50,13 @@ class RegisterDeviceReplicationServlet(ReplicationEndpoint):
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
         user_id: str,
-        device_id: Optional[str],
-        initial_display_name: Optional[str],
+        device_id: str | None,
+        initial_display_name: str | None,
         is_guest: bool,
         is_appservice_ghost: bool,
         should_issue_refresh_token: bool,
-        auth_provider_id: Optional[str],
-        auth_provider_session_id: Optional[str],
+        auth_provider_id: str | None,
+        auth_provider_session_id: str | None,
     ) -> JsonDict:
         """
         Args:
@@ -79,7 +79,7 @@ class RegisterDeviceReplicationServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         device_id = content["device_id"]
         initial_display_name = content["initial_display_name"]
         is_guest = content["is_guest"]
diff --git a/synapse/replication/http/membership.py b/synapse/replication/http/membership.py
index fc66039b2f..8a6c971720 100644
--- a/synapse/replication/http/membership.py
+++ b/synapse/replication/http/membership.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -63,7 +63,7 @@ class ReplicationRemoteJoinRestServlet(ReplicationEndpoint):
         requester: Requester,
         room_id: str,
         user_id: str,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         content: JsonDict,
     ) -> JsonDict:
         """
@@ -85,7 +85,7 @@ class ReplicationRemoteJoinRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: SynapseRequest, content: JsonDict, room_id: str, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         remote_room_hosts = content["remote_room_hosts"]
         event_content = content["content"]
 
@@ -130,7 +130,7 @@ class ReplicationRemoteKnockRestServlet(ReplicationEndpoint):
         requester: Requester,
         room_id: str,
         user_id: str,
-        remote_room_hosts: List[str],
+        remote_room_hosts: list[str],
         content: JsonDict,
     ) -> JsonDict:
         """
@@ -149,7 +149,7 @@ class ReplicationRemoteKnockRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: SynapseRequest, content: JsonDict, room_id: str, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         remote_room_hosts = content["remote_room_hosts"]
         event_content = content["content"]
 
@@ -192,7 +192,7 @@ class ReplicationRemoteRejectInviteRestServlet(ReplicationEndpoint):
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
         invite_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
     ) -> JsonDict:
@@ -215,7 +215,7 @@ class ReplicationRemoteRejectInviteRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: SynapseRequest, content: JsonDict, invite_event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         txn_id = content["txn_id"]
         event_content = content["content"]
 
@@ -260,7 +260,7 @@ class ReplicationRemoteRescindKnockRestServlet(ReplicationEndpoint):
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
         knock_event_id: str,
-        txn_id: Optional[str],
+        txn_id: str | None,
         requester: Requester,
         content: JsonDict,
     ) -> JsonDict:
@@ -279,7 +279,7 @@ class ReplicationRemoteRescindKnockRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: SynapseRequest, content: JsonDict, knock_event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         txn_id = content["txn_id"]
         event_content = content["content"]
 
@@ -343,7 +343,7 @@ class ReplicationUserJoinedLeftRoomRestServlet(ReplicationEndpoint):
         room_id: str,
         user_id: str,
         change: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         logger.info("user membership change: %s in %s", user_id, room_id)
 
         user = UserID.from_string(user_id)
diff --git a/synapse/replication/http/presence.py b/synapse/replication/http/presence.py
index 8a3f3b0e67..960f0485ff 100644
--- a/synapse/replication/http/presence.py
+++ b/synapse/replication/http/presence.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -58,12 +58,12 @@ class ReplicationBumpPresenceActiveTime(ReplicationEndpoint):
         self._presence_handler = hs.get_presence_handler()
 
     @staticmethod
-    async def _serialize_payload(user_id: str, device_id: Optional[str]) -> JsonDict:  # type: ignore[override]
+    async def _serialize_payload(user_id: str, device_id: str | None) -> JsonDict:  # type: ignore[override]
         return {"device_id": device_id}
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self._presence_handler.bump_presence_active_time(
             UserID.from_string(user_id), content.get("device_id")
         )
@@ -102,7 +102,7 @@ class ReplicationPresenceSetState(ReplicationEndpoint):
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         state: JsonDict,
         force_notify: bool = False,
         is_sync: bool = False,
@@ -116,7 +116,7 @@ class ReplicationPresenceSetState(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self._presence_handler.set_state(
             UserID.from_string(user_id),
             content.get("device_id"),
diff --git a/synapse/replication/http/push.py b/synapse/replication/http/push.py
index 6e20a208b6..905414b5ee 100644
--- a/synapse/replication/http/push.py
+++ b/synapse/replication/http/push.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -68,7 +68,7 @@ class ReplicationRemovePusherRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         app_id = content["app_id"]
         pushkey = content["pushkey"]
 
@@ -110,7 +110,7 @@ class ReplicationCopyPusherRestServlet(ReplicationEndpoint):
         user_id: str,
         old_room_id: str,
         new_room_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self._store.copy_push_rules_from_room_to_room_for_user(
             old_room_id, new_room_id, user_id
         )
@@ -144,7 +144,7 @@ class ReplicationDeleteAllPushersForUserRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self._store.delete_all_pushers_for_user(user_id)
 
         return 200, {}
diff --git a/synapse/replication/http/register.py b/synapse/replication/http/register.py
index 27d3504c3c..bd83b38c96 100644
--- a/synapse/replication/http/register.py
+++ b/synapse/replication/http/register.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -59,14 +59,14 @@ class ReplicationRegisterServlet(ReplicationEndpoint):
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
         user_id: str,
-        password_hash: Optional[str],
+        password_hash: str | None,
         was_guest: bool,
         make_guest: bool,
-        appservice_id: Optional[str],
-        create_profile_with_displayname: Optional[str],
+        appservice_id: str | None,
+        create_profile_with_displayname: str | None,
         admin: bool,
-        user_type: Optional[str],
-        address: Optional[str],
+        user_type: str | None,
+        address: str | None,
         shadow_banned: bool,
         approved: bool,
     ) -> JsonDict:
@@ -104,7 +104,7 @@ class ReplicationRegisterServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self.registration_handler.check_registration_ratelimit(content["address"])
 
         # Always default admin users to approved (since it means they were created by
@@ -143,7 +143,7 @@ class ReplicationPostRegisterActionsServlet(ReplicationEndpoint):
 
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
-        user_id: str, auth_result: JsonDict, access_token: Optional[str]
+        user_id: str, auth_result: JsonDict, access_token: str | None
     ) -> JsonDict:
         """
         Args:
@@ -156,7 +156,7 @@ class ReplicationPostRegisterActionsServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         auth_result = content["auth_result"]
         access_token = content["access_token"]
 
diff --git a/synapse/replication/http/send_events.py b/synapse/replication/http/send_events.py
index 6b1a5a9956..b020a0fe7c 100644
--- a/synapse/replication/http/send_events.py
+++ b/synapse/replication/http/send_events.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -85,11 +85,11 @@ class ReplicationSendEventsRestServlet(ReplicationEndpoint):
 
     @staticmethod
     async def _serialize_payload(  # type: ignore[override]
-        events_and_context: List[EventPersistencePair],
+        events_and_context: list[EventPersistencePair],
         store: "DataStore",
         requester: Requester,
         ratelimit: bool,
-        extra_users: List[UserID],
+        extra_users: list[UserID],
     ) -> JsonDict:
         """
         Args:
@@ -122,7 +122,7 @@ class ReplicationSendEventsRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, payload: JsonDict
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         with Measure(
             self.clock, name="repl_send_events_parse", server_name=self.server_name
         ):
diff --git a/synapse/replication/http/state.py b/synapse/replication/http/state.py
index 3ec4ca5de3..823d330041 100644
--- a/synapse/replication/http/state.py
+++ b/synapse/replication/http/state.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -65,7 +65,7 @@ class ReplicationUpdateCurrentStateRestServlet(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         writer_instance = self._events_shard_config.get_instance(room_id)
         if writer_instance != self._instance_name:
             raise SynapseError(
diff --git a/synapse/replication/http/streams.py b/synapse/replication/http/streams.py
index 61f70d5790..42e78c976f 100644
--- a/synapse/replication/http/streams.py
+++ b/synapse/replication/http/streams.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -79,7 +79,7 @@ class ReplicationGetStreamUpdates(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict, stream_name: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         stream = self.streams.get(stream_name)
         if stream is None:
             raise SynapseError(400, "Unknown stream")
diff --git a/synapse/replication/tcp/client.py b/synapse/replication/tcp/client.py
index ee9250cf7d..bc7e46d4c9 100644
--- a/synapse/replication/tcp/client.py
+++ b/synapse/replication/tcp/client.py
@@ -21,7 +21,7 @@
 """A replication client for use by synapse workers."""
 
 import logging
-from typing import TYPE_CHECKING, Dict, Iterable, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Iterable
 
 from sortedcontainers import SortedList
 
@@ -32,7 +32,6 @@ from synapse.api.constants import EventTypes, Membership, ReceiptTypes
 from synapse.federation import send_queue
 from synapse.federation.sender import FederationSender
 from synapse.logging.context import PreserveLoggingContext, make_deferred_yieldable
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.tcp.streams import (
     AccountDataStream,
     DeviceListsStream,
@@ -44,6 +43,10 @@ from synapse.replication.tcp.streams import (
     UnPartialStatedEventStream,
     UnPartialStatedRoomStream,
 )
+from synapse.replication.tcp.streams._base import (
+    StickyEventsStream,
+    ThreadSubscriptionsStream,
+)
 from synapse.replication.tcp.streams.events import (
     EventsStream,
     EventsStreamEventRow,
@@ -55,6 +58,7 @@ from synapse.replication.tcp.streams.partial_state import (
 )
 from synapse.types import PersistedEventPosition, ReadReceipt, StreamKeyType, UserID
 from synapse.util.async_helpers import Linearizer, timeout_deferred
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
 from synapse.util.metrics import Measure
 
@@ -89,14 +93,14 @@ class ReplicationDataHandler:
         self._pusher_pool = hs.get_pusherpool()
         self._presence_handler = hs.get_presence_handler()
 
-        self.send_handler: Optional[FederationSenderHandler] = None
+        self.send_handler: FederationSenderHandler | None = None
         if hs.should_send_federation():
             self.send_handler = FederationSenderHandler(hs)
 
         # Map from stream and instance to list of deferreds waiting for the stream to
         # arrive at a particular position. The lists are sorted by stream position.
-        self._streams_to_waiters: Dict[
-            Tuple[str, str], SortedList[Tuple[int, Deferred]]
+        self._streams_to_waiters: dict[
+            tuple[str, str], SortedList[tuple[int, Deferred]]
         ] = {}
 
     async def on_rdata(
@@ -113,7 +117,7 @@ class ReplicationDataHandler:
             token: stream token for this batch of rows
             rows: a list of Stream.ROW_TYPE objects as returned by Stream.parse_row.
         """
-        all_room_ids: Set[str] = set()
+        all_room_ids: set[str] = set()
         if stream_name == DeviceListsStream.NAME:
             if any(not row.is_signature and not row.hosts_calculated for row in rows):
                 # This only uses the minimum stream position on the device lists
@@ -173,7 +177,7 @@ class ReplicationDataHandler:
                 )
 
                 # Yield to reactor so that we don't block.
-                await self._clock.sleep(0)
+                await self._clock.sleep(Duration(seconds=0))
         elif stream_name == PushersStream.NAME:
             for row in rows:
                 if row.deleted:
@@ -200,7 +204,7 @@ class ReplicationDataHandler:
                 if row.data.rejected:
                     continue
 
-                extra_users: Tuple[UserID, ...] = ()
+                extra_users: tuple[UserID, ...] = ()
                 if row.data.type == EventTypes.Member and row.data.state_key:
                     extra_users = (UserID.from_string(row.data.state_key),)
 
@@ -255,6 +259,18 @@ class ReplicationDataHandler:
                 self._state_storage_controller.notify_event_un_partial_stated(
                     row.event_id
                 )
+        elif stream_name == ThreadSubscriptionsStream.NAME:
+            self.notifier.on_new_event(
+                StreamKeyType.THREAD_SUBSCRIPTIONS,
+                token,
+                users=[row.user_id for row in rows],
+            )
+        elif stream_name == StickyEventsStream.NAME:
+            self.notifier.on_new_event(
+                StreamKeyType.STICKY_EVENTS,
+                token,
+                rooms=[row.room_id for row in rows],
+            )
 
         await self._presence_handler.process_replication_rows(
             stream_name, instance_name, token, rows
@@ -337,7 +353,9 @@ class ReplicationDataHandler:
         # to wedge here forever.
         deferred: "Deferred[None]" = Deferred()
         deferred = timeout_deferred(
-            deferred, _WAIT_FOR_REPLICATION_TIMEOUT_SECONDS, self._reactor
+            deferred=deferred,
+            timeout=_WAIT_FOR_REPLICATION_TIMEOUT_SECONDS,
+            clock=self._clock,
         )
 
         waiting_list = self._streams_to_waiters.setdefault(
@@ -427,9 +445,11 @@ class FederationSenderHandler:
 
         # Stores the latest position in the federation stream we've gotten up
         # to. This is always set before we use it.
-        self.federation_position: Optional[int] = None
+        self.federation_position: int | None = None
 
-        self._fed_position_linearizer = Linearizer(name="_fed_position_linearizer")
+        self._fed_position_linearizer = Linearizer(
+            name="_fed_position_linearizer", clock=hs.get_clock()
+        )
 
     async def process_replication_rows(
         self, stream_name: str, token: int, rows: list
@@ -504,8 +524,8 @@ class FederationSenderHandler:
             # no need to queue up another task.
             return
 
-        run_as_background_process(
-            "_save_and_send_ack", self.server_name, self._save_and_send_ack
+        self._hs.run_as_background_process(
+            "_save_and_send_ack", self._save_and_send_ack
         )
 
     async def _save_and_send_ack(self) -> None:
diff --git a/synapse/replication/tcp/commands.py b/synapse/replication/tcp/commands.py
index 6ab5356660..0c85fb36fc 100644
--- a/synapse/replication/tcp/commands.py
+++ b/synapse/replication/tcp/commands.py
@@ -26,10 +26,10 @@ allowed to be sent by which side.
 
 import abc
 import logging
-from typing import List, Optional, Tuple, Type, TypeVar
+from typing import TypeVar
 
 from synapse.replication.tcp.streams._base import StreamRow
-from synapse.util import json_decoder, json_encoder
+from synapse.util.json import json_decoder, json_encoder
 
 logger = logging.getLogger(__name__)
 
@@ -49,7 +49,7 @@ class Command(metaclass=abc.ABCMeta):
 
     @classmethod
     @abc.abstractmethod
-    def from_line(cls: Type[T], line: str) -> T:
+    def from_line(cls: type[T], line: str) -> T:
         """Deserialises a line from the wire into this command. `line` does not
         include the command.
         """
@@ -88,7 +88,7 @@ class _SimpleCommand(Command):
         self.data = data
 
     @classmethod
-    def from_line(cls: Type[SC], line: str) -> SC:
+    def from_line(cls: type[SC], line: str) -> SC:
         return cls(line)
 
     def to_line(self) -> str:
@@ -137,7 +137,7 @@ class RdataCommand(Command):
     NAME = "RDATA"
 
     def __init__(
-        self, stream_name: str, instance_name: str, token: Optional[int], row: StreamRow
+        self, stream_name: str, instance_name: str, token: int | None, row: StreamRow
     ):
         self.stream_name = stream_name
         self.instance_name = instance_name
@@ -145,7 +145,7 @@ class RdataCommand(Command):
         self.row = row
 
     @classmethod
-    def from_line(cls: Type["RdataCommand"], line: str) -> "RdataCommand":
+    def from_line(cls: type["RdataCommand"], line: str) -> "RdataCommand":
         stream_name, instance_name, token, row_json = line.split(" ", 3)
         return cls(
             stream_name,
@@ -204,7 +204,7 @@ class PositionCommand(Command):
         self.new_token = new_token
 
     @classmethod
-    def from_line(cls: Type["PositionCommand"], line: str) -> "PositionCommand":
+    def from_line(cls: type["PositionCommand"], line: str) -> "PositionCommand":
         stream_name, instance_name, prev_token, new_token = line.split(" ", 3)
         return cls(stream_name, instance_name, int(prev_token), int(new_token))
 
@@ -249,7 +249,7 @@ class ReplicateCommand(Command):
         REPLICATE
     """
 
-    __slots__: List[str] = []
+    __slots__: list[str] = []
 
     NAME = "REPLICATE"
 
@@ -257,7 +257,7 @@ class ReplicateCommand(Command):
         pass
 
     @classmethod
-    def from_line(cls: Type[T], line: str) -> T:
+    def from_line(cls: type[T], line: str) -> T:
         return cls()
 
     def to_line(self) -> str:
@@ -288,7 +288,7 @@ class UserSyncCommand(Command):
         self,
         instance_id: str,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         is_syncing: bool,
         last_sync_ms: int,
     ):
@@ -299,8 +299,8 @@ class UserSyncCommand(Command):
         self.last_sync_ms = last_sync_ms
 
     @classmethod
-    def from_line(cls: Type["UserSyncCommand"], line: str) -> "UserSyncCommand":
-        device_id: Optional[str]
+    def from_line(cls: type["UserSyncCommand"], line: str) -> "UserSyncCommand":
+        device_id: str | None
         instance_id, user_id, device_id, state, last_sync_ms = line.split(" ", 4)
 
         if device_id == "None":
@@ -343,7 +343,7 @@ class ClearUserSyncsCommand(Command):
 
     @classmethod
     def from_line(
-        cls: Type["ClearUserSyncsCommand"], line: str
+        cls: type["ClearUserSyncsCommand"], line: str
     ) -> "ClearUserSyncsCommand":
         return cls(line)
 
@@ -373,7 +373,7 @@ class FederationAckCommand(Command):
 
     @classmethod
     def from_line(
-        cls: Type["FederationAckCommand"], line: str
+        cls: type["FederationAckCommand"], line: str
     ) -> "FederationAckCommand":
         instance_name, token = line.split(" ")
         return cls(instance_name, int(token))
@@ -407,7 +407,7 @@ class UserIpCommand(Command):
         access_token: str,
         ip: str,
         user_agent: str,
-        device_id: Optional[str],
+        device_id: str | None,
         last_seen: int,
     ):
         self.user_id = user_id
@@ -418,7 +418,7 @@ class UserIpCommand(Command):
         self.last_seen = last_seen
 
     @classmethod
-    def from_line(cls: Type["UserIpCommand"], line: str) -> "UserIpCommand":
+    def from_line(cls: type["UserIpCommand"], line: str) -> "UserIpCommand":
         user_id, jsn = line.split(" ", 1)
 
         access_token, ip, user_agent, device_id, last_seen = json_decoder.decode(jsn)
@@ -485,7 +485,7 @@ class LockReleasedCommand(Command):
         self.lock_key = lock_key
 
     @classmethod
-    def from_line(cls: Type["LockReleasedCommand"], line: str) -> "LockReleasedCommand":
+    def from_line(cls: type["LockReleasedCommand"], line: str) -> "LockReleasedCommand":
         instance_name, lock_name, lock_key = json_decoder.decode(line)
 
         return cls(instance_name, lock_name, lock_key)
@@ -505,7 +505,19 @@ class NewActiveTaskCommand(_SimpleCommand):
     NAME = "NEW_ACTIVE_TASK"
 
 
-_COMMANDS: Tuple[Type[Command], ...] = (
+class CancelTaskCommand(_SimpleCommand):
+    """Sent to inform the instance handling background tasks that a task
+    has been cancelled and should be terminated.
+
+    Format::
+
+        CANCEL_TASK "<task_id>"
+    """
+
+    NAME = "CANCEL_TASK"
+
+
+_COMMANDS: tuple[type[Command], ...] = (
     ServerCommand,
     RdataCommand,
     PositionCommand,
@@ -520,6 +532,7 @@ _COMMANDS: Tuple[Type[Command], ...] = (
     ClearUserSyncsCommand,
     LockReleasedCommand,
     NewActiveTaskCommand,
+    CancelTaskCommand,
 )
 
 # Map of command name to command type.
diff --git a/synapse/replication/tcp/external_cache.py b/synapse/replication/tcp/external_cache.py
index 497b26fcaf..ca959a7aae 100644
--- a/synapse/replication/tcp/external_cache.py
+++ b/synapse/replication/tcp/external_cache.py
@@ -20,14 +20,14 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Any, Optional
+from typing import TYPE_CHECKING, Any
 
 from prometheus_client import Counter, Histogram
 
 from synapse.logging import opentracing
 from synapse.logging.context import make_deferred_yieldable
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.util import json_decoder, json_encoder
+from synapse.util.json import json_decoder, json_encoder
 
 if TYPE_CHECKING:
     from txredisapi import ConnectionHandler
@@ -73,7 +73,7 @@ class ExternalCache:
         self.server_name = hs.hostname
 
         if hs.config.redis.redis_enabled:
-            self._redis_connection: Optional["ConnectionHandler"] = (
+            self._redis_connection: "ConnectionHandler" | None = (
                 hs.get_outbound_redis_connection()
             )
         else:
@@ -121,7 +121,7 @@ class ExternalCache:
                     )
                 )
 
-    async def get(self, cache_name: str, key: str) -> Optional[Any]:
+    async def get(self, cache_name: str, key: str) -> Any | None:
         """Look up a key/value in the named cache."""
 
         if self._redis_connection is None:
diff --git a/synapse/replication/tcp/handler.py b/synapse/replication/tcp/handler.py
index 0f14c7e380..ad9fed72dd 100644
--- a/synapse/replication/tcp/handler.py
+++ b/synapse/replication/tcp/handler.py
@@ -24,16 +24,9 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Awaitable,
-    Deque,
-    Dict,
     Iterable,
     Iterator,
-    List,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
 )
 
 from prometheus_client import Counter
@@ -41,8 +34,8 @@ from prometheus_client import Counter
 from twisted.internet.protocol import ReconnectingClientFactory
 
 from synapse.metrics import SERVER_NAME_LABEL, LaterGauge
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.tcp.commands import (
+    CancelTaskCommand,
     ClearUserSyncsCommand,
     Command,
     FederationAckCommand,
@@ -74,8 +67,10 @@ from synapse.replication.tcp.streams import (
 )
 from synapse.replication.tcp.streams._base import (
     DeviceListsStream,
+    StickyEventsStream,
     ThreadSubscriptionsStream,
 )
+from synapse.util.background_queue import BackgroundQueue
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -106,11 +101,21 @@ user_ip_cache_counter = Counter(
     "synapse_replication_tcp_resource_user_ip_cache", "", labelnames=[SERVER_NAME_LABEL]
 )
 
+tcp_resource_total_connections_gauge = LaterGauge(
+    name="synapse_replication_tcp_resource_total_connections",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
+tcp_command_queue_gauge = LaterGauge(
+    name="synapse_replication_tcp_command_queue",
+    desc="Number of inbound RDATA/POSITION commands queued for processing",
+    labelnames=["stream_name", SERVER_NAME_LABEL],
+)
+
 
 # the type of the entries in _command_queues_by_stream
-_StreamCommandQueue = Deque[
-    Tuple[Union[RdataCommand, PositionCommand], IReplicationConnection]
-]
+_StreamCommandQueueItem = tuple[RdataCommand | PositionCommand, IReplicationConnection]
 
 
 class ReplicationCommandHandler:
@@ -120,6 +125,7 @@ class ReplicationCommandHandler:
 
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname
+        self.hs = hs
         self._replication_data_handler = hs.get_replication_data_handler()
         self._presence_handler = hs.get_presence_handler()
         self._store = hs.get_datastores().main
@@ -129,18 +135,18 @@ class ReplicationCommandHandler:
         self._instance_name = hs.get_instance_name()
 
         # Additional Redis channel suffixes to subscribe to.
-        self._channels_to_subscribe_to: List[str] = []
+        self._channels_to_subscribe_to: list[str] = []
 
         self._is_presence_writer = (
             hs.get_instance_name() in hs.config.worker.writers.presence
         )
 
-        self._streams: Dict[str, Stream] = {
+        self._streams: dict[str, Stream] = {
             stream.NAME: stream(hs) for stream in STREAMS_MAP.values()
         }
 
         # List of streams that this instance is the source of
-        self._streams_to_replicate: List[Stream] = []
+        self._streams_to_replicate: list[Stream] = []
 
         for stream in self._streams.values():
             if hs.config.redis.redis_enabled and stream.NAME == CachesStream.NAME:
@@ -212,6 +218,12 @@ class ReplicationCommandHandler:
 
                 continue
 
+            if isinstance(stream, StickyEventsStream):
+                if hs.get_instance_name() in hs.config.worker.writers.events:
+                    self._streams_to_replicate.append(stream)
+
+                continue
+
             if isinstance(stream, DeviceListsStream):
                 if hs.get_instance_name() in hs.config.worker.writers.device_lists:
                     self._streams_to_replicate.append(stream)
@@ -234,43 +246,44 @@ class ReplicationCommandHandler:
 
         # Map of stream name to batched updates. See RdataCommand for info on
         # how batching works.
-        self._pending_batches: Dict[str, List[Any]] = {}
+        self._pending_batches: dict[str, list[Any]] = {}
 
         # The factory used to create connections.
-        self._factory: Optional[ReconnectingClientFactory] = None
+        self._factory: ReconnectingClientFactory | None = None
 
         # The currently connected connections. (The list of places we need to send
         # outgoing replication commands to.)
-        self._connections: List[IReplicationConnection] = []
+        self._connections: list[IReplicationConnection] = []
 
-        LaterGauge(
-            name="synapse_replication_tcp_resource_total_connections",
-            desc="",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {(self.server_name,): len(self._connections)},
+        tcp_resource_total_connections_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {(self.server_name,): len(self._connections)},
         )
 
         # When POSITION or RDATA commands arrive, we stick them in a queue and process
         # them in order in a separate background process.
 
         # the streams which are currently being processed by _unsafe_process_queue
-        self._processing_streams: Set[str] = set()
+        self._processing_streams: set[str] = set()
 
         # for each stream, a queue of commands that are awaiting processing, and the
         # connection that they arrived on.
         self._command_queues_by_stream = {
-            stream_name: _StreamCommandQueue() for stream_name in self._streams
+            stream_name: BackgroundQueue[_StreamCommandQueueItem](
+                hs,
+                "process-replication-data",
+                self._unsafe_process_item,
+            )
+            for stream_name in self._streams
         }
 
         # For each connection, the incoming stream names that have received a POSITION
         # from that connection.
-        self._streams_by_connection: Dict[IReplicationConnection, Set[str]] = {}
+        self._streams_by_connection: dict[IReplicationConnection, set[str]] = {}
 
-        LaterGauge(
-            name="synapse_replication_tcp_command_queue",
-            desc="Number of inbound RDATA/POSITION commands queued for processing",
-            labelnames=["stream_name", SERVER_NAME_LABEL],
-            caller=lambda: {
+        tcp_command_queue_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {
                 (stream_name, self.server_name): len(queue)
                 for stream_name, queue in self._command_queues_by_stream.items()
             },
@@ -332,7 +345,7 @@ class ReplicationCommandHandler:
             self._channels_to_subscribe_to.append(channel_name)
 
     def _add_command_to_stream_queue(
-        self, conn: IReplicationConnection, cmd: Union[RdataCommand, PositionCommand]
+        self, conn: IReplicationConnection, cmd: RdataCommand | PositionCommand
     ) -> None:
         """Queue the given received command for processing
 
@@ -345,43 +358,21 @@ class ReplicationCommandHandler:
             logger.error("Got %s for unknown stream: %s", cmd.NAME, stream_name)
             return
 
-        queue.append((cmd, conn))
+        queue.add((cmd, conn))
 
-        # if we're already processing this stream, there's nothing more to do:
-        # the new entry on the queue will get picked up in due course
-        if stream_name in self._processing_streams:
-            return
+    async def _unsafe_process_item(self, item: _StreamCommandQueueItem) -> None:
+        """Process a single command from the stream queue.
 
-        # fire off a background process to start processing the queue.
-        run_as_background_process(
-            "process-replication-data",
-            self.server_name,
-            self._unsafe_process_queue,
-            stream_name,
-        )
-
-    async def _unsafe_process_queue(self, stream_name: str) -> None:
-        """Processes the command queue for the given stream, until it is empty
-
-        Does not check if there is already a thread processing the queue, hence "unsafe"
+        This should only be called one at a time per stream, and is called from
+        the stream's BackgroundQueue.
         """
-        assert stream_name not in self._processing_streams
-
-        self._processing_streams.add(stream_name)
-        try:
-            queue = self._command_queues_by_stream.get(stream_name)
-            while queue:
-                cmd, conn = queue.popleft()
-                try:
-                    await self._process_command(cmd, conn, stream_name)
-                except Exception:
-                    logger.exception("Failed to handle command %s", cmd)
-        finally:
-            self._processing_streams.discard(stream_name)
+        cmd, conn = item
+        stream_name = cmd.stream_name
+        await self._process_command(cmd, conn, stream_name)
 
     async def _process_command(
         self,
-        cmd: Union[PositionCommand, RdataCommand],
+        cmd: PositionCommand | RdataCommand,
         conn: IReplicationConnection,
         stream_name: str,
     ) -> None:
@@ -443,11 +434,11 @@ class ReplicationCommandHandler:
                 bindAddress=None,
             )
 
-    def get_streams(self) -> Dict[str, Stream]:
+    def get_streams(self) -> dict[str, Stream]:
         """Get a map from stream name to all streams."""
         return self._streams
 
-    def get_streams_to_replicate(self) -> List[Stream]:
+    def get_streams_to_replicate(self) -> list[Stream]:
         """Get a list of streams that this instances replicates."""
         return self._streams_to_replicate
 
@@ -472,7 +463,7 @@ class ReplicationCommandHandler:
 
     def on_USER_SYNC(
         self, conn: IReplicationConnection, cmd: UserSyncCommand
-    ) -> Optional[Awaitable[None]]:
+    ) -> Awaitable[None] | None:
         user_sync_counter.labels(**{SERVER_NAME_LABEL: self.server_name}).inc()
 
         if self._is_presence_writer:
@@ -488,7 +479,7 @@ class ReplicationCommandHandler:
 
     def on_CLEAR_USER_SYNC(
         self, conn: IReplicationConnection, cmd: ClearUserSyncsCommand
-    ) -> Optional[Awaitable[None]]:
+    ) -> Awaitable[None] | None:
         if self._is_presence_writer:
             return self._presence_handler.update_external_syncs_clear(cmd.instance_id)
         else:
@@ -504,7 +495,7 @@ class ReplicationCommandHandler:
 
     def on_USER_IP(
         self, conn: IReplicationConnection, cmd: UserIpCommand
-    ) -> Optional[Awaitable[None]]:
+    ) -> Awaitable[None] | None:
         user_ip_cache_counter.labels(**{SERVER_NAME_LABEL: self.server_name}).inc()
 
         if self._is_master or self._should_insert_client_ips:
@@ -763,10 +754,17 @@ class ReplicationCommandHandler:
     def on_NEW_ACTIVE_TASK(
         self, conn: IReplicationConnection, cmd: NewActiveTaskCommand
     ) -> None:
-        """Called when get a new NEW_ACTIVE_TASK command."""
+        """Called when we get a new NEW_ACTIVE_TASK command."""
         if self._task_scheduler:
             self._task_scheduler.on_new_task(cmd.data)
 
+    async def on_CANCEL_TASK(
+        self, conn: IReplicationConnection, cmd: CancelTaskCommand
+    ) -> None:
+        """Called when we get a new CANCEL_TASK command."""
+        if self._task_scheduler:
+            await self._task_scheduler.on_cancel_task(cmd.data)
+
     def new_connection(self, connection: IReplicationConnection) -> None:
         """Called when we have a new connection."""
         self._connections.append(connection)
@@ -846,7 +844,7 @@ class ReplicationCommandHandler:
         self,
         instance_id: str,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         is_syncing: bool,
         last_sync_ms: int,
     ) -> None:
@@ -861,7 +859,7 @@ class ReplicationCommandHandler:
         access_token: str,
         ip: str,
         user_agent: str,
-        device_id: Optional[str],
+        device_id: str | None,
         last_seen: int,
     ) -> None:
         """Tell the master that the user made a request."""
@@ -871,7 +869,7 @@ class ReplicationCommandHandler:
     def send_remote_server_up(self, server: str) -> None:
         self.send_command(RemoteServerUpCommand(server))
 
-    def stream_update(self, stream_name: str, token: Optional[int], data: Any) -> None:
+    def stream_update(self, stream_name: str, token: int | None, data: Any) -> None:
         """Called when a new update is available to stream to Redis subscribers.
 
         We need to check if the client is interested in the stream or not
@@ -889,14 +887,18 @@ class ReplicationCommandHandler:
         """Called when a new task has been scheduled for immediate launch and is ACTIVE."""
         self.send_command(NewActiveTaskCommand(task_id))
 
+    def send_cancel_task(self, task_id: str) -> None:
+        """Called when a scheduled task has been cancelled and should be terminated."""
+        self.send_command(CancelTaskCommand(task_id))
+
 
 UpdateToken = TypeVar("UpdateToken")
 UpdateRow = TypeVar("UpdateRow")
 
 
 def _batch_updates(
-    updates: Iterable[Tuple[UpdateToken, UpdateRow]],
-) -> Iterator[Tuple[UpdateToken, List[UpdateRow]]]:
+    updates: Iterable[tuple[UpdateToken, UpdateRow]],
+) -> Iterator[tuple[UpdateToken, list[UpdateRow]]]:
     """Collect stream updates with the same token together
 
     Given a series of updates returned by Stream.get_updates_since(), collects
diff --git a/synapse/replication/tcp/protocol.py b/synapse/replication/tcp/protocol.py
index 969f0303e0..489a2c76a6 100644
--- a/synapse/replication/tcp/protocol.py
+++ b/synapse/replication/tcp/protocol.py
@@ -28,7 +28,7 @@ import fcntl
 import logging
 import struct
 from inspect import isawaitable
-from typing import TYPE_CHECKING, Any, Collection, List, Optional
+from typing import TYPE_CHECKING, Any, Collection
 
 from prometheus_client import Counter
 from zope.interface import Interface, implementer
@@ -42,7 +42,6 @@ from synapse.logging.context import PreserveLoggingContext
 from synapse.metrics import SERVER_NAME_LABEL, LaterGauge
 from synapse.metrics.background_process_metrics import (
     BackgroundProcessLoggingContext,
-    run_as_background_process,
 )
 from synapse.replication.tcp.commands import (
     VALID_CLIENT_COMMANDS,
@@ -55,7 +54,8 @@ from synapse.replication.tcp.commands import (
     ServerCommand,
     parse_command_from_line,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.stringutils import random_string
 
 if TYPE_CHECKING:
@@ -83,7 +83,7 @@ tcp_outbound_commands_counter = Counter(
 
 # A list of all connected protocols. This allows us to send metrics about the
 # connections.
-connected_connections: "List[BaseReplicationStreamProtocol]" = []
+connected_connections: "list[BaseReplicationStreamProtocol]" = []
 
 
 logger = logging.getLogger(__name__)
@@ -140,16 +140,21 @@ class BaseReplicationStreamProtocol(LineOnlyReceiver):
     max_line_buffer = 10000
 
     def __init__(
-        self, server_name: str, clock: Clock, handler: "ReplicationCommandHandler"
+        self,
+        hs: "HomeServer",
+        server_name: str,
+        clock: Clock,
+        handler: "ReplicationCommandHandler",
     ):
         self.server_name = server_name
+        self.hs = hs
         self.clock = clock
         self.command_handler = handler
 
         self.last_received_command = self.clock.time_msec()
         self.last_sent_command = 0
         # When we requested the connection be closed
-        self.time_we_closed: Optional[int] = None
+        self.time_we_closed: int | None = None
 
         self.received_ping = False  # Have we received a ping from the other side
 
@@ -159,10 +164,10 @@ class BaseReplicationStreamProtocol(LineOnlyReceiver):
         self.conn_id = random_string(5)  # To dedupe in case of name clashes.
 
         # List of pending commands to send once we've established the connection
-        self.pending_commands: List[Command] = []
+        self.pending_commands: list[Command] = []
 
         # The LoopingCall for sending pings.
-        self._send_ping_loop: Optional[task.LoopingCall] = None
+        self._send_ping_loop: task.LoopingCall | None = None
 
         # a logcontext which we use for processing incoming commands. We declare it as a
         # background process so that the CPU stats get reported to prometheus.
@@ -189,7 +194,9 @@ class BaseReplicationStreamProtocol(LineOnlyReceiver):
         self._send_pending_commands()
 
         # Starts sending pings
-        self._send_ping_loop = self.clock.looping_call(self.send_ping, 5000)
+        self._send_ping_loop = self.clock.looping_call(
+            self.send_ping, Duration(seconds=5)
+        )
 
         # Always send the initial PING so that the other side knows that they
         # can time us out.
@@ -290,9 +297,8 @@ class BaseReplicationStreamProtocol(LineOnlyReceiver):
             # if so.
 
             if isawaitable(res):
-                run_as_background_process(
+                self.hs.run_as_background_process(
                     "replication-" + cmd.get_logcontext_id(),
-                    self.server_name,
                     lambda: res,
                 )
 
@@ -470,9 +476,13 @@ class ServerReplicationStreamProtocol(BaseReplicationStreamProtocol):
     VALID_OUTBOUND_COMMANDS = VALID_SERVER_COMMANDS
 
     def __init__(
-        self, server_name: str, clock: Clock, handler: "ReplicationCommandHandler"
+        self,
+        hs: "HomeServer",
+        server_name: str,
+        clock: Clock,
+        handler: "ReplicationCommandHandler",
     ):
-        super().__init__(server_name, clock, handler)
+        super().__init__(hs, server_name, clock, handler)
 
         self.server_name = server_name
 
@@ -497,7 +507,7 @@ class ClientReplicationStreamProtocol(BaseReplicationStreamProtocol):
         clock: Clock,
         command_handler: "ReplicationCommandHandler",
     ):
-        super().__init__(server_name, clock, command_handler)
+        super().__init__(hs, server_name, clock, command_handler)
 
         self.client_name = client_name
         self.server_name = server_name
@@ -527,7 +537,10 @@ pending_commands = LaterGauge(
     name="synapse_replication_tcp_protocol_pending_commands",
     desc="",
     labelnames=["name", SERVER_NAME_LABEL],
-    caller=lambda: {
+)
+pending_commands.register_hook(
+    homeserver_instance_id=None,
+    hook=lambda: {
         (p.name, p.server_name): len(p.pending_commands) for p in connected_connections
     },
 )
@@ -544,7 +557,10 @@ transport_send_buffer = LaterGauge(
     name="synapse_replication_tcp_protocol_transport_send_buffer",
     desc="",
     labelnames=["name", SERVER_NAME_LABEL],
-    caller=lambda: {
+)
+transport_send_buffer.register_hook(
+    homeserver_instance_id=None,
+    hook=lambda: {
         (p.name, p.server_name): transport_buffer_size(p) for p in connected_connections
     },
 )
@@ -571,7 +587,10 @@ tcp_transport_kernel_send_buffer = LaterGauge(
     name="synapse_replication_tcp_protocol_transport_kernel_send_buffer",
     desc="",
     labelnames=["name", SERVER_NAME_LABEL],
-    caller=lambda: {
+)
+tcp_transport_kernel_send_buffer.register_hook(
+    homeserver_instance_id=None,
+    hook=lambda: {
         (p.name, p.server_name): transport_kernel_read_buffer_size(p, False)
         for p in connected_connections
     },
@@ -582,7 +601,10 @@ tcp_transport_kernel_read_buffer = LaterGauge(
     name="synapse_replication_tcp_protocol_transport_kernel_read_buffer",
     desc="",
     labelnames=["name", SERVER_NAME_LABEL],
-    caller=lambda: {
+)
+tcp_transport_kernel_read_buffer.register_hook(
+    homeserver_instance_id=None,
+    hook=lambda: {
         (p.name, p.server_name): transport_kernel_read_buffer_size(p, True)
         for p in connected_connections
     },
diff --git a/synapse/replication/tcp/redis.py b/synapse/replication/tcp/redis.py
index aba79b2378..93ba48b406 100644
--- a/synapse/replication/tcp/redis.py
+++ b/synapse/replication/tcp/redis.py
@@ -21,7 +21,7 @@
 
 import logging
 from inspect import isawaitable
-from typing import TYPE_CHECKING, Any, Generic, List, Optional, Type, TypeVar, cast
+from typing import TYPE_CHECKING, Any, Generic, TypeVar, cast
 
 import attr
 from txredisapi import (
@@ -40,7 +40,6 @@ from synapse.logging.context import PreserveLoggingContext, make_deferred_yielda
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.metrics.background_process_metrics import (
     BackgroundProcessLoggingContext,
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.replication.tcp.commands import (
@@ -54,6 +53,7 @@ from synapse.replication.tcp.protocol import (
     tcp_inbound_commands_counter,
     tcp_outbound_commands_counter,
 )
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.replication.tcp.handler import ReplicationCommandHandler
@@ -73,10 +73,10 @@ class ConstantProperty(Generic[T, V]):
 
     constant: V = attr.ib()
 
-    def __get__(self, obj: Optional[T], objtype: Optional[Type[T]] = None) -> V:
+    def __get__(self, obj: T | None, objtype: type[T] | None = None) -> V:
         return self.constant
 
-    def __set__(self, obj: Optional[T], value: V) -> None:
+    def __set__(self, obj: T | None, value: V) -> None:
         pass
 
 
@@ -109,9 +109,10 @@ class RedisSubscriber(SubscriberProtocol):
     """
 
     server_name: str
+    hs: "HomeServer"
     synapse_handler: "ReplicationCommandHandler"
     synapse_stream_prefix: str
-    synapse_channel_names: List[str]
+    synapse_channel_names: list[str]
     synapse_outbound_redis_connection: ConnectionHandler
 
     def __init__(self, *args: Any, **kwargs: Any):
@@ -119,7 +120,7 @@ class RedisSubscriber(SubscriberProtocol):
 
         # a logcontext which we use for processing incoming commands. We declare it as a
         # background process so that the CPU stats get reported to prometheus.
-        self._logging_context: Optional[BackgroundProcessLoggingContext] = None
+        self._logging_context: BackgroundProcessLoggingContext | None = None
 
     def _get_logging_context(self) -> BackgroundProcessLoggingContext:
         """
@@ -146,9 +147,7 @@ class RedisSubscriber(SubscriberProtocol):
     def connectionMade(self) -> None:
         logger.info("Connected to redis")
         super().connectionMade()
-        run_as_background_process(
-            "subscribe-replication", self.server_name, self._send_subscribe
-        )
+        self.hs.run_as_background_process("subscribe-replication", self._send_subscribe)
 
     async def _send_subscribe(self) -> None:
         # it's important to make sure that we only send the REPLICATE command once we
@@ -223,8 +222,8 @@ class RedisSubscriber(SubscriberProtocol):
         # if so.
 
         if isawaitable(res):
-            run_as_background_process(
-                "replication-" + cmd.get_logcontext_id(), self.server_name, lambda: res
+            self.hs.run_as_background_process(
+                "replication-" + cmd.get_logcontext_id(), lambda: res
             )
 
     def connectionLost(self, reason: Failure) -> None:  # type: ignore[override]
@@ -245,11 +244,17 @@ class RedisSubscriber(SubscriberProtocol):
         Args:
             cmd: The command to send
         """
-        run_as_background_process(
+        self.hs.run_as_background_process(
             "send-cmd",
-            self.server_name,
             self._async_send_command,
             cmd,
+            # We originally started tracing background processes to avoid `There was no
+            # active span` errors but this change meant we started generating 15x the
+            # number of spans than before (this is one of the most heavily called
+            # instances of `run_as_background_process`).
+            #
+            # Since we don't log or tag a tracing span in the downstream
+            # code, we can safely disable this.
             bg_start_span=False,
         )
 
@@ -289,14 +294,14 @@ class SynapseRedisFactory(RedisFactory):
         self,
         hs: "HomeServer",
         uuid: str,
-        dbid: Optional[int],
+        dbid: int | None,
         poolsize: int,
         isLazy: bool = False,
-        handler: Type = ConnectionHandler,
+        handler: type = ConnectionHandler,
         charset: str = "utf-8",
-        password: Optional[str] = None,
+        password: str | None = None,
         replyTimeout: int = 30,
-        convertNumbers: Optional[int] = True,
+        convertNumbers: int | None = True,
     ):
         super().__init__(
             uuid=uuid,
@@ -310,11 +315,10 @@ class SynapseRedisFactory(RedisFactory):
             convertNumbers=convertNumbers,
         )
 
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
 
-        hs.get_clock().looping_call(self._send_ping, 30 * 1000)
+        hs.get_clock().looping_call(self._send_ping, Duration(seconds=30))
 
     @wrap_as_background_process("redis_ping")
     async def _send_ping(self) -> None:
@@ -378,7 +382,7 @@ class RedisDirectTcpReplicationClientFactory(SynapseRedisFactory):
         self,
         hs: "HomeServer",
         outbound_redis_connection: ConnectionHandler,
-        channel_names: List[str],
+        channel_names: list[str],
     ):
         super().__init__(
             hs,
@@ -390,6 +394,7 @@ class RedisDirectTcpReplicationClientFactory(SynapseRedisFactory):
         )
 
         self.server_name = hs.hostname
+        self.hs = hs
         self.synapse_handler = hs.get_replication_command_handler()
         self.synapse_stream_prefix = hs.hostname
         self.synapse_channel_names = channel_names
@@ -405,6 +410,7 @@ class RedisDirectTcpReplicationClientFactory(SynapseRedisFactory):
         # the base method does some other things than just instantiating the
         # protocol.
         p.server_name = self.server_name
+        p.hs = self.hs
         p.synapse_handler = self.synapse_handler
         p.synapse_outbound_redis_connection = self.synapse_outbound_redis_connection
         p.synapse_stream_prefix = self.synapse_stream_prefix
@@ -417,9 +423,9 @@ def lazyConnection(
     hs: "HomeServer",
     host: str = "localhost",
     port: int = 6379,
-    dbid: Optional[int] = None,
+    dbid: int | None = None,
     reconnect: bool = True,
-    password: Optional[str] = None,
+    password: str | None = None,
     replyTimeout: int = 30,
 ) -> ConnectionHandler:
     """Creates a connection to Redis that is lazily set up and reconnects if the
@@ -466,9 +472,9 @@ def lazyConnection(
 def lazyUnixConnection(
     hs: "HomeServer",
     path: str = "/tmp/redis.sock",
-    dbid: Optional[int] = None,
+    dbid: int | None = None,
     reconnect: bool = True,
-    password: Optional[str] = None,
+    password: str | None = None,
     replyTimeout: int = 30,
 ) -> ConnectionHandler:
     """Creates a connection to Redis that is lazily set up and reconnects if the
diff --git a/synapse/replication/tcp/resource.py b/synapse/replication/tcp/resource.py
index d800cfe6f6..36dd39ed67 100644
--- a/synapse/replication/tcp/resource.py
+++ b/synapse/replication/tcp/resource.py
@@ -22,7 +22,7 @@
 
 import logging
 import random
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from prometheus_client import Counter
 
@@ -30,11 +30,11 @@ from twisted.internet.interfaces import IAddress
 from twisted.internet.protocol import ServerFactory
 
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.replication.tcp.commands import PositionCommand
 from synapse.replication.tcp.protocol import ServerReplicationStreamProtocol
 from synapse.replication.tcp.streams import EventsStream
 from synapse.replication.tcp.streams._base import CachesStream, StreamRow, Token
+from synapse.util.duration import Duration
 from synapse.util.metrics import Measure
 
 if TYPE_CHECKING:
@@ -55,6 +55,7 @@ class ReplicationStreamProtocolFactory(ServerFactory):
     def __init__(self, hs: "HomeServer"):
         self.command_handler = hs.get_replication_command_handler()
         self.clock = hs.get_clock()
+        self.hs = hs
         self.server_name = hs.config.server.server_name
 
         # If we've created a `ReplicationStreamProtocolFactory` then we're
@@ -69,7 +70,7 @@ class ReplicationStreamProtocolFactory(ServerFactory):
 
     def buildProtocol(self, addr: IAddress) -> ServerReplicationStreamProtocol:
         return ServerReplicationStreamProtocol(
-            self.server_name, self.clock, self.command_handler
+            self.hs, self.server_name, self.clock, self.command_handler
         )
 
 
@@ -82,6 +83,7 @@ class ReplicationStreamer:
 
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname
+        self.hs = hs
         self.store = hs.get_datastores().main
         self.clock = hs.get_clock()
         self.notifier = hs.get_notifier()
@@ -115,7 +117,7 @@ class ReplicationStreamer:
         #
         # Note that if the position hasn't advanced then we won't send anything.
         if any(EventsStream.NAME == s.NAME for s in self.streams):
-            self.clock.looping_call(self.on_notifier_poke, 1000)
+            self.clock.looping_call(self.on_notifier_poke, Duration(seconds=1))
 
     def on_notifier_poke(self) -> None:
         """Checks if there is actually any new data and sends it to the
@@ -147,8 +149,8 @@ class ReplicationStreamer:
             logger.debug("Notifier poke loop already running")
             return
 
-        run_as_background_process(
-            "replication_notifier", self.server_name, self._run_notifier_loop
+        self.hs.run_as_background_process(
+            "replication_notifier", self._run_notifier_loop
         )
 
     async def _run_notifier_loop(self) -> None:
@@ -319,8 +321,8 @@ class ReplicationStreamer:
 
 
 def _batch_updates(
-    updates: List[Tuple[Token, StreamRow]],
-) -> List[Tuple[Optional[Token], StreamRow]]:
+    updates: list[tuple[Token, StreamRow]],
+) -> list[tuple[Token | None, StreamRow]]:
     """Takes a list of updates of form [(token, row)] and sets the token to
     None for all rows where the next row has the same token. This is used to
     implement batching.
@@ -336,7 +338,7 @@ def _batch_updates(
     if not updates:
         return []
 
-    new_updates: List[Tuple[Optional[Token], StreamRow]] = []
+    new_updates: list[tuple[Token | None, StreamRow]] = []
     for i, update in enumerate(updates[:-1]):
         if update[0] == updates[i + 1][0]:
             new_updates.append((None, update[1]))
diff --git a/synapse/replication/tcp/streams/__init__.py b/synapse/replication/tcp/streams/__init__.py
index 25c15e5d48..067847617f 100644
--- a/synapse/replication/tcp/streams/__init__.py
+++ b/synapse/replication/tcp/streams/__init__.py
@@ -40,6 +40,7 @@ from synapse.replication.tcp.streams._base import (
     PushersStream,
     PushRulesStream,
     ReceiptsStream,
+    StickyEventsStream,
     Stream,
     ThreadSubscriptionsStream,
     ToDeviceStream,
@@ -68,6 +69,7 @@ STREAMS_MAP = {
         ToDeviceStream,
         FederationStream,
         AccountDataStream,
+        StickyEventsStream,
         ThreadSubscriptionsStream,
         UnPartialStatedRoomStream,
         UnPartialStatedEventStream,
@@ -77,6 +79,7 @@ STREAMS_MAP = {
 __all__ = [
     "STREAMS_MAP",
     "Stream",
+    "EventsStream",
     "BackfillStream",
     "PresenceStream",
     "PresenceFederationStream",
@@ -87,7 +90,9 @@ __all__ = [
     "CachesStream",
     "DeviceListsStream",
     "ToDeviceStream",
+    "FederationStream",
     "AccountDataStream",
+    "StickyEventsStream",
     "ThreadSubscriptionsStream",
     "UnPartialStatedRoomStream",
     "UnPartialStatedEventStream",
diff --git a/synapse/replication/tcp/streams/_base.py b/synapse/replication/tcp/streams/_base.py
index ec7e935d6a..1ea6b4fa85 100644
--- a/synapse/replication/tcp/streams/_base.py
+++ b/synapse/replication/tcp/streams/_base.py
@@ -26,9 +26,6 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    List,
-    Optional,
-    Tuple,
     TypeVar,
 )
 
@@ -56,7 +53,7 @@ Token = int
 # parsing with Stream.parse_row (which turns it into a `ROW_TYPE`). Normally it's
 # just a row from a database query, though this is dependent on the stream in question.
 #
-StreamRow = TypeVar("StreamRow", bound=Tuple)
+StreamRow = TypeVar("StreamRow", bound=tuple)
 
 # The type returned by the update_function of a stream, as well as get_updates(),
 # get_updates_since, etc.
@@ -66,7 +63,7 @@ StreamRow = TypeVar("StreamRow", bound=Tuple)
 #   * `new_last_token` is the new position in stream.
 #   * `limited` is whether there are more updates to fetch.
 #
-StreamUpdateResult = Tuple[List[Tuple[Token, StreamRow]], Token, bool]
+StreamUpdateResult = tuple[list[tuple[Token, StreamRow]], Token, bool]
 
 # The type of an update_function for a stream
 #
@@ -287,9 +284,9 @@ class BackfillStream(Stream):
         event_id: str
         room_id: str
         type: str
-        state_key: Optional[str]
-        redacts: Optional[str]
-        relates_to: Optional[str]
+        state_key: str | None
+        redacts: str | None
+        relates_to: str | None
 
     NAME = "backfill"
     ROW_TYPE = BackfillStreamRow
@@ -400,7 +397,7 @@ class TypingStream(Stream):
         room_id: str
 
         # All the users that are 'typing' right now in the specified room.
-        user_ids: List[str]
+        user_ids: list[str]
 
     NAME = "typing"
     ROW_TYPE = TypingStreamRow
@@ -410,7 +407,7 @@ class TypingStream(Stream):
             # On the writer, query the typing handler
             typing_writer_handler = hs.get_typing_writer_handler()
             update_function: Callable[
-                [str, int, int, int], Awaitable[Tuple[List[Tuple[int, Any]], int, bool]]
+                [str, int, int, int], Awaitable[tuple[list[tuple[int, Any]], int, bool]]
             ] = typing_writer_handler.get_all_typing_updates
             self.current_token_function = typing_writer_handler.get_current_token
         else:
@@ -437,7 +434,7 @@ class ReceiptsStream(_StreamFromIdGen):
         receipt_type: str
         user_id: str
         event_id: str
-        thread_id: Optional[str]
+        thread_id: str | None
         data: dict
 
     NAME = "receipts"
@@ -512,7 +509,7 @@ class CachesStream(Stream):
         """
 
         cache_func: str
-        keys: Optional[List[Any]]
+        keys: list[Any] | None
         invalidation_ts: int
 
     NAME = "caches"
@@ -641,7 +638,7 @@ class AccountDataStream(_StreamFromIdGen):
     @attr.s(slots=True, frozen=True, auto_attribs=True)
     class AccountDataStreamRow:
         user_id: str
-        room_id: Optional[str]
+        room_id: str | None
         data_type: str
 
     NAME = "account_data"
@@ -766,3 +763,48 @@ class ThreadSubscriptionsStream(_StreamFromIdGen):
             return [], to_token, False
 
         return rows, rows[-1][0], len(updates) == limit
+
+
+@attr.s(slots=True, auto_attribs=True)
+class StickyEventsStreamRow:
+    """Stream to inform workers about changes to sticky events."""
+
+    room_id: str
+
+    event_id: str
+    """The sticky event ID"""
+
+
+class StickyEventsStream(_StreamFromIdGen):
+    """A sticky event was changed."""
+
+    NAME = "sticky_events"
+    ROW_TYPE = StickyEventsStreamRow
+
+    def __init__(self, hs: "HomeServer"):
+        self.store = hs.get_datastores().main
+        super().__init__(
+            hs.get_instance_name(),
+            self._update_function,
+            self.store._sticky_events_id_gen,
+        )
+
+    async def _update_function(
+        self, instance_name: str, from_token: int, to_token: int, limit: int
+    ) -> StreamUpdateResult:
+        updates = await self.store.get_updated_sticky_events(
+            from_id=from_token, to_id=to_token, limit=limit
+        )
+        rows = [
+            (
+                update.stream_id,
+                # These are the args to `StickyEventsStreamRow`
+                (update.room_id, update.event_id),
+            )
+            for update in updates
+        ]
+
+        if not rows:
+            return [], to_token, False
+
+        return rows, rows[-1][0], len(updates) == limit
diff --git a/synapse/replication/tcp/streams/events.py b/synapse/replication/tcp/streams/events.py
index 05b55fb033..ca9f6f12da 100644
--- a/synapse/replication/tcp/streams/events.py
+++ b/synapse/replication/tcp/streams/events.py
@@ -20,7 +20,7 @@
 #
 import heapq
 from collections import defaultdict
-from typing import TYPE_CHECKING, Iterable, Optional, Tuple, Type, TypeVar, cast
+from typing import TYPE_CHECKING, Iterable, TypeVar, cast
 
 import attr
 
@@ -93,7 +93,7 @@ class BaseEventsStreamRow:
     TypeId: str
 
     @classmethod
-    def from_data(cls: Type[T], data: Iterable[Optional[str]]) -> T:
+    def from_data(cls: type[T], data: Iterable[str | None]) -> T:
         """Parse the data from the replication stream into a row.
 
         By default we just call the constructor with the data list as arguments
@@ -111,10 +111,10 @@ class EventsStreamEventRow(BaseEventsStreamRow):
     event_id: str
     room_id: str
     type: str
-    state_key: Optional[str]
-    redacts: Optional[str]
-    relates_to: Optional[str]
-    membership: Optional[str]
+    state_key: str | None
+    redacts: str | None
+    relates_to: str | None
+    membership: str | None
     rejected: bool
     outlier: bool
 
@@ -126,7 +126,7 @@ class EventsStreamCurrentStateRow(BaseEventsStreamRow):
     room_id: str
     type: str
     state_key: str
-    event_id: Optional[str]
+    event_id: str | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -136,7 +136,7 @@ class EventsStreamAllStateRow(BaseEventsStreamRow):
     room_id: str
 
 
-_EventRows: Tuple[Type[BaseEventsStreamRow], ...] = (
+_EventRows: tuple[type[BaseEventsStreamRow], ...] = (
     EventsStreamEventRow,
     EventsStreamCurrentStateRow,
     EventsStreamAllStateRow,
@@ -237,7 +237,7 @@ class EventsStream(_StreamFromIdGen):
         # distinguish the row type). At the same time, we can limit the event_rows
         # to the max stream_id from state_rows.
 
-        event_updates: Iterable[Tuple[int, Tuple]] = (
+        event_updates: Iterable[tuple[int, tuple]] = (
             (stream_id, (EventsStreamEventRow.TypeId, rest))
             for (stream_id, *rest) in event_rows
             if stream_id <= upper_limit
@@ -254,20 +254,20 @@ class EventsStream(_StreamFromIdGen):
             for room_id, stream_ids in state_updates_by_room.items()
             if len(stream_ids) >= _MAX_STATE_UPDATES_PER_ROOM
         ]
-        state_all_updates: Iterable[Tuple[int, Tuple]] = (
+        state_all_updates: Iterable[tuple[int, tuple]] = (
             (max_stream_id, (EventsStreamAllStateRow.TypeId, (room_id,)))
             for (max_stream_id, room_id) in state_all_rows
         )
 
         # Any remaining state updates are sent individually.
         state_all_rooms = {room_id for _, room_id in state_all_rows}
-        state_updates: Iterable[Tuple[int, Tuple]] = (
+        state_updates: Iterable[tuple[int, tuple]] = (
             (stream_id, (EventsStreamCurrentStateRow.TypeId, rest))
             for (stream_id, *rest) in state_rows
             if rest[0] not in state_all_rooms
         )
 
-        ex_outliers_updates: Iterable[Tuple[int, Tuple]] = (
+        ex_outliers_updates: Iterable[tuple[int, tuple]] = (
             (stream_id, (EventsStreamEventRow.TypeId, rest))
             for (stream_id, *rest) in ex_outliers_rows
         )
@@ -282,6 +282,6 @@ class EventsStream(_StreamFromIdGen):
 
     @classmethod
     def parse_row(cls, row: StreamRow) -> "EventsStreamRow":
-        (typ, data) = cast(Tuple[str, Iterable[Optional[str]]], row)
+        (typ, data) = cast(tuple[str, Iterable[str | None]], row)
         event_stream_row_data = TypeToRow[typ].from_data(data)
         return EventsStreamRow(typ, event_stream_row_data)
diff --git a/synapse/replication/tcp/streams/federation.py b/synapse/replication/tcp/streams/federation.py
index 1c2ffe86b7..c99e720381 100644
--- a/synapse/replication/tcp/streams/federation.py
+++ b/synapse/replication/tcp/streams/federation.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import TYPE_CHECKING, Any, Awaitable, Callable, List, Tuple
+from typing import TYPE_CHECKING, Any, Awaitable, Callable
 
 import attr
 
@@ -58,7 +58,7 @@ class FederationStream(Stream):
                 federation_sender.get_current_token
             )
             update_function: Callable[
-                [str, int, int, int], Awaitable[Tuple[List[Tuple[int, Any]], int, bool]]
+                [str, int, int, int], Awaitable[tuple[list[tuple[int, Any]], int, bool]]
             ] = federation_sender.get_replication_rows
 
         elif hs.should_send_federation():
@@ -88,5 +88,5 @@ class FederationStream(Stream):
     @staticmethod
     async def _stub_update_function(
         instance_name: str, from_token: int, upto_token: int, limit: int
-    ) -> Tuple[list, int, bool]:
+    ) -> tuple[list, int, bool]:
         return [], upto_token, False
diff --git a/synapse/res/providers.json b/synapse/res/providers.json
index 2dc9fec8e3..48ad5dabda 100644
--- a/synapse/res/providers.json
+++ b/synapse/res/providers.json
@@ -1,14 +1,15 @@
 [
     {
-        "provider_name": "Twitter",
-        "provider_url": "http://www.twitter.com/",
+        "provider_name": "X",
+        "provider_url": "https://x.com/",
         "endpoints": [
             {
                 "schemes": [
-                    "https://twitter.com/*/moments/*",
-                    "https://*.twitter.com/*/moments/*"
+                    "https://x.com/*",
+                    "https://x.com/*/status/*",
+                    "https://*.x.com/*/status/*"
                 ],
-                "url": "https://publish.twitter.com/oembed"
+                "url": "https://publish.x.com/oembed"
             }
         ]
     },
diff --git a/synapse/res/templates/sso_error.html b/synapse/res/templates/sso_error.html
index 6fa36c11c9..e7e34c7293 100644
--- a/synapse/res/templates/sso_error.html
+++ b/synapse/res/templates/sso_error.html
@@ -20,6 +20,27 @@
         <header>
             <p>You are not allowed to log in here.</p>
         </header>
+{% elif error == "provider_unavailable" %}
+        <header>
+            <h1>This login provider is unavailable right now.</h1>
+            <p>
+                There has been a problem which means that it's not currently possible
+                to log in with that provider.
+            </p>
+            <p>
+                If your account has a password, or is connected to other login providers,
+                try those methods to log in.
+            </p>
+            <p>
+                This issue could be temporary, so please try again later.
+                If the problem persists, please contact the server's administrator.
+            </p>
+            <small>
+                If you are the administrator of this server, please check the server logs for more information.
+                This could be caused by a server misconfiguration or an issue with the provider.
+            </small>
+        </header>
+        {% include "sso_footer.html" without context %}
 {% else %}
         <header>
             <h1>There was an error</h1>
diff --git a/synapse/rest/__init__.py b/synapse/rest/__init__.py
index a24ca09846..fe66494d82 100644
--- a/synapse/rest/__init__.py
+++ b/synapse/rest/__init__.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Callable, Dict, Iterable, List, Optional, Tuple
+from typing import TYPE_CHECKING, Callable, Iterable
 
 from synapse.http.server import HttpServer, JsonResource
 from synapse.rest import admin
@@ -42,6 +42,7 @@ from synapse.rest.client import (
     login,
     login_token_request,
     logout,
+    matrixrtc,
     mutual_rooms,
     notifications,
     openid,
@@ -77,7 +78,7 @@ if TYPE_CHECKING:
 
 RegisterServletsFunc = Callable[["HomeServer", HttpServer], None]
 
-CLIENT_SERVLET_FUNCTIONS: Tuple[RegisterServletsFunc, ...] = (
+CLIENT_SERVLET_FUNCTIONS: tuple[RegisterServletsFunc, ...] = (
     versions.register_servlets,
     initial_sync.register_servlets,
     room.register_deprecated_servlets,
@@ -89,6 +90,7 @@ CLIENT_SERVLET_FUNCTIONS: Tuple[RegisterServletsFunc, ...] = (
     presence.register_servlets,
     directory.register_servlets,
     voip.register_servlets,
+    matrixrtc.register_servlets,
     pusher.register_servlets,
     push_rule.register_servlets,
     logout.register_servlets,
@@ -126,7 +128,7 @@ CLIENT_SERVLET_FUNCTIONS: Tuple[RegisterServletsFunc, ...] = (
     thread_subscriptions.register_servlets,
 )
 
-SERVLET_GROUPS: Dict[str, Iterable[RegisterServletsFunc]] = {
+SERVLET_GROUPS: dict[str, Iterable[RegisterServletsFunc]] = {
     "client": CLIENT_SERVLET_FUNCTIONS,
 }
 
@@ -141,7 +143,7 @@ class ClientRestResource(JsonResource):
        * etc
     """
 
-    def __init__(self, hs: "HomeServer", servlet_groups: Optional[List[str]] = None):
+    def __init__(self, hs: "HomeServer", servlet_groups: list[str] | None = None):
         JsonResource.__init__(self, hs, canonical_json=False)
         if hs.config.media.can_load_media_repo:
             # This import is here to prevent a circular import failure
@@ -154,7 +156,7 @@ class ClientRestResource(JsonResource):
     def register_servlets(
         client_resource: HttpServer,
         hs: "HomeServer",
-        servlet_groups: Optional[Iterable[str]] = None,
+        servlet_groups: Iterable[str] | None = None,
     ) -> None:
         # Some servlets are only registered on the main process (and not worker
         # processes).
diff --git a/synapse/rest/admin/__init__.py b/synapse/rest/admin/__init__.py
index d9a6e99c5d..b209404cd1 100644
--- a/synapse/rest/admin/__init__.py
+++ b/synapse/rest/admin/__init__.py
@@ -35,7 +35,7 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import Codes, NotFoundError, SynapseError
 from synapse.handlers.pagination import PURGE_HISTORY_ACTION_NAME
@@ -57,6 +57,9 @@ from synapse.rest.admin.event_reports import (
     EventReportDetailRestServlet,
     EventReportsRestServlet,
 )
+from synapse.rest.admin.events import (
+    EventRestServlet,
+)
 from synapse.rest.admin.experimental_features import ExperimentalFeaturesRestServlet
 from synapse.rest.admin.federation import (
     DestinationMembershipRestServlet,
@@ -71,6 +74,7 @@ from synapse.rest.admin.registration_tokens import (
     RegistrationTokenRestServlet,
 )
 from synapse.rest.admin.rooms import (
+    AdminRoomHierarchy,
     BlockRoomRestServlet,
     DeleteRoomStatusByDeleteIdRestServlet,
     DeleteRoomStatusByRoomIdRestServlet,
@@ -110,10 +114,12 @@ from synapse.rest.admin.users import (
     UserByThreePid,
     UserInvitesCount,
     UserJoinedRoomCount,
-    UserMembershipRestServlet,
+    UserJoinedRoomsRestServlet,
+    UserMembershipsRestServlet,
     UserRegisterServlet,
     UserReplaceMasterCrossSigningKeyRestServlet,
     UserRestServletV2,
+    UserRestServletV2Get,
     UsersRestServletV2,
     UsersRestServletV3,
     UserTokenRestServlet,
@@ -134,7 +140,7 @@ class VersionServlet(RestServlet):
     def __init__(self, hs: "HomeServer"):
         self.res = {"server_version": SYNAPSE_VERSION}
 
-    def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         return HTTPStatus.OK, self.res
 
 
@@ -149,8 +155,8 @@ class PurgeHistoryRestServlet(RestServlet):
         self.auth = hs.get_auth()
 
     async def on_POST(
-        self, request: SynapseRequest, room_id: str, event_id: Optional[str]
-    ) -> Tuple[int, JsonDict]:
+        self, request: SynapseRequest, room_id: str, event_id: str | None
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         body = parse_json_object_from_request(request, allow_empty_body=True)
@@ -169,7 +175,7 @@ class PurgeHistoryRestServlet(RestServlet):
             if event.room_id != room_id:
                 raise SynapseError(HTTPStatus.BAD_REQUEST, "Event is for wrong room.")
 
-            # RoomStreamToken expects [int] not Optional[int]
+            # RoomStreamToken expects [int] not [int | None]
             assert event.internal_metadata.stream_ordering is not None
             room_token = RoomStreamToken(
                 topological=event.depth, stream=event.internal_metadata.stream_ordering
@@ -234,7 +240,7 @@ class PurgeHistoryStatusRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, purge_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         purge_task = await self.pagination_handler.get_delete_task(purge_id)
@@ -276,6 +282,8 @@ def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
         # matrix_authentication_service integration uses the dedicated MAS API.
         if hs.config.experimental.msc3861.enabled:
             register_servlets_for_msc3861_delegation(hs, http_server)
+        else:
+            UserRestServletV2Get(hs).register(http_server)
 
         return
 
@@ -293,7 +301,8 @@ def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
     VersionServlet(hs).register(http_server)
     if not auth_delegated:
         UserAdminServlet(hs).register(http_server)
-    UserMembershipRestServlet(hs).register(http_server)
+    UserJoinedRoomsRestServlet(hs).register(http_server)
+    UserMembershipsRestServlet(hs).register(http_server)
     if not auth_delegated:
         UserTokenRestServlet(hs).register(http_server)
     UserRestServletV2(hs).register(http_server)
@@ -339,6 +348,8 @@ def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
     ExperimentalFeaturesRestServlet(hs).register(http_server)
     SuspendAccountRestServlet(hs).register(http_server)
     ScheduledTasksRestServlet(hs).register(http_server)
+    AdminRoomHierarchy(hs).register(http_server)
+    EventRestServlet(hs).register(http_server)
 
 
 def register_servlets_for_client_rest_resource(
diff --git a/synapse/rest/admin/background_updates.py b/synapse/rest/admin/background_updates.py
index 6fba616d3a..96190c416d 100644
--- a/synapse/rest/admin/background_updates.py
+++ b/synapse/rest/admin/background_updates.py
@@ -20,7 +20,7 @@
 #
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import SynapseError
 from synapse.http.servlet import (
@@ -47,7 +47,7 @@ class BackgroundUpdateEnabledRestServlet(RestServlet):
         self._auth = hs.get_auth()
         self._data_stores = hs.get_datastores()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         # We need to check that all configured databases have updates enabled.
@@ -56,7 +56,7 @@ class BackgroundUpdateEnabledRestServlet(RestServlet):
 
         return HTTPStatus.OK, {"enabled": enabled}
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         body = parse_json_object_from_request(request)
@@ -88,7 +88,7 @@ class BackgroundUpdateRestServlet(RestServlet):
         self._auth = hs.get_auth()
         self._data_stores = hs.get_datastores()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         # We need to check that all configured databases have updates enabled.
@@ -121,7 +121,7 @@ class BackgroundUpdateStartJobRestServlet(RestServlet):
         self._auth = hs.get_auth()
         self._store = hs.get_datastores().main
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         body = parse_json_object_from_request(request)
diff --git a/synapse/rest/admin/devices.py b/synapse/rest/admin/devices.py
index c488bce58e..c8e9242ce8 100644
--- a/synapse/rest/admin/devices.py
+++ b/synapse/rest/admin/devices.py
@@ -20,7 +20,7 @@
 #
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import NotFoundError, SynapseError
 from synapse.http.servlet import (
@@ -56,7 +56,7 @@ class DeviceRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str, device_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         target_user = UserID.from_string(user_id)
@@ -76,7 +76,7 @@ class DeviceRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, user_id: str, device_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         target_user = UserID.from_string(user_id)
@@ -92,7 +92,7 @@ class DeviceRestServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str, device_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         target_user = UserID.from_string(user_id)
@@ -128,7 +128,7 @@ class DevicesRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         target_user = UserID.from_string(user_id)
@@ -157,7 +157,7 @@ class DevicesRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """Creates a new device for the user."""
         await assert_requester_is_admin(self.auth, request)
 
@@ -201,7 +201,7 @@ class DeleteDevicesRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         target_user = UserID.from_string(user_id)
diff --git a/synapse/rest/admin/event_reports.py b/synapse/rest/admin/event_reports.py
index ff1abc0697..5e8f85de7e 100644
--- a/synapse/rest/admin/event_reports.py
+++ b/synapse/rest/admin/event_reports.py
@@ -21,7 +21,7 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import Direction
 from synapse.api.errors import Codes, NotFoundError, SynapseError
@@ -65,7 +65,7 @@ class EventReportsRestServlet(RestServlet):
         self._auth = hs.get_auth()
         self._store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         start = parse_integer(request, "from", default=0)
@@ -123,7 +123,7 @@ class EventReportDetailRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, report_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         message = (
@@ -149,7 +149,7 @@ class EventReportDetailRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, report_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         message = (
diff --git a/synapse/rest/admin/events.py b/synapse/rest/admin/events.py
new file mode 100644
index 0000000000..8da7a67820
--- /dev/null
+++ b/synapse/rest/admin/events.py
@@ -0,0 +1,73 @@
+from http import HTTPStatus
+from typing import TYPE_CHECKING
+
+from synapse.api.errors import NotFoundError
+from synapse.events.utils import (
+    SerializeEventConfig,
+    format_event_raw,
+)
+from synapse.http.servlet import RestServlet
+from synapse.http.site import SynapseRequest
+from synapse.rest.admin import admin_patterns
+from synapse.rest.admin._base import assert_user_is_admin
+from synapse.storage.databases.main.events_worker import EventRedactBehaviour
+from synapse.types import JsonDict
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
+
+
+class EventRestServlet(RestServlet):
+    """
+    Get an event that is known to the homeserver.
+    The requester must have administrator access in Synapse.
+
+    GET /_synapse/admin/v1/fetch_event/<event_id>
+    returns:
+        200 OK with event json if the event is known to the homeserver. Otherwise raises
+        a NotFound error.
+
+    Args:
+        event_id: the id of the requested event.
+    Returns:
+        JSON blob of the event
+    """
+
+    PATTERNS = admin_patterns("/fetch_event/(?P<event_id>[^/]*)$")
+
+    def __init__(self, hs: "HomeServer"):
+        self._auth = hs.get_auth()
+        self._store = hs.get_datastores().main
+        self._clock = hs.get_clock()
+        self._event_serializer = hs.get_event_client_serializer()
+
+    async def on_GET(
+        self, request: SynapseRequest, event_id: str
+    ) -> tuple[int, JsonDict]:
+        requester = await self._auth.get_user_by_req(request)
+        await assert_user_is_admin(self._auth, requester)
+
+        event = await self._store.get_event(
+            event_id,
+            EventRedactBehaviour.as_is,
+            allow_none=True,
+        )
+
+        if event is None:
+            raise NotFoundError("Event not found")
+
+        config = SerializeEventConfig(
+            as_client_event=False,
+            event_format=format_event_raw,
+            requester=requester,
+            only_event_fields=None,
+            include_stripped_room_state=True,
+            include_admin_metadata=True,
+        )
+        res = {
+            "event": await self._event_serializer.serialize_event(
+                event, self._clock.time_msec(), config=config
+            )
+        }
+
+        return HTTPStatus.OK, res
diff --git a/synapse/rest/admin/experimental_features.py b/synapse/rest/admin/experimental_features.py
index afb71f4a0f..abdb937793 100644
--- a/synapse/rest/admin/experimental_features.py
+++ b/synapse/rest/admin/experimental_features.py
@@ -22,7 +22,7 @@
 
 from enum import Enum
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Dict, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import SynapseError
 from synapse.http.servlet import RestServlet, parse_json_object_from_request
@@ -74,7 +74,7 @@ class ExperimentalFeaturesRestServlet(RestServlet):
         self,
         request: SynapseRequest,
         user_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """
         List which features are enabled for a given user
         """
@@ -92,14 +92,14 @@ class ExperimentalFeaturesRestServlet(RestServlet):
         user_features = {}
         for feature in ExperimentalFeature:
             if feature in enabled_features:
-                user_features[feature] = True
+                user_features[feature.value] = True
             else:
-                user_features[feature] = False
+                user_features[feature.value] = False
         return HTTPStatus.OK, {"features": user_features}
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[HTTPStatus, Dict]:
+    ) -> tuple[HTTPStatus, dict]:
         """
         Enable or disable the provided features for the requester
         """
diff --git a/synapse/rest/admin/federation.py b/synapse/rest/admin/federation.py
index d85a04b825..e958ef9747 100644
--- a/synapse/rest/admin/federation.py
+++ b/synapse/rest/admin/federation.py
@@ -20,7 +20,7 @@
 #
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import Direction
 from synapse.api.errors import NotFoundError, SynapseError
@@ -58,7 +58,7 @@ class ListDestinationsRestServlet(RestServlet):
         self._auth = hs.get_auth()
         self._store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         start = parse_integer(request, "from", default=0)
@@ -115,7 +115,7 @@ class DestinationRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, destination: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         if not await self._store.is_destination_known(destination):
@@ -175,7 +175,7 @@ class DestinationMembershipRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, destination: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         if not await self._store.is_destination_known(destination):
@@ -224,7 +224,7 @@ class DestinationResetConnectionRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, destination: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         if not await self._store.is_destination_known(destination):
diff --git a/synapse/rest/admin/media.py b/synapse/rest/admin/media.py
index 195f22a4c2..d5346fe0d5 100644
--- a/synapse/rest/admin/media.py
+++ b/synapse/rest/admin/media.py
@@ -18,10 +18,9 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 import attr
 
@@ -41,7 +40,9 @@ from synapse.rest.admin._base import (
     assert_requester_is_admin,
     assert_user_is_admin,
 )
-from synapse.storage.databases.main.media_repository import MediaSortOrder
+from synapse.storage.databases.main.media_repository import (
+    MediaSortOrder,
+)
 from synapse.types import JsonDict, UserID
 
 if TYPE_CHECKING:
@@ -50,6 +51,72 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+class QueryMediaById(RestServlet):
+    """
+    Fetch info about a piece of local or cached remote media.
+    """
+
+    PATTERNS = admin_patterns("/media/(?P<server_name>[^/]*)/(?P<media_id>[^/]*)$")
+
+    def __init__(self, hs: "HomeServer"):
+        self.store = hs.get_datastores().main
+        self.auth = hs.get_auth()
+        self.server_name = hs.hostname
+        self.hs = hs
+        self.media_repo = hs.get_media_repository()
+
+    async def on_GET(
+        self, request: SynapseRequest, server_name: str, media_id: str
+    ) -> tuple[int, JsonDict]:
+        requester = await self.auth.get_user_by_req(request)
+        await assert_user_is_admin(self.auth, requester)
+
+        if not self.hs.is_mine_server_name(server_name):
+            remote_media_info = await self.media_repo.get_cached_remote_media_info(
+                server_name, media_id
+            )
+            if remote_media_info is None:
+                raise NotFoundError("Unknown media")
+            resp = {
+                "media_origin": remote_media_info.media_origin,
+                "user_id": None,
+                "media_id": remote_media_info.media_id,
+                "media_type": remote_media_info.media_type,
+                "media_length": remote_media_info.media_length,
+                "upload_name": remote_media_info.upload_name,
+                "created_ts": remote_media_info.created_ts,
+                "filesystem_id": remote_media_info.filesystem_id,
+                "url_cache": None,
+                "last_access_ts": remote_media_info.last_access_ts,
+                "quarantined_by": remote_media_info.quarantined_by,
+                "authenticated": remote_media_info.authenticated,
+                "safe_from_quarantine": None,
+                "sha256": remote_media_info.sha256,
+            }
+        else:
+            local_media_info = await self.store.get_local_media(media_id)
+            if local_media_info is None:
+                raise NotFoundError("Unknown media")
+            resp = {
+                "media_origin": None,
+                "user_id": local_media_info.user_id,
+                "media_id": local_media_info.media_id,
+                "media_type": local_media_info.media_type,
+                "media_length": local_media_info.media_length,
+                "upload_name": local_media_info.upload_name,
+                "created_ts": local_media_info.created_ts,
+                "filesystem_id": None,
+                "url_cache": local_media_info.url_cache,
+                "last_access_ts": local_media_info.last_access_ts,
+                "quarantined_by": local_media_info.quarantined_by,
+                "authenticated": local_media_info.authenticated,
+                "safe_from_quarantine": local_media_info.safe_from_quarantine,
+                "sha256": local_media_info.sha256,
+            }
+
+        return HTTPStatus.OK, {"media_info": resp}
+
+
 class QuarantineMediaInRoom(RestServlet):
     """Quarantines all media in a room so that no one can download it via
     this server.
@@ -67,7 +134,7 @@ class QuarantineMediaInRoom(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
 
@@ -94,7 +161,7 @@ class QuarantineMediaByUser(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
 
@@ -123,7 +190,7 @@ class QuarantineMediaByID(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, server_name: str, media_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
 
@@ -152,7 +219,7 @@ class UnquarantineMediaByID(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, server_name: str, media_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         logger.info("Remove from quarantine media by ID: %s/%s", server_name, media_id)
@@ -174,7 +241,7 @@ class ProtectMediaByID(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, media_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         logger.info("Protecting local media by ID: %s", media_id)
@@ -196,7 +263,7 @@ class UnprotectMediaByID(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, media_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         logger.info("Unprotecting local media by ID: %s", media_id)
@@ -218,7 +285,7 @@ class ListMediaInRoom(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         local_mxcs, remote_mxcs = await self.store.get_media_mxcs_in_room(room_id)
@@ -233,7 +300,7 @@ class PurgeMediaCacheRestServlet(RestServlet):
         self.media_repository = hs.get_media_repository()
         self.auth = hs.get_auth()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         before_ts = parse_integer(request, "before_ts", required=True)
@@ -271,7 +338,7 @@ class DeleteMediaByID(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, server_name: str, media_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if not self._is_mine_server_name(server_name):
@@ -307,8 +374,8 @@ class DeleteMediaByDateSize(RestServlet):
         self.media_repository = hs.get_media_repository()
 
     async def on_POST(
-        self, request: SynapseRequest, server_name: Optional[str] = None
-    ) -> Tuple[int, JsonDict]:
+        self, request: SynapseRequest, server_name: str | None = None
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         before_ts = parse_integer(request, "before_ts", required=True)
@@ -366,7 +433,7 @@ class UserMediaRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # This will always be set by the time Twisted calls us.
         assert request.args is not None
 
@@ -410,7 +477,7 @@ class UserMediaRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # This will always be set by the time Twisted calls us.
         assert request.args is not None
 
@@ -470,3 +537,4 @@ def register_servlets_for_media_repo(hs: "HomeServer", http_server: HttpServer)
     DeleteMediaByDateSize(hs).register(http_server)
     DeleteMediaByID(hs).register(http_server)
     UserMediaRestServlet(hs).register(http_server)
+    QueryMediaById(hs).register(http_server)
diff --git a/synapse/rest/admin/registration_tokens.py b/synapse/rest/admin/registration_tokens.py
index bec2331590..ea266403a0 100644
--- a/synapse/rest/admin/registration_tokens.py
+++ b/synapse/rest/admin/registration_tokens.py
@@ -22,7 +22,7 @@
 import logging
 import string
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import Codes, NotFoundError, SynapseError
 from synapse.http.servlet import (
@@ -80,7 +80,7 @@ class ListRegistrationTokensRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
         valid = parse_boolean(request, "valid")
         token_list = await self.store.get_registration_tokens(valid)
@@ -133,7 +133,7 @@ class NewRegistrationTokenRestServlet(RestServlet):
         self.allowed_chars = string.ascii_letters + string.digits + "._~-"
         self.allowed_chars_set = set(self.allowed_chars)
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
         body = parse_json_object_from_request(request)
 
@@ -282,7 +282,7 @@ class RegistrationTokenRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest, token: str) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest, token: str) -> tuple[int, JsonDict]:
         """Retrieve a registration token."""
         await assert_requester_is_admin(self.auth, request)
         token_info = await self.store.get_one_registration_token(token)
@@ -293,7 +293,7 @@ class RegistrationTokenRestServlet(RestServlet):
 
         return HTTPStatus.OK, token_info
 
-    async def on_PUT(self, request: SynapseRequest, token: str) -> Tuple[int, JsonDict]:
+    async def on_PUT(self, request: SynapseRequest, token: str) -> tuple[int, JsonDict]:
         """Update a registration token."""
         await assert_requester_is_admin(self.auth, request)
         body = parse_json_object_from_request(request)
@@ -348,7 +348,7 @@ class RegistrationTokenRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, token: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """Delete a registration token."""
         await assert_requester_is_admin(self.auth, request)
 
diff --git a/synapse/rest/admin/rooms.py b/synapse/rest/admin/rooms.py
index 5bed89c2c4..a886859ffa 100644
--- a/synapse/rest/admin/rooms.py
+++ b/synapse/rest/admin/rooms.py
@@ -20,7 +20,7 @@
 #
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, List, Optional, Tuple, cast
+from typing import TYPE_CHECKING, cast
 
 import attr
 from immutabledict import immutabledict
@@ -28,9 +28,13 @@ from immutabledict import immutabledict
 from synapse.api.constants import Direction, EventTypes, JoinRules, Membership
 from synapse.api.errors import AuthError, Codes, NotFoundError, SynapseError
 from synapse.api.filtering import Filter
+from synapse.events.utils import (
+    SerializeEventConfig,
+)
 from synapse.handlers.pagination import (
     PURGE_ROOM_ACTION_NAME,
     SHUTDOWN_AND_PURGE_ROOM_ACTION_NAME,
+    GetMessagesResult,
 )
 from synapse.http.servlet import (
     ResolveRoomIdMixin,
@@ -44,11 +48,13 @@ from synapse.http.servlet import (
     parse_string,
 )
 from synapse.http.site import SynapseRequest
+from synapse.logging.opentracing import trace
 from synapse.rest.admin._base import (
     admin_patterns,
     assert_requester_is_admin,
     assert_user_is_admin,
 )
+from synapse.rest.client.room import SerializeMessagesDeps, encode_messages_response
 from synapse.storage.databases.main.room import RoomSortOrder
 from synapse.streams.config import PaginationConfig
 from synapse.types import JsonDict, RoomID, ScheduledTask, UserID, create_requester
@@ -63,6 +69,50 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+class AdminRoomHierarchy(RestServlet):
+    """
+    Given a room, returns room details on that room and any space children of
+    the provided room. Does not reach out over federation to fetch information about
+    any remote rooms which the server is not currently participating in
+    """
+
+    PATTERNS = admin_patterns("/rooms/(?P<room_id>[^/]*)/hierarchy$")
+
+    def __init__(self, hs: "HomeServer"):
+        self._auth = hs.get_auth()
+        self._room_summary_handler = hs.get_room_summary_handler()
+        self._store = hs.get_datastores().main
+        self._storage_controllers = hs.get_storage_controllers()
+
+    async def on_GET(
+        self, request: SynapseRequest, room_id: str
+    ) -> tuple[int, JsonDict]:
+        requester = await self._auth.get_user_by_req(request)
+        await assert_user_is_admin(self._auth, requester)
+
+        max_depth = parse_integer(request, "max_depth")
+        limit = parse_integer(request, "limit")
+
+        room_entry_summary = await self._room_summary_handler.get_room_hierarchy(
+            requester,
+            room_id,
+            # We omit details about remote rooms because we only care
+            # about managing rooms local to the homeserver. This
+            # also immensely helps with the response time of the
+            # endpoint since we don't need to reach out over federation.
+            # There is a trade-off as this will leave holes where
+            # information about public/peekable remote rooms the
+            # server is not participating in will be omitted.
+            omit_remote_room_hierarchy=True,
+            admin_skip_room_visibility_check=True,
+            max_depth=max_depth,
+            limit=limit,
+            from_token=parse_string(request, "from"),
+        )
+
+        return HTTPStatus.OK, room_entry_summary
+
+
 class RoomRestV2Servlet(RestServlet):
     """Delete a room from server asynchronously with a background task.
 
@@ -88,7 +138,7 @@ class RoomRestV2Servlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request)
         await assert_user_is_admin(self._auth, requester)
 
@@ -167,7 +217,7 @@ class DeleteRoomStatusByRoomIdRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         if not RoomID.is_valid(room_id):
@@ -198,7 +248,7 @@ class DeleteRoomStatusByDeleteIdRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, delete_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         delete_task = await self._pagination_handler.get_delete_task(delete_id)
@@ -224,7 +274,7 @@ class ListRoomRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.admin_handler = hs.get_admin_handler()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         # Extract query parameters
@@ -319,7 +369,7 @@ class RoomRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         ret = await self.store.get_room_with_stats(room_id)
@@ -337,7 +387,7 @@ class RoomRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         return await self._delete_room(
             request,
             room_id,
@@ -353,7 +403,7 @@ class RoomRestServlet(RestServlet):
         auth: "Auth",
         room_shutdown_handler: "RoomShutdownHandler",
         pagination_handler: "PaginationHandler",
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await auth.get_user_by_req(request)
         await assert_user_is_admin(auth, requester)
 
@@ -429,7 +479,7 @@ class RoomMembersRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         room = await self.store.get_room(room_id)
@@ -458,7 +508,7 @@ class RoomStateRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         room = await self.store.get_room(room_id)
@@ -498,7 +548,7 @@ class JoinRoomAliasServlet(ResolveRoomIdMixin, RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_identifier: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # This will always be set by the time Twisted calls us.
         assert request.args is not None
 
@@ -521,7 +571,7 @@ class JoinRoomAliasServlet(ResolveRoomIdMixin, RestServlet):
 
         # Get the room ID from the identifier.
         try:
-            remote_room_hosts: Optional[List[str]] = [
+            remote_room_hosts: list[str] | None = [
                 x.decode("ascii") for x in request.args[b"server_name"]
             ]
         except Exception:
@@ -591,7 +641,7 @@ class MakeRoomAdminRestServlet(ResolveRoomIdMixin, RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_identifier: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
         content = parse_json_object_from_request(request, allow_empty_body=True)
@@ -756,7 +806,7 @@ class ForwardExtremitiesRestServlet(ResolveRoomIdMixin, RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, room_identifier: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         room_id, _ = await self.resolve_room_id(room_identifier)
@@ -766,7 +816,7 @@ class ForwardExtremitiesRestServlet(ResolveRoomIdMixin, RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_identifier: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         room_id, _ = await self.resolve_room_id(room_identifier)
@@ -805,7 +855,7 @@ class RoomEventContextServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str, event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=False)
         await assert_user_is_admin(self.auth, requester)
 
@@ -871,7 +921,7 @@ class BlockRoomRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         if not RoomID.is_valid(room_id):
@@ -891,7 +941,7 @@ class BlockRoomRestServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request)
         await assert_user_is_admin(self._auth, requester)
 
@@ -932,10 +982,11 @@ class RoomMessagesRestServlet(RestServlet):
         self._pagination_handler = hs.get_pagination_handler()
         self._auth = hs.get_auth()
         self._store = hs.get_datastores().main
+        self._event_serializer = hs.get_event_client_serializer()
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request)
         await assert_user_is_admin(self._auth, requester)
 
@@ -955,7 +1006,11 @@ class RoomMessagesRestServlet(RestServlet):
         ):
             as_client_event = False
 
-        msgs = await self._pagination_handler.get_messages(
+        serialize_options = SerializeEventConfig(
+            as_client_event=as_client_event, requester=requester
+        )
+
+        get_messages_result = await self._pagination_handler.get_messages(
             room_id=room_id,
             requester=requester,
             pagin_config=pagination_config,
@@ -964,7 +1019,27 @@ class RoomMessagesRestServlet(RestServlet):
             use_admin_priviledge=True,
         )
 
-        return HTTPStatus.OK, msgs
+        response_content = await self.encode_response(
+            get_messages_result, serialize_options
+        )
+
+        return HTTPStatus.OK, response_content
+
+    @trace
+    async def encode_response(
+        self,
+        get_messages_result: GetMessagesResult,
+        serialize_options: SerializeEventConfig,
+    ) -> JsonDict:
+        return await encode_messages_response(
+            get_messages_result=get_messages_result,
+            serialize_options=serialize_options,
+            serialize_deps=SerializeMessagesDeps(
+                clock=self._clock,
+                event_serializer=self._event_serializer,
+                store=self._store,
+            ),
+        )
 
 
 class RoomTimestampToEventRestServlet(RestServlet):
@@ -997,7 +1072,7 @@ class RoomTimestampToEventRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request)
         await assert_user_is_admin(self._auth, requester)
 
diff --git a/synapse/rest/admin/scheduled_tasks.py b/synapse/rest/admin/scheduled_tasks.py
index 2ae13021b9..5b3526c7e5 100644
--- a/synapse/rest/admin/scheduled_tasks.py
+++ b/synapse/rest/admin/scheduled_tasks.py
@@ -13,7 +13,7 @@
 #
 #
 #
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http.servlet import RestServlet, parse_integer, parse_string
 from synapse.http.site import SynapseRequest
@@ -35,13 +35,18 @@ class ScheduledTasksRestServlet(RestServlet):
         self._auth = hs.get_auth()
         self._store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         # extract query params
         action_name = parse_string(request, "action_name")
         resource_id = parse_string(request, "resource_id")
-        status = parse_string(request, "job_status")
+        status = parse_string(request, "status")
+        # This parameter was historically called `job_status`, while the Admin API docs
+        # defined it as `status`. We now support both, as `status` is generally
+        # a nicer name. A v2 of this endpoint should keep only `status`.
+        if status is None:
+            status = parse_string(request, "job_status")
         max_timestamp = parse_integer(request, "max_timestamp")
 
         actions = [action_name] if action_name else None
diff --git a/synapse/rest/admin/server_notice_servlet.py b/synapse/rest/admin/server_notice_servlet.py
index f3150e88d7..50d2f35b18 100644
--- a/synapse/rest/admin/server_notice_servlet.py
+++ b/synapse/rest/admin/server_notice_servlet.py
@@ -18,7 +18,7 @@
 #
 #
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import EventTypes
 from synapse.api.errors import NotFoundError, SynapseError
@@ -80,8 +80,8 @@ class SendServerNoticeServlet(RestServlet):
         self,
         request: SynapseRequest,
         requester: Requester,
-        txn_id: Optional[str],
-    ) -> Tuple[int, JsonDict]:
+        txn_id: str | None,
+    ) -> tuple[int, JsonDict]:
         await assert_user_is_admin(self.auth, requester)
         body = parse_json_object_from_request(request)
         assert_params_in_dict(body, ("user_id", "content"))
@@ -118,13 +118,13 @@ class SendServerNoticeServlet(RestServlet):
     async def on_POST(
         self,
         request: SynapseRequest,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         return await self._do(request, requester, None)
 
     async def on_PUT(
         self, request: SynapseRequest, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         set_tag("txn_id", txn_id)
         return await self.txns.fetch_or_execute_request(
diff --git a/synapse/rest/admin/statistics.py b/synapse/rest/admin/statistics.py
index 0adc5b7005..3de1d4e9bd 100644
--- a/synapse/rest/admin/statistics.py
+++ b/synapse/rest/admin/statistics.py
@@ -21,7 +21,7 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import Direction
 from synapse.api.errors import Codes, SynapseError
@@ -48,7 +48,7 @@ class UserMediaStatisticsRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         order_by = parse_string(
@@ -119,7 +119,7 @@ class LargestRoomsStatistics(RestServlet):
         self.auth = hs.get_auth()
         self.stats_controller = hs.get_storage_controllers().stats
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         room_sizes = await self.stats_controller.get_room_db_size_estimate()
diff --git a/synapse/rest/admin/username_available.py b/synapse/rest/admin/username_available.py
index 2d642f7d6b..fb0cee42da 100644
--- a/synapse/rest/admin/username_available.py
+++ b/synapse/rest/admin/username_available.py
@@ -20,7 +20,7 @@
 #
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http.servlet import RestServlet, parse_string
 from synapse.http.site import SynapseRequest
@@ -50,7 +50,7 @@ class UsernameAvailableRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.registration_handler = hs.get_registration_handler()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         username = parse_string(request, "username", required=True)
diff --git a/synapse/rest/admin/users.py b/synapse/rest/admin/users.py
index 25a38dc4ac..8265c2d789 100644
--- a/synapse/rest/admin/users.py
+++ b/synapse/rest/admin/users.py
@@ -23,11 +23,11 @@ import hmac
 import logging
 import secrets
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Dict, List, Optional, Tuple, Union
+from typing import TYPE_CHECKING
 
 import attr
+from pydantic import StrictBool, StrictInt, StrictStr
 
-from synapse._pydantic_compat import StrictBool, StrictInt, StrictStr
 from synapse.api.constants import Direction
 from synapse.api.errors import Codes, NotFoundError, SynapseError
 from synapse.http.servlet import (
@@ -113,7 +113,7 @@ class UsersRestServletV2(RestServlet):
             hs.config.mas.enabled or hs.config.experimental.msc3861.enabled
         )
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         start = parse_integer(request, "from", default=0)
@@ -163,8 +163,8 @@ class UsersRestServletV2(RestServlet):
 
         direction = parse_enum(request, "dir", Direction, default=Direction.FORWARDS)
 
-        # twisted.web.server.Request.args is incorrectly defined as Optional[Any]
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        # twisted.web.server.Request.args is incorrectly defined as Any | None
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         not_user_types = parse_strings_from_args(args, "not_user_type")
 
         users, total = await self.store.get_users_paginate(
@@ -195,7 +195,7 @@ class UsersRestServletV2(RestServlet):
 
         return HTTPStatus.OK, ret
 
-    def _parse_parameter_deactivated(self, request: SynapseRequest) -> Optional[bool]:
+    def _parse_parameter_deactivated(self, request: SynapseRequest) -> bool | None:
         """
         Return None (no filtering) if `deactivated` is `true`, otherwise return `False`
         (exclude deactivated users from the results).
@@ -206,13 +206,11 @@ class UsersRestServletV2(RestServlet):
 class UsersRestServletV3(UsersRestServletV2):
     PATTERNS = admin_patterns("/users$", "v3")
 
-    def _parse_parameter_deactivated(
-        self, request: SynapseRequest
-    ) -> Union[bool, None]:
+    def _parse_parameter_deactivated(self, request: SynapseRequest) -> bool | None:
         return parse_boolean(request, "deactivated")
 
 
-class UserRestServletV2(RestServlet):
+class UserRestServletV2Get(RestServlet):
     PATTERNS = admin_patterns("/users/(?P<user_id>[^/]*)$", "v2")
 
     """Get request to list user details.
@@ -222,22 +220,6 @@ class UserRestServletV2(RestServlet):
 
     returns:
         200 OK with user details if success otherwise an error.
-
-    Put request to allow an administrator to add or modify a user.
-    This needs user to have administrator access in Synapse.
-    We use PUT instead of POST since we already know the id of the user
-    object to create. POST could be used to create guests.
-
-    PUT /_synapse/admin/v2/users/<user_id>
-    {
-        "password": "secret",
-        "displayname": "User"
-    }
-
-    returns:
-        201 OK with new user object if user was created or
-        200 OK with modified user object if user was modified
-        otherwise an error.
     """
 
     def __init__(self, hs: "HomeServer"):
@@ -256,7 +238,7 @@ class UserRestServletV2(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonMapping]:
+    ) -> tuple[int, JsonMapping]:
         await assert_requester_is_admin(self.auth, request)
 
         target_user = UserID.from_string(user_id)
@@ -269,9 +251,31 @@ class UserRestServletV2(RestServlet):
 
         return HTTPStatus.OK, user_info_dict
 
+
+class UserRestServletV2(UserRestServletV2Get):
+    """
+    Put request to allow an administrator to add or modify a user.
+    This needs user to have administrator access in Synapse.
+    We use PUT instead of POST since we already know the id of the user
+    object to create. POST could be used to create guests.
+
+    Note: This inherits from `UserRestServletV2Get`, so also supports the `GET` route.
+
+    PUT /_synapse/admin/v2/users/<user_id>
+    {
+        "password": "secret",
+        "displayname": "User"
+    }
+
+    returns:
+        201 OK with new user object if user was created or
+        200 OK with modified user object if user was modified
+        otherwise an error.
+    """
+
     async def on_PUT(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonMapping]:
+    ) -> tuple[int, JsonMapping]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
 
@@ -340,7 +344,7 @@ class UserRestServletV2(RestServlet):
                 HTTPStatus.BAD_REQUEST, "An user can't be deactivated and locked"
             )
 
-        approved: Optional[bool] = None
+        approved: bool | None = None
         if "approved" in body and self._msc3866_enabled:
             approved = body["approved"]
             if not isinstance(approved, bool):
@@ -349,14 +353,14 @@ class UserRestServletV2(RestServlet):
                     "'approved' parameter is not of type boolean",
                 )
 
-        # convert List[Dict[str, str]] into List[Tuple[str, str]]
+        # convert list[dict[str, str]] into list[tuple[str, str]]
         if external_ids is not None:
             new_external_ids = [
                 (external_id["auth_provider"], external_id["external_id"])
                 for external_id in external_ids
             ]
 
-        # convert List[Dict[str, str]] into Set[Tuple[str, str]]
+        # convert list[dict[str, str]] into set[tuple[str, str]]
         if threepids is not None:
             new_threepids = {
                 (threepid["medium"], threepid["address"]) for threepid in threepids
@@ -365,7 +369,7 @@ class UserRestServletV2(RestServlet):
         if user:  # modify user
             if "displayname" in body:
                 await self.profile_handler.set_displayname(
-                    target_user, requester, body["displayname"], True
+                    target_user, requester, body["displayname"], by_admin=True
                 )
 
             if threepids is not None:
@@ -414,7 +418,7 @@ class UserRestServletV2(RestServlet):
 
             if "avatar_url" in body:
                 await self.profile_handler.set_avatar_url(
-                    target_user, requester, body["avatar_url"], True
+                    target_user, requester, body["avatar_url"], by_admin=True
                 )
 
             if "admin" in body:
@@ -522,7 +526,7 @@ class UserRestServletV2(RestServlet):
 
             if "avatar_url" in body and isinstance(body["avatar_url"], str):
                 await self.profile_handler.set_avatar_url(
-                    target_user, requester, body["avatar_url"], True
+                    target_user, requester, body["avatar_url"], by_admin=True
                 )
 
             user_info_dict = await self.admin_handler.get_user(target_user)
@@ -545,7 +549,7 @@ class UserRegisterServlet(RestServlet):
     def __init__(self, hs: "HomeServer"):
         self.auth_handler = hs.get_auth_handler()
         self.reactor = hs.get_reactor()
-        self.nonces: Dict[str, int] = {}
+        self.nonces: dict[str, int] = {}
         self.hs = hs
         self._all_user_types = hs.config.user_types.all_user_types
 
@@ -559,7 +563,7 @@ class UserRegisterServlet(RestServlet):
             if now - v > self.NONCE_TIMEOUT:
                 del self.nonces[k]
 
-    def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         """
         Generate a new nonce.
         """
@@ -569,7 +573,7 @@ class UserRegisterServlet(RestServlet):
         self.nonces[nonce] = int(self.reactor.seconds())
         return HTTPStatus.OK, {"nonce": nonce}
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         self._clear_old_nonces()
 
         if not self.hs.config.registration.registration_shared_secret:
@@ -730,7 +734,7 @@ class WhoisRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonMapping]:
+    ) -> tuple[int, JsonMapping]:
         target_user = UserID.from_string(user_id)
         requester = await self.auth.get_user_by_req(request)
 
@@ -756,7 +760,7 @@ class DeactivateAccountRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, target_user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
 
@@ -801,7 +805,7 @@ class SuspendAccountRestServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, target_user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
 
@@ -828,7 +832,7 @@ class AccountValidityRenewServlet(RestServlet):
         )
         self.auth = hs.get_auth()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if self.account_validity_module_callbacks.on_legacy_admin_request_callback:
@@ -878,7 +882,7 @@ class ResetPasswordRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, target_user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """Post request to allow an administrator reset password for a user.
         This needs user to have administrator access in Synapse.
         """
@@ -920,7 +924,7 @@ class SearchUsersRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, target_user_id: str
-    ) -> Tuple[int, Optional[List[JsonDict]]]:
+    ) -> tuple[int, list[JsonDict] | None]:
         """Get request to search user table for specific users according to
         search term.
         This needs user to have a administrator access in Synapse.
@@ -989,7 +993,7 @@ class UserAdminServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         target_user = UserID.from_string(user_id)
@@ -1006,7 +1010,7 @@ class UserAdminServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
         auth_user = requester.user
@@ -1033,7 +1037,7 @@ class UserAdminServlet(RestServlet):
         return HTTPStatus.OK, {}
 
 
-class UserMembershipRestServlet(RestServlet):
+class UserJoinedRoomsRestServlet(RestServlet):
     """
     Get list of joined room ID's for a user.
     """
@@ -1047,7 +1051,7 @@ class UserMembershipRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         room_ids = await self.store.get_rooms_for_user(user_id)
@@ -1056,6 +1060,28 @@ class UserMembershipRestServlet(RestServlet):
         return HTTPStatus.OK, rooms_response
 
 
+class UserMembershipsRestServlet(RestServlet):
+    """
+    Get list of room memberships for a user.
+    """
+
+    PATTERNS = admin_patterns("/users/(?P<user_id>[^/]*)/memberships$")
+
+    def __init__(self, hs: "HomeServer"):
+        self.is_mine = hs.is_mine
+        self.auth = hs.get_auth()
+        self.store = hs.get_datastores().main
+
+    async def on_GET(
+        self, request: SynapseRequest, user_id: str
+    ) -> tuple[int, JsonDict]:
+        await assert_requester_is_admin(self.auth, request)
+
+        memberships = await self.store.get_memberships_for_user(user_id)
+
+        return HTTPStatus.OK, {"memberships": memberships}
+
+
 class PushersRestServlet(RestServlet):
     """
     Gets information about all pushers for a specific `user_id`.
@@ -1079,7 +1105,7 @@ class PushersRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if not self.is_mine(UserID.from_string(user_id)):
@@ -1118,11 +1144,12 @@ class UserTokenRestServlet(RestServlet):
         self.store = hs.get_datastores().main
         self.auth = hs.get_auth()
         self.auth_handler = hs.get_auth_handler()
+        self.admin_handler = hs.get_admin_handler()
         self.is_mine_id = hs.is_mine_id
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         await assert_user_is_admin(self.auth, requester)
         auth_user = requester.user
@@ -1132,6 +1159,12 @@ class UserTokenRestServlet(RestServlet):
                 HTTPStatus.BAD_REQUEST, "Only local users can be logged in as"
             )
 
+        # Validate user_id
+        UserID.from_string(user_id)
+        _user_info_dict = await self.store.get_user_by_id(user_id)
+        if not _user_info_dict:
+            raise NotFoundError("User not found")
+
         body = parse_json_object_from_request(request, allow_empty_body=True)
 
         valid_until_ms = body.get("valid_until_ms")
@@ -1190,7 +1223,7 @@ class ShadowBanRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if not self.is_mine_id(user_id):
@@ -1204,7 +1237,7 @@ class ShadowBanRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if not self.is_mine_id(user_id):
@@ -1242,7 +1275,7 @@ class RateLimitRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if not self.is_mine_id(user_id):
@@ -1273,7 +1306,7 @@ class RateLimitRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if not self.is_mine_id(user_id):
@@ -1321,7 +1354,7 @@ class RateLimitRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self.auth, request)
 
         if not self.is_mine_id(user_id):
@@ -1349,7 +1382,7 @@ class AccountDataRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         if not self._is_mine_id(user_id):
@@ -1390,7 +1423,7 @@ class UserReplaceMasterCrossSigningKeyRestServlet(RestServlet):
         self,
         request: SynapseRequest,
         user_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         if user_id is None:
@@ -1424,7 +1457,7 @@ class UserByExternalId(RestServlet):
         request: SynapseRequest,
         provider: str,
         external_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         user_id = await self._store.get_user_by_external_id(provider, external_id)
@@ -1449,7 +1482,7 @@ class UserByThreePid(RestServlet):
         request: SynapseRequest,
         medium: str,
         address: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         user_id = await self._store.get_user_id_by_threepid(medium, address)
@@ -1475,14 +1508,14 @@ class RedactUser(RestServlet):
         self.admin_handler = hs.get_admin_handler()
 
     class PostBody(RequestBodyModel):
-        rooms: List[StrictStr]
-        reason: Optional[StrictStr]
-        limit: Optional[StrictInt]
-        use_admin: Optional[StrictBool]
+        rooms: list[StrictStr]
+        reason: StrictStr | None = None
+        limit: StrictInt | None = None
+        use_admin: StrictBool | None = None
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request)
         await assert_user_is_admin(self._auth, requester)
 
@@ -1531,7 +1564,7 @@ class RedactUserStatus(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, redact_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
 
         task = await self.admin_handler.get_redact_task(redact_id)
@@ -1574,7 +1607,7 @@ class UserInvitesCount(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
         from_ts = parse_integer(request, "from_ts", required=True)
 
@@ -1599,7 +1632,7 @@ class UserJoinedRoomCount(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await assert_requester_is_admin(self._auth, request)
         from_ts = parse_integer(request, "from_ts", required=True)
 
diff --git a/synapse/rest/client/_base.py b/synapse/rest/client/_base.py
index 6cf37869d8..fad7234718 100644
--- a/synapse/rest/client/_base.py
+++ b/synapse/rest/client/_base.py
@@ -23,7 +23,7 @@
 
 import logging
 import re
-from typing import Any, Awaitable, Callable, Iterable, Pattern, Tuple, TypeVar, cast
+from typing import Any, Awaitable, Callable, Iterable, Pattern, TypeVar, cast
 
 from synapse.api.errors import InteractiveAuthIncompleteError
 from synapse.api.urls import CLIENT_API_PREFIX
@@ -86,7 +86,7 @@ def set_timeline_upper_limit(filter_json: JsonDict, filter_timeline_limit: int)
         )
 
 
-C = TypeVar("C", bound=Callable[..., Awaitable[Tuple[int, JsonDict]]])
+C = TypeVar("C", bound=Callable[..., Awaitable[tuple[int, JsonDict]]])
 
 
 def interactive_auth_handler(orig: C) -> C:
@@ -104,7 +104,7 @@ def interactive_auth_handler(orig: C) -> C:
         await self.auth_handler.check_auth
     """
 
-    async def wrapped(*args: Any, **kwargs: Any) -> Tuple[int, JsonDict]:
+    async def wrapped(*args: Any, **kwargs: Any) -> tuple[int, JsonDict]:
         try:
             return await orig(*args, **kwargs)
         except InteractiveAuthIncompleteError as e:
diff --git a/synapse/rest/client/account.py b/synapse/rest/client/account.py
index d9f0c169e8..3cb1e09f44 100644
--- a/synapse/rest/client/account.py
+++ b/synapse/rest/client/account.py
@@ -21,14 +21,15 @@
 #
 import logging
 import random
-from typing import TYPE_CHECKING, List, Literal, Optional, Tuple
+from typing import TYPE_CHECKING, Literal
 from urllib.parse import urlparse
 
 import attr
+from pydantic import StrictBool, StrictStr, StringConstraints
+from typing_extensions import Annotated
 
 from twisted.web.server import Request
 
-from synapse._pydantic_compat import StrictBool, StrictStr, constr
 from synapse.api.constants import LoginType
 from synapse.api.errors import (
     Codes,
@@ -57,6 +58,7 @@ from synapse.types.rest.client import (
     EmailRequestTokenBody,
     MsisdnRequestTokenBody,
 )
+from synapse.util.duration import Duration
 from synapse.util.msisdn import phone_number_to_msisdn
 from synapse.util.stringutils import assert_valid_client_secret, random_string
 from synapse.util.threepids import check_3pid_allowed, validate_email
@@ -89,7 +91,7 @@ class EmailPasswordRequestTokenRestServlet(RestServlet):
                 template_text=self.config.email.email_password_reset_template_text,
             )
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         if not self.config.email.can_verify_email:
             logger.warning(
                 "User password resets have been disabled due to lack of email config"
@@ -124,7 +126,9 @@ class EmailPasswordRequestTokenRestServlet(RestServlet):
                 # comments for request_token_inhibit_3pid_errors.
                 # Also wait for some random amount of time between 100ms and 1s to make it
                 # look like we did something.
-                await self.hs.get_clock().sleep(random.randint(1, 10) / 10)
+                await self.hs.get_clock().sleep(
+                    Duration(milliseconds=random.randint(100, 1000))
+                )
                 return 200, {"sid": random_string(16)}
 
             raise SynapseError(400, "Email not found", Codes.THREEPID_NOT_FOUND)
@@ -160,16 +164,14 @@ class PasswordRestServlet(RestServlet):
         self._set_password_handler = hs.get_set_password_handler()
 
     class PostBody(RequestBodyModel):
-        auth: Optional[AuthenticationData] = None
+        auth: AuthenticationData | None = None
         logout_devices: StrictBool = True
-        if TYPE_CHECKING:
-            # workaround for https://github.com/samuelcolvin/pydantic/issues/156
-            new_password: Optional[StrictStr] = None
-        else:
-            new_password: Optional[constr(max_length=512, strict=True)] = None
+        new_password: (
+            Annotated[str, StringConstraints(max_length=512, strict=True)] | None
+        ) = None
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
 
         # we do basic sanity checks here because the auth layer will store these
@@ -260,7 +262,7 @@ class PasswordRestServlet(RestServlet):
         # If we have a password in this request, prefer it. Otherwise, use the
         # password hash from an earlier request.
         if new_password:
-            password_hash: Optional[str] = await self.auth_handler.hash(new_password)
+            password_hash: str | None = await self.auth_handler.hash(new_password)
         elif session_id is not None:
             password_hash = existing_session_password_hash
         else:
@@ -290,13 +292,13 @@ class DeactivateAccountRestServlet(RestServlet):
         self._deactivate_account_handler = hs.get_deactivate_account_handler()
 
     class PostBody(RequestBodyModel):
-        auth: Optional[AuthenticationData] = None
-        id_server: Optional[StrictStr] = None
+        auth: AuthenticationData | None = None
+        id_server: StrictStr | None = None
         # Not specced, see https://github.com/matrix-org/matrix-spec/issues/297
         erase: StrictBool = False
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
 
         requester = await self.auth.get_user_by_req(request)
@@ -341,7 +343,7 @@ class EmailThreepidRequestTokenRestServlet(RestServlet):
                 template_text=self.config.email.email_add_threepid_template_text,
             )
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         if not self.hs.config.registration.enable_3pid_changes:
             raise SynapseError(
                 400, "3PID changes are disabled on this server", Codes.FORBIDDEN
@@ -384,7 +386,9 @@ class EmailThreepidRequestTokenRestServlet(RestServlet):
                 # comments for request_token_inhibit_3pid_errors.
                 # Also wait for some random amount of time between 100ms and 1s to make it
                 # look like we did something.
-                await self.hs.get_clock().sleep(random.randint(1, 10) / 10)
+                await self.hs.get_clock().sleep(
+                    Duration(milliseconds=random.randint(100, 1000))
+                )
                 return 200, {"sid": random_string(16)}
 
             raise SynapseError(400, "Email is already in use", Codes.THREEPID_IN_USE)
@@ -418,7 +422,7 @@ class MsisdnThreepidRequestTokenRestServlet(RestServlet):
         self.store = self.hs.get_datastores().main
         self.identity_handler = hs.get_identity_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         body = parse_and_validate_json_object_from_request(
             request, MsisdnRequestTokenBody
         )
@@ -450,7 +454,9 @@ class MsisdnThreepidRequestTokenRestServlet(RestServlet):
                 # comments for request_token_inhibit_3pid_errors.
                 # Also wait for some random amount of time between 100ms and 1s to make it
                 # look like we did something.
-                await self.hs.get_clock().sleep(random.randint(1, 10) / 10)
+                await self.hs.get_clock().sleep(
+                    Duration(milliseconds=random.randint(100, 1000))
+                )
                 return 200, {"sid": random_string(16)}
 
             logger.info("MSISDN %s is already in use by %s", msisdn, existing_user_id)
@@ -567,7 +573,7 @@ class AddThreepidMsisdnSubmitTokenServlet(RestServlet):
         self.store = hs.get_datastores().main
         self.identity_handler = hs.get_identity_handler()
 
-    async def on_POST(self, request: Request) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: Request) -> tuple[int, JsonDict]:
         if not self.config.registration.account_threepid_delegate_msisdn:
             raise SynapseError(
                 400,
@@ -601,7 +607,7 @@ class ThreepidRestServlet(RestServlet):
         self.auth_handler = hs.get_auth_handler()
         self.datastore = self.hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         threepids = await self.datastore.user_get_threepids(requester.user.to_string())
@@ -612,7 +618,7 @@ class ThreepidRestServlet(RestServlet):
     # the endpoint is deprecated. (If you really want to, you could do this by reusing
     # ThreePidBindRestServelet.PostBody with an `alias_generator` to handle
     # `threePidCreds` versus `three_pid_creds`.
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         if self.hs.config.mas.enabled or self.hs.config.experimental.msc3861.enabled:
             raise NotFoundError(errcode=Codes.UNRECOGNIZED)
 
@@ -664,12 +670,12 @@ class ThreepidAddRestServlet(RestServlet):
         self.auth_handler = hs.get_auth_handler()
 
     class PostBody(RequestBodyModel):
-        auth: Optional[AuthenticationData] = None
+        auth: AuthenticationData | None = None
         client_secret: ClientSecretStr
         sid: StrictStr
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         if not self.hs.config.registration.enable_3pid_changes:
             raise SynapseError(
                 400, "3PID changes are disabled on this server", Codes.FORBIDDEN
@@ -718,7 +724,7 @@ class ThreepidBindRestServlet(RestServlet):
         id_server: StrictStr
         sid: StrictStr
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
 
         requester = await self.auth.get_user_by_req(request)
@@ -743,10 +749,10 @@ class ThreepidUnbindRestServlet(RestServlet):
 
     class PostBody(RequestBodyModel):
         address: StrictStr
-        id_server: Optional[StrictStr] = None
+        id_server: StrictStr | None = None
         medium: Literal["email", "msisdn"]
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         """Unbind the given 3pid from a specific identity server, or identity servers that are
         known to have this 3pid bound
         """
@@ -772,10 +778,10 @@ class ThreepidDeleteRestServlet(RestServlet):
 
     class PostBody(RequestBodyModel):
         address: StrictStr
-        id_server: Optional[StrictStr] = None
+        id_server: StrictStr | None = None
         medium: Literal["email", "msisdn"]
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         if not self.hs.config.registration.enable_3pid_changes:
             raise SynapseError(
                 400, "3PID changes are disabled on this server", Codes.FORBIDDEN
@@ -859,7 +865,7 @@ class WhoamiRestServlet(RestServlet):
         super().__init__()
         self.auth = hs.get_auth()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         response = {
@@ -889,9 +895,9 @@ class AccountStatusRestServlet(RestServlet):
     class PostBody(RequestBodyModel):
         # TODO: we could validate that each user id is an mxid here, and/or parse it
         #       as a UserID
-        user_ids: List[StrictStr]
+        user_ids: list[StrictStr]
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await self._auth.get_user_by_req(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
diff --git a/synapse/rest/client/account_data.py b/synapse/rest/client/account_data.py
index 734c9e992f..b18232fc56 100644
--- a/synapse/rest/client/account_data.py
+++ b/synapse/rest/client/account_data.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import AccountDataTypes, ReceiptTypes
 from synapse.api.errors import AuthError, Codes, NotFoundError, SynapseError
@@ -75,7 +75,7 @@ class AccountDataServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str, account_data_type: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot add account data for other users.")
@@ -101,16 +101,16 @@ class AccountDataServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str, account_data_type: str
-    ) -> Tuple[int, JsonMapping]:
+    ) -> tuple[int, JsonMapping]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot get account data for other users.")
 
         # Push rules are stored in a separate table and must be queried separately.
         if account_data_type == AccountDataTypes.PUSH_RULES:
-            account_data: Optional[
-                JsonMapping
-            ] = await self._push_rules_handler.push_rules_for_user(requester.user)
+            account_data: (
+                JsonMapping | None
+            ) = await self._push_rules_handler.push_rules_for_user(requester.user)
         else:
             account_data = await self.store.get_global_account_data_by_type_for_user(
                 user_id, account_data_type
@@ -152,7 +152,7 @@ class UnstableAccountDataServlet(RestServlet):
         request: SynapseRequest,
         user_id: str,
         account_data_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot delete account data for other users.")
@@ -191,7 +191,7 @@ class RoomAccountDataServlet(RestServlet):
         user_id: str,
         room_id: str,
         account_data_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot add account data for other users.")
@@ -230,7 +230,7 @@ class RoomAccountDataServlet(RestServlet):
         user_id: str,
         room_id: str,
         account_data_type: str,
-    ) -> Tuple[int, JsonMapping]:
+    ) -> tuple[int, JsonMapping]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot get account data for other users.")
@@ -244,7 +244,7 @@ class RoomAccountDataServlet(RestServlet):
 
         # Room-specific push rules are not currently supported.
         if account_data_type == AccountDataTypes.PUSH_RULES:
-            account_data: Optional[JsonMapping] = {}
+            account_data: JsonMapping | None = {}
         else:
             account_data = await self.store.get_account_data_for_room_and_type(
                 user_id, room_id, account_data_type
@@ -288,7 +288,7 @@ class UnstableRoomAccountDataServlet(RestServlet):
         user_id: str,
         room_id: str,
         account_data_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot delete account data for other users.")
diff --git a/synapse/rest/client/account_validity.py b/synapse/rest/client/account_validity.py
index ec7836b647..1c60539054 100644
--- a/synapse/rest/client/account_validity.py
+++ b/synapse/rest/client/account_validity.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -90,7 +90,7 @@ class AccountValiditySendMailServlet(RestServlet):
             hs.config.account_validity.account_validity_renew_by_email_enabled
         )
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_expired=True)
         user_id = requester.user.to_string()
         await self.account_activity_handler.send_renewal_email_to_user(user_id)
diff --git a/synapse/rest/client/appservice_ping.py b/synapse/rest/client/appservice_ping.py
index 1f9662a95a..7e2ac15783 100644
--- a/synapse/rest/client/appservice_ping.py
+++ b/synapse/rest/client/appservice_ping.py
@@ -22,7 +22,7 @@
 import logging
 import time
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Any, Dict, Tuple
+from typing import TYPE_CHECKING, Any
 
 from synapse.api.errors import (
     CodeMessageException,
@@ -58,7 +58,7 @@ class AppservicePingRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, appservice_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         if not requester.app_service:
@@ -97,7 +97,7 @@ class AppservicePingRestServlet(RestServlet):
                 Codes.AS_PING_CONNECTION_TIMEOUT,
             )
         except CodeMessageException as e:
-            additional_fields: Dict[str, Any] = {"status": e.code}
+            additional_fields: dict[str, Any] = {"status": e.code}
             if isinstance(e, HttpResponseException):
                 try:
                     additional_fields["body"] = e.response.decode("utf-8")
diff --git a/synapse/rest/client/auth.py b/synapse/rest/client/auth.py
index 600bb51a7e..f325499044 100644
--- a/synapse/rest/client/auth.py
+++ b/synapse/rest/client/auth.py
@@ -67,7 +67,11 @@ class AuthRestServlet(RestServlet):
         if not session:
             raise SynapseError(400, "No session supplied")
 
-        if stagetype == "org.matrix.cross_signing_reset":
+        # We support the unstable (`org.matrix.cross_signing_reset`) name from MSC4312 until
+        # enough clients have adopted the stable name (`m.oauth`).
+        # Note: `org.matrix.cross_signing_reset` *is* the stable name of the *action* in the
+        # authorization server metadata. The unstable status only applies to the UIA stage name.
+        if stagetype == "m.oauth" or stagetype == "org.matrix.cross_signing_reset":
             if self.hs.config.mas.enabled:
                 assert isinstance(self.auth, MasDelegatedAuth)
 
diff --git a/synapse/rest/client/auth_metadata.py b/synapse/rest/client/auth_metadata.py
index 4b5d997478..062b8ed13e 100644
--- a/synapse/rest/client/auth_metadata.py
+++ b/synapse/rest/client/auth_metadata.py
@@ -13,7 +13,7 @@
 # limitations under the License.
 import logging
 import typing
-from typing import Tuple, cast
+from typing import cast
 
 from synapse.api.auth.mas import MasDelegatedAuth
 from synapse.api.errors import Codes, SynapseError
@@ -48,7 +48,26 @@ class AuthIssuerServlet(RestServlet):
         self._config = hs.config
         self._auth = hs.get_auth()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        # This endpoint is unauthenticated and the response only depends on
+        # the metadata we get from Matrix Authentication Service. Internally,
+        # MasDelegatedAuth/MSC3861DelegatedAuth.issuer() are already caching the
+        # response in memory anyway. Ideally we would follow any Cache-Control directive
+        # given by MAS, but this is fine for now.
+        #
+        # - `public` means it can be cached both in the browser and in caching proxies
+        # - `max-age` controls how long we cache on the browser side. 10m is sane enough
+        # - `s-maxage` controls how long we cache on the proxy side. Since caching
+        #   proxies usually have a way to purge caches, it is fine to cache there for
+        #   longer (1h), and issue cache invalidations in case we need it
+        # - `stale-while-revalidate` allows caching proxies to serve stale content while
+        #   revalidating in the background. This is useful for making this request always
+        #   'snappy' to end users whilst still keeping it fresh
+        request.setHeader(
+            b"Cache-Control",
+            b"public, max-age=600, s-maxage=3600, stale-while-revalidate=600",
+        )
+
         if self._config.mas.enabled:
             assert isinstance(self._auth, MasDelegatedAuth)
             return 200, {"issuer": await self._auth.issuer()}
@@ -93,7 +112,26 @@ class AuthMetadataServlet(RestServlet):
         self._config = hs.config
         self._auth = hs.get_auth()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        # This endpoint is unauthenticated and the response only depends on
+        # the metadata we get from Matrix Authentication Service. Internally,
+        # MasDelegatedAuth/MSC3861DelegatedAuth.issuer() are already caching the
+        # response in memory anyway. Ideally we would follow any Cache-Control directive
+        # given by MAS, but this is fine for now.
+        #
+        # - `public` means it can be cached both in the browser and in caching proxies
+        # - `max-age` controls how long we cache on the browser side. 10m is sane enough
+        # - `s-maxage` controls how long we cache on the proxy side. Since caching
+        #   proxies usually have a way to purge caches, it is fine to cache there for
+        #   longer (1h), and issue cache invalidations in case we need it
+        # - `stale-while-revalidate` allows caching proxies to serve stale content while
+        #   revalidating in the background. This is useful for making this request always
+        #   'snappy' to end users whilst still keeping it fresh
+        request.setHeader(
+            b"Cache-Control",
+            b"public, max-age=600, s-maxage=3600, stale-while-revalidate=600",
+        )
+
         if self._config.mas.enabled:
             assert isinstance(self._auth, MasDelegatedAuth)
             return 200, await self._auth.auth_metadata()
diff --git a/synapse/rest/client/capabilities.py b/synapse/rest/client/capabilities.py
index a279db1cc5..705d74dee1 100644
--- a/synapse/rest/client/capabilities.py
+++ b/synapse/rest/client/capabilities.py
@@ -19,9 +19,9 @@
 #
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
-from synapse.api.room_versions import KNOWN_ROOM_VERSIONS, MSC3244_CAPABILITIES
+from synapse.api.room_versions import KNOWN_ROOM_VERSIONS
 from synapse.http.server import HttpServer
 from synapse.http.servlet import RestServlet
 from synapse.http.site import SynapseRequest
@@ -48,7 +48,7 @@ class CapabilitiesRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.auth_handler = hs.get_auth_handler()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await self.auth.get_user_by_req(request, allow_guest=True)
         change_password = self.auth_handler.can_change_password()
 
@@ -77,11 +77,6 @@ class CapabilitiesRestServlet(RestServlet):
             }
         }
 
-        if self.config.experimental.msc3244_enabled:
-            response["capabilities"]["m.room_versions"][
-                "org.matrix.msc3244.room_capabilities"
-            ] = MSC3244_CAPABILITIES
-
         if self.config.experimental.msc3720_enabled:
             response["capabilities"]["org.matrix.msc3720.account_status"] = {
                 "enabled": True,
diff --git a/synapse/rest/client/delayed_events.py b/synapse/rest/client/delayed_events.py
index 2dd5a60b2b..7afecffe2d 100644
--- a/synapse/rest/client/delayed_events.py
+++ b/synapse/rest/client/delayed_events.py
@@ -17,7 +17,7 @@
 import logging
 from enum import Enum
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import Codes, SynapseError
 from synapse.http.server import HttpServer
@@ -47,14 +47,11 @@ class UpdateDelayedEventServlet(RestServlet):
 
     def __init__(self, hs: "HomeServer"):
         super().__init__()
-        self.auth = hs.get_auth()
         self.delayed_events_handler = hs.get_delayed_events_handler()
 
     async def on_POST(
         self, request: SynapseRequest, delay_id: str
-    ) -> Tuple[int, JsonDict]:
-        requester = await self.auth.get_user_by_req(request)
-
+    ) -> tuple[int, JsonDict]:
         body = parse_json_object_from_request(request)
         try:
             action = str(body["action"])
@@ -75,11 +72,65 @@ class UpdateDelayedEventServlet(RestServlet):
             )
 
         if enum_action == _UpdateDelayedEventAction.CANCEL:
-            await self.delayed_events_handler.cancel(requester, delay_id)
+            await self.delayed_events_handler.cancel(request, delay_id)
         elif enum_action == _UpdateDelayedEventAction.RESTART:
-            await self.delayed_events_handler.restart(requester, delay_id)
+            await self.delayed_events_handler.restart(request, delay_id)
         elif enum_action == _UpdateDelayedEventAction.SEND:
-            await self.delayed_events_handler.send(requester, delay_id)
+            await self.delayed_events_handler.send(request, delay_id)
+        return 200, {}
+
+
+class CancelDelayedEventServlet(RestServlet):
+    PATTERNS = client_patterns(
+        r"/org\.matrix\.msc4140/delayed_events/(?P<delay_id>[^/]+)/cancel$",
+        releases=(),
+    )
+    CATEGORY = "Delayed event management requests"
+
+    def __init__(self, hs: "HomeServer"):
+        super().__init__()
+        self.delayed_events_handler = hs.get_delayed_events_handler()
+
+    async def on_POST(
+        self, request: SynapseRequest, delay_id: str
+    ) -> tuple[int, JsonDict]:
+        await self.delayed_events_handler.cancel(request, delay_id)
+        return 200, {}
+
+
+class RestartDelayedEventServlet(RestServlet):
+    PATTERNS = client_patterns(
+        r"/org\.matrix\.msc4140/delayed_events/(?P<delay_id>[^/]+)/restart$",
+        releases=(),
+    )
+    CATEGORY = "Delayed event management requests"
+
+    def __init__(self, hs: "HomeServer"):
+        super().__init__()
+        self.delayed_events_handler = hs.get_delayed_events_handler()
+
+    async def on_POST(
+        self, request: SynapseRequest, delay_id: str
+    ) -> tuple[int, JsonDict]:
+        await self.delayed_events_handler.restart(request, delay_id)
+        return 200, {}
+
+
+class SendDelayedEventServlet(RestServlet):
+    PATTERNS = client_patterns(
+        r"/org\.matrix\.msc4140/delayed_events/(?P<delay_id>[^/]+)/send$",
+        releases=(),
+    )
+    CATEGORY = "Delayed event management requests"
+
+    def __init__(self, hs: "HomeServer"):
+        super().__init__()
+        self.delayed_events_handler = hs.get_delayed_events_handler()
+
+    async def on_POST(
+        self, request: SynapseRequest, delay_id: str
+    ) -> tuple[int, JsonDict]:
+        await self.delayed_events_handler.send(request, delay_id)
         return 200, {}
 
 
@@ -95,7 +146,7 @@ class DelayedEventsServlet(RestServlet):
         self.auth = hs.get_auth()
         self.delayed_events_handler = hs.get_delayed_events_handler()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         # TODO: Support Pagination stream API ("from" query parameter)
         delayed_events = await self.delayed_events_handler.get_all_for_user(requester)
@@ -105,7 +156,10 @@ class DelayedEventsServlet(RestServlet):
 
 
 def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
-    # The following can't currently be instantiated on workers.
+    # Most of the following can't currently be instantiated on workers.
     if hs.config.worker.worker_app is None:
         UpdateDelayedEventServlet(hs).register(http_server)
+        CancelDelayedEventServlet(hs).register(http_server)
+        SendDelayedEventServlet(hs).register(http_server)
+    RestartDelayedEventServlet(hs).register(http_server)
     DelayedEventsServlet(hs).register(http_server)
diff --git a/synapse/rest/client/devices.py b/synapse/rest/client/devices.py
index 0777abde7f..4b84131d32 100644
--- a/synapse/rest/client/devices.py
+++ b/synapse/rest/client/devices.py
@@ -22,9 +22,10 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
+
+from pydantic import ConfigDict, StrictStr
 
-from synapse._pydantic_compat import Extra, StrictStr
 from synapse.api import errors
 from synapse.api.errors import NotFoundError, SynapseError, UnrecognizedRequestError
 from synapse.http.server import HttpServer
@@ -54,25 +55,17 @@ class DevicesRestServlet(RestServlet):
         self.hs = hs
         self.auth = hs.get_auth()
         self.device_handler = hs.get_device_handler()
-        self._msc3852_enabled = hs.config.experimental.msc3852_enabled
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         devices = await self.device_handler.get_devices_by_user(
             requester.user.to_string()
         )
 
-        # If MSC3852 is disabled, then the "last_seen_user_agent" field will be
-        # removed from each device. If it is enabled, then the field name will
-        # be replaced by the unstable identifier.
-        #
-        # When MSC3852 is accepted, this block of code can just be removed to
-        # expose "last_seen_user_agent" to clients.
         for device in devices:
-            last_seen_user_agent = device["last_seen_user_agent"]
+            # This field is only for admin access and should not be exposed to clients.
+            # (MSC3852, which is closed, did propose to expose it.).
             del device["last_seen_user_agent"]
-            if self._msc3852_enabled:
-                device["org.matrix.msc3852.last_seen_user_agent"] = last_seen_user_agent
 
         return 200, {"devices": devices}
 
@@ -94,11 +87,11 @@ class DeleteDevicesRestServlet(RestServlet):
         self.auth_handler = hs.get_auth_handler()
 
     class PostBody(RequestBodyModel):
-        auth: Optional[AuthenticationData]
-        devices: List[StrictStr]
+        auth: AuthenticationData | None = None
+        devices: list[StrictStr]
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         try:
@@ -108,11 +101,11 @@ class DeleteDevicesRestServlet(RestServlet):
                 # TODO: Can/should we remove this fallback now?
                 # deal with older clients which didn't pass a JSON dict
                 # the same as those that pass an empty dict
-                body = self.PostBody.parse_obj({})
+                body = self.PostBody.model_validate({})
             else:
                 raise e
 
-        if requester.app_service and requester.app_service.msc4190_device_management:
+        if requester.app_service:
             # MSC4190 can skip UIA for this endpoint
             pass
         else:
@@ -143,14 +136,13 @@ class DeviceRestServlet(RestServlet):
         handler = hs.get_device_handler()
         self.device_handler = handler
         self.auth_handler = hs.get_auth_handler()
-        self._msc3852_enabled = hs.config.experimental.msc3852_enabled
         self._auth_delegation_enabled = (
             hs.config.mas.enabled or hs.config.experimental.msc3861.enabled
         )
 
     async def on_GET(
         self, request: SynapseRequest, device_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         device = await self.device_handler.get_device(
             requester.user.to_string(), device_id
@@ -158,26 +150,19 @@ class DeviceRestServlet(RestServlet):
         if device is None:
             raise NotFoundError("No device found")
 
-        # If MSC3852 is disabled, then the "last_seen_user_agent" field will be
-        # removed from each device. If it is enabled, then the field name will
-        # be replaced by the unstable identifier.
-        #
-        # When MSC3852 is accepted, this block of code can just be removed to
-        # expose "last_seen_user_agent" to clients.
-        last_seen_user_agent = device["last_seen_user_agent"]
+        # This field is only for admin access and should not be exposed to clients.
+        # (MSC3852, which is closed, did propose to expose it.)
         del device["last_seen_user_agent"]
-        if self._msc3852_enabled:
-            device["org.matrix.msc3852.last_seen_user_agent"] = last_seen_user_agent
 
         return 200, device
 
     class DeleteBody(RequestBodyModel):
-        auth: Optional[AuthenticationData]
+        auth: AuthenticationData | None = None
 
     @interactive_auth_handler
     async def on_DELETE(
         self, request: SynapseRequest, device_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         try:
@@ -188,11 +173,11 @@ class DeviceRestServlet(RestServlet):
                 # TODO: can/should we remove this fallback now?
                 # deal with older clients which didn't pass a JSON dict
                 # the same as those that pass an empty dict
-                body = self.DeleteBody.parse_obj({})
+                body = self.DeleteBody.model_validate({})
             else:
                 raise
 
-        if requester.app_service and requester.app_service.msc4190_device_management:
+        if requester.app_service:
             # MSC4190 allows appservices to delete devices through this endpoint without UIA
             # It's also allowed with MSC3861 enabled
             pass
@@ -217,17 +202,17 @@ class DeviceRestServlet(RestServlet):
         return 200, {}
 
     class PutBody(RequestBodyModel):
-        display_name: Optional[StrictStr]
+        display_name: StrictStr | None = None
 
     async def on_PUT(
         self, request: SynapseRequest, device_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         body = parse_and_validate_json_object_from_request(request, self.PutBody)
 
         # MSC4190 allows appservices to create devices through this endpoint
-        if requester.app_service and requester.app_service.msc4190_device_management:
+        if requester.app_service:
             created = await self.device_handler.upsert_device(
                 user_id=requester.user.to_string(),
                 device_id=device_id,
@@ -247,137 +232,11 @@ class DehydratedDeviceDataModel(RequestBodyModel):
     Expects other freeform fields. Use .dict() to access them.
     """
 
-    class Config:
-        extra = Extra.allow
+    model_config = ConfigDict(extra="allow")
 
     algorithm: StrictStr
 
 
-class DehydratedDeviceServlet(RestServlet):
-    """Retrieve or store a dehydrated device.
-
-    Implements MSC2697.
-
-    GET /org.matrix.msc2697.v2/dehydrated_device
-
-    HTTP/1.1 200 OK
-    Content-Type: application/json
-
-    {
-      "device_id": "dehydrated_device_id",
-      "device_data": {
-        "algorithm": "org.matrix.msc2697.v1.dehydration.v1.olm",
-        "account": "dehydrated_device"
-      }
-    }
-
-    PUT /org.matrix.msc2697.v2/dehydrated_device
-    Content-Type: application/json
-
-    {
-      "device_data": {
-        "algorithm": "org.matrix.msc2697.v1.dehydration.v1.olm",
-        "account": "dehydrated_device"
-      }
-    }
-
-    HTTP/1.1 200 OK
-    Content-Type: application/json
-
-    {
-      "device_id": "dehydrated_device_id"
-    }
-
-    """
-
-    PATTERNS = client_patterns(
-        "/org.matrix.msc2697.v2/dehydrated_device$",
-        releases=(),
-    )
-
-    def __init__(self, hs: "HomeServer"):
-        super().__init__()
-        self.hs = hs
-        self.auth = hs.get_auth()
-        handler = hs.get_device_handler()
-        self.device_handler = handler
-
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        requester = await self.auth.get_user_by_req(request)
-        dehydrated_device = await self.device_handler.get_dehydrated_device(
-            requester.user.to_string()
-        )
-        if dehydrated_device is not None:
-            (device_id, device_data) = dehydrated_device
-            result = {"device_id": device_id, "device_data": device_data}
-            return 200, result
-        else:
-            raise errors.NotFoundError("No dehydrated device available")
-
-    class PutBody(RequestBodyModel):
-        device_data: DehydratedDeviceDataModel
-        initial_device_display_name: Optional[StrictStr]
-
-    async def on_PUT(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        submission = parse_and_validate_json_object_from_request(request, self.PutBody)
-        requester = await self.auth.get_user_by_req(request)
-
-        device_id = await self.device_handler.store_dehydrated_device(
-            requester.user.to_string(),
-            None,
-            submission.device_data.dict(),
-            submission.initial_device_display_name,
-        )
-        return 200, {"device_id": device_id}
-
-
-class ClaimDehydratedDeviceServlet(RestServlet):
-    """Claim a dehydrated device.
-
-    POST /org.matrix.msc2697.v2/dehydrated_device/claim
-    Content-Type: application/json
-
-    {
-      "device_id": "dehydrated_device_id"
-    }
-
-    HTTP/1.1 200 OK
-    Content-Type: application/json
-
-    {
-      "success": true,
-    }
-
-    """
-
-    PATTERNS = client_patterns(
-        "/org.matrix.msc2697.v2/dehydrated_device/claim", releases=()
-    )
-
-    def __init__(self, hs: "HomeServer"):
-        super().__init__()
-        self.hs = hs
-        self.auth = hs.get_auth()
-        handler = hs.get_device_handler()
-        self.device_handler = handler
-
-    class PostBody(RequestBodyModel):
-        device_id: StrictStr
-
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        requester = await self.auth.get_user_by_req(request)
-
-        submission = parse_and_validate_json_object_from_request(request, self.PostBody)
-
-        result = await self.device_handler.rehydrate_device(
-            requester.user.to_string(),
-            self.auth.get_access_token_from_request(request),
-            submission.device_id,
-        )
-
-        return 200, result
-
-
 class DehydratedDeviceEventsServlet(RestServlet):
     PATTERNS = client_patterns(
         "/org.matrix.msc3814.v1/dehydrated_device/(?P<device_id>[^/]*)/events$",
@@ -391,11 +250,11 @@ class DehydratedDeviceEventsServlet(RestServlet):
         self.store = hs.get_datastores().main
 
     class PostBody(RequestBodyModel):
-        next_batch: Optional[StrictStr]
+        next_batch: StrictStr | None = None
 
     async def on_POST(
         self, request: SynapseRequest, device_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         next_batch = parse_and_validate_json_object_from_request(
@@ -501,7 +360,7 @@ class DehydratedDeviceV2Servlet(RestServlet):
         self.e2e_keys_handler = hs.get_e2e_keys_handler()
         self.device_handler = handler
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         dehydrated_device = await self.device_handler.get_dehydrated_device(
@@ -515,7 +374,7 @@ class DehydratedDeviceV2Servlet(RestServlet):
         else:
             raise errors.NotFoundError("No dehydrated device available")
 
-    async def on_DELETE(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_DELETE(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         dehydrated_device = await self.device_handler.get_dehydrated_device(
@@ -538,12 +397,10 @@ class DehydratedDeviceV2Servlet(RestServlet):
     class PutBody(RequestBodyModel):
         device_data: DehydratedDeviceDataModel
         device_id: StrictStr
-        initial_device_display_name: Optional[StrictStr]
+        initial_device_display_name: StrictStr | None
+        model_config = ConfigDict(extra="allow")
 
-        class Config:
-            extra = Extra.allow
-
-    async def on_PUT(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_PUT(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         submission = parse_and_validate_json_object_from_request(request, self.PutBody)
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
@@ -581,9 +438,6 @@ def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
     DevicesRestServlet(hs).register(http_server)
     DeviceRestServlet(hs).register(http_server)
 
-    if hs.config.experimental.msc2697_enabled:
-        DehydratedDeviceServlet(hs).register(http_server)
-        ClaimDehydratedDeviceServlet(hs).register(http_server)
     if hs.config.experimental.msc3814_enabled:
         DehydratedDeviceV2Servlet(hs).register(http_server)
         DehydratedDeviceEventsServlet(hs).register(http_server)
diff --git a/synapse/rest/client/directory.py b/synapse/rest/client/directory.py
index 479f489623..0b334f9b0b 100644
--- a/synapse/rest/client/directory.py
+++ b/synapse/rest/client/directory.py
@@ -20,11 +20,12 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List, Literal, Optional, Tuple
+from typing import TYPE_CHECKING, Literal
+
+from pydantic import StrictStr
 
 from twisted.web.server import Request
 
-from synapse._pydantic_compat import StrictStr
 from synapse.api.errors import AuthError, Codes, NotFoundError, SynapseError
 from synapse.http.server import HttpServer
 from synapse.http.servlet import (
@@ -59,7 +60,7 @@ class ClientDirectoryServer(RestServlet):
         self.directory_handler = hs.get_directory_handler()
         self.auth = hs.get_auth()
 
-    async def on_GET(self, request: Request, room_alias: str) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: Request, room_alias: str) -> tuple[int, JsonDict]:
         if not RoomAlias.is_valid(room_alias):
             raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM)
         room_alias_obj = RoomAlias.from_string(room_alias)
@@ -72,11 +73,11 @@ class ClientDirectoryServer(RestServlet):
         # TODO: get Pydantic to validate that this is a valid room id?
         room_id: StrictStr
         # `servers` is unspecced
-        servers: Optional[List[StrictStr]] = None
+        servers: list[StrictStr] | None = None
 
     async def on_PUT(
         self, request: SynapseRequest, room_alias: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         if not RoomAlias.is_valid(room_alias):
             raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM)
         room_alias_obj = RoomAlias.from_string(room_alias)
@@ -103,7 +104,7 @@ class ClientDirectoryServer(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, room_alias: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         if not RoomAlias.is_valid(room_alias):
             raise SynapseError(400, "Room alias invalid", errcode=Codes.INVALID_PARAM)
         room_alias_obj = RoomAlias.from_string(room_alias)
@@ -141,7 +142,7 @@ class ClientDirectoryListServer(RestServlet):
         self.directory_handler = hs.get_directory_handler()
         self.auth = hs.get_auth()
 
-    async def on_GET(self, request: Request, room_id: str) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: Request, room_id: str) -> tuple[int, JsonDict]:
         room = await self.store.get_room(room_id)
         if room is None:
             raise NotFoundError("Unknown room")
@@ -153,7 +154,7 @@ class ClientDirectoryListServer(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         content = parse_and_validate_json_object_from_request(request, self.PutBody)
@@ -181,13 +182,13 @@ class ClientAppserviceDirectoryListServer(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, network_id: str, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         content = parse_and_validate_json_object_from_request(request, self.PutBody)
         return await self._edit(request, network_id, room_id, content.visibility)
 
     async def on_DELETE(
         self, request: SynapseRequest, network_id: str, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         return await self._edit(request, network_id, room_id, "private")
 
     async def _edit(
@@ -196,7 +197,7 @@ class ClientAppserviceDirectoryListServer(RestServlet):
         network_id: str,
         room_id: str,
         visibility: Literal["public", "private"],
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if not requester.app_service:
             raise AuthError(
diff --git a/synapse/rest/client/events.py b/synapse/rest/client/events.py
index ad23cc76ce..de73c96fd0 100644
--- a/synapse/rest/client/events.py
+++ b/synapse/rest/client/events.py
@@ -22,7 +22,7 @@
 """This module contains REST servlets to do with event streaming, /events."""
 
 import logging
-from typing import TYPE_CHECKING, Dict, List, Tuple, Union
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import SynapseError
 from synapse.events.utils import SerializeEventConfig
@@ -51,9 +51,9 @@ class EventStreamRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         if requester.is_guest:
             if b"room_id" not in args:
                 raise SynapseError(400, "Guest users must specify room_id param")
@@ -96,7 +96,7 @@ class EventRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, event_id: str
-    ) -> Tuple[int, Union[str, JsonDict]]:
+    ) -> tuple[int, str | JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         event = await self.event_handler.get_event(requester.user, None, event_id)
 
diff --git a/synapse/rest/client/filter.py b/synapse/rest/client/filter.py
index f1e881975f..cfe82e1473 100644
--- a/synapse/rest/client/filter.py
+++ b/synapse/rest/client/filter.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import AuthError, NotFoundError, StoreError, SynapseError
 from synapse.http.server import HttpServer
@@ -48,7 +48,7 @@ class GetFilterRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str, filter_id: str
-    ) -> Tuple[int, JsonMapping]:
+    ) -> tuple[int, JsonMapping]:
         target_user = UserID.from_string(user_id)
         requester = await self.auth.get_user_by_req(request)
 
@@ -87,7 +87,7 @@ class CreateFilterRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         target_user = UserID.from_string(user_id)
         requester = await self.auth.get_user_by_req(request)
 
diff --git a/synapse/rest/client/initial_sync.py b/synapse/rest/client/initial_sync.py
index a2c50f5d58..c20e007c5b 100644
--- a/synapse/rest/client/initial_sync.py
+++ b/synapse/rest/client/initial_sync.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import TYPE_CHECKING, Dict, List, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http.server import HttpServer
 from synapse.http.servlet import RestServlet, parse_boolean
@@ -43,9 +43,9 @@ class InitialSyncRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         as_client_event = b"raw" not in args
         pagination_config = await PaginationConfig.from_request(
             self.store, request, default_limit=10
diff --git a/synapse/rest/client/keys.py b/synapse/rest/client/keys.py
index 9f39889c75..89b68331f2 100644
--- a/synapse/rest/client/keys.py
+++ b/synapse/rest/client/keys.py
@@ -23,10 +23,14 @@
 import logging
 import re
 from collections import Counter
-from typing import TYPE_CHECKING, Any, Dict, Optional, Tuple
+from http import HTTPStatus
+from typing import TYPE_CHECKING, Any, Mapping
+
+from pydantic import StrictBool, StrictStr, field_validator
 
 from synapse.api.auth.mas import MasDelegatedAuth
 from synapse.api.errors import (
+    Codes,
     InteractiveAuthIncompleteError,
     InvalidAPICallError,
     SynapseError,
@@ -37,11 +41,13 @@ from synapse.http.servlet import (
     parse_integer,
     parse_json_object_from_request,
     parse_string,
+    validate_json_object,
 )
 from synapse.http.site import SynapseRequest
-from synapse.logging.opentracing import log_kv, set_tag
+from synapse.logging.opentracing import set_tag
 from synapse.rest.client._base import client_patterns, interactive_auth_handler
 from synapse.types import JsonDict, StreamToken
+from synapse.types.rest import RequestBodyModel
 from synapse.util.cancellation import cancellable
 
 if TYPE_CHECKING:
@@ -59,7 +65,6 @@ class KeyUploadServlet(RestServlet):
         "device_keys": {
             "user_id": "<user_id>",
             "device_id": "<device_id>",
-            "valid_until_ts": <millisecond_timestamp>,
             "algorithms": [
                 "m.olm.curve25519-aes-sha2",
             ]
@@ -100,7 +105,7 @@ class KeyUploadServlet(RestServlet):
 
     """
 
-    PATTERNS = client_patterns("/keys/upload(/(?P<device_id>[^/]+))?$")
+    PATTERNS = client_patterns("/keys/upload$")
     CATEGORY = "Encryption requests"
 
     def __init__(self, hs: "HomeServer"):
@@ -111,46 +116,156 @@ class KeyUploadServlet(RestServlet):
         self._clock = hs.get_clock()
         self._store = hs.get_datastores().main
 
-    async def on_POST(
-        self, request: SynapseRequest, device_id: Optional[str]
-    ) -> Tuple[int, JsonDict]:
+    class KeyUploadRequestBody(RequestBodyModel):
+        """
+        The body of a `POST /_matrix/client/v3/keys/upload` request.
+
+        Based on https://spec.matrix.org/v1.16/client-server-api/#post_matrixclientv3keysupload.
+        """
+
+        class DeviceKeys(RequestBodyModel):
+            algorithms: list[StrictStr]
+            """The encryption algorithms supported by this device."""
+
+            device_id: StrictStr
+            """The ID of the device these keys belong to. Must match the device ID used when logging in."""
+
+            keys: Mapping[StrictStr, StrictStr]
+            """
+            Public identity keys. The names of the properties should be in the
+            format `<algorithm>:<device_id>`. The keys themselves should be encoded as
+            specified by the key algorithm.
+            """
+
+            signatures: Mapping[StrictStr, Mapping[StrictStr, StrictStr]]
+            """Signatures for the device key object. A map from user ID, to a map from "<algorithm>:<device_id>" to the signature."""
+
+            user_id: StrictStr
+            """The ID of the user the device belongs to. Must match the user ID used when logging in."""
+
+        class KeyObject(RequestBodyModel):
+            key: StrictStr
+            """The key, encoded using unpadded base64."""
+
+            fallback: StrictBool | None = False
+            """Whether this is a fallback key. Only used when handling fallback keys."""
+
+            signatures: Mapping[StrictStr, Mapping[StrictStr, StrictStr]]
+            """Signature for the device. Mapped from user ID to another map of key signing identifier to the signature itself.
+
+            See the following for more detail: https://spec.matrix.org/v1.16/appendices/#signing-details
+            """
+
+        device_keys: DeviceKeys | None = None
+        """Identity keys for the device. May be absent if no new identity keys are required."""
+
+        fallback_keys: Mapping[StrictStr, StrictStr | KeyObject] | None = None
+        """
+        The public key which should be used if the device's one-time keys are
+        exhausted. The fallback key is not deleted once used, but should be
+        replaced when additional one-time keys are being uploaded. The server
+        will notify the client of the fallback key being used through `/sync`.
+
+        There can only be at most one key per algorithm uploaded, and the server
+        will only persist one key per algorithm.
+
+        When uploading a signed key, an additional fallback: true key should be
+        included to denote that the key is a fallback key.
+
+        May be absent if a new fallback key is not required.
+        """
+
+        @field_validator("fallback_keys", mode="before")
+        @classmethod
+        def validate_fallback_keys(cls, v: Any) -> Any:
+            if v is None:
+                return v
+            if not isinstance(v, dict):
+                raise TypeError("fallback_keys must be a mapping")
+
+            for k in v.keys():
+                if not len(k.split(":")) == 2:
+                    raise SynapseError(
+                        code=HTTPStatus.BAD_REQUEST,
+                        errcode=Codes.BAD_JSON,
+                        msg=f"Invalid fallback_keys key {k!r}. "
+                        'Expected "<algorithm>:<device_id>".',
+                    )
+            return v
+
+        one_time_keys: Mapping[StrictStr, StrictStr | KeyObject] | None = None
+        """
+        One-time public keys for "pre-key" messages. The names of the properties
+        should be in the format `<algorithm>:<key_id>`.
+
+        The format of the key is determined by the key algorithm, see:
+        https://spec.matrix.org/v1.16/client-server-api/#key-algorithms.
+        """
+
+        @field_validator("one_time_keys", mode="before")
+        @classmethod
+        def validate_one_time_keys(cls, v: Any) -> Any:
+            if v is None:
+                return v
+            if not isinstance(v, dict):
+                raise TypeError("one_time_keys must be a mapping")
+
+            for k, _ in v.items():
+                if not len(k.split(":")) == 2:
+                    raise SynapseError(
+                        code=HTTPStatus.BAD_REQUEST,
+                        errcode=Codes.BAD_JSON,
+                        msg=f"Invalid one_time_keys key {k!r}. "
+                        'Expected "<algorithm>:<device_id>".',
+                    )
+            return v
+
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         user_id = requester.user.to_string()
-        body = parse_json_object_from_request(request)
 
-        if device_id is not None:
-            # Providing the device_id should only be done for setting keys
-            # for dehydrated devices; however, we allow it for any device for
-            # compatibility with older clients.
-            if requester.device_id is not None and device_id != requester.device_id:
-                dehydrated_device = await self.device_handler.get_dehydrated_device(
-                    user_id
-                )
-                if dehydrated_device is not None and device_id != dehydrated_device[0]:
-                    set_tag("error", True)
-                    log_kv(
-                        {
-                            "message": "Client uploading keys for a different device",
-                            "logged_in_id": requester.device_id,
-                            "key_being_uploaded": device_id,
-                        }
-                    )
-                    logger.warning(
-                        "Client uploading keys for a different device "
-                        "(logged in as %s, uploading for %s)",
-                        requester.device_id,
-                        device_id,
-                    )
-        else:
-            device_id = requester.device_id
+        # Parse the request body. Validate separately, as the handler expects a
+        # plain dict, rather than any parsed object.
+        #
+        # Note: It would be nice to work with a parsed object, but the handler
+        # needs to encode portions of the request body as canonical JSON before
+        # storing the result in the DB. There's little point in converted to a
+        # parsed object and then back to a dict.
+        body = parse_json_object_from_request(request)
+        validate_json_object(body, self.KeyUploadRequestBody)
+
+        device_id = requester.device_id
 
         if device_id is None:
             raise SynapseError(
                 400, "To upload keys, you must pass device_id when authenticating"
             )
 
+        if "device_keys" in body and isinstance(body["device_keys"], dict):
+            # Validate the provided `user_id` and `device_id` fields in
+            # `device_keys` match that of the requesting user. We can't do
+            # this directly in the pydantic model as we don't have access
+            # to the requester yet.
+            #
+            # TODO: We could use ValidationInfo when we switch to Pydantic v2.
+            # https://docs.pydantic.dev/latest/concepts/validators/#validation-info
+            if body["device_keys"].get("user_id") != user_id:
+                raise SynapseError(
+                    code=HTTPStatus.BAD_REQUEST,
+                    errcode=Codes.BAD_JSON,
+                    msg="Provided `user_id` in `device_keys` does not match that of the authenticated user",
+                )
+            if body["device_keys"].get("device_id") != device_id:
+                raise SynapseError(
+                    code=HTTPStatus.BAD_REQUEST,
+                    errcode=Codes.BAD_JSON,
+                    msg="Provided `device_id` in `device_keys` does not match that of the authenticated user device",
+                )
+
         result = await self.e2e_keys_handler.upload_keys_for_user(
-            user_id=user_id, device_id=device_id, keys=body
+            user_id=user_id,
+            device_id=device_id,
+            keys=body,
         )
 
         return 200, result
@@ -199,7 +314,7 @@ class KeyQueryServlet(RestServlet):
         self.e2e_keys_handler = hs.get_e2e_keys_handler()
 
     @cancellable
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         user_id = requester.user.to_string()
         device_id = requester.device_id
@@ -244,7 +359,7 @@ class KeyChangesServlet(RestServlet):
         self.store = hs.get_datastores().main
 
     @cancellable
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         from_token_string = parse_string(request, "from", required=True)
@@ -298,13 +413,13 @@ class OneTimeKeyServlet(RestServlet):
         self.auth = hs.get_auth()
         self.e2e_keys_handler = hs.get_e2e_keys_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         timeout = parse_integer(request, "timeout", 10 * 1000)
         body = parse_json_object_from_request(request)
 
         # Generate a count for each algorithm, which is hard-coded to 1.
-        query: Dict[str, Dict[str, Dict[str, int]]] = {}
+        query: dict[str, dict[str, dict[str, int]]] = {}
         for user_id, one_time_keys in body.get("one_time_keys", {}).items():
             for device_id, algorithm in one_time_keys.items():
                 query.setdefault(user_id, {})[device_id] = {algorithm: 1}
@@ -346,13 +461,13 @@ class UnstableOneTimeKeyServlet(RestServlet):
         self.auth = hs.get_auth()
         self.e2e_keys_handler = hs.get_e2e_keys_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         timeout = parse_integer(request, "timeout", 10 * 1000)
         body = parse_json_object_from_request(request)
 
         # Generate a count for each algorithm.
-        query: Dict[str, Dict[str, Dict[str, int]]] = {}
+        query: dict[str, dict[str, dict[str, int]]] = {}
         for user_id, one_time_keys in body.get("one_time_keys", {}).items():
             for device_id, algorithms in one_time_keys.items():
                 query.setdefault(user_id, {})[device_id] = Counter(algorithms)
@@ -382,7 +497,7 @@ class SigningKeyUploadServlet(RestServlet):
         self.auth_handler = hs.get_auth_handler()
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
         body = parse_json_object_from_request(request)
@@ -402,7 +517,8 @@ class SigningKeyUploadServlet(RestServlet):
         # The keys are different; is x-signing set up? If no, then this is first-time
         # setup, and that is allowed without UIA, per MSC3967.
         # If yes, then we need to authenticate the change.
-        if is_cross_signing_setup:
+        # MSC4190 can skip UIA for replacing cross-signing keys as well.
+        if is_cross_signing_setup and not requester.app_service:
             # With MSC3861, UIA is not possible. Instead, the auth service has to
             # explicitly mark the master key as replaceable.
             if self.hs.config.mas.enabled:
@@ -418,9 +534,14 @@ class SigningKeyUploadServlet(RestServlet):
                         {
                             "session": "dummy",
                             "flows": [
+                                {"stages": ["m.oauth"]},
+                                # The unstable name from MSC4312 should be supported until enough clients have adopted the stable (`m.oauth`) name:
                                 {"stages": ["org.matrix.cross_signing_reset"]},
                             ],
                             "params": {
+                                "m.oauth": {
+                                    "url": url,
+                                },
                                 "org.matrix.cross_signing_reset": {
                                     "url": url,
                                 },
@@ -452,9 +573,14 @@ class SigningKeyUploadServlet(RestServlet):
                         {
                             "session": "dummy",
                             "flows": [
+                                {"stages": ["m.oauth"]},
+                                # The unstable name from MSC4312 should be supported until enough clients have adopted the stable (`m.oauth`) name:
                                 {"stages": ["org.matrix.cross_signing_reset"]},
                             ],
                             "params": {
+                                "m.oauth": {
+                                    "url": url,
+                                },
                                 "org.matrix.cross_signing_reset": {
                                     "url": url,
                                 },
@@ -514,7 +640,7 @@ class SignaturesUploadServlet(RestServlet):
         self.auth = hs.get_auth()
         self.e2e_keys_handler = hs.get_e2e_keys_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         user_id = requester.user.to_string()
         body = parse_json_object_from_request(request)
diff --git a/synapse/rest/client/knock.py b/synapse/rest/client/knock.py
index d7a17e1b35..cd3afda11e 100644
--- a/synapse/rest/client/knock.py
+++ b/synapse/rest/client/knock.py
@@ -20,7 +20,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Dict, List, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import Membership
 from synapse.api.errors import SynapseError
@@ -58,7 +58,7 @@ class KnockRoomAliasServlet(RestServlet):
         self,
         request: SynapseRequest,
         room_identifier: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         content = parse_json_object_from_request(request)
@@ -69,8 +69,8 @@ class KnockRoomAliasServlet(RestServlet):
         if RoomID.is_valid(room_identifier):
             room_id = room_identifier
 
-            # twisted.web.server.Request.args is incorrectly defined as Optional[Any]
-            args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+            # twisted.web.server.Request.args is incorrectly defined as Any | None
+            args: dict[bytes, list[bytes]] = request.args  # type: ignore
             # Prefer via over server_name (deprecated with MSC4156)
             remote_room_hosts = parse_strings_from_args(args, "via", required=False)
             if remote_room_hosts is None:
diff --git a/synapse/rest/client/login.py b/synapse/rest/client/login.py
index acb9111ad2..a49b27d009 100644
--- a/synapse/rest/client/login.py
+++ b/synapse/rest/client/login.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-
 import logging
 import re
 from typing import (
@@ -26,12 +25,7 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
-    List,
-    Optional,
-    Tuple,
     TypedDict,
-    Union,
 )
 
 from synapse.api.constants import ApprovalNoticeMedium
@@ -47,7 +41,7 @@ from synapse.api.errors import (
 from synapse.api.ratelimiting import Ratelimiter
 from synapse.api.urls import CLIENT_API_PREFIX
 from synapse.appservice import ApplicationService
-from synapse.handlers.sso import SsoIdentityProvider
+from synapse.handlers.sso import SsoIdentityProvider, SsoSetupError
 from synapse.http import get_request_uri
 from synapse.http.server import HttpServer, finish_request
 from synapse.http.servlet import (
@@ -70,12 +64,12 @@ logger = logging.getLogger(__name__)
 
 class LoginResponse(TypedDict, total=False):
     user_id: str
-    access_token: Optional[str]
+    access_token: str | None
     home_server: str
-    expires_in_ms: Optional[int]
-    refresh_token: Optional[str]
-    device_id: Optional[str]
-    well_known: Optional[Dict[str, Any]]
+    expires_in_ms: int | None
+    refresh_token: str | None
+    device_id: str | None
+    well_known: dict[str, Any] | None
 
 
 class LoginRestServlet(RestServlet):
@@ -142,8 +136,8 @@ class LoginRestServlet(RestServlet):
         # counters are initialised for the auth_provider_ids.
         _load_sso_handlers(hs)
 
-    def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        flows: List[JsonDict] = []
+    def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        flows: list[JsonDict] = []
         if self.jwt_enabled:
             flows.append({"type": LoginRestServlet.JWT_TYPE})
 
@@ -178,7 +172,7 @@ class LoginRestServlet(RestServlet):
         # fall back to the fallback API if they don't understand one of the
         # login flow types returned.
         if support_login_token_flow:
-            tokenTypeFlow: Dict[str, Any] = {"type": LoginRestServlet.TOKEN_TYPE}
+            tokenTypeFlow: dict[str, Any] = {"type": LoginRestServlet.TOKEN_TYPE}
             # If the login token flow is enabled advertise the get_login_token flag.
             if self._get_login_token_enabled:
                 tokenTypeFlow["get_login_token"] = True
@@ -190,7 +184,7 @@ class LoginRestServlet(RestServlet):
 
         return 200, {"flows": flows}
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, LoginResponse]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, LoginResponse]:
         login_submission = parse_json_object_from_request(request)
 
         # Check to see if the client requested a refresh token.
@@ -216,6 +210,13 @@ class LoginRestServlet(RestServlet):
                         "This login method is only valid for application services"
                     )
 
+                if appservice.msc4190_device_management:
+                    raise SynapseError(
+                        400,
+                        "This appservice has MSC4190 enabled, so appservice login cannot be used.",
+                        errcode=Codes.APPSERVICE_LOGIN_UNSUPPORTED,
+                    )
+
                 if appservice.is_rate_limited():
                     await self._address_ratelimiter.ratelimit(
                         None, request.getClientAddress().host
@@ -363,13 +364,13 @@ class LoginRestServlet(RestServlet):
         self,
         user_id: str,
         login_submission: JsonDict,
-        callback: Optional[Callable[[LoginResponse], Awaitable[None]]] = None,
+        callback: Callable[[LoginResponse], Awaitable[None]] | None = None,
         create_non_existent_users: bool = False,
-        default_display_name: Optional[str] = None,
+        default_display_name: str | None = None,
         ratelimit: bool = True,
-        auth_provider_id: Optional[str] = None,
+        auth_provider_id: str | None = None,
         should_issue_refresh_token: bool = False,
-        auth_provider_session_id: Optional[str] = None,
+        auth_provider_session_id: str | None = None,
         should_check_deactivated_or_locked: bool = True,
         *,
         request_info: RequestInfo,
@@ -595,7 +596,7 @@ class RefreshTokenServlet(RestServlet):
         )
         self.refresh_token_lifetime = hs.config.registration.refresh_token_lifetime
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         refresh_submission = parse_json_object_from_request(request)
 
         assert_params_in_dict(refresh_submission, ["refresh_token"])
@@ -619,7 +620,7 @@ class RefreshTokenServlet(RestServlet):
             token, access_valid_until_ms, refresh_valid_until_ms
         )
 
-        response: Dict[str, Union[str, int]] = {
+        response: dict[str, str | int] = {
             "access_token": access_token,
             "refresh_token": refresh_token,
         }
@@ -648,9 +649,7 @@ class SsoRedirectServlet(RestServlet):
         self._sso_handler = hs.get_sso_handler()
         self._public_baseurl = hs.config.server.public_baseurl
 
-    async def on_GET(
-        self, request: SynapseRequest, idp_id: Optional[str] = None
-    ) -> None:
+    async def on_GET(self, request: SynapseRequest, idp_id: str | None = None) -> None:
         if not self._public_baseurl:
             raise SynapseError(400, "SSO requires a valid public_baseurl")
 
@@ -677,13 +676,28 @@ class SsoRedirectServlet(RestServlet):
             finish_request(request)
             return
 
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         client_redirect_url = parse_bytes_from_args(args, "redirectUrl", required=True)
-        sso_url = await self._sso_handler.handle_redirect_request(
-            request,
-            client_redirect_url,
-            idp_id,
-        )
+        try:
+            sso_url = await self._sso_handler.handle_redirect_request(
+                request,
+                client_redirect_url,
+                idp_id,
+            )
+        except SsoSetupError:
+            logger.exception(
+                "Login redirect failed because SSO/identity provider %r unavailable",
+                idp_id,
+            )
+            # Show an error page that is slightly more friendly than JSON
+            self._sso_handler.render_error(
+                request,
+                "provider_unavailable",
+                "This login provider is currently unavailable on this homeserver.",
+                code=503,
+            )
+            return
+
         logger.info("Redirecting to %s", sso_url)
         request.redirect(sso_url)
         finish_request(request)
diff --git a/synapse/rest/client/login_token_request.py b/synapse/rest/client/login_token_request.py
index a053db8e55..f455e9c0b7 100644
--- a/synapse/rest/client/login_token_request.py
+++ b/synapse/rest/client/login_token_request.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.ratelimiting import Ratelimiter
 from synapse.config.ratelimiting import RatelimitSettings
@@ -89,7 +89,7 @@ class LoginTokenRequestServlet(RestServlet):
         )
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         body = parse_json_object_from_request(request)
 
diff --git a/synapse/rest/client/logout.py b/synapse/rest/client/logout.py
index 39c62b9e26..d804552a4a 100644
--- a/synapse/rest/client/logout.py
+++ b/synapse/rest/client/logout.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http.server import HttpServer
 from synapse.http.servlet import RestServlet
@@ -43,7 +43,7 @@ class LogoutRestServlet(RestServlet):
         self._auth_handler = hs.get_auth_handler()
         self._device_handler = hs.get_device_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(
             request, allow_expired=True, allow_locked=True
         )
@@ -70,7 +70,7 @@ class LogoutAllRestServlet(RestServlet):
         self._auth_handler = hs.get_auth_handler()
         self._device_handler = hs.get_device_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(
             request, allow_expired=True, allow_locked=True
         )
diff --git a/synapse/rest/client/matrixrtc.py b/synapse/rest/client/matrixrtc.py
new file mode 100644
index 0000000000..22f8498f2f
--- /dev/null
+++ b/synapse/rest/client/matrixrtc.py
@@ -0,0 +1,52 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+# [This file includes modifications made by New Vector Limited]
+#
+#
+
+from typing import TYPE_CHECKING
+
+from synapse.http.server import HttpServer
+from synapse.http.servlet import RestServlet
+from synapse.http.site import SynapseRequest
+from synapse.rest.client._base import client_patterns
+from synapse.types import JsonDict
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
+
+
+class MatrixRTCRestServlet(RestServlet):
+    PATTERNS = client_patterns(r"/org\.matrix\.msc4143/rtc/transports$", releases=())
+    CATEGORY = "Client API requests"
+
+    def __init__(self, hs: "HomeServer"):
+        super().__init__()
+        self._hs = hs
+        self._auth = hs.get_auth()
+        self._transports = hs.config.matrix_rtc.transports
+
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        # Require authentication for this endpoint.
+        await self._auth.get_user_by_req(request)
+
+        if self._transports:
+            return 200, {"rtc_transports": self._transports}
+
+        return 200, {}
+
+
+def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
+    if hs.config.experimental.msc4143_enabled:
+        MatrixRTCRestServlet(hs).register(http_server)
diff --git a/synapse/rest/client/media.py b/synapse/rest/client/media.py
index 4c044ae900..4db3b01576 100644
--- a/synapse/rest/client/media.py
+++ b/synapse/rest/client/media.py
@@ -22,8 +22,8 @@
 
 import logging
 import re
-from typing import Optional
 
+from synapse.api.errors import Codes, cs_error
 from synapse.http.server import (
     HttpServer,
     respond_with_json,
@@ -231,12 +231,28 @@ class DownloadResource(RestServlet):
         request: SynapseRequest,
         server_name: str,
         media_id: str,
-        file_name: Optional[str] = None,
+        file_name: str | None = None,
     ) -> None:
         # Validate the server name, raising if invalid
         parse_and_validate_server_name(server_name)
 
-        await self.auth.get_user_by_req(request, allow_guest=True)
+        requester = await self.auth.get_user_by_req(request, allow_guest=True)
+        is_admin = await self.auth.is_server_admin(requester)
+        bypass_quarantine = False
+        if parse_string(request, "admin_unsafely_bypass_quarantine") == "true":
+            if is_admin:
+                logger.info("Admin bypassing quarantine for media download")
+                bypass_quarantine = True
+            else:
+                respond_with_json(
+                    request,
+                    400,
+                    cs_error(
+                        "Must be a server admin to bypass quarantine",
+                        code=Codes.UNKNOWN,
+                    ),
+                    send_cors=True,
+                )
 
         set_cors_headers(request)
         set_corp_headers(request)
@@ -260,7 +276,11 @@ class DownloadResource(RestServlet):
 
         if self._is_mine_server_name(server_name):
             await self.media_repo.get_local_media(
-                request, media_id, file_name, max_timeout_ms
+                request,
+                media_id,
+                file_name,
+                max_timeout_ms,
+                bypass_quarantine=bypass_quarantine,
             )
         else:
             ip_address = request.getClientAddress().host
@@ -272,6 +292,7 @@ class DownloadResource(RestServlet):
                 max_timeout_ms,
                 ip_address,
                 True,
+                bypass_quarantine=bypass_quarantine,
             )
 
 
diff --git a/synapse/rest/client/mutual_rooms.py b/synapse/rest/client/mutual_rooms.py
index abb1fab0a3..d6783c15da 100644
--- a/synapse/rest/client/mutual_rooms.py
+++ b/synapse/rest/client/mutual_rooms.py
@@ -19,14 +19,17 @@
 #
 #
 import logging
+from bisect import bisect
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Dict, List, Tuple
+from typing import TYPE_CHECKING
+
+from unpaddedbase64 import decode_base64, encode_base64
 
 from synapse.api.errors import Codes, SynapseError
 from synapse.http.server import HttpServer
 from synapse.http.servlet import RestServlet, parse_strings_from_args
 from synapse.http.site import SynapseRequest
-from synapse.types import JsonDict
+from synapse.types import JsonDict, UserID
 
 from ._base import client_patterns
 
@@ -35,27 +38,51 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+MUTUAL_ROOMS_BATCH_LIMIT = 100
+
+
+def _parse_mutual_rooms_batch_token_args(args: dict[bytes, list[bytes]]) -> str | None:
+    from_batches = parse_strings_from_args(args, "from")
+    if not from_batches:
+        return None
+    if len(from_batches) > 1:
+        raise SynapseError(
+            HTTPStatus.BAD_REQUEST,
+            "Duplicate from query parameter",
+            errcode=Codes.INVALID_PARAM,
+        )
+    if from_batches[0]:
+        try:
+            return decode_base64(from_batches[0]).decode("utf-8")
+        except Exception:
+            raise SynapseError(
+                HTTPStatus.BAD_REQUEST,
+                "Malformed from token",
+                errcode=Codes.INVALID_PARAM,
+            )
+    return None
+
 
 class UserMutualRoomsServlet(RestServlet):
     """
-    GET /uk.half-shot.msc2666/user/mutual_rooms?user_id={user_id} HTTP/1.1
+    GET /mutual_rooms?user_id={user_id}&from={token} HTTP/1.1
     """
 
-    PATTERNS = client_patterns(
-        "/uk.half-shot.msc2666/user/mutual_rooms$",
-        releases=(),  # This is an unstable feature
-    )
+    PATTERNS = [*client_patterns("/mutual_rooms$", releases=("v1",))]
 
     def __init__(self, hs: "HomeServer"):
         super().__init__()
         self.auth = hs.get_auth()
         self.store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        # twisted.web.server.Request.args is incorrectly defined as Optional[Any]
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        # twisted.web.server.Request.args is incorrectly defined as Any | None
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
 
-        user_ids = parse_strings_from_args(args, "user_id", required=True)
+        user_ids = parse_strings_from_args(
+            args, "user_id", required=True, encoding="utf-8"
+        )
+        from_batch = _parse_mutual_rooms_batch_token_args(args)
 
         if len(user_ids) > 1:
             raise SynapseError(
@@ -64,29 +91,63 @@ class UserMutualRoomsServlet(RestServlet):
                 errcode=Codes.INVALID_PARAM,
             )
 
-        # We don't do batching, so a batch token is illegal by default
-        if b"batch_token" in args:
+        user_id = user_ids[0]
+        if not UserID.is_valid_strict(user_id):
             raise SynapseError(
                 HTTPStatus.BAD_REQUEST,
-                "Unknown batch_token",
+                "Invalid user_id query parameter",
                 errcode=Codes.INVALID_PARAM,
             )
 
-        user_id = user_ids[0]
-
         requester = await self.auth.get_user_by_req(request)
         if user_id == requester.user.to_string():
             raise SynapseError(
-                HTTPStatus.UNPROCESSABLE_ENTITY,
+                HTTPStatus.BAD_REQUEST,
                 "You cannot request a list of shared rooms with yourself",
                 errcode=Codes.INVALID_PARAM,
             )
 
-        rooms = await self.store.get_mutual_rooms_between_users(
-            frozenset((requester.user.to_string(), user_id))
+        # Sort here instead of the database function, so that we don't expose
+        # clients to any unrelated changes to the sorting algorithm.
+        rooms = sorted(
+            await self.store.get_mutual_rooms_between_users(
+                frozenset((requester.user.to_string(), user_id))
+            )
         )
+        total_count = len(rooms)
 
-        return 200, {"joined": list(rooms)}
+        if from_batch:
+            # A from_batch token was provided, so cut off any rooms where the ID is
+            # lower than or equal to the token. This method doesn't care whether the
+            # provided token room still exists, nor whether it's even a real room ID.
+            #
+            # However, if rooms with a lower ID are added after the token was issued,
+            # they will not be included until the client makes a new request without a
+            # from token. This is considered acceptable, as clients generally won't
+            # persist these results for long periods.
+            rooms = rooms[bisect(rooms, from_batch) :]
+
+        if len(rooms) <= MUTUAL_ROOMS_BATCH_LIMIT:
+            # We've reached the end of the list, don't return a batch token
+            return 200, {"joined": rooms, "count": total_count}
+
+        rooms = rooms[:MUTUAL_ROOMS_BATCH_LIMIT]
+        # We use urlsafe unpadded base64 encoding for the batch token in order to
+        # handle funny room IDs in old pre-v12 rooms properly. We also truncate it
+        # to stay within the 255-character limit of opaque tokens.
+        next_batch = encode_base64(rooms[-1].encode("utf-8"), urlsafe=True)[:255]
+        # Due to the truncation, it is technically possible to have conflicting next
+        # batches by creating hundreds of rooms with the same 191 character prefix
+        # in the room ID. In the event that some silly user does that, don't let
+        # them paginate further.
+        if next_batch == from_batch:
+            return 200, {"joined": rooms, "count": total_count}
+
+        return 200, {
+            "joined": rooms,
+            "next_batch": next_batch,
+            "count": total_count,
+        }
 
 
 def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
diff --git a/synapse/rest/client/notifications.py b/synapse/rest/client/notifications.py
index 168ce50d3f..2420e9fffb 100644
--- a/synapse/rest/client/notifications.py
+++ b/synapse/rest/client/notifications.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import ReceiptTypes
 from synapse.events.utils import (
@@ -53,7 +53,7 @@ class NotificationsServlet(RestServlet):
         self.clock = hs.get_clock()
         self._event_serializer = hs.get_event_client_serializer()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
 
diff --git a/synapse/rest/client/openid.py b/synapse/rest/client/openid.py
index a2c2faa199..e624a48ce7 100644
--- a/synapse/rest/client/openid.py
+++ b/synapse/rest/client/openid.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import AuthError
 from synapse.http.server import HttpServer
@@ -80,7 +80,7 @@ class IdTokenServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot request tokens for other users.")
diff --git a/synapse/rest/client/password_policy.py b/synapse/rest/client/password_policy.py
index 7ec6dd3443..314c409fc2 100644
--- a/synapse/rest/client/password_policy.py
+++ b/synapse/rest/client/password_policy.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -46,7 +46,7 @@ class PasswordPolicyServlet(RestServlet):
         self.policy = hs.config.auth.password_policy
         self.enabled = hs.config.auth.password_policy_enabled
 
-    def on_GET(self, request: Request) -> Tuple[int, JsonDict]:
+    def on_GET(self, request: Request) -> tuple[int, JsonDict]:
         if not self.enabled or not self.policy:
             return 200, {}
 
diff --git a/synapse/rest/client/presence.py b/synapse/rest/client/presence.py
index 104d54cd89..de3ffdaa0b 100644
--- a/synapse/rest/client/presence.py
+++ b/synapse/rest/client/presence.py
@@ -22,7 +22,7 @@
 """This module contains REST servlets to do with presence: /presence/<paths>"""
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import AuthError, Codes, LimitExceededError, SynapseError
 from synapse.api.ratelimiting import Ratelimiter
@@ -60,7 +60,7 @@ class PresenceStatusRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user = UserID.from_string(user_id)
 
@@ -84,7 +84,7 @@ class PresenceStatusRestServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user = UserID.from_string(user_id)
 
diff --git a/synapse/rest/client/profile.py b/synapse/rest/client/profile.py
index 243245f739..c2ec5b3611 100644
--- a/synapse/rest/client/profile.py
+++ b/synapse/rest/client/profile.py
@@ -23,7 +23,7 @@
 
 import re
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import ProfileFields
 from synapse.api.errors import Codes, SynapseError
@@ -69,7 +69,7 @@ class ProfileRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester_user = None
 
         if self.hs.config.server.require_auth_for_profile_requests:
@@ -109,10 +109,16 @@ class ProfileFieldRestServlet(RestServlet):
         self.hs = hs
         self.profile_handler = hs.get_profile_handler()
         self.auth = hs.get_auth()
+        if hs.config.experimental.msc4133_enabled:
+            self.PATTERNS.append(
+                re.compile(
+                    r"^/_matrix/client/unstable/uk\.tcpip\.msc4133/profile/(?P<user_id>[^/]*)/(?P<field_name>[^/]*)"
+                )
+            )
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str, field_name: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester_user = None
 
         if self.hs.config.server.require_auth_for_profile_requests:
@@ -150,7 +156,7 @@ class ProfileFieldRestServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str, field_name: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         if not UserID.is_valid(user_id):
             raise SynapseError(
                 HTTPStatus.BAD_REQUEST, "Invalid user id", Codes.INVALID_PARAM
@@ -200,22 +206,22 @@ class ProfileFieldRestServlet(RestServlet):
 
         if field_name == ProfileFields.DISPLAYNAME:
             await self.profile_handler.set_displayname(
-                user, requester, new_value, is_admin, propagate=propagate
+                user, requester, new_value, by_admin=is_admin, propagate=propagate
             )
         elif field_name == ProfileFields.AVATAR_URL:
             await self.profile_handler.set_avatar_url(
-                user, requester, new_value, is_admin, propagate=propagate
+                user, requester, new_value, by_admin=is_admin, propagate=propagate
             )
         else:
             await self.profile_handler.set_profile_field(
-                user, requester, field_name, new_value, is_admin
+                user, requester, field_name, new_value, by_admin=is_admin
             )
 
         return 200, {}
 
     async def on_DELETE(
         self, request: SynapseRequest, user_id: str, field_name: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         if not UserID.is_valid(user_id):
             raise SynapseError(
                 HTTPStatus.BAD_REQUEST, "Invalid user id", Codes.INVALID_PARAM
@@ -257,15 +263,15 @@ class ProfileFieldRestServlet(RestServlet):
 
         if field_name == ProfileFields.DISPLAYNAME:
             await self.profile_handler.set_displayname(
-                user, requester, "", is_admin, propagate=propagate
+                user, requester, "", by_admin=is_admin, propagate=propagate
             )
         elif field_name == ProfileFields.AVATAR_URL:
             await self.profile_handler.set_avatar_url(
-                user, requester, "", is_admin, propagate=propagate
+                user, requester, "", by_admin=is_admin, propagate=propagate
             )
         else:
             await self.profile_handler.delete_profile_field(
-                user, requester, field_name, is_admin
+                user, requester, field_name, by_admin=is_admin
             )
 
         return 200, {}
diff --git a/synapse/rest/client/push_rule.py b/synapse/rest/client/push_rule.py
index af042504c9..39b0cde47b 100644
--- a/synapse/rest/client/push_rule.py
+++ b/synapse/rest/client/push_rule.py
@@ -19,9 +19,11 @@
 #
 #
 
-from typing import TYPE_CHECKING, List, Tuple, Union
+from http import HTTPStatus
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import (
+    Codes,
     NotFoundError,
     StoreError,
     SynapseError,
@@ -63,9 +65,9 @@ class PushRuleRestServlet(RestServlet):
             hs.get_instance_name() in hs.config.worker.writers.push_rules
         )
         self._push_rules_handler = hs.get_push_rules_handler()
-        self._push_rule_linearizer = Linearizer(name="push_rules")
+        self._push_rule_linearizer = Linearizer(name="push_rules", clock=hs.get_clock())
 
-    async def on_PUT(self, request: SynapseRequest, path: str) -> Tuple[int, JsonDict]:
+    async def on_PUT(self, request: SynapseRequest, path: str) -> tuple[int, JsonDict]:
         if not self._is_push_worker:
             raise Exception("Cannot handle PUT /push_rules on worker")
 
@@ -77,7 +79,7 @@ class PushRuleRestServlet(RestServlet):
 
     async def handle_put(
         self, request: SynapseRequest, path: str, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         spec = _rule_spec_from_path(path.split("/"))
         try:
             priority_class = _priority_class_from_spec(spec)
@@ -138,7 +140,7 @@ class PushRuleRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, path: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         if not self._is_push_worker:
             raise Exception("Cannot handle DELETE /push_rules on worker")
 
@@ -153,7 +155,7 @@ class PushRuleRestServlet(RestServlet):
         request: SynapseRequest,
         path: str,
         user_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         spec = _rule_spec_from_path(path.split("/"))
 
         namespaced_rule_id = f"global/{spec.template}/{spec.rule_id}"
@@ -168,7 +170,7 @@ class PushRuleRestServlet(RestServlet):
             else:
                 raise
 
-    async def on_GET(self, request: SynapseRequest, path: str) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest, path: str) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         requester.user.to_string()
 
@@ -194,7 +196,7 @@ class PushRuleRestServlet(RestServlet):
             raise UnrecognizedRequestError()
 
 
-def _rule_spec_from_path(path: List[str]) -> RuleSpec:
+def _rule_spec_from_path(path: list[str]) -> RuleSpec:
     """Turn a sequence of path components into a rule spec
 
     Args:
@@ -238,7 +240,16 @@ def _rule_spec_from_path(path: List[str]) -> RuleSpec:
 
 def _rule_tuple_from_request_object(
     rule_template: str, rule_id: str, req_obj: JsonDict
-) -> Tuple[List[JsonDict], List[Union[str, JsonDict]]]:
+) -> tuple[list[JsonDict], list[str | JsonDict]]:
+    if rule_template == "postcontent":
+        # postcontent is from MSC4306, which says that clients
+        # cannot create their own postcontent rules right now.
+        raise SynapseError(
+            HTTPStatus.BAD_REQUEST,
+            "user-defined rules using `postcontent` are not accepted",
+            errcode=Codes.INVALID_PARAM,
+        )
+
     if rule_template in ["override", "underride"]:
         if "conditions" not in req_obj:
             raise InvalidRuleException("Missing 'conditions'")
@@ -268,7 +279,7 @@ def _rule_tuple_from_request_object(
     return conditions, actions
 
 
-def _filter_ruleset_with_path(ruleset: JsonDict, path: List[str]) -> JsonDict:
+def _filter_ruleset_with_path(ruleset: JsonDict, path: list[str]) -> JsonDict:
     if path == []:
         raise UnrecognizedRequestError(
             PushRuleRestServlet.SLIGHTLY_PEDANTIC_TRAILING_SLASH_ERROR
diff --git a/synapse/rest/client/pusher.py b/synapse/rest/client/pusher.py
index a455f95a26..66d7fec07e 100644
--- a/synapse/rest/client/pusher.py
+++ b/synapse/rest/client/pusher.py
@@ -21,7 +21,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import Codes, SynapseError
 from synapse.http.server import HttpServer
@@ -52,7 +52,7 @@ class PushersRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self._store = hs.get_datastores().main
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
 
@@ -85,7 +85,7 @@ class PushersSetRestServlet(RestServlet):
         self.pusher_pool = self.hs.get_pusherpool()
         self._store = hs.get_datastores().main
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
 
diff --git a/synapse/rest/client/read_marker.py b/synapse/rest/client/read_marker.py
index d3d3c7c41d..874e7487bf 100644
--- a/synapse/rest/client/read_marker.py
+++ b/synapse/rest/client/read_marker.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import ReceiptTypes
 from synapse.http.server import HttpServer
@@ -56,7 +56,7 @@ class ReadMarkerRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         await self.presence_handler.bump_presence_active_time(
diff --git a/synapse/rest/client/receipts.py b/synapse/rest/client/receipts.py
index 4bf93f485c..d3a43537bb 100644
--- a/synapse/rest/client/receipts.py
+++ b/synapse/rest/client/receipts.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import MAIN_TIMELINE, ReceiptTypes
 from synapse.api.errors import Codes, SynapseError
@@ -59,7 +59,7 @@ class ReceiptRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str, receipt_type: str, event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         if not RoomID.is_valid(room_id) or not event_id.startswith(EventID.SIGIL):
diff --git a/synapse/rest/client/register.py b/synapse/rest/client/register.py
index 102c04bb67..73832ba7a8 100644
--- a/synapse/rest/client/register.py
+++ b/synapse/rest/client/register.py
@@ -21,7 +21,7 @@
 #
 import logging
 import random
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -59,6 +59,7 @@ from synapse.http.site import SynapseRequest
 from synapse.metrics import SERVER_NAME_LABEL, threepid_send_requests
 from synapse.push.mailer import Mailer
 from synapse.types import JsonDict
+from synapse.util.duration import Duration
 from synapse.util.msisdn import phone_number_to_msisdn
 from synapse.util.ratelimitutils import FederationRateLimiter
 from synapse.util.stringutils import assert_valid_client_secret, random_string
@@ -85,6 +86,7 @@ class EmailRegisterRequestTokenRestServlet(RestServlet):
         self.server_name = hs.hostname
         self.identity_handler = hs.get_identity_handler()
         self.config = hs.config
+        self._registration_enabled = hs.config.registration.enable_registration
 
         if self.hs.config.email.can_verify_email:
             self.registration_mailer = Mailer(
@@ -100,7 +102,7 @@ class EmailRegisterRequestTokenRestServlet(RestServlet):
                 template_text=self.config.email.email_already_in_use_template_text,
             )
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         if not self.hs.config.email.can_verify_email:
             logger.warning(
                 "Email registration has been disabled due to lack of email config"
@@ -108,6 +110,14 @@ class EmailRegisterRequestTokenRestServlet(RestServlet):
             raise SynapseError(
                 400, "Email-based registration has been disabled on this server"
             )
+
+        if not self._registration_enabled:
+            raise SynapseError(
+                403,
+                "Registration is disabled on this homeserver",
+                Codes.FORBIDDEN,
+            )
+
         body = parse_json_object_from_request(request)
 
         assert_params_in_dict(body, ["client_secret", "email", "send_attempt"])
@@ -150,7 +160,9 @@ class EmailRegisterRequestTokenRestServlet(RestServlet):
                 # Also wait for some random amount of time between 100ms and 1s to make it
                 # look like we did something.
                 await self.already_in_use_mailer.send_already_in_use_mail(email)
-                await self.hs.get_clock().sleep(random.randint(1, 10) / 10)
+                await self.hs.get_clock().sleep(
+                    Duration(milliseconds=random.randint(100, 1000))
+                )
                 return 200, {"sid": random_string(16)}
 
             raise SynapseError(400, "Email is already in use", Codes.THREEPID_IN_USE)
@@ -183,7 +195,7 @@ class MsisdnRegisterRequestTokenRestServlet(RestServlet):
         self.server_name = hs.hostname
         self.identity_handler = hs.get_identity_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         body = parse_json_object_from_request(request)
 
         assert_params_in_dict(
@@ -219,7 +231,9 @@ class MsisdnRegisterRequestTokenRestServlet(RestServlet):
                 # comments for request_token_inhibit_3pid_errors.
                 # Also wait for some random amount of time between 100ms and 1s to make it
                 # look like we did something.
-                await self.hs.get_clock().sleep(random.randint(1, 10) / 10)
+                await self.hs.get_clock().sleep(
+                    Duration(milliseconds=random.randint(100, 1000))
+                )
                 return 200, {"sid": random_string(16)}
 
             raise SynapseError(
@@ -352,7 +366,7 @@ class UsernameAvailabilityRestServlet(RestServlet):
             hs.config.registration.inhibit_user_in_use_error
         )
 
-    async def on_GET(self, request: Request) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: Request) -> tuple[int, JsonDict]:
         if not self.hs.config.registration.enable_registration:
             raise SynapseError(
                 403, "Registration has been disabled", errcode=Codes.FORBIDDEN
@@ -402,7 +416,7 @@ class RegistrationTokenValidityRestServlet(RestServlet):
             cfg=hs.config.ratelimiting.rc_registration_token_validity,
         )
 
-    async def on_GET(self, request: Request) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: Request) -> tuple[int, JsonDict]:
         await self.ratelimiter.ratelimit(None, (request.getClientAddress().host,))
 
         if not self.hs.config.registration.enable_registration:
@@ -453,7 +467,7 @@ class RegisterRestServlet(RestServlet):
         )
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         body = parse_json_object_from_request(request)
 
         client_addr = request.getClientAddress().host
@@ -782,8 +796,12 @@ class RegisterRestServlet(RestServlet):
         user_id, appservice = await self.registration_handler.appservice_register(
             username, as_token
         )
-        if appservice.msc4190_device_management:
-            body["inhibit_login"] = True
+        if appservice.msc4190_device_management and not body.get("inhibit_login"):
+            raise SynapseError(
+                400,
+                "This appservice has MSC4190 enabled, so the inhibit_login parameter must be set to true.",
+                errcode=Codes.APPSERVICE_LOGIN_UNSUPPORTED,
+            )
 
         return await self._create_registration_details(
             user_id,
@@ -848,8 +866,8 @@ class RegisterRestServlet(RestServlet):
         return result
 
     async def _do_guest_registration(
-        self, params: JsonDict, address: Optional[str] = None
-    ) -> Tuple[int, JsonDict]:
+        self, params: JsonDict, address: str | None = None
+    ) -> tuple[int, JsonDict]:
         if not self.hs.config.registration.allow_guest_access:
             raise SynapseError(403, "Guest access is disabled")
         user_id = await self.registration_handler.register_user(
@@ -909,7 +927,7 @@ class RegisterAppServiceOnlyRestServlet(RestServlet):
         self.ratelimiter = hs.get_registration_ratelimiter()
 
     @interactive_auth_handler
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         body = parse_json_object_from_request(request)
 
         client_addr = request.getClientAddress().host
@@ -923,6 +941,12 @@ class RegisterAppServiceOnlyRestServlet(RestServlet):
                 "Registration has been disabled. Only m.login.application_service registrations are allowed.",
                 errcode=Codes.FORBIDDEN,
             )
+        if not body.get("inhibit_login"):
+            raise SynapseError(
+                400,
+                "This server uses OAuth2, so the inhibit_login parameter must be set to true for appservice registrations.",
+                errcode=Codes.APPSERVICE_LOGIN_UNSUPPORTED,
+            )
 
         kind = parse_string(request, "kind", default="user")
 
@@ -960,7 +984,7 @@ class RegisterAppServiceOnlyRestServlet(RestServlet):
 
 def _calculate_registration_flows(
     config: HomeServerConfig, auth_handler: AuthHandler
-) -> List[List[str]]:
+) -> list[list[str]]:
     """Get a suitable flows list for registration
 
     Args:
diff --git a/synapse/rest/client/relations.py b/synapse/rest/client/relations.py
index 49943cf0c3..c913bc6970 100644
--- a/synapse/rest/client/relations.py
+++ b/synapse/rest/client/relations.py
@@ -20,7 +20,7 @@
 
 import logging
 import re
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import Direction
 from synapse.handlers.relations import ThreadsListInclude
@@ -61,9 +61,9 @@ class RelationPaginationServlet(RestServlet):
         request: SynapseRequest,
         room_id: str,
         parent_id: str,
-        relation_type: Optional[str] = None,
-        event_type: Optional[str] = None,
-    ) -> Tuple[int, JsonDict]:
+        relation_type: str | None = None,
+        event_type: str | None = None,
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         pagination_config = await PaginationConfig.from_request(
@@ -105,7 +105,7 @@ class ThreadsServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         limit = parse_integer(request, "limit", default=5)
diff --git a/synapse/rest/client/rendezvous.py b/synapse/rest/client/rendezvous.py
index a1808847f0..246788609e 100644
--- a/synapse/rest/client/rendezvous.py
+++ b/synapse/rest/client/rendezvous.py
@@ -20,8 +20,9 @@
 #
 
 import logging
+from http import HTTPStatus
 from http.client import TEMPORARY_REDIRECT
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING, Any
 
 from synapse.http.server import HttpServer, respond_with_redirect
 from synapse.http.servlet import RestServlet
@@ -41,7 +42,7 @@ class MSC4108DelegationRendezvousServlet(RestServlet):
 
     def __init__(self, hs: "HomeServer"):
         super().__init__()
-        redirection_target: Optional[str] = (
+        redirection_target: str | None = (
             hs.config.experimental.msc4108_delegation_endpoint
         )
         assert redirection_target is not None, (
@@ -68,9 +69,63 @@ class MSC4108RendezvousServlet(RestServlet):
         self._handler.handle_post(request)
 
 
+class MSC4388CreateRendezvousServlet(RestServlet):
+    PATTERNS = client_patterns(
+        "/io.element.msc4388/rendezvous$", releases=[], v1=False, unstable=True
+    )
+
+    def __init__(self, hs: "HomeServer") -> None:
+        super().__init__()
+        self._handler = hs.get_msc4388_rendezvous_handler()
+        self.auth = hs.get_auth()
+        self.require_authentication = (
+            hs.config.experimental.msc4388_requires_authentication
+        )
+
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, Any]:
+        if self.require_authentication:
+            # This will raise if the user is not authenticated
+            await self.auth.get_user_by_req(request)
+        return HTTPStatus.OK, {"create_available": True}
+
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, Any]:
+        if self.require_authentication:
+            # This will raise if the user is not authenticated
+            await self.auth.get_user_by_req(request)
+        return self._handler.handle_post(request)
+
+
+class MSC4388UpdateRendezvousServlet(RestServlet):
+    PATTERNS = client_patterns(
+        "/io.element.msc4388/rendezvous/(?P<rendezvous_id>[^/]+)$",
+        releases=[],
+        v1=False,
+        unstable=True,
+    )
+
+    def __init__(self, hs: "HomeServer") -> None:
+        super().__init__()
+        self._handler = hs.get_msc4388_rendezvous_handler()
+
+    def on_GET(self, request: SynapseRequest, rendezvous_id: str) -> tuple[int, Any]:
+        return self._handler.handle_get(rendezvous_id, request)
+
+    def on_PUT(self, request: SynapseRequest, rendezvous_id: str) -> tuple[int, Any]:
+        return self._handler.handle_put(rendezvous_id, request)
+
+    def on_DELETE(
+        self, _request: SynapseRequest, rendezvous_id: str
+    ) -> tuple[int, Any]:
+        return self._handler.handle_delete(rendezvous_id)
+
+
 def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
     if hs.config.experimental.msc4108_enabled:
         MSC4108RendezvousServlet(hs).register(http_server)
 
     if hs.config.experimental.msc4108_delegation_endpoint is not None:
         MSC4108DelegationRendezvousServlet(hs).register(http_server)
+
+    if hs.config.experimental.msc4388_enabled:
+        MSC4388CreateRendezvousServlet(hs).register(http_server)
+        MSC4388UpdateRendezvousServlet(hs).register(http_server)
diff --git a/synapse/rest/client/reporting.py b/synapse/rest/client/reporting.py
index 81faf38a7f..0c594b9f3f 100644
--- a/synapse/rest/client/reporting.py
+++ b/synapse/rest/client/reporting.py
@@ -21,9 +21,10 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
+
+from pydantic import StrictStr
 
-from synapse._pydantic_compat import StrictStr
 from synapse.api.errors import AuthError, Codes, NotFoundError, SynapseError
 from synapse.http.server import HttpServer
 from synapse.http.servlet import (
@@ -57,7 +58,7 @@ class ReportEventRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str, event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
 
@@ -138,7 +139,7 @@ class ReportRoomRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
 
@@ -191,7 +192,7 @@ class ReportUserRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, target_user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
 
diff --git a/synapse/rest/client/room.py b/synapse/rest/client/room.py
index 64deae7650..65d9c130ef 100644
--- a/synapse/rest/client/room.py
+++ b/synapse/rest/client/room.py
@@ -25,15 +25,22 @@ import logging
 import re
 from enum import Enum
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Awaitable, Dict, List, Optional, Tuple
+from typing import TYPE_CHECKING, Awaitable
 from urllib import parse as urlparse
 
+import attr
 from prometheus_client.core import Histogram
 
 from twisted.web.server import Request
 
 from synapse import event_auth
-from synapse.api.constants import Direction, EventTypes, Membership
+from synapse.api.constants import (
+    Direction,
+    EventTypes,
+    Membership,
+    StickyEvent,
+    StickyEventField,
+)
 from synapse.api.errors import (
     AuthError,
     Codes,
@@ -45,10 +52,11 @@ from synapse.api.errors import (
 )
 from synapse.api.filtering import Filter
 from synapse.events.utils import (
+    EventClientSerializer,
     SerializeEventConfig,
     format_event_for_client_v2,
-    serialize_event,
 )
+from synapse.handlers.pagination import GetMessagesResult
 from synapse.http.server import HttpServer
 from synapse.http.servlet import (
     ResolveRoomIdMixin,
@@ -64,16 +72,17 @@ from synapse.http.servlet import (
 )
 from synapse.http.site import SynapseRequest
 from synapse.logging.context import make_deferred_yieldable, run_in_background
-from synapse.logging.opentracing import set_tag
+from synapse.logging.opentracing import set_tag, trace
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.rest.client._base import client_patterns
 from synapse.rest.client.transactions import HttpTransactionCache
 from synapse.state import CREATE_KEY, POWER_KEY
+from synapse.storage.databases.main import DataStore
 from synapse.streams.config import PaginationConfig
 from synapse.types import JsonDict, Requester, StreamToken, ThirdPartyInstanceID, UserID
 from synapse.types.state import StateFilter
 from synapse.util.cancellation import cancellable
+from synapse.util.clock import Clock
 from synapse.util.events import generate_fake_event_id
 from synapse.util.stringutils import parse_and_validate_server_name
 
@@ -167,20 +176,20 @@ class RoomCreateRestServlet(TransactionRestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         set_tag("txn_id", txn_id)
         return await self.txns.fetch_or_execute_request(
             request, requester, self._do, request, requester
         )
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         return await self._do(request, requester)
 
     async def _do(
         self, request: SynapseRequest, requester: Requester
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         room_id, _, _ = await self._room_creation_handler.create_room(
             requester, self.get_room_config(request)
         )
@@ -204,8 +213,10 @@ class RoomStateEventRestServlet(RestServlet):
         self.delayed_events_handler = hs.get_delayed_events_handler()
         self.auth = hs.get_auth()
         self.clock = hs.get_clock()
+        self._event_serializer = hs.get_event_client_serializer()
         self._max_event_delay_ms = hs.config.server.max_event_delay_ms
         self._spam_checker_module_callbacks = hs.get_module_api_callbacks().spam_checker
+        self._msc4354_enabled = hs.config.experimental.msc4354_enabled
 
     def register(self, http_server: HttpServer) -> None:
         # /rooms/$roomid/state/$eventtype
@@ -245,18 +256,18 @@ class RoomStateEventRestServlet(RestServlet):
     @cancellable
     def on_GET_no_state_key(
         self, request: SynapseRequest, room_id: str, event_type: str
-    ) -> Awaitable[Tuple[int, JsonDict]]:
+    ) -> Awaitable[tuple[int, JsonDict]]:
         return self.on_GET(request, room_id, event_type, "")
 
     def on_PUT_no_state_key(
         self, request: SynapseRequest, room_id: str, event_type: str
-    ) -> Awaitable[Tuple[int, JsonDict]]:
+    ) -> Awaitable[tuple[int, JsonDict]]:
         return self.on_PUT(request, room_id, event_type, "")
 
     @cancellable
     async def on_GET(
         self, request: SynapseRequest, room_id: str, event_type: str, state_key: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         format = parse_string(
             request, "format", default="content", allowed_values=["content", "event"]
@@ -274,7 +285,7 @@ class RoomStateEventRestServlet(RestServlet):
             raise SynapseError(404, "Event not found.", errcode=Codes.NOT_FOUND)
 
         if format == "event":
-            event = serialize_event(
+            event = await self._event_serializer.serialize_event(
                 data,
                 self.clock.time_msec(),
                 config=SerializeEventConfig(
@@ -295,8 +306,8 @@ class RoomStateEventRestServlet(RestServlet):
         room_id: str,
         event_type: str,
         state_key: str,
-        txn_id: Optional[str] = None,
-    ) -> Tuple[int, JsonDict]:
+        txn_id: str | None = None,
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         if txn_id:
@@ -327,6 +338,10 @@ class RoomStateEventRestServlet(RestServlet):
         if requester.app_service:
             origin_server_ts = parse_integer(request, "ts")
 
+        sticky_duration_ms: int | None = None
+        if self._msc4354_enabled:
+            sticky_duration_ms = parse_integer(request, StickyEvent.QUERY_PARAM_NAME)
+
         delay = _parse_request_delay(request, self._max_event_delay_ms)
         if delay is not None:
             delay_id = await self.delayed_events_handler.add(
@@ -337,6 +352,7 @@ class RoomStateEventRestServlet(RestServlet):
                 origin_server_ts=origin_server_ts,
                 content=content,
                 delay=delay,
+                sticky_duration_ms=sticky_duration_ms,
             )
 
             set_tag("delay_id", delay_id)
@@ -364,6 +380,10 @@ class RoomStateEventRestServlet(RestServlet):
                     "room_id": room_id,
                     "sender": requester.user.to_string(),
                 }
+                if sticky_duration_ms is not None:
+                    event_dict[StickyEvent.EVENT_FIELD_NAME] = StickyEventField(
+                        duration_ms=sticky_duration_ms
+                    )
 
                 if state_key is not None:
                     event_dict["state_key"] = state_key
@@ -396,6 +416,7 @@ class RoomSendEventRestServlet(TransactionRestServlet):
         self.delayed_events_handler = hs.get_delayed_events_handler()
         self.auth = hs.get_auth()
         self._max_event_delay_ms = hs.config.server.max_event_delay_ms
+        self._msc4354_enabled = hs.config.experimental.msc4354_enabled
 
     def register(self, http_server: HttpServer) -> None:
         # /rooms/$roomid/send/$event_type[/$txn_id]
@@ -408,14 +429,18 @@ class RoomSendEventRestServlet(TransactionRestServlet):
         requester: Requester,
         room_id: str,
         event_type: str,
-        txn_id: Optional[str],
-    ) -> Tuple[int, JsonDict]:
+        txn_id: str | None,
+    ) -> tuple[int, JsonDict]:
         content = parse_json_object_from_request(request)
 
         origin_server_ts = None
         if requester.app_service:
             origin_server_ts = parse_integer(request, "ts")
 
+        sticky_duration_ms: int | None = None
+        if self._msc4354_enabled:
+            sticky_duration_ms = parse_integer(request, StickyEvent.QUERY_PARAM_NAME)
+
         delay = _parse_request_delay(request, self._max_event_delay_ms)
         if delay is not None:
             delay_id = await self.delayed_events_handler.add(
@@ -426,6 +451,7 @@ class RoomSendEventRestServlet(TransactionRestServlet):
                 origin_server_ts=origin_server_ts,
                 content=content,
                 delay=delay,
+                sticky_duration_ms=sticky_duration_ms,
             )
 
             set_tag("delay_id", delay_id)
@@ -442,6 +468,11 @@ class RoomSendEventRestServlet(TransactionRestServlet):
         if origin_server_ts is not None:
             event_dict["origin_server_ts"] = origin_server_ts
 
+        if sticky_duration_ms is not None:
+            event_dict[StickyEvent.EVENT_FIELD_NAME] = StickyEventField(
+                duration_ms=sticky_duration_ms
+            )
+
         try:
             (
                 event,
@@ -461,13 +492,13 @@ class RoomSendEventRestServlet(TransactionRestServlet):
         request: SynapseRequest,
         room_id: str,
         event_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         return await self._do(request, requester, room_id, event_type, None)
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str, event_type: str, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         set_tag("txn_id", txn_id)
 
@@ -485,8 +516,8 @@ class RoomSendEventRestServlet(TransactionRestServlet):
 
 def _parse_request_delay(
     request: SynapseRequest,
-    max_delay: Optional[int],
-) -> Optional[int]:
+    max_delay: int | None,
+) -> int | None:
     """Parses from the request string the delay parameter for
         delayed event requests, and checks it for correctness.
 
@@ -545,12 +576,12 @@ class JoinRoomAliasServlet(ResolveRoomIdMixin, TransactionRestServlet):
         request: SynapseRequest,
         requester: Requester,
         room_identifier: str,
-        txn_id: Optional[str],
-    ) -> Tuple[int, JsonDict]:
+        txn_id: str | None,
+    ) -> tuple[int, JsonDict]:
         content = parse_json_object_from_request(request, allow_empty_body=True)
 
-        # twisted.web.server.Request.args is incorrectly defined as Optional[Any]
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        # twisted.web.server.Request.args is incorrectly defined as Any | None
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         # Prefer via over server_name (deprecated with MSC4156)
         remote_room_hosts = parse_strings_from_args(args, "via", required=False)
         if remote_room_hosts is None:
@@ -579,13 +610,13 @@ class JoinRoomAliasServlet(ResolveRoomIdMixin, TransactionRestServlet):
         self,
         request: SynapseRequest,
         room_identifier: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         return await self._do(request, requester, room_identifier, None)
 
     async def on_PUT(
         self, request: SynapseRequest, room_identifier: str, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         set_tag("txn_id", txn_id)
 
@@ -604,7 +635,7 @@ class PublicRoomListRestServlet(RestServlet):
         self.hs = hs
         self.auth = hs.get_auth()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         server = parse_string(request, "server")
 
         try:
@@ -624,7 +655,7 @@ class PublicRoomListRestServlet(RestServlet):
             if server:
                 raise e
 
-        limit: Optional[int] = parse_integer(request, "limit", 0)
+        limit: int | None = parse_integer(request, "limit", 0)
         since_token = parse_string(request, "since")
 
         if limit == 0:
@@ -653,13 +684,13 @@ class PublicRoomListRestServlet(RestServlet):
 
         return 200, data
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await self.auth.get_user_by_req(request, allow_guest=True)
 
         server = parse_string(request, "server")
         content = parse_json_object_from_request(request)
 
-        limit: Optional[int] = int(content.get("limit", 100))
+        limit: int | None = int(content.get("limit", 100))
         since_token = content.get("since", None)
         search_filter = content.get("filter", None)
 
@@ -727,7 +758,7 @@ class RoomMemberListRestServlet(RestServlet):
     @cancellable
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         # TODO support Pagination stream API (limit/tokens)
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         handler = self.message_handler
@@ -781,7 +812,7 @@ class JoinedRoomMemberListRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         users_with_profile = await self.message_handler.get_joined_members(
@@ -791,6 +822,56 @@ class JoinedRoomMemberListRestServlet(RestServlet):
         return 200, {"joined": users_with_profile}
 
 
+@attr.s(slots=True, frozen=True, auto_attribs=True)
+class SerializeMessagesDeps:
+    clock: Clock
+    event_serializer: EventClientSerializer
+    store: DataStore
+
+
+@trace
+async def encode_messages_response(
+    *,
+    get_messages_result: GetMessagesResult,
+    serialize_options: SerializeEventConfig,
+    serialize_deps: SerializeMessagesDeps,
+) -> JsonDict:
+    """
+    Serialize a `GetMessagesResult` into the JSON response format for the `/messages`
+    endpoint.
+
+    This logic is shared between the client API and Synapse admin API.
+    """
+
+    time_now = serialize_deps.clock.time_msec()
+
+    serialized_result = {
+        "chunk": (
+            await serialize_deps.event_serializer.serialize_events(
+                get_messages_result.messages_chunk,
+                time_now,
+                config=serialize_options,
+                bundle_aggregations=get_messages_result.bundled_aggregations,
+            )
+        ),
+        "start": await get_messages_result.start_token.to_string(serialize_deps.store),
+    }
+
+    if get_messages_result.end_token is not None:
+        serialized_result["end"] = await get_messages_result.end_token.to_string(
+            serialize_deps.store
+        )
+
+    if get_messages_result.state is not None:
+        serialized_result[
+            "state"
+        ] = await serialize_deps.event_serializer.serialize_events(
+            get_messages_result.state, time_now, config=serialize_options
+        )
+
+    return serialized_result
+
+
 # TODO: Needs better unit testing
 class RoomMessageListRestServlet(RestServlet):
     PATTERNS = client_patterns("/rooms/(?P<room_id>[^/]*)/messages$", v1=True)
@@ -807,10 +888,11 @@ class RoomMessageListRestServlet(RestServlet):
         self.pagination_handler = hs.get_pagination_handler()
         self.auth = hs.get_auth()
         self.store = hs.get_datastores().main
+        self.event_serializer = hs.get_event_client_serializer()
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         processing_start_time = self.clock.time_msec()
         # Fire off and hope that we get a result by the end.
         #
@@ -840,7 +922,11 @@ class RoomMessageListRestServlet(RestServlet):
         ):
             as_client_event = False
 
-        msgs = await self.pagination_handler.get_messages(
+        serialize_options = SerializeEventConfig(
+            as_client_event=as_client_event, requester=requester
+        )
+
+        get_messages_result = await self.pagination_handler.get_messages(
             room_id=room_id,
             requester=requester,
             pagin_config=pagination_config,
@@ -848,6 +934,24 @@ class RoomMessageListRestServlet(RestServlet):
             event_filter=event_filter,
         )
 
+        # Useful for debugging timeline/pagination issues. For example, if a client
+        # isn't seeing the full history, we can check the homeserver logs to see if the
+        # client just never made the next request with the given `end` token.
+        logger.info(
+            "Responding to `/messages` request: {%s} %s %s -> %d messages with end_token=%s",
+            requester.user.to_string(),
+            request.get_method(),
+            request.get_redacted_uri(),
+            len(get_messages_result.messages_chunk),
+            (await get_messages_result.end_token.to_string(self.store))
+            if get_messages_result.end_token
+            else None,
+        )
+
+        response_content = await self.encode_response(
+            get_messages_result, serialize_options
+        )
+
         processing_end_time = self.clock.time_msec()
         room_member_count = await make_deferred_yieldable(room_member_count_deferred)
         messsages_response_timer.labels(
@@ -855,7 +959,23 @@ class RoomMessageListRestServlet(RestServlet):
             **{SERVER_NAME_LABEL: self.server_name},
         ).observe((processing_end_time - processing_start_time) / 1000)
 
-        return 200, msgs
+        return 200, response_content
+
+    @trace
+    async def encode_response(
+        self,
+        get_messages_result: GetMessagesResult,
+        serialize_options: SerializeEventConfig,
+    ) -> JsonDict:
+        return await encode_messages_response(
+            get_messages_result=get_messages_result,
+            serialize_options=serialize_options,
+            serialize_deps=SerializeMessagesDeps(
+                clock=self.clock,
+                event_serializer=self.event_serializer,
+                store=self.store,
+            ),
+        )
 
 
 # TODO: Needs unit testing
@@ -871,7 +991,7 @@ class RoomStateRestServlet(RestServlet):
     @cancellable
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, List[JsonDict]]:
+    ) -> tuple[int, list[JsonDict]]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         # Get all the current state for this room
         events = await self.message_handler.get_state_events(
@@ -894,7 +1014,7 @@ class RoomInitialSyncRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         pagination_config = await PaginationConfig.from_request(
             self.store, request, default_limit=10
@@ -926,7 +1046,7 @@ class RoomEventServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str, event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         include_unredacted_content = self.msc2815_enabled and (
@@ -1014,7 +1134,7 @@ class RoomEventContextServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str, event_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         limit = parse_integer(request, "limit", default=10)
@@ -1073,20 +1193,20 @@ class RoomForgetRestServlet(TransactionRestServlet):
         PATTERNS = "/rooms/(?P<room_id>[^/]*)/forget"
         register_txn_path(self, PATTERNS, http_server)
 
-    async def _do(self, requester: Requester, room_id: str) -> Tuple[int, JsonDict]:
+    async def _do(self, requester: Requester, room_id: str) -> tuple[int, JsonDict]:
         await self.room_member_handler.forget(user=requester.user, room_id=room_id)
 
         return 200, {}
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=False)
         return await self._do(requester, room_id)
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=False)
         set_tag("txn_id", txn_id)
 
@@ -1119,8 +1239,8 @@ class RoomMembershipRestServlet(TransactionRestServlet):
         requester: Requester,
         room_id: str,
         membership_action: str,
-        txn_id: Optional[str],
-    ) -> Tuple[int, JsonDict]:
+        txn_id: str | None,
+    ) -> tuple[int, JsonDict]:
         if requester.is_guest and membership_action not in {
             Membership.JOIN,
             Membership.LEAVE,
@@ -1197,13 +1317,13 @@ class RoomMembershipRestServlet(TransactionRestServlet):
         request: SynapseRequest,
         room_id: str,
         membership_action: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         return await self._do(request, requester, room_id, membership_action, None)
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str, membership_action: str, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         set_tag("txn_id", txn_id)
 
@@ -1225,6 +1345,7 @@ class RoomRedactEventRestServlet(TransactionRestServlet):
     def __init__(self, hs: "HomeServer"):
         super().__init__(hs)
         self.server_name = hs.hostname
+        self.hs = hs
         self.event_creation_handler = hs.get_event_creation_handler()
         self.auth = hs.get_auth()
         self._store = hs.get_datastores().main
@@ -1241,8 +1362,8 @@ class RoomRedactEventRestServlet(TransactionRestServlet):
         requester: Requester,
         room_id: str,
         event_id: str,
-        txn_id: Optional[str],
-    ) -> Tuple[int, JsonDict]:
+        txn_id: str | None,
+    ) -> tuple[int, JsonDict]:
         content = parse_json_object_from_request(request)
 
         requester_suspended = await self._store.get_user_suspended_status(
@@ -1307,9 +1428,8 @@ class RoomRedactEventRestServlet(TransactionRestServlet):
                 )
 
                 if with_relations:
-                    run_as_background_process(
+                    self.hs.run_as_background_process(
                         "redact_related_events",
-                        self.server_name,
                         self._relation_handler.redact_events_related_to,
                         requester=requester,
                         event_id=event_id,
@@ -1329,13 +1449,13 @@ class RoomRedactEventRestServlet(TransactionRestServlet):
         request: SynapseRequest,
         room_id: str,
         event_id: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         return await self._do(request, requester, room_id, event_id, None)
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str, event_id: str, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         set_tag("txn_id", txn_id)
 
@@ -1364,7 +1484,7 @@ class RoomTypingRestServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str, user_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         if not self._is_typing_writer:
@@ -1420,7 +1540,7 @@ class RoomAliasListServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         alias_list = await self.directory_handler.get_aliases_for_room(
@@ -1439,7 +1559,7 @@ class SearchRestServlet(RestServlet):
         self.search_handler = hs.get_search_handler()
         self.auth = hs.get_auth()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
 
         content = parse_json_object_from_request(request)
@@ -1459,7 +1579,7 @@ class JoinedRoomsRestServlet(RestServlet):
         self.store = hs.get_datastores().main
         self.auth = hs.get_auth()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
 
         room_ids = await self.store.get_rooms_for_user(requester.user.to_string())
@@ -1534,7 +1654,7 @@ class TimestampLookupRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request)
         await self._auth.check_user_in_room_or_world_readable(room_id, requester)
 
@@ -1567,16 +1687,16 @@ class RoomHierarchyRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request, allow_guest=True)
 
         max_depth = parse_integer(request, "max_depth")
         limit = parse_integer(request, "limit")
 
-        # twisted.web.server.Request.args is incorrectly defined as Optional[Any]
+        # twisted.web.server.Request.args is incorrectly defined as Any | None
         remote_room_hosts = None
         if self.msc4235_enabled:
-            args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+            args: dict[bytes, list[bytes]] = request.args  # type: ignore
             via_param = parse_strings_from_args(
                 args, "org.matrix.msc4235.via", required=False
             )
@@ -1615,16 +1735,16 @@ class RoomSummaryRestServlet(ResolveRoomIdMixin, RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_identifier: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         try:
             requester = await self._auth.get_user_by_req(request, allow_guest=True)
-            requester_user_id: Optional[str] = requester.user.to_string()
+            requester_user_id: str | None = requester.user.to_string()
         except MissingClientTokenError:
             # auth is optional
             requester_user_id = None
 
-        # twisted.web.server.Request.args is incorrectly defined as Optional[Any]
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        # twisted.web.server.Request.args is incorrectly defined as Any | None
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         remote_room_hosts = parse_strings_from_args(args, "via", required=False)
         room_id, remote_room_hosts = await self.resolve_room_id(
             room_identifier,
diff --git a/synapse/rest/client/room_keys.py b/synapse/rest/client/room_keys.py
index 7be08ecb60..b7f7c68d8f 100644
--- a/synapse/rest/client/room_keys.py
+++ b/synapse/rest/client/room_keys.py
@@ -19,7 +19,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional, Tuple, cast
+from typing import TYPE_CHECKING, cast
 
 from synapse.api.errors import Codes, NotFoundError, SynapseError
 from synapse.http.server import HttpServer
@@ -51,8 +51,8 @@ class RoomKeysServlet(RestServlet):
         self.e2e_room_keys_handler = hs.get_e2e_room_keys_handler()
 
     async def on_PUT(
-        self, request: SynapseRequest, room_id: Optional[str], session_id: Optional[str]
-    ) -> Tuple[int, JsonDict]:
+        self, request: SynapseRequest, room_id: str | None, session_id: str | None
+    ) -> tuple[int, JsonDict]:
         """
         Uploads one or more encrypted E2E room keys for backup purposes.
         room_id: the ID of the room the keys are for (optional)
@@ -146,8 +146,8 @@ class RoomKeysServlet(RestServlet):
         return 200, ret
 
     async def on_GET(
-        self, request: SynapseRequest, room_id: Optional[str], session_id: Optional[str]
-    ) -> Tuple[int, JsonDict]:
+        self, request: SynapseRequest, room_id: str | None, session_id: str | None
+    ) -> tuple[int, JsonDict]:
         """
         Retrieves one or more encrypted E2E room keys for backup purposes.
         Symmetric with the PUT version of the API.
@@ -233,8 +233,8 @@ class RoomKeysServlet(RestServlet):
         return 200, room_keys
 
     async def on_DELETE(
-        self, request: SynapseRequest, room_id: Optional[str], session_id: Optional[str]
-    ) -> Tuple[int, JsonDict]:
+        self, request: SynapseRequest, room_id: str | None, session_id: str | None
+    ) -> tuple[int, JsonDict]:
         """
         Deletes one or more encrypted E2E room keys for a user for backup purposes.
 
@@ -267,7 +267,7 @@ class RoomKeysNewVersionServlet(RestServlet):
         self.auth = hs.get_auth()
         self.e2e_room_keys_handler = hs.get_e2e_room_keys_handler()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         """
         Retrieve the version information about the most current backup version (if any)
 
@@ -293,7 +293,7 @@ class RoomKeysNewVersionServlet(RestServlet):
                 raise SynapseError(404, "No backup found", Codes.NOT_FOUND)
         return 200, info
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         """
         Create a new backup version for this user's room_keys with the given
         info.  The version is allocated by the server and returned to the user
@@ -345,7 +345,7 @@ class RoomKeysVersionServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, version: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """
         Retrieve the version information about a given version of the user's
         room_keys backup.
@@ -374,7 +374,7 @@ class RoomKeysVersionServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, version: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """
         Delete the information about a given version of the user's
         room_keys backup. Doesn't delete the actual room data.
@@ -391,7 +391,7 @@ class RoomKeysVersionServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, version: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         """
         Update the information about a given version of the user's room_keys backup.
 
diff --git a/synapse/rest/client/room_upgrade_rest_servlet.py b/synapse/rest/client/room_upgrade_rest_servlet.py
index a9717781b0..1c87b86ecb 100644
--- a/synapse/rest/client/room_upgrade_rest_servlet.py
+++ b/synapse/rest/client/room_upgrade_rest_servlet.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import Codes, ShadowBanError, SynapseError
 from synapse.api.room_versions import KNOWN_ROOM_VERSIONS
@@ -73,7 +73,7 @@ class RoomUpgradeRestServlet(RestServlet):
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self._auth.get_user_by_req(request)
 
         content = parse_json_object_from_request(request)
diff --git a/synapse/rest/client/sendtodevice.py b/synapse/rest/client/sendtodevice.py
index 2a67514560..597cb1fecc 100644
--- a/synapse/rest/client/sendtodevice.py
+++ b/synapse/rest/client/sendtodevice.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http import servlet
 from synapse.http.server import HttpServer
@@ -53,7 +53,7 @@ class SendToDeviceRestServlet(servlet.RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, message_type: str, txn_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request, allow_guest=True)
         set_tag("txn_id", txn_id)
         return await self.txns.fetch_or_execute_request(
@@ -70,7 +70,7 @@ class SendToDeviceRestServlet(servlet.RestServlet):
         request: SynapseRequest,
         requester: Requester,
         message_type: str,
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         content = parse_json_object_from_request(request)
         assert_params_in_dict(content, ("messages",))
 
diff --git a/synapse/rest/client/sync.py b/synapse/rest/client/sync.py
index 5e0596d1bc..710d097eab 100644
--- a/synapse/rest/client/sync.py
+++ b/synapse/rest/client/sync.py
@@ -21,7 +21,9 @@
 import itertools
 import logging
 from collections import defaultdict
-from typing import TYPE_CHECKING, Any, Dict, List, Mapping, Optional, Tuple, Union
+from typing import TYPE_CHECKING, Any, Mapping
+
+import attr
 
 from synapse.api.constants import AccountDataTypes, EduTypes, Membership, PresenceState
 from synapse.api.errors import Codes, StoreError, SynapseError
@@ -42,7 +44,6 @@ from synapse.handlers.sync import (
     KnockedSyncResult,
     SyncConfig,
     SyncResult,
-    SyncVersion,
 )
 from synapse.http.server import HttpServer
 from synapse.http.servlet import (
@@ -57,8 +58,9 @@ from synapse.logging.opentracing import log_kv, set_tag, trace_with_opname
 from synapse.rest.admin.experimental_features import ExperimentalFeature
 from synapse.types import JsonDict, Requester, SlidingSyncStreamToken, StreamToken
 from synapse.types.rest.client import SlidingSyncBody
-from synapse.util import json_decoder
 from synapse.util.caches.lrucache import LruCache
+from synapse.util.cancellation import cancellable
+from synapse.util.json import json_decoder
 
 from ._base import client_patterns, set_timeline_upper_limit
 
@@ -125,6 +127,7 @@ class SyncRestServlet(RestServlet):
 
         self._json_filter_cache: LruCache[str, bool] = LruCache(
             max_size=1000,
+            clock=self.clock,
             cache_name="sync_valid_filter",
             server_name=self.server_name,
         )
@@ -136,7 +139,8 @@ class SyncRestServlet(RestServlet):
             cfg=hs.config.ratelimiting.rc_presence_per_user,
         )
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    @cancellable
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         # This will always be set by the time Twisted calls us.
         assert request.args is not None
 
@@ -187,7 +191,7 @@ class SyncRestServlet(RestServlet):
         # in the response cache once the set of ignored users has changed.
         # (We filter out ignored users from timeline events, so our sync response
         # is invalid once the set of ignored users changes.)
-        last_ignore_accdata_streampos: Optional[int] = None
+        last_ignore_accdata_streampos: int | None = None
         if not since:
             # No `since`, so this is an initial sync.
             last_ignore_accdata_streampos = await self.store.get_latest_stream_id_for_global_account_data_by_type_for_user(
@@ -267,7 +271,6 @@ class SyncRestServlet(RestServlet):
             sync_result = await self.sync_handler.wait_for_sync_for_user(
                 requester,
                 sync_config,
-                SyncVersion.SYNC_V2,
                 request_key,
                 since_token=since_token,
                 timeout=timeout,
@@ -363,9 +366,6 @@ class SyncRestServlet(RestServlet):
 
         # https://github.com/matrix-org/matrix-doc/blob/54255851f642f84a4f1aaf7bc063eebe3d76752b/proposals/2732-olm-fallback-keys.md
         # states that this field should always be included, as long as the server supports the feature.
-        response["org.matrix.msc2732.device_unused_fallback_key_types"] = (
-            sync_result.device_unused_fallback_key_types
-        )
         response["device_unused_fallback_key_types"] = (
             sync_result.device_unused_fallback_key_types
         )
@@ -382,7 +382,7 @@ class SyncRestServlet(RestServlet):
         return response
 
     @staticmethod
-    def encode_presence(events: List[UserPresenceState], time_now: int) -> JsonDict:
+    def encode_presence(events: list[UserPresenceState], time_now: int) -> JsonDict:
         return {
             "events": [
                 {
@@ -400,7 +400,7 @@ class SyncRestServlet(RestServlet):
     async def encode_joined(
         self,
         sync_config: SyncConfig,
-        rooms: List[JoinedSyncResult],
+        rooms: list[JoinedSyncResult],
         time_now: int,
         serialize_options: SerializeEventConfig,
     ) -> JsonDict:
@@ -430,7 +430,7 @@ class SyncRestServlet(RestServlet):
     @trace_with_opname("sync.encode_invited")
     async def encode_invited(
         self,
-        rooms: List[InvitedSyncResult],
+        rooms: list[InvitedSyncResult],
         time_now: int,
         serialize_options: SerializeEventConfig,
     ) -> JsonDict:
@@ -466,10 +466,10 @@ class SyncRestServlet(RestServlet):
     @trace_with_opname("sync.encode_knocked")
     async def encode_knocked(
         self,
-        rooms: List[KnockedSyncResult],
+        rooms: list[KnockedSyncResult],
         time_now: int,
         serialize_options: SerializeEventConfig,
-    ) -> Dict[str, Dict[str, Any]]:
+    ) -> dict[str, dict[str, Any]]:
         """
         Encode the rooms we've knocked on in a sync result.
 
@@ -519,7 +519,7 @@ class SyncRestServlet(RestServlet):
     async def encode_archived(
         self,
         sync_config: SyncConfig,
-        rooms: List[ArchivedSyncResult],
+        rooms: list[ArchivedSyncResult],
         time_now: int,
         serialize_options: SerializeEventConfig,
     ) -> JsonDict:
@@ -549,7 +549,7 @@ class SyncRestServlet(RestServlet):
     async def encode_room(
         self,
         sync_config: SyncConfig,
-        room: Union[JoinedSyncResult, ArchivedSyncResult],
+        room: JoinedSyncResult | ArchivedSyncResult,
         time_now: int,
         joined: bool,
         serialize_options: SerializeEventConfig,
@@ -619,6 +619,14 @@ class SyncRestServlet(RestServlet):
             ephemeral_events = room.ephemeral
             result["ephemeral"] = {"events": ephemeral_events}
             result["unread_notifications"] = room.unread_notifications
+            if room.sticky:
+                # The sticky events have already been deduplicated so that events
+                # appearing in the timeline won't appear again here
+                result["msc4354_sticky"] = {
+                    "events": await self._event_serializer.serialize_events(
+                        room.sticky, time_now, config=serialize_options
+                    )
+                }
             if room.unread_thread_notifications:
                 result["unread_thread_notifications"] = room.unread_thread_notifications
                 if self._msc3773_enabled:
@@ -632,185 +640,23 @@ class SyncRestServlet(RestServlet):
         return result
 
 
-class SlidingSyncE2eeRestServlet(RestServlet):
-    """
-    API endpoint for MSC3575 Sliding Sync `/sync/e2ee`. This is being introduced as part
-    of Sliding Sync but doesn't have any sliding window component. It's just a way to
-    get E2EE events without having to sit through a big initial sync (`/sync` v2). And
-    we can avoid encryption events being backed up by the main sync response.
-
-    Having To-Device messages split out to this sync endpoint also helps when clients
-    need to have 2 or more sync streams open at a time, e.g a push notification process
-    and a main process. This can cause the two processes to race to fetch the To-Device
-    events, resulting in the need for complex synchronisation rules to ensure the token
-    is correctly and atomically exchanged between processes.
-
-    GET parameters::
-        timeout(int): How long to wait for new events in milliseconds.
-        since(batch_token): Batch token when asking for incremental deltas.
-
-    Response JSON::
-        {
-            "next_batch": // batch token for the next /sync
-            "to_device": {
-                // list of to-device events
-                "events": [
-                    {
-                        "content: { "algorithm": "m.olm.v1.curve25519-aes-sha2", "ciphertext": { ... }, "org.matrix.msgid": "abcd", "session_id": "abcd" },
-                        "type": "m.room.encrypted",
-                        "sender": "@alice:example.com",
-                    }
-                    // ...
-                ]
-            },
-            "device_lists": {
-                "changed": ["@alice:example.com"],
-                "left": ["@bob:example.com"]
-            },
-            "device_one_time_keys_count": {
-                "signed_curve25519": 50
-            },
-            "device_unused_fallback_key_types": [
-                "signed_curve25519"
-            ]
-        }
-    """
-
-    PATTERNS = client_patterns(
-        "/org.matrix.msc3575/sync/e2ee$", releases=[], v1=False, unstable=True
-    )
-
-    def __init__(self, hs: "HomeServer"):
-        super().__init__()
-        self.hs = hs
-        self.auth = hs.get_auth()
-        self.store = hs.get_datastores().main
-        self.sync_handler = hs.get_sync_handler()
-
-        # Filtering only matters for the `device_lists` because it requires a bunch of
-        # derived information from rooms (see how `_generate_sync_entry_for_rooms()`
-        # prepares a bunch of data for `_generate_sync_entry_for_device_list()`).
-        self.only_member_events_filter_collection = FilterCollection(
-            self.hs,
-            {
-                "room": {
-                    # We only care about membership events for the `device_lists`.
-                    # Membership will tell us whether a user has joined/left a room and
-                    # if there are new devices to encrypt for.
-                    "timeline": {
-                        "types": ["m.room.member"],
-                    },
-                    "state": {
-                        "types": ["m.room.member"],
-                    },
-                    # We don't want any extra account_data generated because it's not
-                    # returned by this endpoint. This helps us avoid work in
-                    # `_generate_sync_entry_for_rooms()`
-                    "account_data": {
-                        "not_types": ["*"],
-                    },
-                    # We don't want any extra ephemeral data generated because it's not
-                    # returned by this endpoint. This helps us avoid work in
-                    # `_generate_sync_entry_for_rooms()`
-                    "ephemeral": {
-                        "not_types": ["*"],
-                    },
-                },
-                # We don't want any extra account_data generated because it's not
-                # returned by this endpoint. (This is just here for good measure)
-                "account_data": {
-                    "not_types": ["*"],
-                },
-                # We don't want any extra presence data generated because it's not
-                # returned by this endpoint. (This is just here for good measure)
-                "presence": {
-                    "not_types": ["*"],
-                },
-            },
-        )
-
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        requester = await self.auth.get_user_by_req_experimental_feature(
-            request, allow_guest=True, feature=ExperimentalFeature.MSC3575
-        )
-        user = requester.user
-        device_id = requester.device_id
-
-        timeout = parse_integer(request, "timeout", default=0)
-        since = parse_string(request, "since")
-
-        sync_config = SyncConfig(
-            user=user,
-            filter_collection=self.only_member_events_filter_collection,
-            is_guest=requester.is_guest,
-            device_id=device_id,
-            use_state_after=False,  # We don't return any rooms so this flag is a no-op
-        )
-
-        since_token = None
-        if since is not None:
-            since_token = await StreamToken.from_string(self.store, since)
-
-        # Request cache key
-        request_key = (
-            SyncVersion.E2EE_SYNC,
-            user,
-            timeout,
-            since,
-        )
-
-        # Gather data for the response
-        sync_result = await self.sync_handler.wait_for_sync_for_user(
-            requester,
-            sync_config,
-            SyncVersion.E2EE_SYNC,
-            request_key,
-            since_token=since_token,
-            timeout=timeout,
-            full_state=False,
-        )
-
-        # The client may have disconnected by now; don't bother to serialize the
-        # response if so.
-        if request._disconnected:
-            logger.info("Client has disconnected; not serializing response.")
-            return 200, {}
-
-        response: JsonDict = defaultdict(dict)
-        response["next_batch"] = await sync_result.next_batch.to_string(self.store)
-
-        if sync_result.to_device:
-            response["to_device"] = {"events": sync_result.to_device}
-
-        if sync_result.device_lists.changed:
-            response["device_lists"]["changed"] = list(sync_result.device_lists.changed)
-        if sync_result.device_lists.left:
-            response["device_lists"]["left"] = list(sync_result.device_lists.left)
-
-        # We always include this because https://github.com/vector-im/element-android/issues/3725
-        # The spec isn't terribly clear on when this can be omitted and how a client would tell
-        # the difference between "no keys present" and "nothing changed" in terms of whole field
-        # absent / individual key type entry absent
-        # Corresponding synapse issue: https://github.com/matrix-org/synapse/issues/10456
-        response["device_one_time_keys_count"] = sync_result.device_one_time_keys_count
-
-        # https://github.com/matrix-org/matrix-doc/blob/54255851f642f84a4f1aaf7bc063eebe3d76752b/proposals/2732-olm-fallback-keys.md
-        # states that this field should always be included, as long as the server supports the feature.
-        response["device_unused_fallback_key_types"] = (
-            sync_result.device_unused_fallback_key_types
-        )
-
-        return 200, response
-
-
 class SlidingSyncRestServlet(RestServlet):
     """
-    API endpoint for MSC3575 Sliding Sync `/sync`. Allows for clients to request a
+    API endpoint for MSC4186 Simplified Sliding Sync `/sync`, which was historically derived
+    from MSC3575 (Sliding Sync; now abandoned). Allows for clients to request a
     subset (sliding window) of rooms, state, and timeline events (just what they need)
     in order to bootstrap quickly and subscribe to only what the client cares about.
     Because the client can specify what it cares about, we can respond quickly and skip
     all of the work we would normally have to do with a sync v2 response.
 
+    Extensions of various features are defined in:
+        - to-device messaging (MSC3885)
+        - end-to-end encryption (MSC3884)
+        - typing notifications (MSC3961)
+        - receipts (MSC3960)
+        - account data (MSC3959)
+        - thread subscriptions (MSC4308)
+
     Request query parameters:
         timeout: How long to wait for new events in milliseconds.
         pos: Stream position token when asking for incremental deltas.
@@ -932,7 +778,7 @@ class SlidingSyncRestServlet(RestServlet):
         self.sliding_sync_handler = hs.get_sliding_sync_handler()
         self.event_serializer = hs.get_event_client_serializer()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req_experimental_feature(
             request, allow_guest=True, feature=ExperimentalFeature.MSC3575
         )
@@ -1064,7 +910,7 @@ class SlidingSyncRestServlet(RestServlet):
     async def encode_rooms(
         self,
         requester: Requester,
-        rooms: Dict[str, SlidingSyncResult.RoomResult],
+        rooms: dict[str, SlidingSyncResult.RoomResult],
     ) -> JsonDict:
         time_now = self.clock.time_msec()
 
@@ -1073,7 +919,7 @@ class SlidingSyncRestServlet(RestServlet):
             requester=requester,
         )
 
-        serialized_rooms: Dict[str, JsonDict] = {}
+        serialized_rooms: dict[str, JsonDict] = {}
         for room_id, room_result in rooms.items():
             serialized_rooms[room_id] = {
                 "notification_count": room_result.notification_count,
@@ -1247,11 +1093,49 @@ class SlidingSyncRestServlet(RestServlet):
                 "rooms": extensions.typing.room_id_to_typing_map,
             }
 
+        # excludes both None and falsy `thread_subscriptions`
+        if extensions.thread_subscriptions:
+            serialized_extensions["io.element.msc4308.thread_subscriptions"] = (
+                _serialise_thread_subscriptions(extensions.thread_subscriptions)
+            )
+
         return serialized_extensions
 
 
+def _serialise_thread_subscriptions(
+    thread_subscriptions: SlidingSyncResult.Extensions.ThreadSubscriptionsExtension,
+) -> JsonDict:
+    out: JsonDict = {}
+
+    if thread_subscriptions.subscribed:
+        out["subscribed"] = {
+            room_id: {
+                thread_root_id: attr.asdict(
+                    change, filter=lambda _attr, v: v is not None
+                )
+                for thread_root_id, change in room_threads.items()
+            }
+            for room_id, room_threads in thread_subscriptions.subscribed.items()
+        }
+
+    if thread_subscriptions.unsubscribed:
+        out["unsubscribed"] = {
+            room_id: {
+                thread_root_id: attr.asdict(
+                    change, filter=lambda _attr, v: v is not None
+                )
+                for thread_root_id, change in room_threads.items()
+            }
+            for room_id, room_threads in thread_subscriptions.unsubscribed.items()
+        }
+
+    if thread_subscriptions.prev_batch:
+        out["prev_batch"] = thread_subscriptions.prev_batch.to_string()
+
+    return out
+
+
 def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
     SyncRestServlet(hs).register(http_server)
 
     SlidingSyncRestServlet(hs).register(http_server)
-    SlidingSyncE2eeRestServlet(hs).register(http_server)
diff --git a/synapse/rest/client/tags.py b/synapse/rest/client/tags.py
index fb59efb11f..5699ff35c7 100644
--- a/synapse/rest/client/tags.py
+++ b/synapse/rest/client/tags.py
@@ -21,7 +21,7 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import AuthError, Codes, SynapseError
 from synapse.http.server import HttpServer
@@ -56,7 +56,7 @@ class TagListServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, user_id: str, room_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot get tags for other users.")
@@ -85,7 +85,7 @@ class TagServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, user_id: str, room_id: str, tag: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot add tags for other users.")
@@ -114,7 +114,7 @@ class TagServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, user_id: str, room_id: str, tag: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
         if user_id != requester.user.to_string():
             raise AuthError(403, "Cannot add tags for other users.")
diff --git a/synapse/rest/client/thirdparty.py b/synapse/rest/client/thirdparty.py
index f972591ebf..c17335eb48 100644
--- a/synapse/rest/client/thirdparty.py
+++ b/synapse/rest/client/thirdparty.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Dict, List, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import ThirdPartyEntityKind
 from synapse.http.server import HttpServer
@@ -45,7 +45,7 @@ class ThirdPartyProtocolsServlet(RestServlet):
         self.auth = hs.get_auth()
         self.appservice_handler = hs.get_application_service_handler()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await self.auth.get_user_by_req(request, allow_guest=True)
 
         protocols = await self.appservice_handler.get_3pe_protocols()
@@ -63,7 +63,7 @@ class ThirdPartyProtocolServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, protocol: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         await self.auth.get_user_by_req(request, allow_guest=True)
 
         protocols = await self.appservice_handler.get_3pe_protocols(
@@ -86,10 +86,10 @@ class ThirdPartyUserServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, protocol: str
-    ) -> Tuple[int, List[JsonDict]]:
+    ) -> tuple[int, list[JsonDict]]:
         await self.auth.get_user_by_req(request, allow_guest=True)
 
-        fields: Dict[bytes, List[bytes]] = request.args  # type: ignore[assignment]
+        fields: dict[bytes, list[bytes]] = request.args  # type: ignore[assignment]
         fields.pop(b"access_token", None)
 
         results = await self.appservice_handler.query_3pe(
@@ -110,10 +110,10 @@ class ThirdPartyLocationServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, protocol: str
-    ) -> Tuple[int, List[JsonDict]]:
+    ) -> tuple[int, list[JsonDict]]:
         await self.auth.get_user_by_req(request, allow_guest=True)
 
-        fields: Dict[bytes, List[bytes]] = request.args  # type: ignore[assignment]
+        fields: dict[bytes, list[bytes]] = request.args  # type: ignore[assignment]
         fields.pop(b"access_token", None)
 
         results = await self.appservice_handler.query_3pe(
diff --git a/synapse/rest/client/thread_subscriptions.py b/synapse/rest/client/thread_subscriptions.py
index 4e7b5d06db..60676a4032 100644
--- a/synapse/rest/client/thread_subscriptions.py
+++ b/synapse/rest/client/thread_subscriptions.py
@@ -1,21 +1,39 @@
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
+
+import attr
+from typing_extensions import TypeAlias
 
 from synapse.api.errors import Codes, NotFoundError, SynapseError
 from synapse.http.server import HttpServer
 from synapse.http.servlet import (
     RestServlet,
     parse_and_validate_json_object_from_request,
+    parse_integer,
+    parse_string,
 )
 from synapse.http.site import SynapseRequest
 from synapse.rest.client._base import client_patterns
-from synapse.types import JsonDict, RoomID
+from synapse.types import (
+    JsonDict,
+    RoomID,
+    SlidingSyncStreamToken,
+    ThreadSubscriptionsToken,
+)
+from synapse.types.handlers.sliding_sync import SlidingSyncResult
 from synapse.types.rest import RequestBodyModel
 from synapse.util.pydantic_models import AnyEventId
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
 
+_ThreadSubscription: TypeAlias = (
+    SlidingSyncResult.Extensions.ThreadSubscriptionsExtension.ThreadSubscription
+)
+_ThreadUnsubscription: TypeAlias = (
+    SlidingSyncResult.Extensions.ThreadSubscriptionsExtension.ThreadUnsubscription
+)
+
 
 class ThreadSubscriptionsRestServlet(RestServlet):
     PATTERNS = client_patterns(
@@ -32,7 +50,7 @@ class ThreadSubscriptionsRestServlet(RestServlet):
         self.handler = hs.get_thread_subscriptions_handler()
 
     class PutBody(RequestBodyModel):
-        automatic: Optional[AnyEventId]
+        automatic: AnyEventId | None = None
         """
         If supplied, the event ID of an event giving rise to this automatic subscription.
 
@@ -41,7 +59,7 @@ class ThreadSubscriptionsRestServlet(RestServlet):
 
     async def on_GET(
         self, request: SynapseRequest, room_id: str, thread_root_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         RoomID.from_string(room_id)
         if not thread_root_id.startswith("$"):
             raise SynapseError(
@@ -62,7 +80,7 @@ class ThreadSubscriptionsRestServlet(RestServlet):
 
     async def on_PUT(
         self, request: SynapseRequest, room_id: str, thread_root_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         RoomID.from_string(room_id)
         if not thread_root_id.startswith("$"):
             raise SynapseError(
@@ -83,7 +101,7 @@ class ThreadSubscriptionsRestServlet(RestServlet):
 
     async def on_DELETE(
         self, request: SynapseRequest, room_id: str, thread_root_id: str
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         RoomID.from_string(room_id)
         if not thread_root_id.startswith("$"):
             raise SynapseError(
@@ -100,6 +118,130 @@ class ThreadSubscriptionsRestServlet(RestServlet):
         return HTTPStatus.OK, {}
 
 
+class ThreadSubscriptionsPaginationRestServlet(RestServlet):
+    PATTERNS = client_patterns(
+        "/io.element.msc4308/thread_subscriptions$",
+        unstable=True,
+        releases=(),
+    )
+    CATEGORY = "Thread Subscriptions requests (unstable)"
+
+    # Maximum number of thread subscriptions to return in one request.
+    MAX_LIMIT = 512
+
+    def __init__(self, hs: "HomeServer"):
+        self.auth = hs.get_auth()
+        self.is_mine = hs.is_mine
+        self.store = hs.get_datastores().main
+
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        requester = await self.auth.get_user_by_req(request)
+
+        limit = min(
+            parse_integer(request, "limit", default=100, negative=False),
+            ThreadSubscriptionsPaginationRestServlet.MAX_LIMIT,
+        )
+        from_end_opt = parse_string(request, "from", required=False)
+        to_start_opt = parse_string(request, "to", required=False)
+        _direction = parse_string(request, "dir", required=True, allowed_values=("b",))
+
+        if limit <= 0:
+            # condition needed because `negative=False` still allows 0
+            raise SynapseError(
+                HTTPStatus.BAD_REQUEST,
+                "limit must be greater than 0",
+                errcode=Codes.INVALID_PARAM,
+            )
+
+        if from_end_opt is not None:
+            try:
+                # because of backwards pagination, the `from` token is actually the
+                # bound closest to the end of the stream
+                end_stream_id = ThreadSubscriptionsToken.from_string(
+                    from_end_opt
+                ).stream_id
+            except ValueError:
+                raise SynapseError(
+                    HTTPStatus.BAD_REQUEST,
+                    "`from` is not a valid token",
+                    errcode=Codes.INVALID_PARAM,
+                )
+        else:
+            end_stream_id = self.store.get_max_thread_subscriptions_stream_id()
+
+        if to_start_opt is not None:
+            # because of backwards pagination, the `to` token is actually the
+            # bound closest to the start of the stream
+            try:
+                start_stream_id = ThreadSubscriptionsToken.from_string(
+                    to_start_opt
+                ).stream_id
+            except ValueError:
+                # we also accept sliding sync `pos` tokens on this parameter
+                try:
+                    sliding_sync_pos = await SlidingSyncStreamToken.from_string(
+                        self.store, to_start_opt
+                    )
+                    start_stream_id = (
+                        sliding_sync_pos.stream_token.thread_subscriptions_key
+                    )
+                except ValueError:
+                    raise SynapseError(
+                        HTTPStatus.BAD_REQUEST,
+                        "`to` is not a valid token",
+                        errcode=Codes.INVALID_PARAM,
+                    )
+        else:
+            # the start of time is ID 1; the lower bound is exclusive though
+            start_stream_id = 0
+
+        subscriptions = (
+            await self.store.get_latest_updated_thread_subscriptions_for_user(
+                requester.user.to_string(),
+                from_id=start_stream_id,
+                to_id=end_stream_id,
+                limit=limit,
+            )
+        )
+
+        subscribed_threads: dict[str, dict[str, JsonDict]] = {}
+        unsubscribed_threads: dict[str, dict[str, JsonDict]] = {}
+        for stream_id, room_id, thread_root_id, subscribed, automatic in subscriptions:
+            if subscribed:
+                subscribed_threads.setdefault(room_id, {})[thread_root_id] = (
+                    attr.asdict(
+                        _ThreadSubscription(
+                            automatic=automatic,
+                            bump_stamp=stream_id,
+                        )
+                    )
+                )
+            else:
+                unsubscribed_threads.setdefault(room_id, {})[thread_root_id] = (
+                    attr.asdict(_ThreadUnsubscription(bump_stamp=stream_id))
+                )
+
+        result: JsonDict = {}
+        if subscribed_threads:
+            result["subscribed"] = subscribed_threads
+        if unsubscribed_threads:
+            result["unsubscribed"] = unsubscribed_threads
+
+        if len(subscriptions) == limit:
+            # We hit the limit, so there might be more entries to return.
+            # Generate a new token that has moved backwards, ready for the next
+            # request.
+            min_returned_stream_id, _, _, _, _ = subscriptions[0]
+            result["end"] = ThreadSubscriptionsToken(
+                # We subtract one because the 'later in the stream' bound is inclusive,
+                # and we already saw the element at index 0.
+                stream_id=min_returned_stream_id - 1
+            ).to_string()
+
+        return HTTPStatus.OK, result
+
+
 def register_servlets(hs: "HomeServer", http_server: HttpServer) -> None:
     if hs.config.experimental.msc4306_enabled:
         ThreadSubscriptionsRestServlet(hs).register(http_server)
+        ThreadSubscriptionsPaginationRestServlet(hs).register(http_server)
diff --git a/synapse/rest/client/transactions.py b/synapse/rest/client/transactions.py
index 1a57996aec..43c7b6f993 100644
--- a/synapse/rest/client/transactions.py
+++ b/synapse/rest/client/transactions.py
@@ -23,7 +23,7 @@
 to ensure idempotency when performing PUTs using the REST API."""
 
 import logging
-from typing import TYPE_CHECKING, Awaitable, Callable, Dict, Hashable, Tuple
+from typing import TYPE_CHECKING, Awaitable, Callable, Hashable
 
 from typing_extensions import ParamSpec
 
@@ -34,13 +34,14 @@ from twisted.web.iweb import IRequest
 from synapse.logging.context import make_deferred_yieldable, run_in_background
 from synapse.types import JsonDict, Requester
 from synapse.util.async_helpers import ObservableDeferred
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
 
 logger = logging.getLogger(__name__)
 
-CLEANUP_PERIOD_MS = 1000 * 60 * 30  # 30 mins
+CLEANUP_PERIOD = Duration(minutes=30)
 
 
 P = ParamSpec("P")
@@ -51,12 +52,12 @@ class HttpTransactionCache:
         self.hs = hs
         self.clock = self.hs.get_clock()
         # $txn_key: (ObservableDeferred<(res_code, res_json_body)>, timestamp)
-        self.transactions: Dict[
-            Hashable, Tuple[ObservableDeferred[Tuple[int, JsonDict]], int]
+        self.transactions: dict[
+            Hashable, tuple[ObservableDeferred[tuple[int, JsonDict]], int]
         ] = {}
         # Try to clean entries every 30 mins. This means entries will exist
         # for at *LEAST* 30 mins, and at *MOST* 60 mins.
-        self.cleaner = self.clock.looping_call(self._cleanup, CLEANUP_PERIOD_MS)
+        self.clock.looping_call(self._cleanup, CLEANUP_PERIOD)
 
     def _get_transaction_key(self, request: IRequest, requester: Requester) -> Hashable:
         """A helper function which returns a transaction key that can be used
@@ -103,10 +104,10 @@ class HttpTransactionCache:
         self,
         request: IRequest,
         requester: Requester,
-        fn: Callable[P, Awaitable[Tuple[int, JsonDict]]],
+        fn: Callable[P, Awaitable[tuple[int, JsonDict]]],
         *args: P.args,
         **kwargs: P.kwargs,
-    ) -> "Deferred[Tuple[int, JsonDict]]":
+    ) -> "Deferred[tuple[int, JsonDict]]":
         """Fetches the response for this transaction, or executes the given function
         to produce a response for this transaction.
 
@@ -145,5 +146,5 @@ class HttpTransactionCache:
         now = self.clock.time_msec()
         for key in list(self.transactions):
             ts = self.transactions[key][1]
-            if now > (ts + CLEANUP_PERIOD_MS):  # after cleanup period
+            if now > (ts + CLEANUP_PERIOD.as_millis()):  # after cleanup period
                 del self.transactions[key]
diff --git a/synapse/rest/client/user_directory.py b/synapse/rest/client/user_directory.py
index 94fcb11c0c..fa1342d0bf 100644
--- a/synapse/rest/client/user_directory.py
+++ b/synapse/rest/client/user_directory.py
@@ -20,9 +20,10 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import SynapseError
+from synapse.api.ratelimiting import Ratelimiter
 from synapse.http.server import HttpServer
 from synapse.http.servlet import RestServlet, parse_json_object_from_request
 from synapse.http.site import SynapseRequest
@@ -46,7 +47,13 @@ class UserDirectorySearchRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.user_directory_handler = hs.get_user_directory_handler()
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonMapping]:
+        self._per_user_limiter = Ratelimiter(
+            store=hs.get_datastores().main,
+            clock=hs.get_clock(),
+            cfg=hs.config.ratelimiting.rc_user_directory,
+        )
+
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonMapping]:
         """Searches for users in directory
 
         Returns:
@@ -69,6 +76,8 @@ class UserDirectorySearchRestServlet(RestServlet):
         if not self.hs.config.userdirectory.user_directory_search_enabled:
             return 200, {"limited": False, "results": []}
 
+        await self._per_user_limiter.ratelimit(requester)
+
         body = parse_json_object_from_request(request)
 
         limit = int(body.get("limit", 10))
diff --git a/synapse/rest/client/versions.py b/synapse/rest/client/versions.py
index 7f78379534..7bf4b12e8b 100644
--- a/synapse/rest/client/versions.py
+++ b/synapse/rest/client/versions.py
@@ -23,7 +23,7 @@
 
 import logging
 import re
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import RoomCreationPreset
 from synapse.http.server import HttpServer
@@ -62,7 +62,7 @@ class VersionsRestServlet(RestServlet):
             in self.config.room.encryption_enabled_by_default_for_room_presets
         )
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         msc3881_enabled = self.config.experimental.msc3881_enabled
         msc3575_enabled = self.config.experimental.msc3575_enabled
 
@@ -81,6 +81,26 @@ class VersionsRestServlet(RestServlet):
             msc3575_enabled = await self.store.is_feature_enabled(
                 user_id, ExperimentalFeature.MSC3575
             )
+        else:
+            # Allow caching of unauthenticated responses, as they only depend
+            # on server configuration which rarely changes.
+            #
+            # - `public` means it can be cached both in the browser and in caching proxies
+            # - `max-age` controls how long we cache on the browser side. 10m is sane enough
+            # - `s-maxage` controls how long we cache on the proxy side. Since caching
+            #   proxies usually have a way to purge caches, it is fine to cache there for
+            #   longer (1h), and issue cache invalidations in case we need it
+            # - `stale-while-revalidate` allows caching proxies to serve stale content while
+            #   revalidating in the background. This is useful for making this request always
+            #   'snappy' to end users whilst still keeping it fresh
+            request.setHeader(
+                b"Cache-Control",
+                b"public, max-age=600, s-maxage=3600, stale-while-revalidate=600",
+            )
+
+        # Tell caches to vary on the Authorization header, so that
+        # authenticated responses are not served from cache.
+        request.setHeader(b"Vary", b"Authorization")
 
         return (
             200,
@@ -124,7 +144,7 @@ class VersionsRestServlet(RestServlet):
                     # Implements additional endpoints as described in MSC2432
                     "org.matrix.msc2432": True,
                     # Implements additional endpoints as described in MSC2666
-                    "uk.half-shot.msc2666.query_mutual_rooms": True,
+                    "uk.half-shot.msc2666.query_mutual_rooms.stable": True,
                     # Whether new rooms will be set to encrypted or not (based on presets).
                     "io.element.e2ee_forced.public": self.e2ee_forced_public,
                     "io.element.e2ee_forced.private": self.e2ee_forced_private,
@@ -161,7 +181,7 @@ class VersionsRestServlet(RestServlet):
                     "org.matrix.msc4069": self.config.experimental.msc4069_profile_inhibit_propagation,
                     # Allows clients to handle push for encrypted events.
                     "org.matrix.msc4028": self.config.experimental.msc4028_push_encrypted_events,
-                    # MSC4108: Mechanism to allow OIDC sign in and E2EE set up via QR code
+                    # MSC4108: Mechanism to allow OIDC sign in and E2EE set up via QR code - 2024 version
                     "org.matrix.msc4108": (
                         self.config.experimental.msc4108_enabled
                         or (
@@ -175,10 +195,17 @@ class VersionsRestServlet(RestServlet):
                     "org.matrix.simplified_msc3575": msc3575_enabled,
                     # Arbitrary key-value profile fields.
                     "uk.tcpip.msc4133": self.config.experimental.msc4133_enabled,
+                    "uk.tcpip.msc4133.stable": True,
                     # MSC4155: Invite filtering
                     "org.matrix.msc4155": self.config.experimental.msc4155_enabled,
                     # MSC4306: Support for thread subscriptions
                     "org.matrix.msc4306": self.config.experimental.msc4306_enabled,
+                    # MSC4169: Backwards-compatible redaction sending using `/send`
+                    "com.beeper.msc4169": self.config.experimental.msc4169_enabled,
+                    # MSC4354: Sticky events
+                    "org.matrix.msc4354": self.config.experimental.msc4354_enabled,
+                    # MSC4380: Invite blocking
+                    "org.matrix.msc4380.stable": True,
                 },
             },
         )
diff --git a/synapse/rest/client/voip.py b/synapse/rest/client/voip.py
index fbed3a3bae..581829a790 100644
--- a/synapse/rest/client/voip.py
+++ b/synapse/rest/client/voip.py
@@ -22,7 +22,7 @@
 import base64
 import hashlib
 import hmac
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http.server import HttpServer
 from synapse.http.servlet import RestServlet
@@ -43,7 +43,7 @@ class VoipRestServlet(RestServlet):
         self.hs = hs
         self.auth = hs.get_auth()
 
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(
             request, self.hs.config.voip.turn_allow_guests
         )
diff --git a/synapse/rest/consent/consent_resource.py b/synapse/rest/consent/consent_resource.py
index 3961f82894..a1d2364bed 100644
--- a/synapse/rest/consent/consent_resource.py
+++ b/synapse/rest/consent/consent_resource.py
@@ -23,7 +23,7 @@ import logging
 from hashlib import sha256
 from http import HTTPStatus
 from os import path
-from typing import TYPE_CHECKING, Any, Dict, List
+from typing import TYPE_CHECKING, Any
 
 import jinja2
 from jinja2 import TemplateNotFound
@@ -121,7 +121,7 @@ class ConsentResource(DirectServeHtmlResource):
         has_consented = False
         public_version = username == ""
         if not public_version:
-            args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+            args: dict[bytes, list[bytes]] = request.args  # type: ignore
             userhmac_bytes = parse_bytes_from_args(args, "h", required=True)
 
             self._check_hash(username, userhmac_bytes)
@@ -154,7 +154,7 @@ class ConsentResource(DirectServeHtmlResource):
     async def _async_render_POST(self, request: Request) -> None:
         version = parse_string(request, "v", required=True)
         username = parse_string(request, "u", required=True)
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         userhmac = parse_bytes_from_args(args, "h", required=True)
 
         self._check_hash(username, userhmac)
diff --git a/synapse/rest/health.py b/synapse/rest/health.py
index ae7cab7a2d..9c7a846076 100644
--- a/synapse/rest/health.py
+++ b/synapse/rest/health.py
@@ -22,6 +22,8 @@
 from twisted.web.resource import Resource
 from twisted.web.server import Request
 
+from synapse.api.errors import Codes
+
 
 class HealthResource(Resource):
     """A resource that does nothing except return a 200 with a body of `OK`,
@@ -34,5 +36,15 @@ class HealthResource(Resource):
     isLeaf = 1
 
     def render_GET(self, request: Request) -> bytes:
+        # Prevent path traversal by ensuring the request path is exactly /health.
+        if request.path != b"/health":
+            request.setResponseCode(404)
+            body = (
+                '{"errcode":"'
+                + Codes.UNRECOGNIZED
+                + '","error":"Unrecognized request"}'
+            )
+            return body.encode("utf-8")
+
         request.setHeader(b"Content-Type", b"text/plain")
         return b"OK"
diff --git a/synapse/rest/key/v2/local_key_resource.py b/synapse/rest/key/v2/local_key_resource.py
index 608da25a6c..41e49ac384 100644
--- a/synapse/rest/key/v2/local_key_resource.py
+++ b/synapse/rest/key/v2/local_key_resource.py
@@ -21,7 +21,7 @@
 
 import logging
 import re
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from signedjson.sign import sign_json
 from unpaddedbase64 import encode_base64
@@ -107,8 +107,8 @@ class LocalKey(RestServlet):
         return json_object
 
     def on_GET(
-        self, request: Request, key_id: Optional[str] = None
-    ) -> Tuple[int, JsonDict]:
+        self, request: Request, key_id: str | None = None
+    ) -> tuple[int, JsonDict]:
         # Matrix 1.6 drops support for passing the key_id, this is incompatible
         # with earlier versions and is allowed in order to support both.
         # A warning is issued to help determine when it is safe to drop this.
diff --git a/synapse/rest/key/v2/remote_key_resource.py b/synapse/rest/key/v2/remote_key_resource.py
index fea0b9706d..c3dc69889b 100644
--- a/synapse/rest/key/v2/remote_key_resource.py
+++ b/synapse/rest/key/v2/remote_key_resource.py
@@ -21,13 +21,13 @@
 
 import logging
 import re
-from typing import TYPE_CHECKING, Dict, Mapping, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Mapping
 
+from pydantic import ConfigDict, StrictInt, StrictStr
 from signedjson.sign import sign_json
 
 from twisted.web.server import Request
 
-from synapse._pydantic_compat import Extra, StrictInt, StrictStr
 from synapse.crypto.keyring import ServerKeyFetcher
 from synapse.http.server import HttpServer
 from synapse.http.servlet import (
@@ -38,8 +38,8 @@ from synapse.http.servlet import (
 from synapse.storage.keys import FetchKeyResultForRemote
 from synapse.types import JsonDict
 from synapse.types.rest import RequestBodyModel
-from synapse.util import json_decoder
 from synapse.util.async_helpers import yieldable_gather_results
+from synapse.util.json import json_decoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -48,10 +48,9 @@ logger = logging.getLogger(__name__)
 
 
 class _KeyQueryCriteriaDataModel(RequestBodyModel):
-    class Config:
-        extra = Extra.allow
+    model_config = ConfigDict(extra="allow")
 
-    minimum_valid_until_ts: Optional[StrictInt]
+    minimum_valid_until_ts: StrictInt | None
 
 
 class RemoteKey(RestServlet):
@@ -113,7 +112,7 @@ class RemoteKey(RestServlet):
     CATEGORY = "Federation requests"
 
     class PostBody(RequestBodyModel):
-        server_keys: Dict[StrictStr, Dict[StrictStr, _KeyQueryCriteriaDataModel]]
+        server_keys: dict[StrictStr, dict[StrictStr, _KeyQueryCriteriaDataModel]]
 
     def __init__(self, hs: "HomeServer"):
         self.fetcher = ServerKeyFetcher(hs)
@@ -143,8 +142,8 @@ class RemoteKey(RestServlet):
         )
 
     async def on_GET(
-        self, request: Request, server: str, key_id: Optional[str] = None
-    ) -> Tuple[int, JsonDict]:
+        self, request: Request, server: str, key_id: str | None = None
+    ) -> tuple[int, JsonDict]:
         if server and key_id:
             # Matrix 1.6 drops support for passing the key_id, this is incompatible
             # with earlier versions and is allowed in order to support both.
@@ -168,7 +167,7 @@ class RemoteKey(RestServlet):
 
         return 200, await self.query_keys(query, query_remote_on_cache_miss=True)
 
-    async def on_POST(self, request: Request) -> Tuple[int, JsonDict]:
+    async def on_POST(self, request: Request) -> tuple[int, JsonDict]:
         content = parse_and_validate_json_object_from_request(request, self.PostBody)
 
         query = content.server_keys
@@ -177,16 +176,16 @@ class RemoteKey(RestServlet):
 
     async def query_keys(
         self,
-        query: Dict[str, Dict[str, _KeyQueryCriteriaDataModel]],
+        query: dict[str, dict[str, _KeyQueryCriteriaDataModel]],
         query_remote_on_cache_miss: bool = False,
     ) -> JsonDict:
         logger.info("Handling query for keys %r", query)
 
-        server_keys: Dict[Tuple[str, str], Optional[FetchKeyResultForRemote]] = {}
+        server_keys: dict[tuple[str, str], FetchKeyResultForRemote | None] = {}
         for server_name, key_ids in query.items():
             if key_ids:
                 results: Mapping[
-                    str, Optional[FetchKeyResultForRemote]
+                    str, FetchKeyResultForRemote | None
                 ] = await self.store.get_server_keys_json_for_remote(
                     server_name, key_ids
                 )
@@ -199,13 +198,13 @@ class RemoteKey(RestServlet):
                 ((server_name, key_id), res) for key_id, res in results.items()
             )
 
-        json_results: Set[bytes] = set()
+        json_results: set[bytes] = set()
 
         time_now_ms = self.clock.time_msec()
 
         # Map server_name->key_id->int. Note that the value of the int is unused.
         # XXX: why don't we just use a set?
-        cache_misses: Dict[str, Dict[str, int]] = {}
+        cache_misses: dict[str, dict[str, int]] = {}
         for (server_name, key_id), key_result in server_keys.items():
             if not query[server_name]:
                 # all keys were requested. Just return what we have without worrying
diff --git a/synapse/rest/media/create_resource.py b/synapse/rest/media/create_resource.py
index e45df11c9f..8bef1f4c08 100644
--- a/synapse/rest/media/create_resource.py
+++ b/synapse/rest/media/create_resource.py
@@ -60,15 +60,16 @@ class CreateResource(RestServlet):
         # If the create media requests for the user are over the limit, drop them.
         await self._create_media_rate_limiter.ratelimit(requester)
 
-        (
-            reached_pending_limit,
-            first_expiration_ts,
-        ) = await self.media_repo.reached_pending_media_limit(requester.user)
-        if reached_pending_limit:
-            raise LimitExceededError(
-                limiter_name="max_pending_media_uploads",
-                retry_after_ms=first_expiration_ts - self.clock.time_msec(),
-            )
+        if not requester.app_service or requester.app_service.is_rate_limited():
+            (
+                reached_pending_limit,
+                first_expiration_ts,
+            ) = await self.media_repo.reached_pending_media_limit(requester.user)
+            if reached_pending_limit:
+                raise LimitExceededError(
+                    limiter_name="max_pending_media_uploads",
+                    retry_after_ms=first_expiration_ts - self.clock.time_msec(),
+                )
 
         content_uri, unused_expires_at = await self.media_repo.create_media_id(
             requester.user
diff --git a/synapse/rest/media/download_resource.py b/synapse/rest/media/download_resource.py
index 3c3f703667..f4569cfc7e 100644
--- a/synapse/rest/media/download_resource.py
+++ b/synapse/rest/media/download_resource.py
@@ -21,7 +21,7 @@
 #
 import logging
 import re
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from synapse.http.server import set_corp_headers, set_cors_headers
 from synapse.http.servlet import RestServlet, parse_boolean, parse_integer
@@ -57,7 +57,7 @@ class DownloadResource(RestServlet):
         request: SynapseRequest,
         server_name: str,
         media_id: str,
-        file_name: Optional[str] = None,
+        file_name: str | None = None,
     ) -> None:
         # Validate the server name, raising if invalid
         parse_and_validate_server_name(server_name)
diff --git a/synapse/rest/media/upload_resource.py b/synapse/rest/media/upload_resource.py
index 74d8280582..56bc727cf8 100644
--- a/synapse/rest/media/upload_resource.py
+++ b/synapse/rest/media/upload_resource.py
@@ -22,7 +22,7 @@
 
 import logging
 import re
-from typing import IO, TYPE_CHECKING, Dict, List, Optional, Tuple
+from typing import IO, TYPE_CHECKING
 
 from synapse.api.errors import Codes, SynapseError
 from synapse.http.server import respond_with_json
@@ -56,7 +56,7 @@ class BaseUploadServlet(RestServlet):
 
     async def _get_file_metadata(
         self, request: SynapseRequest, user_id: str
-    ) -> Tuple[int, Optional[str], str]:
+    ) -> tuple[int, str | None, str]:
         raw_content_length = request.getHeader("Content-Length")
         if raw_content_length is None:
             raise SynapseError(msg="Request must specify a Content-Length", code=400)
@@ -78,11 +78,11 @@ class BaseUploadServlet(RestServlet):
                 code=413,
                 errcode=Codes.TOO_LARGE,
             )
-        args: Dict[bytes, List[bytes]] = request.args  # type: ignore
+        args: dict[bytes, list[bytes]] = request.args  # type: ignore
         upload_name_bytes = parse_bytes_from_args(args, "filename")
         if upload_name_bytes:
             try:
-                upload_name: Optional[str] = upload_name_bytes.decode("utf8")
+                upload_name: str | None = upload_name_bytes.decode("utf8")
             except UnicodeDecodeError:
                 raise SynapseError(
                     msg="Invalid UTF-8 filename parameter: %r" % (upload_name_bytes,),
diff --git a/synapse/rest/synapse/client/federation_whitelist.py b/synapse/rest/synapse/client/federation_whitelist.py
index f59daf8428..0382fef1e2 100644
--- a/synapse/rest/synapse/client/federation_whitelist.py
+++ b/synapse/rest/synapse/client/federation_whitelist.py
@@ -13,7 +13,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http.server import DirectServeJsonResource
 from synapse.http.site import SynapseRequest
@@ -50,7 +50,7 @@ class FederationWhitelistResource(DirectServeJsonResource):
 
         self._auth = hs.get_auth()
 
-    async def _async_render_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def _async_render_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         await self._auth.get_user_by_req(request)
 
         whitelist = []
diff --git a/synapse/rest/synapse/client/jwks.py b/synapse/rest/synapse/client/jwks.py
index e9a7c24e3b..15ff6f47c1 100644
--- a/synapse/rest/synapse/client/jwks.py
+++ b/synapse/rest/synapse/client/jwks.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.http.server import DirectServeJsonResource
 from synapse.http.site import SynapseRequest
@@ -73,5 +73,5 @@ class JwksResource(DirectServeJsonResource):
             "keys": keys,
         }
 
-    async def _async_render_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def _async_render_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         return 200, self.res
diff --git a/synapse/rest/synapse/client/password_reset.py b/synapse/rest/synapse/client/password_reset.py
index 377578ef8a..1ccdf23da8 100644
--- a/synapse/rest/synapse/client/password_reset.py
+++ b/synapse/rest/synapse/client/password_reset.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.server import Request
 
@@ -65,7 +65,7 @@ class PasswordResetSubmitTokenResource(DirectServeHtmlResource):
         # This resource should only be mounted if email validation is enabled
         assert hs.config.email.can_verify_email
 
-    async def _async_render_GET(self, request: Request) -> Tuple[int, bytes]:
+    async def _async_render_GET(self, request: Request) -> tuple[int, bytes]:
         sid = parse_string(request, "sid", required=True)
         token = parse_string(request, "token", required=True)
         client_secret = parse_string(request, "client_secret", required=True)
@@ -83,7 +83,7 @@ class PasswordResetSubmitTokenResource(DirectServeHtmlResource):
             self._confirmation_email_template.render(**template_vars).encode("utf-8"),
         )
 
-    async def _async_render_POST(self, request: Request) -> Tuple[int, bytes]:
+    async def _async_render_POST(self, request: Request) -> tuple[int, bytes]:
         sid = parse_string(request, "sid", required=True)
         token = parse_string(request, "token", required=True)
         client_secret = parse_string(request, "client_secret", required=True)
diff --git a/synapse/rest/synapse/client/pick_idp.py b/synapse/rest/synapse/client/pick_idp.py
index 9668a09c19..15c1b3ab49 100644
--- a/synapse/rest/synapse/client/pick_idp.py
+++ b/synapse/rest/synapse/client/pick_idp.py
@@ -63,6 +63,22 @@ class PickIdpResource(DirectServeHtmlResource):
         if not idp:
             return await self._serve_id_picker(request, client_redirect_url)
 
+        # Validate the `idp` query parameter. We should only be working with known IdPs.
+        # No need waste further effort if we don't know about it.
+        #
+        # Although, we primarily prevent open redirect attacks by URL encoding all of
+        # the parameters we use in the redirect URL below, this validation also helps
+        # prevent Synapse from crafting arbitrary URLs and being used in open redirect
+        # attacks (defense in depth).
+        providers = self._sso_handler.get_identity_providers()
+        auth_provider = providers.get(idp)
+        if not auth_provider:
+            logger.info("Unknown idp %r", idp)
+            self._sso_handler.render_error(
+                request, "unknown_idp", "Unknown identity provider ID"
+            )
+            return
+
         # Otherwise, redirect to the login SSO redirect endpoint for the given IdP
         # (which will in turn take us to the the IdP's redirect URI).
         #
diff --git a/synapse/rest/synapse/client/pick_username.py b/synapse/rest/synapse/client/pick_username.py
index 1727bb63b7..867ea1866d 100644
--- a/synapse/rest/synapse/client/pick_username.py
+++ b/synapse/rest/synapse/client/pick_username.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Generator, List, Tuple
+from typing import TYPE_CHECKING, Generator
 
 from twisted.web.resource import Resource
 from twisted.web.server import Request
@@ -65,7 +65,7 @@ class AvailabilityCheckResource(DirectServeJsonResource):
         super().__init__(clock=hs.get_clock())
         self._sso_handler = hs.get_sso_handler()
 
-    async def _async_render_GET(self, request: Request) -> Tuple[int, JsonDict]:
+    async def _async_render_GET(self, request: Request) -> tuple[int, JsonDict]:
         localpart = parse_string(request, "username", required=True)
 
         session_id = get_username_mapping_session_cookie_from_request(request)
@@ -138,7 +138,7 @@ class AccountDetailsResource(DirectServeHtmlResource):
             use_avatar = parse_boolean(request, "use_avatar", default=False)
 
             try:
-                emails_to_use: List[str] = [
+                emails_to_use: list[str] = [
                     val.decode("utf-8") for val in request.args.get(b"use_email", [])
                 ]
             except ValueError:
diff --git a/synapse/rest/synapse/client/rendezvous.py b/synapse/rest/synapse/client/rendezvous.py
index 5278c35572..24c10dee82 100644
--- a/synapse/rest/synapse/client/rendezvous.py
+++ b/synapse/rest/synapse/client/rendezvous.py
@@ -14,7 +14,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List
+from typing import TYPE_CHECKING
 
 from synapse.api.errors import UnrecognizedRequestError
 from synapse.http.server import DirectServeJsonResource
@@ -34,7 +34,7 @@ class MSC4108RendezvousSessionResource(DirectServeJsonResource):
         self._handler = hs.get_rendezvous_handler()
 
     async def _async_render_GET(self, request: SynapseRequest) -> None:
-        postpath: List[bytes] = request.postpath  # type: ignore
+        postpath: list[bytes] = request.postpath  # type: ignore
         if len(postpath) != 1:
             raise UnrecognizedRequestError()
         session_id = postpath[0].decode("ascii")
@@ -42,7 +42,7 @@ class MSC4108RendezvousSessionResource(DirectServeJsonResource):
         self._handler.handle_get(request, session_id)
 
     def _async_render_PUT(self, request: SynapseRequest) -> None:
-        postpath: List[bytes] = request.postpath  # type: ignore
+        postpath: list[bytes] = request.postpath  # type: ignore
         if len(postpath) != 1:
             raise UnrecognizedRequestError()
         session_id = postpath[0].decode("ascii")
@@ -50,7 +50,7 @@ class MSC4108RendezvousSessionResource(DirectServeJsonResource):
         self._handler.handle_put(request, session_id)
 
     def _async_render_DELETE(self, request: SynapseRequest) -> None:
-        postpath: List[bytes] = request.postpath  # type: ignore
+        postpath: list[bytes] = request.postpath  # type: ignore
         if len(postpath) != 1:
             raise UnrecognizedRequestError()
         session_id = postpath[0].decode("ascii")
diff --git a/synapse/rest/synapse/mas/devices.py b/synapse/rest/synapse/mas/devices.py
index 6cc1153590..9d94a67675 100644
--- a/synapse/rest/synapse/mas/devices.py
+++ b/synapse/rest/synapse/mas/devices.py
@@ -15,9 +15,10 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
+
+from pydantic import StrictStr
 
-from synapse._pydantic_compat import StrictStr
 from synapse.api.errors import NotFoundError
 from synapse.http.servlet import parse_and_validate_json_object_from_request
 from synapse.types import JsonDict, UserID
@@ -52,11 +53,11 @@ class MasUpsertDeviceResource(MasBaseResource):
     class PostBody(RequestBodyModel):
         localpart: StrictStr
         device_id: StrictStr
-        display_name: Optional[StrictStr]
+        display_name: StrictStr | None = None
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -97,7 +98,7 @@ class MasDeleteDeviceResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -138,7 +139,7 @@ class MasUpdateDeviceDisplayNameResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -176,11 +177,11 @@ class MasSyncDevicesResource(MasBaseResource):
 
     class PostBody(RequestBodyModel):
         localpart: StrictStr
-        devices: set[StrictStr]
+        devices: list[str]
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
diff --git a/synapse/rest/synapse/mas/users.py b/synapse/rest/synapse/mas/users.py
index 09aa13bebb..01db41bcfa 100644
--- a/synapse/rest/synapse/mas/users.py
+++ b/synapse/rest/synapse/mas/users.py
@@ -15,9 +15,10 @@
 
 import logging
 from http import HTTPStatus
-from typing import TYPE_CHECKING, Any, Optional, Tuple, TypedDict
+from typing import TYPE_CHECKING, Any, TypedDict
+
+from pydantic import StrictBool, StrictStr, model_validator
 
-from synapse._pydantic_compat import StrictBool, StrictStr, root_validator
 from synapse.api.errors import NotFoundError, SynapseError
 from synapse.http.servlet import (
     parse_and_validate_json_object_from_request,
@@ -51,20 +52,20 @@ class MasQueryUserResource(MasBaseResource):
 
     class Response(TypedDict):
         user_id: str
-        display_name: Optional[str]
-        avatar_url: Optional[str]
+        display_name: str | None
+        avatar_url: str | None
         is_suspended: bool
         is_deactivated: bool
 
     async def _async_render_GET(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, Response]:
+    ) -> tuple[int, Response]:
         self.assert_request_is_from_mas(request)
 
         localpart = parse_string(request, "localpart", required=True)
         user_id = UserID(localpart, self.hostname)
 
-        user: Optional[UserInfo] = await self.store.get_user_by_id(user_id=str(user_id))
+        user: UserInfo | None = await self.store.get_user_by_id(user_id=str(user_id))
         if user is None:
             raise NotFoundError("User not found")
 
@@ -103,15 +104,28 @@ class MasProvisionUserResource(MasBaseResource):
         localpart: StrictStr
 
         unset_displayname: StrictBool = False
-        set_displayname: Optional[StrictStr] = None
+        set_displayname: StrictStr | None = None
 
         unset_avatar_url: StrictBool = False
-        set_avatar_url: Optional[StrictStr] = None
+        set_avatar_url: StrictStr | None = None
 
         unset_emails: StrictBool = False
-        set_emails: Optional[list[StrictStr]] = None
+        set_emails: list[StrictStr] | None = None
 
-        @root_validator(pre=True)
+        locked: StrictBool | None = None
+        """
+        True to lock user. False to unlock. None to leave the same.
+
+        This is mostly for informational purposes; if the user's account is locked in MAS
+        but not in Synapse, the token introspection response will prevent them from using
+        their account.
+
+        However, having a local copy of the locked state in Synapse is useful for excluding
+        the user from the user directory.
+        """
+
+        @model_validator(mode="before")
+        @classmethod
         def validate_exclusive(cls, values: Any) -> Any:
             if "unset_displayname" in values and "set_displayname" in values:
                 raise ValueError(
@@ -128,7 +142,7 @@ class MasProvisionUserResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -163,7 +177,7 @@ class MasProvisionUserResource(MasBaseResource):
                     by_admin=True,
                 )
 
-            new_email_list: Optional[set[str]] = None
+            new_email_list: set[str] | None = None
             if body.unset_emails:
                 new_email_list = set()
             elif body.set_emails is not None:
@@ -204,6 +218,9 @@ class MasProvisionUserResource(MasBaseResource):
                         validated_at=current_time,
                     )
 
+        if body.locked is not None:
+            await self.store.set_user_locked_status(user_id.to_string(), body.locked)
+
         if body.unset_avatar_url:
             await self.profile_handler.set_avatar_url(
                 target_user=user_id,
@@ -239,7 +256,7 @@ class MasIsLocalpartAvailableResource(MasBaseResource):
 
     async def _async_render_GET(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
         localpart = parse_string(request, "localpart")
         if localpart is None:
@@ -272,7 +289,7 @@ class MasDeleteUserResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -312,7 +329,7 @@ class MasReactivateUserResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -350,7 +367,7 @@ class MasSetDisplayNameResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -394,7 +411,7 @@ class MasUnsetDisplayNameResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
@@ -440,7 +457,7 @@ class MasAllowCrossSigningResetResource(MasBaseResource):
 
     async def _async_render_POST(
         self, request: "SynapseRequest"
-    ) -> Tuple[int, JsonDict]:
+    ) -> tuple[int, JsonDict]:
         self.assert_request_is_from_mas(request)
 
         body = parse_and_validate_json_object_from_request(request, self.PostBody)
diff --git a/synapse/rest/well_known.py b/synapse/rest/well_known.py
index e4fe4c45ef..801d474ecc 100644
--- a/synapse/rest/well_known.py
+++ b/synapse/rest/well_known.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Optional, Tuple
+from typing import TYPE_CHECKING
 
 from twisted.web.resource import Resource
 from twisted.web.server import Request
@@ -28,7 +28,7 @@ from synapse.api.errors import NotFoundError
 from synapse.http.server import DirectServeJsonResource
 from synapse.http.site import SynapseRequest
 from synapse.types import JsonDict
-from synapse.util import json_encoder
+from synapse.util.json import json_encoder
 from synapse.util.stringutils import parse_server_name
 
 if TYPE_CHECKING:
@@ -42,7 +42,7 @@ class WellKnownBuilder:
         self._config = hs.config
         self._auth = hs.get_auth()
 
-    async def get_well_known(self) -> Optional[JsonDict]:
+    async def get_well_known(self) -> JsonDict | None:
         if not self._config.server.serve_client_wellknown:
             return None
 
@@ -97,7 +97,7 @@ class ClientWellKnownResource(DirectServeJsonResource):
         super().__init__(clock=hs.get_clock())
         self._well_known_builder = WellKnownBuilder(hs)
 
-    async def _async_render_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
+    async def _async_render_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
         r = await self._well_known_builder.get_well_known()
         if not r:
             raise NotFoundError(".well-known not available")
diff --git a/synapse/server.py b/synapse/server.py
index bf82f79bec..8bf19f11b5 100644
--- a/synapse/server.py
+++ b/synapse/server.py
@@ -28,10 +28,23 @@
 import abc
 import functools
 import logging
-from typing import TYPE_CHECKING, Callable, Dict, List, Optional, Type, TypeVar, cast
+from threading import Thread
+from typing import (
+    TYPE_CHECKING,
+    Any,
+    Awaitable,
+    Callable,
+    Optional,
+    TypeVar,
+    cast,
+)
+from wsgiref.simple_server import WSGIServer
 
+from attr import dataclass
 from typing_extensions import TypeAlias
 
+from twisted.internet import defer
+from twisted.internet.base import _SystemEventID
 from twisted.internet.interfaces import IOpenSSLContextFactory
 from twisted.internet.tcp import Port
 from twisted.python.threadpool import ThreadPool
@@ -42,8 +55,11 @@ from synapse.api.auth import Auth
 from synapse.api.auth.internal import InternalAuth
 from synapse.api.auth.mas import MasDelegatedAuth
 from synapse.api.auth_blocking import AuthBlocking
+from synapse.api.errors import HomeServerNotSetupException
 from synapse.api.filtering import Filtering
 from synapse.api.ratelimiting import Ratelimiter, RequestRatelimiter
+from synapse.app._base import unregister_sighups
+from synapse.app.phone_stats_home import start_phone_stats_home
 from synapse.appservice.api import ApplicationServiceApi
 from synapse.appservice.scheduler import ApplicationServiceScheduler
 from synapse.config.homeserver import HomeServerConfig
@@ -128,8 +144,15 @@ from synapse.http.client import (
     SimpleHttpClient,
 )
 from synapse.http.matrixfederationclient import MatrixFederationHttpClient
+from synapse.logging.context import PreserveLoggingContext
 from synapse.media.media_repository import MediaRepository
-from synapse.metrics import register_threadpool
+from synapse.metrics import (
+    SERVER_NAME_LABEL,
+    all_later_gauges_to_clean_up_on_shutdown,
+    register_threadpool,
+    synapse_server_name_info,
+)
+from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.metrics.common_usage_metrics import CommonUsageMetricsManager
 from synapse.module_api import ModuleApi
 from synapse.module_api.callbacks import ModuleApiCallbacks
@@ -151,9 +174,12 @@ from synapse.state import StateHandler, StateResolutionHandler
 from synapse.storage import Databases
 from synapse.storage.controllers import StorageControllers
 from synapse.streams.events import EventSources
+from synapse.synapse_rust.msc4388_rendezvous import MSC4388RendezvousHandler
 from synapse.synapse_rust.rendezvous import RendezvousHandler
 from synapse.types import DomainSpecificString, ISynapseReactor
-from synapse.util import Clock
+from synapse.util import SYNAPSE_VERSION
+from synapse.util.caches import CACHE_METRIC_REGISTRY
+from synapse.util.clock import Clock
 from synapse.util.distributor import Distributor
 from synapse.util.macaroons import MacaroonGenerator
 from synapse.util.ratelimitutils import FederationRateLimiter
@@ -163,7 +189,9 @@ from synapse.util.task_scheduler import TaskScheduler
 logger = logging.getLogger(__name__)
 
 if TYPE_CHECKING:
+    # Old Python versions don't have `LiteralString`
     from txredisapi import ConnectionHandler
+    from typing_extensions import LiteralString
 
     from synapse.handlers.jwt import JwtHandler
     from synapse.handlers.oidc import OidcHandler
@@ -193,6 +221,7 @@ if TYPE_CHECKING:
 
 T: TypeAlias = object
 F = TypeVar("F", bound=Callable[["HomeServer"], T])
+R = TypeVar("R")
 
 
 def cache_in_self(builder: F) -> F:
@@ -216,7 +245,8 @@ def cache_in_self(builder: F) -> F:
     @functools.wraps(builder)
     def _get(self: "HomeServer") -> T:
         try:
-            return getattr(self, depname)
+            dep = getattr(self, depname)
+            return dep
         except AttributeError:
             pass
 
@@ -236,6 +266,22 @@ def cache_in_self(builder: F) -> F:
     return cast(F, _get)
 
 
+@dataclass
+class ShutdownInfo:
+    """Information for callable functions called at time of shutdown.
+
+    Attributes:
+        func: the object to call before shutdown.
+        trigger_id: an ID returned when registering this event trigger.
+        args: the arguments to call the function with.
+        kwargs: the keyword arguments to call the function with.
+    """
+
+    func: Callable[..., Any]
+    trigger_id: _SystemEventID
+    kwargs: dict[str, object]
+
+
 class HomeServer(metaclass=abc.ABCMeta):
     """A basic homeserver object without lazy component builders.
 
@@ -268,7 +314,7 @@ class HomeServer(metaclass=abc.ABCMeta):
 
     @property
     @abc.abstractmethod
-    def DATASTORE_CLASS(self) -> Type["SQLBaseStore"]:
+    def DATASTORE_CLASS(self) -> type["SQLBaseStore"]:
         # This is overridden in derived application classes
         # (such as synapse.app.homeserver.SynapseHomeServer) and gives the class to be
         # instantiated during setup() for future return by get_datastores()
@@ -279,13 +325,13 @@ class HomeServer(metaclass=abc.ABCMeta):
         hostname: str,
         config: HomeServerConfig,
         reactor: Optional[ISynapseReactor] = None,
-        version_string: str = "Synapse",
     ):
         """
         Args:
             hostname : The hostname for the server.
             config: The full config for the homeserver.
         """
+
         if not reactor:
             from twisted.internet import reactor as _reactor
 
@@ -296,22 +342,250 @@ class HomeServer(metaclass=abc.ABCMeta):
         # the key we use to sign events and requests
         self.signing_key = config.key.signing_key[0]
         self.config = config
-        self._listening_services: List[Port] = []
-        self.start_time: Optional[int] = None
+        self._listening_services: list[Port] = []
+        self._metrics_listeners: list[tuple[WSGIServer, Thread]] = []
+        self.start_time: int | None = None
 
         self._instance_id = random_string(5)
         self._instance_name = config.worker.instance_name
 
-        self.version_string = version_string
+        self.version_string = f"Synapse/{SYNAPSE_VERSION}"
 
-        self.datastores: Optional[Databases] = None
+        self.datastores: Databases | None = None
 
-        self._module_web_resources: Dict[str, Resource] = {}
+        self._module_web_resources: dict[str, Resource] = {}
         self._module_web_resources_consumed = False
 
         # This attribute is set by the free function `refresh_certificate`.
         self.tls_server_context_factory: Optional[IOpenSSLContextFactory] = None
 
+        self._is_shutdown = False
+        self._async_shutdown_handlers: list[ShutdownInfo] = []
+        self._sync_shutdown_handlers: list[ShutdownInfo] = []
+        self._background_processes: set[defer.Deferred[Any | None]] = set()
+
+        # For every server we spawn in the process, track it in the metrics
+        synapse_server_name_info.labels(**{SERVER_NAME_LABEL: self.hostname}).set(1)
+
+    def run_as_background_process(
+        self,
+        desc: "LiteralString",
+        func: Callable[..., Awaitable[R | None]],
+        *args: Any,
+        **kwargs: Any,
+    ) -> "defer.Deferred[R | None]":
+        """Run the given function in its own logcontext, with resource metrics
+
+        This should be used to wrap processes which are fired off to run in the
+        background, instead of being associated with a particular request.
+
+        It returns a Deferred which completes when the function completes, but it doesn't
+        follow the synapse logcontext rules, which makes it appropriate for passing to
+        clock.looping_call and friends (or for firing-and-forgetting in the middle of a
+        normal synapse async function).
+
+        Because the returned Deferred does not follow the synapse logcontext rules, awaiting
+        the result of this function will result in the log context being cleared (bad). In
+        order to properly await the result of this function and maintain the current log
+        context, use `make_deferred_yieldable`.
+
+        Args:
+            desc: a description for this background process type
+            server_name: The homeserver name that this background process is being run for
+                (this should be `hs.hostname`).
+            func: a function, which may return a Deferred or a coroutine
+            bg_start_span: Whether to start an opentracing span. Defaults to True.
+                Should only be disabled for processes that will not log to or tag
+                a span.
+            args: positional args for func
+            kwargs: keyword args for func
+
+        Returns:
+            Deferred which returns the result of func, or `None` if func raises.
+            Note that the returned Deferred does not follow the synapse logcontext
+            rules.
+        """
+        if self._is_shutdown:
+            raise Exception(
+                "Cannot start background process. HomeServer has been shutdown"
+            )
+
+        # Ignore linter error as this is the one location this should be called.
+        deferred = run_as_background_process(desc, self.hostname, func, *args, **kwargs)  # type: ignore[untracked-background-process]
+        self._background_processes.add(deferred)
+
+        def on_done(res: R) -> R:
+            try:
+                self._background_processes.remove(deferred)
+            except KeyError:
+                # If the background process isn't being tracked anymore we can just move on.
+                pass
+            return res
+
+        deferred.addBoth(on_done)
+        return deferred
+
+    async def shutdown(self) -> None:
+        """
+        Cleanly stops all aspects of the HomeServer and removes any references that
+        have been handed out in order to allow the HomeServer object to be garbage
+        collected.
+
+        You must ensure the HomeServer object to not be frozen in the garbage collector
+        in order for it to be cleaned up. By default, Synapse freezes the HomeServer
+        object in the garbage collector.
+        """
+
+        self._is_shutdown = True
+
+        logger.info(
+            "Received shutdown request for %s (%s).",
+            self.hostname,
+            self.get_instance_id(),
+        )
+
+        # Unregister sighups first. If a shutdown was requested we shouldn't be responding
+        # to things like config changes. So it would be best to stop listening to these first.
+        unregister_sighups(self._instance_id)
+
+        # TODO: It would be desireable to be able to report an error if the HomeServer
+        # object is frozen in the garbage collector as that would prevent it from being
+        # collected after being shutdown.
+        # In theory the following should work, but it doesn't seem to make a difference
+        # when I test it locally.
+        #
+        # if gc.is_tracked(self):
+        #    logger.error("HomeServer object is tracked by garbage collection so cannot be fully cleaned up")
+
+        for listener in self._listening_services:
+            # During unit tests, an incomplete `twisted.pair.testing._FakePort` is used
+            # for listeners so check listener type here to ensure shutdown procedure is
+            # only applied to actual `Port` instances.
+            if type(listener) is Port:
+                port_shutdown = listener.stopListening()
+                if port_shutdown is not None:
+                    await port_shutdown
+        self._listening_services.clear()
+
+        for server, thread in self._metrics_listeners:
+            server.shutdown()
+            thread.join()
+        self._metrics_listeners.clear()
+
+        # TODO: Cleanup replication pieces
+
+        keyring: Keyring | None = None
+        try:
+            keyring = self.get_keyring()
+        except HomeServerNotSetupException:
+            # If the homeserver wasn't fully setup, keyring won't have existed before
+            # this and will fail to be initialized but it cleans itself up for any
+            # partial initialization problem.
+            pass
+
+        if keyring:
+            keyring.shutdown()
+
+        # Cleanup metrics associated with the homeserver
+        for later_gauge in all_later_gauges_to_clean_up_on_shutdown.values():
+            later_gauge.unregister_hooks_for_homeserver_instance_id(
+                self.get_instance_id()
+            )
+
+        CACHE_METRIC_REGISTRY.unregister_hooks_for_homeserver(
+            self.config.server.server_name
+        )
+
+        try:
+            for db in self.get_datastores().databases:
+                db.stop_background_updates()
+        except HomeServerNotSetupException:
+            # If the homeserver wasn't fully setup, the datastores won't exist
+            pass
+
+        if self.should_send_federation():
+            try:
+                self.get_federation_sender().shutdown()
+            except Exception:
+                pass
+
+        for shutdown_handler in self._async_shutdown_handlers:
+            try:
+                self.get_reactor().removeSystemEventTrigger(shutdown_handler.trigger_id)
+                defer.ensureDeferred(shutdown_handler.func(**shutdown_handler.kwargs))
+            except Exception as e:
+                logger.error("Error calling shutdown async handler: %s", e)
+        self._async_shutdown_handlers.clear()
+
+        for shutdown_handler in self._sync_shutdown_handlers:
+            try:
+                self.get_reactor().removeSystemEventTrigger(shutdown_handler.trigger_id)
+                shutdown_handler.func(**shutdown_handler.kwargs)
+            except Exception as e:
+                logger.error("Error calling shutdown sync handler: %s", e)
+        self._sync_shutdown_handlers.clear()
+
+        self.get_clock().shutdown()
+
+        for background_process in list(self._background_processes):
+            try:
+                with PreserveLoggingContext():
+                    background_process.cancel()
+            except Exception:
+                pass
+        self._background_processes.clear()
+
+        try:
+            for db in self.get_datastores().databases:
+                db._db_pool.close()
+        except HomeServerNotSetupException:
+            # If the homeserver wasn't fully setup, the datastores won't exist
+            pass
+
+    def register_async_shutdown_handler(
+        self,
+        *,
+        phase: str,
+        eventType: str,
+        shutdown_func: Callable[..., Any],
+        **kwargs: object,
+    ) -> None:
+        """
+        Register a system event trigger with the HomeServer so it can be cleanly
+        removed when the HomeServer is shutdown.
+        """
+        id = self.get_clock().add_system_event_trigger(
+            phase,
+            eventType,
+            shutdown_func,
+            **kwargs,
+        )
+        self._async_shutdown_handlers.append(
+            ShutdownInfo(func=shutdown_func, trigger_id=id, kwargs=kwargs)
+        )
+
+    def register_sync_shutdown_handler(
+        self,
+        *,
+        phase: str,
+        eventType: str,
+        shutdown_func: Callable[..., Any],
+        **kwargs: object,
+    ) -> None:
+        """
+        Register a system event trigger with the HomeServer so it can be cleanly
+        removed when the HomeServer is shutdown.
+        """
+        id = self.get_clock().add_system_event_trigger(
+            phase,
+            eventType,
+            shutdown_func,
+            **kwargs,
+        )
+        self._sync_shutdown_handlers.append(
+            ShutdownInfo(func=shutdown_func, trigger_id=id, kwargs=kwargs)
+        )
+
     def register_module_web_resource(self, path: str, resource: Resource) -> None:
         """Allows a module to register a web resource to be served at the given path.
 
@@ -363,11 +637,19 @@ class HomeServer(metaclass=abc.ABCMeta):
         self.datastores = Databases(self.DATASTORE_CLASS, self)
         logger.info("Finished setting up.")
 
-        # Register background tasks required by this server. This must be done
-        # somewhat manually due to the background tasks not being registered
-        # unless handlers are instantiated.
-        if self.config.worker.run_background_tasks:
-            self.setup_background_tasks()
+    # def __del__(self) -> None:
+    #    """
+    #    Called when an the homeserver is garbage collected.
+    #
+    #    Make sure we actually do some clean-up, rather than leak data.
+    #    """
+    #
+    #    # NOTE: This is a chicken and egg problem.
+    #    # __del__ will never be called since the HomeServer cannot be garbage collected
+    #    # until the shutdown function has been called. So it makes no sense to call
+    #    # shutdown inside of __del__, even though that is a logical place to assume it
+    #    # should be called.
+    #    self.shutdown()
 
     def start_listening(self) -> None:  # noqa: B027 (no-op by design)
         """Start the HTTP, manhole, metrics, etc listeners
@@ -376,7 +658,7 @@ class HomeServer(metaclass=abc.ABCMeta):
         appropriate listeners.
         """
 
-    def setup_background_tasks(self) -> None:
+    def start_background_tasks(self) -> None:
         """
         Some handlers have side effects on instantiation (like registering
         background updates). This function causes them to be fetched, and
@@ -385,6 +667,8 @@ class HomeServer(metaclass=abc.ABCMeta):
         for i in self.REQUIRED_ON_BACKGROUND_TASK_STARTUP:
             getattr(self, "get_" + i + "_handler")()
         self.get_task_scheduler()
+        self.get_common_usage_metrics_manager().setup()
+        start_phone_stats_home(self)
 
     def get_reactor(self) -> ISynapseReactor:
         """
@@ -414,17 +698,20 @@ class HomeServer(metaclass=abc.ABCMeta):
 
     @cache_in_self
     def get_clock(self) -> Clock:
-        return Clock(self._reactor)
+        # Ignore the linter error since this is the one place the `Clock` should be created.
+        return Clock(self._reactor, server_name=self.hostname)  # type: ignore[multiple-internal-clocks]
 
     def get_datastores(self) -> Databases:
         if not self.datastores:
-            raise Exception("HomeServer.setup must be called before getting datastores")
+            raise HomeServerNotSetupException(
+                "HomeServer.setup must be called before getting datastores"
+            )
 
         return self.datastores
 
     @cache_in_self
     def get_distributor(self) -> Distributor:
-        return Distributor(server_name=self.hostname)
+        return Distributor(hs=self)
 
     @cache_in_self
     def get_registration_ratelimiter(self) -> Ratelimiter:
@@ -846,7 +1133,7 @@ class HomeServer(metaclass=abc.ABCMeta):
         return ReplicationDataHandler(self)
 
     @cache_in_self
-    def get_replication_streams(self) -> Dict[str, Stream]:
+    def get_replication_streams(self) -> dict[str, Stream]:
         return {stream.NAME: stream(self) for stream in STREAMS_MAP.values()}
 
     @cache_in_self
@@ -898,6 +1185,10 @@ class HomeServer(metaclass=abc.ABCMeta):
     def get_rendezvous_handler(self) -> RendezvousHandler:
         return RendezvousHandler(self)
 
+    @cache_in_self
+    def get_msc4388_rendezvous_handler(self) -> MSC4388RendezvousHandler:
+        return MSC4388RendezvousHandler(self)
+
     @cache_in_self
     def get_outbound_redis_connection(self) -> "ConnectionHandler":
         """
@@ -979,8 +1270,10 @@ class HomeServer(metaclass=abc.ABCMeta):
         )
 
         media_threadpool.start()
-        self.get_reactor().addSystemEventTrigger(
-            "during", "shutdown", media_threadpool.stop
+        self.register_sync_shutdown_handler(
+            phase="during",
+            eventType="shutdown",
+            shutdown_func=media_threadpool.stop,
         )
 
         # Register the threadpool with our metrics.
diff --git a/synapse/server_notices/consent_server_notices.py b/synapse/server_notices/consent_server_notices.py
index d937a3034e..99b362f5ff 100644
--- a/synapse/server_notices/consent_server_notices.py
+++ b/synapse/server_notices/consent_server_notices.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Any, Set
+from typing import TYPE_CHECKING, Any
 
 from synapse.api.errors import SynapseError
 from synapse.api.urls import ConsentURIBuilder
@@ -40,7 +40,7 @@ class ConsentServerNotices:
         self._server_notices_manager = hs.get_server_notices_manager()
         self._store = hs.get_datastores().main
 
-        self._users_in_progress: Set[str] = set()
+        self._users_in_progress: set[str] = set()
 
         self._current_consent_version = hs.config.consent.user_consent_version
         self._server_notice_content = (
diff --git a/synapse/server_notices/resource_limits_server_notices.py b/synapse/server_notices/resource_limits_server_notices.py
index e88e8c9b45..493b8cb62b 100644
--- a/synapse/server_notices/resource_limits_server_notices.py
+++ b/synapse/server_notices/resource_limits_server_notices.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, List, Tuple
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import (
     EventTypes,
@@ -127,7 +127,7 @@ class ResourceLimitsServerNotices:
             logger.error("Error sending resource limits server notice: %s", e)
 
     async def _remove_limit_block_notification(
-        self, user_id: str, ref_events: List[str]
+        self, user_id: str, ref_events: list[str]
     ) -> None:
         """Utility method to remove limit block notifications from the server
         notices room.
@@ -170,7 +170,7 @@ class ResourceLimitsServerNotices:
             user_id, content, EventTypes.Pinned, ""
         )
 
-    async def _is_room_currently_blocked(self, room_id: str) -> Tuple[bool, List[str]]:
+    async def _is_room_currently_blocked(self, room_id: str) -> tuple[bool, list[str]]:
         """
         Determines if the room is currently blocked
 
@@ -198,7 +198,7 @@ class ResourceLimitsServerNotices:
             # The user has yet to join the server notices room
             pass
 
-        referenced_events: List[str] = []
+        referenced_events: list[str] = []
         if pinned_state_event is not None:
             referenced_events = list(pinned_state_event.content.get("pinned", []))
 
diff --git a/synapse/server_notices/server_notices_manager.py b/synapse/server_notices/server_notices_manager.py
index 19f86b5a56..b4e512618e 100644
--- a/synapse/server_notices/server_notices_manager.py
+++ b/synapse/server_notices/server_notices_manager.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from synapse.api.constants import EventTypes, Membership, RoomCreationPreset
 from synapse.events import EventBase
@@ -36,6 +36,7 @@ SERVER_NOTICE_ROOM_TAG = "m.server_notice"
 class ServerNoticesManager:
     def __init__(self, hs: "HomeServer"):
         self.server_name = hs.hostname  # nb must be called this for @cached
+        self.clock = hs.get_clock()  # nb must be called this for @cached
         self._store = hs.get_datastores().main
         self._config = hs.config
         self._account_data_handler = hs.get_account_data_handler()
@@ -58,8 +59,8 @@ class ServerNoticesManager:
         user_id: str,
         event_content: dict,
         type: str = EventTypes.Message,
-        state_key: Optional[str] = None,
-        txn_id: Optional[str] = None,
+        state_key: str | None = None,
+        txn_id: str | None = None,
     ) -> EventBase:
         """Send a notice to the given user
 
@@ -98,7 +99,7 @@ class ServerNoticesManager:
         return event
 
     @cached()
-    async def maybe_get_notice_room_for_user(self, user_id: str) -> Optional[str]:
+    async def maybe_get_notice_room_for_user(self, user_id: str) -> str | None:
         """Try to look up the server notice room for this user if it exists.
 
         Does not create one if none can be found.
@@ -293,8 +294,8 @@ class ServerNoticesManager:
         self,
         requester: Requester,
         room_id: str,
-        display_name: Optional[str],
-        avatar_url: Optional[str],
+        display_name: str | None,
+        avatar_url: str | None,
     ) -> None:
         """
         Updates the notice user's profile if it's different from what is in the room.
@@ -340,7 +341,7 @@ class ServerNoticesManager:
         room_id: str,
         info_event_type: str,
         info_content_key: str,
-        info_value: Optional[str],
+        info_value: str | None,
     ) -> None:
         """
         Updates a specific notice room's info if it's different from what is set.
diff --git a/synapse/server_notices/server_notices_sender.py b/synapse/server_notices/server_notices_sender.py
index bc62d6ac6c..fd4f36f5c8 100644
--- a/synapse/server_notices/server_notices_sender.py
+++ b/synapse/server_notices/server_notices_sender.py
@@ -17,7 +17,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import TYPE_CHECKING, Iterable, Union
+from typing import TYPE_CHECKING, Iterable
 
 from synapse.server_notices.consent_server_notices import ConsentServerNotices
 from synapse.server_notices.resource_limits_server_notices import (
@@ -39,7 +39,7 @@ class ServerNoticesSender(WorkerServerNoticesSender):
     def __init__(self, hs: "HomeServer"):
         super().__init__(hs)
         self._server_notices: Iterable[
-            Union[ConsentServerNotices, ResourceLimitsServerNotices]
+            ConsentServerNotices | ResourceLimitsServerNotices
         ] = (
             ConsentServerNotices(hs),
             ResourceLimitsServerNotices(hs),
diff --git a/synapse/state/__init__.py b/synapse/state/__init__.py
index 3d8016c264..a92233c863 100644
--- a/synapse/state/__init__.py
+++ b/synapse/state/__init__.py
@@ -26,15 +26,9 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    DefaultDict,
-    Dict,
-    FrozenSet,
-    List,
     Mapping,
     Optional,
     Sequence,
-    Set,
-    Tuple,
 )
 
 import attr
@@ -60,6 +54,7 @@ from synapse.types import StateMap, StrCollection
 from synapse.types.state import StateFilter
 from synapse.util.async_helpers import Linearizer
 from synapse.util.caches.expiringcache import ExpiringCache
+from synapse.util.duration import Duration
 from synapse.util.metrics import Measure, measure_func
 from synapse.util.stringutils import shortstr
 
@@ -102,10 +97,10 @@ class _StateCacheEntry:
 
     def __init__(
         self,
-        state: Optional[StateMap[str]],
-        state_group: Optional[int],
-        prev_group: Optional[int] = None,
-        delta_ids: Optional[StateMap[str]] = None,
+        state: StateMap[str] | None,
+        state_group: int | None,
+        prev_group: int | None = None,
+        delta_ids: StateMap[str] | None = None,
     ):
         if state is None and state_group is None and prev_group is None:
             raise Exception("One of state, state_group or prev_group must be not None")
@@ -117,7 +112,7 @@ class _StateCacheEntry:
         #
         # This can be None if we have a `state_group` (as then we can fetch the
         # state from the DB.)
-        self._state: Optional[StateMap[str]] = (
+        self._state: StateMap[str] | None = (
             immutabledict(state) if state is not None else None
         )
 
@@ -126,7 +121,7 @@ class _StateCacheEntry:
         self.state_group = state_group
 
         self.prev_group = prev_group
-        self.delta_ids: Optional[StateMap[str]] = (
+        self.delta_ids: StateMap[str] | None = (
             immutabledict(delta_ids) if delta_ids is not None else None
         )
 
@@ -212,7 +207,7 @@ class StateHandler:
         self,
         room_id: str,
         event_ids: StrCollection,
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
     ) -> StateMap[str]:
         """Fetch the state after each of the given event IDs. Resolve them and return.
@@ -246,7 +241,7 @@ class StateHandler:
 
     async def get_current_user_ids_in_room(
         self, room_id: str, latest_event_ids: StrCollection
-    ) -> Set[str]:
+    ) -> set[str]:
         """
         Get the users IDs who are currently in a room.
 
@@ -271,7 +266,7 @@ class StateHandler:
 
     async def get_hosts_in_room_at_events(
         self, room_id: str, event_ids: StrCollection
-    ) -> FrozenSet[str]:
+    ) -> frozenset[str]:
         """Get the hosts that were in a room at the given event ids
 
         Args:
@@ -289,9 +284,9 @@ class StateHandler:
     async def calculate_context_info(
         self,
         event: EventBase,
-        state_ids_before_event: Optional[StateMap[str]] = None,
-        partial_state: Optional[bool] = None,
-        state_group_before_event: Optional[int] = None,
+        state_ids_before_event: StateMap[str] | None = None,
+        partial_state: bool | None = None,
+        state_group_before_event: int | None = None,
     ) -> UnpersistedEventContextBase:
         """
         Calulates the contents of an unpersisted event context, other than the current
@@ -462,8 +457,8 @@ class StateHandler:
     async def compute_event_context(
         self,
         event: EventBase,
-        state_ids_before_event: Optional[StateMap[str]] = None,
-        partial_state: Optional[bool] = None,
+        state_ids_before_event: StateMap[str] | None = None,
+        partial_state: bool | None = None,
     ) -> EventContext:
         """Build an EventContext structure for a non-outlier event.
 
@@ -642,13 +637,16 @@ class StateResolutionHandler:
         self.server_name = hs.hostname
         self.clock = hs.get_clock()
 
-        self.resolve_linearizer = Linearizer(name="state_resolve_lock")
+        self.resolve_linearizer = Linearizer(
+            name="state_resolve_lock", clock=self.clock
+        )
 
         # dict of set of event_ids -> _StateCacheEntry.
-        self._state_cache: ExpiringCache[FrozenSet[int], _StateCacheEntry] = (
+        self._state_cache: ExpiringCache[frozenset[int], _StateCacheEntry] = (
             ExpiringCache(
                 cache_name="state_cache",
                 server_name=self.server_name,
+                hs=hs,
                 clock=self.clock,
                 max_len=100000,
                 expiry_ms=EVICTION_TIMEOUT_SECONDS * 1000,
@@ -662,18 +660,18 @@ class StateResolutionHandler:
         #
 
         # tracks the amount of work done on state res per room
-        self._state_res_metrics: DefaultDict[str, _StateResMetrics] = defaultdict(
+        self._state_res_metrics: defaultdict[str, _StateResMetrics] = defaultdict(
             _StateResMetrics
         )
 
-        self.clock.looping_call(self._report_metrics, 120 * 1000)
+        self.clock.looping_call(self._report_metrics, Duration(minutes=2))
 
     async def resolve_state_groups(
         self,
         room_id: str,
         room_version: str,
         state_groups_ids: Mapping[int, StateMap[str]],
-        event_map: Optional[Dict[str, EventBase]],
+        event_map: dict[str, EventBase] | None,
         state_res_store: "StateResolutionStore",
     ) -> _StateCacheEntry:
         """Resolves conflicts between a set of state groups
@@ -773,7 +771,7 @@ class StateResolutionHandler:
         room_id: str,
         room_version: str,
         state_sets: Sequence[StateMap[str]],
-        event_map: Optional[Dict[str, EventBase]],
+        event_map: dict[str, EventBase] | None,
         state_res_store: "StateResolutionStore",
     ) -> StateMap[str]:
         """
@@ -881,7 +879,7 @@ class StateResolutionHandler:
         items = self._state_res_metrics.items()
 
         # log the N biggest rooms
-        biggest: List[Tuple[str, _StateResMetrics]] = heapq.nlargest(
+        biggest: list[tuple[str, _StateResMetrics]] = heapq.nlargest(
             n_to_log, items, key=lambda i: extract_key(i[1])
         )
         metrics_logger.debug(
@@ -937,7 +935,7 @@ def _make_state_cache_entry(
 
     # failing that, look for the closest match.
     prev_group = None
-    delta_ids: Optional[StateMap[str]] = None
+    delta_ids: StateMap[str] | None = None
 
     for old_group, old_state in state_groups_ids.items():
         if old_state.keys() - new_state.keys():
@@ -972,7 +970,7 @@ class StateResolutionStore:
 
     def get_events(
         self, event_ids: StrCollection, allow_rejected: bool = False
-    ) -> Awaitable[Dict[str, EventBase]]:
+    ) -> Awaitable[dict[str, EventBase]]:
         """Get events from the database
 
         Args:
@@ -993,9 +991,9 @@ class StateResolutionStore:
     def get_auth_chain_difference(
         self,
         room_id: str,
-        state_sets: List[Set[str]],
-        conflicted_state: Optional[Set[str]],
-        additional_backwards_reachable_conflicted_events: Optional[Set[str]],
+        state_sets: list[set[str]],
+        conflicted_state: set[str] | None,
+        additional_backwards_reachable_conflicted_events: set[str] | None,
     ) -> Awaitable[StateDifference]:
         """ "Given sets of state events figure out the auth chain difference (as
         per state res v2 algorithm).
diff --git a/synapse/state/v1.py b/synapse/state/v1.py
index a2e9eb0a42..0b4514d322 100644
--- a/synapse/state/v1.py
+++ b/synapse/state/v1.py
@@ -23,13 +23,8 @@ import logging
 from typing import (
     Awaitable,
     Callable,
-    Dict,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
 )
 
 from synapse import event_auth
@@ -49,8 +44,8 @@ async def resolve_events_with_store(
     room_id: str,
     room_version: RoomVersion,
     state_sets: Sequence[StateMap[str]],
-    event_map: Optional[Dict[str, EventBase]],
-    state_map_factory: Callable[[StrCollection], Awaitable[Dict[str, EventBase]]],
+    event_map: dict[str, EventBase] | None,
+    state_map_factory: Callable[[StrCollection], Awaitable[dict[str, EventBase]]],
 ) -> StateMap[str]:
     """
     Args:
@@ -145,7 +140,7 @@ async def resolve_events_with_store(
 
 def _seperate(
     state_sets: Iterable[StateMap[str]],
-) -> Tuple[MutableStateMap[str], MutableStateMap[Set[str]]]:
+) -> tuple[MutableStateMap[str], MutableStateMap[set[str]]]:
     """Takes the state_sets and figures out which keys are conflicted and
     which aren't. i.e., which have multiple different event_ids associated
     with them in different state sets.
@@ -166,7 +161,7 @@ def _seperate(
     """
     state_set_iterator = iter(state_sets)
     unconflicted_state = dict(next(state_set_iterator))
-    conflicted_state: MutableStateMap[Set[str]] = {}
+    conflicted_state: MutableStateMap[set[str]] = {}
 
     for state_set in state_set_iterator:
         for key, value in state_set.items():
@@ -196,8 +191,8 @@ def _seperate(
 def _create_auth_events_from_maps(
     room_version: RoomVersion,
     unconflicted_state: StateMap[str],
-    conflicted_state: StateMap[Set[str]],
-    state_map: Dict[str, EventBase],
+    conflicted_state: StateMap[set[str]],
+    state_map: dict[str, EventBase],
 ) -> StateMap[str]:
     """
 
@@ -228,9 +223,9 @@ def _create_auth_events_from_maps(
 def _resolve_with_state(
     room_version: RoomVersion,
     unconflicted_state_ids: MutableStateMap[str],
-    conflicted_state_ids: StateMap[Set[str]],
+    conflicted_state_ids: StateMap[set[str]],
     auth_event_ids: StateMap[str],
-    state_map: Dict[str, EventBase],
+    state_map: dict[str, EventBase],
 ) -> MutableStateMap[str]:
     conflicted_state = {}
     for key, event_ids in conflicted_state_ids.items():
@@ -263,7 +258,7 @@ def _resolve_with_state(
 
 def _resolve_state_events(
     room_version: RoomVersion,
-    conflicted_state: StateMap[List[EventBase]],
+    conflicted_state: StateMap[list[EventBase]],
     auth_events: MutableStateMap[EventBase],
 ) -> StateMap[EventBase]:
     """This is where we actually decide which of the conflicted state to
@@ -312,7 +307,7 @@ def _resolve_state_events(
 
 
 def _resolve_auth_events(
-    room_version: RoomVersion, events: List[EventBase], auth_events: StateMap[EventBase]
+    room_version: RoomVersion, events: list[EventBase], auth_events: StateMap[EventBase]
 ) -> EventBase:
     reverse = list(reversed(_ordered_events(events)))
 
@@ -347,7 +342,7 @@ def _resolve_auth_events(
 
 
 def _resolve_normal_events(
-    events: List[EventBase], auth_events: StateMap[EventBase]
+    events: list[EventBase], auth_events: StateMap[EventBase]
 ) -> EventBase:
     for event in _ordered_events(events):
         try:
@@ -365,8 +360,8 @@ def _resolve_normal_events(
     return event
 
 
-def _ordered_events(events: Iterable[EventBase]) -> List[EventBase]:
-    def key_func(e: EventBase) -> Tuple[int, str]:
+def _ordered_events(events: Iterable[EventBase]) -> list[EventBase]:
+    def key_func(e: EventBase) -> tuple[int, str]:
         # we have to use utf-8 rather than ascii here because it turns out we allow
         # people to send us events with non-ascii event IDs :/
         return -int(e.depth), hashlib.sha1(e.event_id.encode("utf-8")).hexdigest()
diff --git a/synapse/state/v2.py b/synapse/state/v2.py
index 8bf6706434..1241a4d66e 100644
--- a/synapse/state/v2.py
+++ b/synapse/state/v2.py
@@ -25,16 +25,11 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
     Generator,
     Iterable,
-    List,
     Literal,
-    Optional,
     Protocol,
     Sequence,
-    Set,
-    Tuple,
     overload,
 )
 
@@ -45,6 +40,7 @@ from synapse.api.room_versions import RoomVersion, StateResolutionVersions
 from synapse.events import EventBase, is_creator
 from synapse.storage.databases.main.event_federation import StateDifference
 from synapse.types import MutableStateMap, StateMap, StrCollection
+from synapse.util.duration import Duration
 
 logger = logging.getLogger(__name__)
 
@@ -53,7 +49,7 @@ class Clock(Protocol):
     # This is usually synapse.util.Clock, but it's replaced with a FakeClock in tests.
     # We only ever sleep(0) though, so that other async functions can make forward
     # progress without waiting for stateres to complete.
-    async def sleep(self, duration_ms: float) -> None: ...
+    async def sleep(self, duration: Duration) -> None: ...
 
 
 class StateResolutionStore(Protocol):
@@ -61,14 +57,14 @@ class StateResolutionStore(Protocol):
     # TestStateResolutionStore in tests.
     def get_events(
         self, event_ids: StrCollection, allow_rejected: bool = False
-    ) -> Awaitable[Dict[str, EventBase]]: ...
+    ) -> Awaitable[dict[str, EventBase]]: ...
 
     def get_auth_chain_difference(
         self,
         room_id: str,
-        state_sets: List[Set[str]],
-        conflicted_state: Optional[Set[str]],
-        additional_backwards_reachable_conflicted_events: Optional[set[str]],
+        state_sets: list[set[str]],
+        conflicted_state: set[str] | None,
+        additional_backwards_reachable_conflicted_events: set[str] | None,
     ) -> Awaitable[StateDifference]: ...
 
 
@@ -88,7 +84,7 @@ async def resolve_events_with_store(
     room_id: str,
     room_version: RoomVersion,
     state_sets: Sequence[StateMap[str]],
-    event_map: Optional[Dict[str, EventBase]],
+    event_map: dict[str, EventBase] | None,
     state_res_store: StateResolutionStore,
 ) -> StateMap[str]:
     """Resolves the state using the v2 state resolution algorithm
@@ -128,7 +124,7 @@ async def resolve_events_with_store(
     logger.debug("%d conflicted state entries", len(conflicted_state))
     logger.debug("Calculating auth chain difference")
 
-    conflicted_set: Optional[Set[str]] = None
+    conflicted_set: set[str] | None = None
     if room_version.state_res == StateResolutionVersions.V2_1:
         # calculate the conflicted subgraph
         conflicted_set = set(itertools.chain.from_iterable(conflicted_state.values()))
@@ -242,7 +238,7 @@ async def resolve_events_with_store(
 async def _get_power_level_for_sender(
     room_id: str,
     event_id: str,
-    event_map: Dict[str, EventBase],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
 ) -> int:
     """Return the power level of the sender of the given event according to
@@ -315,10 +311,10 @@ async def _get_power_level_for_sender(
 async def _get_auth_chain_difference(
     room_id: str,
     state_sets: Sequence[StateMap[str]],
-    unpersisted_events: Dict[str, EventBase],
+    unpersisted_events: dict[str, EventBase],
     state_res_store: StateResolutionStore,
-    conflicted_state: Optional[Set[str]],
-) -> Set[str]:
+    conflicted_state: set[str] | None,
+) -> set[str]:
     """Compare the auth chains of each state set and return the set of events
     that only appear in some, but not all of the auth chains.
 
@@ -356,10 +352,10 @@ async def _get_auth_chain_difference(
     # event IDs if they appear in the `unpersisted_events`. This is the intersection of
     # the event's auth chain with the events in `unpersisted_events` *plus* their
     # auth event IDs.
-    events_to_auth_chain: Dict[str, Set[str]] = {}
+    events_to_auth_chain: dict[str, set[str]] = {}
     # remember the forward links when doing the graph traversal, we'll need it for v2.1 checks
     # This is a map from an event to the set of events that contain it as an auth event.
-    event_to_next_event: Dict[str, Set[str]] = {}
+    event_to_next_event: dict[str, set[str]] = {}
     for event in unpersisted_events.values():
         chain = {event.event_id}
         events_to_auth_chain[event.event_id] = chain
@@ -379,8 +375,8 @@ async def _get_auth_chain_difference(
     #
     # Note: If there are no `unpersisted_events` (which is the common case), we can do a
     # much simpler calculation.
-    additional_backwards_reachable_conflicted_events: Set[str] = set()
-    unpersisted_conflicted_events: Set[str] = set()
+    additional_backwards_reachable_conflicted_events: set[str] = set()
+    unpersisted_conflicted_events: set[str] = set()
     if unpersisted_events:
         # The list of state sets to pass to the store, where each state set is a set
         # of the event ids making up the state. This is similar to `state_sets`,
@@ -388,17 +384,17 @@ async def _get_auth_chain_difference(
         # ((type, state_key)->event_id) mappings; and (b) we have stripped out
         # unpersisted events and replaced them with the persisted events in
         # their auth chain.
-        state_sets_ids: List[Set[str]] = []
+        state_sets_ids: list[set[str]] = []
 
         # For each state set, the unpersisted event IDs reachable (by their auth
         # chain) from the events in that set.
-        unpersisted_set_ids: List[Set[str]] = []
+        unpersisted_set_ids: list[set[str]] = []
 
         for state_set in state_sets:
-            set_ids: Set[str] = set()
+            set_ids: set[str] = set()
             state_sets_ids.append(set_ids)
 
-            unpersisted_ids: Set[str] = set()
+            unpersisted_ids: set[str] = set()
             unpersisted_set_ids.append(unpersisted_ids)
 
             for event_id in state_set.values():
@@ -479,7 +475,7 @@ async def _get_auth_chain_difference(
         # but NOT the backwards conflicted set. This mirrors what the DB layer does but in reverse:
         # we supplied events which are backwards reachable to the DB and now the DB is providing
         # forwards reachable events from the DB.
-        forwards_conflicted_set: Set[str] = set()
+        forwards_conflicted_set: set[str] = set()
         # we include unpersisted conflicted events here to process exclusive unpersisted subgraphs
         search_queue = subgraph_frontier.union(unpersisted_conflicted_events)
         while search_queue:
@@ -490,7 +486,7 @@ async def _get_auth_chain_difference(
 
         # we've already calculated the backwards form as this is the auth chain for each
         # unpersisted conflicted event.
-        backwards_conflicted_set: Set[str] = set()
+        backwards_conflicted_set: set[str] = set()
         for uce in unpersisted_conflicted_events:
             backwards_conflicted_set.update(events_to_auth_chain.get(uce, []))
 
@@ -526,7 +522,7 @@ async def _get_auth_chain_difference(
 
 def _seperate(
     state_sets: Iterable[StateMap[str]],
-) -> Tuple[StateMap[str], StateMap[Set[str]]]:
+) -> tuple[StateMap[str], StateMap[set[str]]]:
     """Return the unconflicted and conflicted state. This is different than in
     the original algorithm, as this defines a key to be conflicted if one of
     the state sets doesn't have that key.
@@ -550,7 +546,7 @@ def _seperate(
             conflicted_state[key] = event_ids
 
     # mypy doesn't understand that discarding None above means that conflicted
-    # state is StateMap[Set[str]], not StateMap[Set[Optional[Str]]].
+    # state is StateMap[set[str]], not StateMap[set[str | None]].
     return unconflicted_state, conflicted_state  # type: ignore[return-value]
 
 
@@ -579,12 +575,12 @@ def _is_power_event(event: EventBase) -> bool:
 
 
 async def _add_event_and_auth_chain_to_graph(
-    graph: Dict[str, Set[str]],
+    graph: dict[str, set[str]],
     room_id: str,
     event_id: str,
-    event_map: Dict[str, EventBase],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
-    full_conflicted_set: Set[str],
+    full_conflicted_set: set[str],
 ) -> None:
     """Helper function for _reverse_topological_power_sort that add the event
     and its auth chain (that is in the auth diff) to the graph
@@ -616,10 +612,10 @@ async def _reverse_topological_power_sort(
     clock: Clock,
     room_id: str,
     event_ids: Iterable[str],
-    event_map: Dict[str, EventBase],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
-    full_conflicted_set: Set[str],
-) -> List[str]:
+    full_conflicted_set: set[str],
+) -> list[str]:
     """Returns a list of the event_ids sorted by reverse topological ordering,
     and then by power level and origin_server_ts
 
@@ -635,7 +631,7 @@ async def _reverse_topological_power_sort(
         The sorted list
     """
 
-    graph: Dict[str, Set[str]] = {}
+    graph: dict[str, set[str]] = {}
     for idx, event_id in enumerate(event_ids, start=1):
         await _add_event_and_auth_chain_to_graph(
             graph, room_id, event_id, event_map, state_res_store, full_conflicted_set
@@ -644,7 +640,7 @@ async def _reverse_topological_power_sort(
         # We await occasionally when we're working with large data sets to
         # ensure that we don't block the reactor loop for too long.
         if idx % _AWAIT_AFTER_ITERATIONS == 0:
-            await clock.sleep(0)
+            await clock.sleep(Duration(seconds=0))
 
     event_to_pl = {}
     for idx, event_id in enumerate(graph, start=1):
@@ -656,9 +652,9 @@ async def _reverse_topological_power_sort(
         # We await occasionally when we're working with large data sets to
         # ensure that we don't block the reactor loop for too long.
         if idx % _AWAIT_AFTER_ITERATIONS == 0:
-            await clock.sleep(0)
+            await clock.sleep(Duration(seconds=0))
 
-    def _get_power_order(event_id: str) -> Tuple[int, int, str]:
+    def _get_power_order(event_id: str) -> tuple[int, int, str]:
         ev = event_map[event_id]
         pl = event_to_pl[event_id]
 
@@ -675,9 +671,9 @@ async def _iterative_auth_checks(
     clock: Clock,
     room_id: str,
     room_version: RoomVersion,
-    event_ids: List[str],
+    event_ids: list[str],
     base_state: StateMap[str],
-    event_map: Dict[str, EventBase],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
 ) -> MutableStateMap[str]:
     """Sequentially apply auth checks to each event in given list, updating the
@@ -750,7 +746,7 @@ async def _iterative_auth_checks(
         # We await occasionally when we're working with large data sets to
         # ensure that we don't block the reactor loop for too long.
         if idx % _AWAIT_AFTER_ITERATIONS == 0:
-            await clock.sleep(0)
+            await clock.sleep(Duration(seconds=0))
 
     return resolved_state
 
@@ -758,11 +754,11 @@ async def _iterative_auth_checks(
 async def _mainline_sort(
     clock: Clock,
     room_id: str,
-    event_ids: List[str],
-    resolved_power_event_id: Optional[str],
-    event_map: Dict[str, EventBase],
+    event_ids: list[str],
+    resolved_power_event_id: str | None,
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
-) -> List[str]:
+) -> list[str]:
     """Returns a sorted list of event_ids sorted by mainline ordering based on
     the given event resolved_power_event_id
 
@@ -801,7 +797,7 @@ async def _mainline_sort(
         # We await occasionally when we're working with large data sets to
         # ensure that we don't block the reactor loop for too long.
         if idx != 0 and idx % _AWAIT_AFTER_ITERATIONS == 0:
-            await clock.sleep(0)
+            await clock.sleep(Duration(seconds=0))
 
         idx += 1
 
@@ -819,7 +815,7 @@ async def _mainline_sort(
         # We await occasionally when we're working with large data sets to
         # ensure that we don't block the reactor loop for too long.
         if idx % _AWAIT_AFTER_ITERATIONS == 0:
-            await clock.sleep(0)
+            await clock.sleep(Duration(seconds=0))
 
     event_ids.sort(key=lambda ev_id: order_map[ev_id])
 
@@ -829,8 +825,8 @@ async def _mainline_sort(
 async def _get_mainline_depth_for_event(
     clock: Clock,
     event: EventBase,
-    mainline_map: Dict[str, int],
-    event_map: Dict[str, EventBase],
+    mainline_map: dict[str, int],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
 ) -> int:
     """Get the mainline depths for the given event based on the mainline map
@@ -846,7 +842,7 @@ async def _get_mainline_depth_for_event(
     """
 
     room_id = event.room_id
-    tmp_event: Optional[EventBase] = event
+    tmp_event: EventBase | None = event
 
     # We do an iterative search, replacing `event with the power level in its
     # auth events (if any)
@@ -870,7 +866,7 @@ async def _get_mainline_depth_for_event(
         idx += 1
 
         if idx % _AWAIT_AFTER_ITERATIONS == 0:
-            await clock.sleep(0)
+            await clock.sleep(Duration(seconds=0))
 
     # Didn't find a power level auth event, so we just return 0
     return 0
@@ -880,7 +876,7 @@ async def _get_mainline_depth_for_event(
 async def _get_event(
     room_id: str,
     event_id: str,
-    event_map: Dict[str, EventBase],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
     allow_none: Literal[False] = False,
 ) -> EventBase: ...
@@ -890,19 +886,19 @@ async def _get_event(
 async def _get_event(
     room_id: str,
     event_id: str,
-    event_map: Dict[str, EventBase],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
     allow_none: Literal[True],
-) -> Optional[EventBase]: ...
+) -> EventBase | None: ...
 
 
 async def _get_event(
     room_id: str,
     event_id: str,
-    event_map: Dict[str, EventBase],
+    event_map: dict[str, EventBase],
     state_res_store: StateResolutionStore,
     allow_none: bool = False,
-) -> Optional[EventBase]:
+) -> EventBase | None:
     """Helper function to look up event in event_map, falling back to looking
     it up in the store
 
@@ -936,7 +932,7 @@ async def _get_event(
 
 
 def lexicographical_topological_sort(
-    graph: Dict[str, Set[str]], key: Callable[[str], Any]
+    graph: dict[str, set[str]], key: Callable[[str], Any]
 ) -> Generator[str, None, None]:
     """Performs a lexicographic reverse topological sort on the graph.
 
@@ -960,7 +956,7 @@ def lexicographical_topological_sort(
     # outgoing edges, c.f.
     # https://en.wikipedia.org/wiki/Topological_sorting#Kahn's_algorithm
     outdegree_map = graph
-    reverse_graph: Dict[str, Set[str]] = {}
+    reverse_graph: dict[str, set[str]] = {}
 
     # Lists of nodes with zero out degree. Is actually a tuple of
     # `(key(node), node)` so that sorting does the right thing
diff --git a/synapse/storage/_base.py b/synapse/storage/_base.py
index d55c9e18ed..8eeea20967 100644
--- a/synapse/storage/_base.py
+++ b/synapse/storage/_base.py
@@ -21,7 +21,7 @@
 #
 import logging
 from abc import ABCMeta
-from typing import TYPE_CHECKING, Any, Collection, Dict, Iterable, Optional, Union
+from typing import TYPE_CHECKING, Any, Collection, Iterable
 
 from synapse.storage.database import (
     DatabasePool,
@@ -29,8 +29,8 @@ from synapse.storage.database import (
     make_in_list_sql_clause,  # noqa: F401
 )
 from synapse.types import get_domain_from_id
-from synapse.util import json_decoder
 from synapse.util.caches.descriptors import CachedFunction
+from synapse.util.json import json_decoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -56,11 +56,11 @@ class SQLBaseStore(metaclass=ABCMeta):
     ):
         self.hs = hs
         self.server_name = hs.hostname  # nb must be called this for @cached
-        self._clock = hs.get_clock()
+        self.clock = hs.get_clock()  # nb must be called this for @cached
         self.database_engine = database.engine
         self.db_pool = database
 
-        self.external_cached_functions: Dict[str, CachedFunction] = {}
+        self.external_cached_functions: dict[str, CachedFunction] = {}
 
     def process_replication_rows(  # noqa: B027 (no-op by design)
         self,
@@ -176,7 +176,7 @@ class SQLBaseStore(metaclass=ABCMeta):
         )
 
     def _attempt_to_invalidate_cache(
-        self, cache_name: str, key: Optional[Collection[Any]]
+        self, cache_name: str, key: Collection[Any] | None
     ) -> bool:
         """Attempts to invalidate the cache of the given name, ignoring if the
         cache doesn't exist. Mainly used for invalidating caches on workers,
@@ -218,7 +218,7 @@ class SQLBaseStore(metaclass=ABCMeta):
         self.external_cached_functions[cache_name] = func
 
 
-def db_to_json(db_content: Union[memoryview, bytes, bytearray, str]) -> Any:
+def db_to_json(db_content: memoryview | bytes | bytearray | str) -> Any:
     """
     Take some data from a database row and return a JSON-decoded object.
 
diff --git a/synapse/storage/admin_client_config.py b/synapse/storage/admin_client_config.py
index 07acddc660..b56e21edfa 100644
--- a/synapse/storage/admin_client_config.py
+++ b/synapse/storage/admin_client_config.py
@@ -1,5 +1,4 @@
 import logging
-from typing import Optional
 
 from synapse.types import JsonMapping
 
@@ -9,7 +8,7 @@ logger = logging.getLogger(__name__)
 class AdminClientConfig:
     """Class to track various Synapse-specific admin-only client-impacting config options."""
 
-    def __init__(self, account_data: Optional[JsonMapping]):
+    def __init__(self, account_data: JsonMapping | None):
         # Allow soft-failed events to be returned down `/sync` and other
         # client APIs. `io.element.synapse.soft_failed: true` is added to the
         # `unsigned` portion of the event to inform clients that the event
diff --git a/synapse/storage/background_updates.py b/synapse/storage/background_updates.py
index acc0abee63..311534c5e7 100644
--- a/synapse/storage/background_updates.py
+++ b/synapse/storage/background_updates.py
@@ -28,24 +28,20 @@ from typing import (
     AsyncContextManager,
     Awaitable,
     Callable,
-    Dict,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
     cast,
 )
 
 import attr
+from pydantic import BaseModel
 
-from synapse._pydantic_compat import BaseModel
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.storage.engines import PostgresEngine
 from synapse.storage.types import Connection, Cursor
 from synapse.types import JsonDict, StrCollection
-from synapse.util import Clock, json_encoder
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+from synapse.util.json import json_encoder
 
 from . import engines
 
@@ -96,7 +92,7 @@ class ForeignKeyConstraint(Constraint):
     """
 
     referenced_table: str
-    columns: Sequence[Tuple[str, str]]
+    columns: Sequence[tuple[str, str]]
     deferred: bool
 
     def make_check_clause(self, table: str) -> str:
@@ -167,15 +163,15 @@ class _BackgroundUpdateContextManager:
 
     async def __aenter__(self) -> int:
         if self._sleep:
-            await self._clock.sleep(self._sleep_duration_ms / 1000)
+            await self._clock.sleep(Duration(milliseconds=self._sleep_duration_ms))
 
         return self._update_duration_ms
 
     async def __aexit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc: Optional[BaseException],
-        tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        tb: TracebackType | None,
     ) -> None:
         pass
 
@@ -200,7 +196,7 @@ class BackgroundUpdatePerformance:
         self.avg_item_count += 0.1 * (item_count - self.avg_item_count)
         self.avg_duration_ms += 0.1 * (duration_ms - self.avg_duration_ms)
 
-    def average_items_per_ms(self) -> Optional[float]:
+    def average_items_per_ms(self) -> float | None:
         """An estimate of how long it takes to do a single update.
         Returns:
             A duration in ms as a float
@@ -216,7 +212,7 @@ class BackgroundUpdatePerformance:
             # changes in how long the update process takes.
             return float(self.avg_item_count) / float(self.avg_duration_ms)
 
-    def total_items_per_ms(self) -> Optional[float]:
+    def total_items_per_ms(self) -> float | None:
         """An estimate of how long it takes to do a single update.
         Returns:
             A duration in ms as a float
@@ -254,14 +250,14 @@ class BackgroundUpdater:
         self._database_name = database.name()
 
         # if a background update is currently running, its name.
-        self._current_background_update: Optional[str] = None
+        self._current_background_update: str | None = None
 
-        self._on_update_callback: Optional[ON_UPDATE_CALLBACK] = None
-        self._default_batch_size_callback: Optional[DEFAULT_BATCH_SIZE_CALLBACK] = None
-        self._min_batch_size_callback: Optional[MIN_BATCH_SIZE_CALLBACK] = None
+        self._on_update_callback: ON_UPDATE_CALLBACK | None = None
+        self._default_batch_size_callback: DEFAULT_BATCH_SIZE_CALLBACK | None = None
+        self._min_batch_size_callback: MIN_BATCH_SIZE_CALLBACK | None = None
 
-        self._background_update_performance: Dict[str, BackgroundUpdatePerformance] = {}
-        self._background_update_handlers: Dict[str, _BackgroundUpdateHandler] = {}
+        self._background_update_performance: dict[str, BackgroundUpdatePerformance] = {}
+        self._background_update_handlers: dict[str, _BackgroundUpdateHandler] = {}
         # TODO: all these bool flags make me feel icky---can we combine into a status
         # enum?
         self._all_done = False
@@ -284,6 +280,13 @@ class BackgroundUpdater:
         self.sleep_duration_ms = hs.config.background_updates.sleep_duration_ms
         self.sleep_enabled = hs.config.background_updates.sleep_enabled
 
+    def shutdown(self) -> None:
+        """
+        Stop any further background updates from happening.
+        """
+        self.enabled = False
+        self._background_update_handlers.clear()
+
     def get_status(self) -> UpdaterStatus:
         """An integer summarising the updater status. Used as a metric."""
         if self._aborted:
@@ -301,8 +304,8 @@ class BackgroundUpdater:
     def register_update_controller_callbacks(
         self,
         on_update: ON_UPDATE_CALLBACK,
-        default_batch_size: Optional[DEFAULT_BATCH_SIZE_CALLBACK] = None,
-        min_batch_size: Optional[DEFAULT_BATCH_SIZE_CALLBACK] = None,
+        default_batch_size: DEFAULT_BATCH_SIZE_CALLBACK | None = None,
+        min_batch_size: DEFAULT_BATCH_SIZE_CALLBACK | None = None,
     ) -> None:
         """Register callbacks from a module for each hook."""
         if self._on_update_callback is not None:
@@ -377,7 +380,7 @@ class BackgroundUpdater:
 
         return self.minimum_background_batch_size
 
-    def get_current_update(self) -> Optional[BackgroundUpdatePerformance]:
+    def get_current_update(self) -> BackgroundUpdatePerformance | None:
         """Returns the current background update, if any."""
 
         update_name = self._current_background_update
@@ -395,9 +398,8 @@ class BackgroundUpdater:
             # if we start a new background update, not all updates are done.
             self._all_done = False
             sleep = self.sleep_enabled
-            run_as_background_process(
+            self.hs.run_as_background_process(
                 "background_updates",
-                self.server_name,
                 self.run_background_updates,
                 sleep,
             )
@@ -524,14 +526,14 @@ class BackgroundUpdater:
             True if we have finished running all the background updates, otherwise False
         """
 
-        def get_background_updates_txn(txn: Cursor) -> List[Tuple[str, Optional[str]]]:
+        def get_background_updates_txn(txn: Cursor) -> list[tuple[str, str | None]]:
             txn.execute(
                 """
                 SELECT update_name, depends_on FROM background_updates
                 ORDER BY ordering, update_name
                 """
             )
-            return cast(List[Tuple[str, Optional[str]]], txn.fetchall())
+            return cast(list[tuple[str, str | None]], txn.fetchall())
 
         if not self._current_background_update:
             all_pending_updates = await self.db_pool.runInteraction(
@@ -667,10 +669,10 @@ class BackgroundUpdater:
         index_name: str,
         table: str,
         columns: Iterable[str],
-        where_clause: Optional[str] = None,
+        where_clause: str | None = None,
         unique: bool = False,
         psql_only: bool = False,
-        replaces_index: Optional[str] = None,
+        replaces_index: str | None = None,
     ) -> None:
         """Helper for store classes to do a background index addition
 
@@ -761,10 +763,10 @@ class BackgroundUpdater:
         index_name: str,
         table: str,
         columns: Iterable[str],
-        where_clause: Optional[str] = None,
+        where_clause: str | None = None,
         unique: bool = False,
         psql_only: bool = False,
-        replaces_index: Optional[str] = None,
+        replaces_index: str | None = None,
     ) -> None:
         """Add an index in the background.
 
@@ -860,7 +862,7 @@ class BackgroundUpdater:
                 c.execute(sql)
 
         if isinstance(self.db_pool.engine, engines.PostgresEngine):
-            runner: Optional[Callable[[LoggingDatabaseConnection], None]] = (
+            runner: Callable[[LoggingDatabaseConnection], None] | None = (
                 create_index_psql
             )
         elif psql_only:
@@ -952,14 +954,14 @@ class BackgroundUpdater:
         #      match the constraint.
         #   3. We try re-validating the constraint.
 
-        parsed_progress = ValidateConstraintProgress.parse_obj(progress)
+        parsed_progress = ValidateConstraintProgress.model_validate(progress)
 
         if parsed_progress.state == ValidateConstraintProgress.State.check:
             return_columns = ", ".join(unique_columns)
             order_columns = ", ".join(unique_columns)
 
             where_clause = ""
-            args: List[Any] = []
+            args: list[Any] = []
             if parsed_progress.lower_bound:
                 where_clause = f"""WHERE ({order_columns}) > ({", ".join("?" for _ in unique_columns)})"""
                 args.extend(parsed_progress.lower_bound)
diff --git a/synapse/storage/controllers/persist_events.py b/synapse/storage/controllers/persist_events.py
index 120934af57..2948227807 100644
--- a/synapse/storage/controllers/persist_events.py
+++ b/synapse/storage/controllers/persist_events.py
@@ -31,17 +31,10 @@ from typing import (
     Callable,
     ClassVar,
     Collection,
-    Deque,
-    Dict,
     Generator,
     Generic,
     Iterable,
-    List,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
 )
 
 import attr
@@ -62,7 +55,6 @@ from synapse.logging.opentracing import (
     trace,
 )
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.storage.controllers.state import StateStorageController
 from synapse.storage.databases import Databases
 from synapse.storage.databases.main.events import DeltaState
@@ -144,7 +136,7 @@ class _PersistEventsTask:
 
     name: ClassVar[str] = "persist_event_batch"  # used for opentracing
 
-    events_and_contexts: List[EventPersistencePair]
+    events_and_contexts: list[EventPersistencePair]
     backfilled: bool
 
     def try_merge(self, task: "_EventPersistQueueTask") -> bool:
@@ -170,7 +162,7 @@ class _UpdateCurrentStateTask:
         return isinstance(task, _UpdateCurrentStateTask)
 
 
-_EventPersistQueueTask = Union[_PersistEventsTask, _UpdateCurrentStateTask]
+_EventPersistQueueTask = _PersistEventsTask | _UpdateCurrentStateTask
 _PersistResult = TypeVar("_PersistResult")
 
 
@@ -179,7 +171,7 @@ class _EventPersistQueueItem(Generic[_PersistResult]):
     task: _EventPersistQueueTask
     deferred: ObservableDeferred[_PersistResult]
 
-    parent_opentracing_span_contexts: List = attr.ib(factory=list)
+    parent_opentracing_span_contexts: list = attr.ib(factory=list)
     """A list of opentracing spans waiting for this batch"""
 
     opentracing_span_context: Any = None
@@ -195,6 +187,7 @@ class _EventPeristenceQueue(Generic[_PersistResult]):
 
     def __init__(
         self,
+        hs: "HomeServer",
         server_name: str,
         per_item_callback: Callable[
             [str, _EventPersistQueueTask],
@@ -207,8 +200,9 @@ class _EventPeristenceQueue(Generic[_PersistResult]):
         and its result will be returned via the Deferreds returned from add_to_queue.
         """
         self.server_name = server_name
-        self._event_persist_queues: Dict[str, Deque[_EventPersistQueueItem]] = {}
-        self._currently_persisting_rooms: Set[str] = set()
+        self.hs = hs
+        self._event_persist_queues: dict[str, deque[_EventPersistQueueItem]] = {}
+        self._currently_persisting_rooms: set[str] = set()
         self._per_item_callback = per_item_callback
 
     async def add_to_queue(
@@ -311,7 +305,7 @@ class _EventPeristenceQueue(Generic[_PersistResult]):
                 self._currently_persisting_rooms.discard(room_id)
 
         # set handle_queue_loop off in the background
-        run_as_background_process("persist_events", self.server_name, handle_queue_loop)
+        self.hs.run_as_background_process("persist_events", handle_queue_loop)
 
     def _get_drainining_queue(
         self, room_id: str
@@ -354,7 +348,7 @@ class EventsPersistenceStorageController:
         self._instance_name = hs.get_instance_name()
         self.is_mine_id = hs.is_mine_id
         self._event_persist_queue = _EventPeristenceQueue(
-            self.server_name, self._process_event_persist_queue_task
+            hs, self.server_name, self._process_event_persist_queue_task
         )
         self._state_resolution_handler = hs.get_state_resolution_handler()
         self._state_controller = state_controller
@@ -364,7 +358,7 @@ class EventsPersistenceStorageController:
         self,
         room_id: str,
         task: _EventPersistQueueTask,
-    ) -> Dict[str, str]:
+    ) -> dict[str, str]:
         """Callback for the _event_persist_queue
 
         Returns:
@@ -393,7 +387,7 @@ class EventsPersistenceStorageController:
         self,
         events_and_contexts: Iterable[EventPersistencePair],
         backfilled: bool = False,
-    ) -> Tuple[List[EventBase], RoomStreamToken]:
+    ) -> tuple[list[EventBase], RoomStreamToken]:
         """
         Write events to the database
         Args:
@@ -413,8 +407,8 @@ class EventsPersistenceStorageController:
             PartialStateConflictError: if attempting to persist a partial state event in
                 a room that has been un-partial stated.
         """
-        event_ids: List[str] = []
-        partitioned: Dict[str, List[EventPersistencePair]] = {}
+        event_ids: list[str] = []
+        partitioned: dict[str, list[EventPersistencePair]] = {}
         for event, ctx in events_and_contexts:
             partitioned.setdefault(event.room_id, []).append((event, ctx))
             event_ids.append(event.event_id)
@@ -430,8 +424,8 @@ class EventsPersistenceStorageController:
         set_tag(SynapseTags.FUNC_ARG_PREFIX + "backfilled", str(backfilled))
 
         async def enqueue(
-            item: Tuple[str, List[EventPersistencePair]],
-        ) -> Dict[str, str]:
+            item: tuple[str, list[EventPersistencePair]],
+        ) -> dict[str, str]:
             room_id, evs_ctxs = item
             return await self._event_persist_queue.add_to_queue(
                 room_id,
@@ -446,7 +440,7 @@ class EventsPersistenceStorageController:
         #
         # Since we use `yieldable_gather_results` we need to merge the returned list
         # of dicts into one.
-        replaced_events: Dict[str, str] = {}
+        replaced_events: dict[str, str] = {}
         for d in ret_vals:
             replaced_events.update(d)
 
@@ -468,7 +462,7 @@ class EventsPersistenceStorageController:
     @trace
     async def persist_event(
         self, event: EventBase, context: EventContext, backfilled: bool = False
-    ) -> Tuple[EventBase, PersistedEventPosition, RoomStreamToken]:
+    ) -> tuple[EventBase, PersistedEventPosition, RoomStreamToken]:
         """
         Returns:
             The event, stream ordering of `event`, and the stream ordering of the
@@ -572,7 +566,7 @@ class EventsPersistenceStorageController:
 
     async def _persist_event_batch(
         self, room_id: str, task: _PersistEventsTask
-    ) -> Dict[str, str]:
+    ) -> dict[str, str]:
         """Callback for the _event_persist_queue
 
         Calculates the change to current state and forward extremities, and
@@ -591,7 +585,7 @@ class EventsPersistenceStorageController:
         events_and_contexts = task.events_and_contexts
         backfilled = task.backfilled
 
-        replaced_events: Dict[str, str] = {}
+        replaced_events: dict[str, str] = {}
         if not events_and_contexts:
             return replaced_events
 
@@ -677,8 +671,8 @@ class EventsPersistenceStorageController:
         return replaced_events
 
     async def _calculate_new_forward_extremities_and_state_delta(
-        self, room_id: str, ev_ctx_rm: List[EventPersistencePair]
-    ) -> Tuple[Optional[Set[str]], Optional[DeltaState]]:
+        self, room_id: str, ev_ctx_rm: list[EventPersistencePair]
+    ) -> tuple[set[str] | None, DeltaState | None]:
         """Calculates the new forward extremities and state delta for a room
         given events to persist.
 
@@ -802,9 +796,9 @@ class EventsPersistenceStorageController:
     async def _calculate_new_extremities(
         self,
         room_id: str,
-        event_contexts: List[EventPersistencePair],
+        event_contexts: list[EventPersistencePair],
         latest_event_ids: AbstractSet[str],
-    ) -> Set[str]:
+    ) -> set[str]:
         """Calculates the new forward extremities for a room given events to
         persist.
 
@@ -862,10 +856,10 @@ class EventsPersistenceStorageController:
     async def _get_new_state_after_events(
         self,
         room_id: str,
-        events_context: List[EventPersistencePair],
+        events_context: list[EventPersistencePair],
         old_latest_event_ids: AbstractSet[str],
-        new_latest_event_ids: Set[str],
-    ) -> Tuple[Optional[StateMap[str]], Optional[StateMap[str]], Set[str]]:
+        new_latest_event_ids: set[str],
+    ) -> tuple[StateMap[str] | None, StateMap[str] | None, set[str]]:
         """Calculate the current state dict after adding some new events to
         a room
 
@@ -1036,11 +1030,11 @@ class EventsPersistenceStorageController:
     async def _prune_extremities(
         self,
         room_id: str,
-        new_latest_event_ids: Set[str],
+        new_latest_event_ids: set[str],
         resolved_state_group: int,
-        event_id_to_state_group: Dict[str, int],
-        events_context: List[EventPersistencePair],
-    ) -> Set[str]:
+        event_id_to_state_group: dict[str, int],
+        events_context: list[EventPersistencePair],
+    ) -> set[str]:
         """See if we can prune any of the extremities after calculating the
         resolved state.
         """
@@ -1107,7 +1101,7 @@ class EventsPersistenceStorageController:
             # as a first cut.
             events_to_check: Collection[EventBase] = [event]
             while events_to_check:
-                new_events: Set[str] = set()
+                new_events: set[str] = set()
                 for event_to_check in events_to_check:
                     if self.is_mine_id(event_to_check.sender):
                         if event_to_check.type != EventTypes.Dummy:
@@ -1176,7 +1170,7 @@ class EventsPersistenceStorageController:
     async def _is_server_still_joined(
         self,
         room_id: str,
-        ev_ctx_rm: List[EventPersistencePair],
+        ev_ctx_rm: list[EventPersistencePair],
         delta: DeltaState,
     ) -> bool:
         """Check if the server will still be joined after the given events have
diff --git a/synapse/storage/controllers/purge_events.py b/synapse/storage/controllers/purge_events.py
index 14b37ac543..8a2053d25a 100644
--- a/synapse/storage/controllers/purge_events.py
+++ b/synapse/storage/controllers/purge_events.py
@@ -25,8 +25,6 @@ from typing import (
     TYPE_CHECKING,
     Collection,
     Mapping,
-    Optional,
-    Set,
 )
 
 from synapse.logging.context import nested_logging_context
@@ -34,6 +32,7 @@ from synapse.metrics.background_process_metrics import wrap_as_background_proces
 from synapse.storage.database import LoggingTransaction
 from synapse.storage.databases import Databases
 from synapse.types.storage import _BackgroundUpdates
+from synapse.util.duration import Duration
 from synapse.util.stringutils import shortstr
 
 if TYPE_CHECKING:
@@ -46,14 +45,13 @@ class PurgeEventsStorageController:
     """High level interface for purging rooms and event history."""
 
     def __init__(self, hs: "HomeServer", stores: Databases):
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
         self.stores = stores
 
         if hs.config.worker.run_background_tasks:
             self._delete_state_loop_call = hs.get_clock().looping_call(
-                self._delete_state_groups_loop, 60 * 1000
+                self._delete_state_groups_loop, Duration(minutes=1)
             )
 
         self.stores.state.db_pool.updates.register_background_update_handler(
@@ -100,7 +98,7 @@ class PurgeEventsStorageController:
     async def _find_unreferenced_groups(
         self,
         state_groups: Collection[int],
-    ) -> Set[int]:
+    ) -> set[int]:
         """Used when purging history to figure out which state groups can be
         deleted.
 
@@ -317,7 +315,7 @@ class PurgeEventsStorageController:
         self,
         last_checked_state_group: int,
         batch_size: int,
-    ) -> tuple[Set[int], int, bool]:
+    ) -> tuple[set[int], int, bool]:
         """Used when deleting unreferenced state groups in the background to figure out
         which state groups can be deleted.
         To avoid increased DB usage due to de-deltaing state groups, this returns only
@@ -447,7 +445,7 @@ class PurgeEventsStorageController:
 
         # Remove state groups from deletion_candidates which are directly referenced or share a
         # future edge with a referenced state group within this batch.
-        def filter_reference_chains(group: Optional[int]) -> None:
+        def filter_reference_chains(group: int | None) -> None:
             while group is not None:
                 deletion_candidates.discard(group)
                 group = state_group_edges.get(group)
diff --git a/synapse/storage/controllers/state.py b/synapse/storage/controllers/state.py
index 8997f4526f..4885268305 100644
--- a/synapse/storage/controllers/state.py
+++ b/synapse/storage/controllers/state.py
@@ -25,14 +25,8 @@ from typing import (
     AbstractSet,
     Callable,
     Collection,
-    Dict,
-    FrozenSet,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Union,
 )
 
 from synapse.api.constants import EventTypes, Membership
@@ -69,15 +63,17 @@ class StateStorageController:
 
     def __init__(self, hs: "HomeServer", stores: "Databases"):
         self.server_name = hs.hostname  # nb must be called this for @cached
+        self.clock = hs.get_clock()
         self._is_mine_id = hs.is_mine_id
-        self._clock = hs.get_clock()
         self.stores = stores
         self._partial_state_events_tracker = PartialStateEventsTracker(stores.main)
         self._partial_state_room_tracker = PartialCurrentStateTracker(stores.main)
 
         # Used by `_get_joined_hosts` to ensure only one thing mutates the cache
         # at a time. Keyed by room_id.
-        self._joined_host_linearizer = Linearizer("_JoinedHostsCache")
+        self._joined_host_linearizer = Linearizer(
+            name="_JoinedHostsCache", clock=self.clock
+        )
 
     def notify_event_un_partial_stated(self, event_id: str) -> None:
         self._partial_state_events_tracker.notify_un_partial_stated(event_id)
@@ -93,7 +89,7 @@ class StateStorageController:
     @tag_args
     async def get_state_group_delta(
         self, state_group: int
-    ) -> Tuple[Optional[int], Optional[StateMap[str]]]:
+    ) -> tuple[int | None, StateMap[str] | None]:
         """Given a state group try to return a previous group and a delta between
         the old and the new.
 
@@ -112,7 +108,7 @@ class StateStorageController:
     @tag_args
     async def get_state_groups_ids(
         self, _room_id: str, event_ids: Collection[str], await_full_state: bool = True
-    ) -> Dict[int, MutableStateMap[str]]:
+    ) -> dict[int, MutableStateMap[str]]:
         """Get the event IDs of all the state for the state groups for the given events
 
         Args:
@@ -143,7 +139,7 @@ class StateStorageController:
     @trace
     @tag_args
     async def get_state_ids_for_group(
-        self, state_group: int, state_filter: Optional[StateFilter] = None
+        self, state_group: int, state_filter: StateFilter | None = None
     ) -> StateMap[str]:
         """Get the event IDs of all the state in the given state group
 
@@ -162,7 +158,7 @@ class StateStorageController:
     @tag_args
     async def get_state_groups(
         self, room_id: str, event_ids: Collection[str]
-    ) -> Dict[int, List[EventBase]]:
+    ) -> dict[int, list[EventBase]]:
         """Get the state groups for the given list of event_ids
 
         Args:
@@ -198,8 +194,8 @@ class StateStorageController:
     @trace
     @tag_args
     async def _get_state_groups_from_groups(
-        self, groups: List[int], state_filter: StateFilter
-    ) -> Dict[int, StateMap[str]]:
+        self, groups: list[int], state_filter: StateFilter
+    ) -> dict[int, StateMap[str]]:
         """Returns the state groups for a given set of groups, filtering on
         types of state events.
 
@@ -219,8 +215,8 @@ class StateStorageController:
     @trace
     @tag_args
     async def get_state_for_events(
-        self, event_ids: Collection[str], state_filter: Optional[StateFilter] = None
-    ) -> Dict[str, StateMap[EventBase]]:
+        self, event_ids: Collection[str], state_filter: StateFilter | None = None
+    ) -> dict[str, StateMap[EventBase]]:
         """Given a list of event_ids and type tuples, return a list of state
         dicts for each event.
 
@@ -273,9 +269,9 @@ class StateStorageController:
     async def get_state_ids_for_events(
         self,
         event_ids: Collection[str],
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
-    ) -> Dict[str, StateMap[str]]:
+    ) -> dict[str, StateMap[str]]:
         """
         Get the room states after each of a list of events.
 
@@ -324,7 +320,7 @@ class StateStorageController:
     @trace
     @tag_args
     async def get_state_for_event(
-        self, event_id: str, state_filter: Optional[StateFilter] = None
+        self, event_id: str, state_filter: StateFilter | None = None
     ) -> StateMap[EventBase]:
         """
         Get the state dict corresponding to a particular event
@@ -351,7 +347,7 @@ class StateStorageController:
     async def get_state_ids_for_event(
         self,
         event_id: str,
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
     ) -> StateMap[str]:
         """
@@ -384,7 +380,7 @@ class StateStorageController:
     async def get_state_after_event(
         self,
         event_id: str,
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
     ) -> StateMap[str]:
         """
@@ -425,7 +421,7 @@ class StateStorageController:
         self,
         room_id: str,
         stream_position: StreamToken,
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
     ) -> StateMap[str]:
         """Get the room state at a particular stream position
@@ -481,7 +477,7 @@ class StateStorageController:
         self,
         room_id: str,
         stream_position: StreamToken,
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
     ) -> StateMap[EventBase]:
         """Same as `get_state_ids_at` but also fetches the events"""
@@ -502,8 +498,8 @@ class StateStorageController:
     @trace
     @tag_args
     async def get_state_for_groups(
-        self, groups: Iterable[int], state_filter: Optional[StateFilter] = None
-    ) -> Dict[int, MutableStateMap[str]]:
+        self, groups: Iterable[int], state_filter: StateFilter | None = None
+    ) -> dict[int, MutableStateMap[str]]:
         """Gets the state at each of a list of state groups, optionally
         filtering by type/state_key
 
@@ -548,9 +544,9 @@ class StateStorageController:
         self,
         event_id: str,
         room_id: str,
-        prev_group: Optional[int],
-        delta_ids: Optional[StateMap[str]],
-        current_state_ids: Optional[StateMap[str]],
+        prev_group: int | None,
+        delta_ids: StateMap[str] | None,
+        current_state_ids: StateMap[str] | None,
     ) -> int:
         """Store a new set of state, returning a newly assigned state group.
 
@@ -577,9 +573,9 @@ class StateStorageController:
     async def get_current_state_ids(
         self,
         room_id: str,
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
-        on_invalidate: Optional[Callable[[], None]] = None,
+        on_invalidate: Callable[[], None] | None = None,
     ) -> StateMap[str]:
         """Get the current state event ids for a room based on the
         current_state_events table.
@@ -616,7 +612,7 @@ class StateStorageController:
 
     @trace
     @tag_args
-    async def get_canonical_alias_for_room(self, room_id: str) -> Optional[str]:
+    async def get_canonical_alias_for_room(self, room_id: str) -> str | None:
         """Get canonical alias for room, if any
 
         Args:
@@ -641,9 +637,7 @@ class StateStorageController:
         return event.content.get("alias")
 
     @cached()
-    async def get_server_acl_for_room(
-        self, room_id: str
-    ) -> Optional[ServerAclEvaluator]:
+    async def get_server_acl_for_room(self, room_id: str) -> ServerAclEvaluator | None:
         """Get the server ACL evaluator for room, if any
 
         This does up-front parsing of the content to ignore bad data and pre-compile
@@ -669,7 +663,7 @@ class StateStorageController:
     @tag_args
     async def get_current_state_deltas(
         self, prev_stream_id: int, max_stream_id: int
-    ) -> Tuple[int, List[StateDelta]]:
+    ) -> tuple[int, list[StateDelta]]:
         """Fetch a list of room state changes since the given stream id
 
         Args:
@@ -682,12 +676,14 @@ class StateStorageController:
                - the stream id which these results go up to
                - list of current_state_delta_stream rows. If it is empty, we are
                  up to date.
+
+            A maximum of 100 rows will be returned.
         """
         # FIXME(faster_joins): what do we do here?
         #   https://github.com/matrix-org/synapse/issues/13008
 
         return await self.stores.main.get_partial_current_state_deltas(
-            prev_stream_id, max_stream_id
+            prev_stream_id, max_stream_id, limit=100
         )
 
     @trace
@@ -695,7 +691,7 @@ class StateStorageController:
     async def get_current_state(
         self,
         room_id: str,
-        state_filter: Optional[StateFilter] = None,
+        state_filter: StateFilter | None = None,
         await_full_state: bool = True,
     ) -> StateMap[EventBase]:
         """Same as `get_current_state_ids` but also fetches the events"""
@@ -717,7 +713,7 @@ class StateStorageController:
     @tag_args
     async def get_current_state_event(
         self, room_id: str, event_type: str, state_key: str
-    ) -> Optional[EventBase]:
+    ) -> EventBase | None:
         """Get the current state event for the given type/state_key."""
 
         key = (event_type, state_key)
@@ -741,7 +737,7 @@ class StateStorageController:
 
     @trace
     @tag_args
-    async def get_current_hosts_in_room_ordered(self, room_id: str) -> Tuple[str, ...]:
+    async def get_current_hosts_in_room_ordered(self, room_id: str) -> tuple[str, ...]:
         """Get current hosts in room based on current state.
 
         Blocks until we have full state for the given room. This only happens for rooms
@@ -803,8 +799,8 @@ class StateStorageController:
 
     async def get_joined_hosts(
         self, room_id: str, state_entry: "_StateCacheEntry"
-    ) -> FrozenSet[str]:
-        state_group: Union[object, int] = state_entry.state_group
+    ) -> frozenset[str]:
+        state_group: object | int = state_entry.state_group
         if not state_group:
             # If state_group is None it means it has yet to be assigned a
             # state group, i.e. we need to make sure that calls with a state_group
@@ -813,9 +809,7 @@ class StateStorageController:
             state_group = object()
 
         assert state_group is not None
-        with Measure(
-            self._clock, name="get_joined_hosts", server_name=self.server_name
-        ):
+        with Measure(self.clock, name="get_joined_hosts", server_name=self.server_name):
             return await self._get_joined_hosts(
                 room_id, state_group, state_entry=state_entry
             )
@@ -824,9 +818,9 @@ class StateStorageController:
     async def _get_joined_hosts(
         self,
         room_id: str,
-        state_group: Union[object, int],
+        state_group: object | int,
         state_entry: "_StateCacheEntry",
-    ) -> FrozenSet[str]:
+    ) -> frozenset[str]:
         # We don't use `state_group`, it's there so that we can cache based on
         # it. However, its important that its never None, since two
         # current_state's with a state_group of None are likely to be different.
diff --git a/synapse/storage/controllers/stats.py b/synapse/storage/controllers/stats.py
index 9445a86240..5378797f04 100644
--- a/synapse/storage/controllers/stats.py
+++ b/synapse/storage/controllers/stats.py
@@ -20,7 +20,8 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Collection, Counter, List, Tuple
+from collections import Counter
+from typing import TYPE_CHECKING, Collection
 
 from synapse.api.errors import SynapseError
 from synapse.storage.database import LoggingTransaction
@@ -39,7 +40,7 @@ class StatsController:
     def __init__(self, hs: "HomeServer", stores: Databases):
         self.stores = stores
 
-    async def get_room_db_size_estimate(self) -> List[Tuple[str, int]]:
+    async def get_room_db_size_estimate(self) -> list[tuple[str, int]]:
         """Get an estimate of the largest rooms and how much database space they
         use, in bytes.
 
diff --git a/synapse/storage/database.py b/synapse/storage/database.py
index f7aec16c96..6e38b55686 100644
--- a/synapse/storage/database.py
+++ b/synapse/storage/database.py
@@ -31,16 +31,11 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
     Iterable,
     Iterator,
-    List,
     Literal,
     Mapping,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
     TypeVar,
     cast,
     overload,
@@ -61,13 +56,13 @@ from synapse.logging.context import (
     current_context,
     make_deferred_yieldable,
 )
-from synapse.metrics import SERVER_NAME_LABEL, LaterGauge, register_threadpool
-from synapse.metrics.background_process_metrics import run_as_background_process
+from synapse.metrics import SERVER_NAME_LABEL, register_threadpool
 from synapse.storage.background_updates import BackgroundUpdater
 from synapse.storage.engines import BaseDatabaseEngine, PostgresEngine, Sqlite3Engine
 from synapse.storage.types import Connection, Cursor, SQLQueryParameters
 from synapse.types import StrCollection
 from synapse.util.async_helpers import delay_cancellation
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
 
 if TYPE_CHECKING:
@@ -146,7 +141,7 @@ def make_pool(
     def _on_new_connection(conn: Connection) -> None:
         # Ensure we have a logging context so we can correctly track queries,
         # etc.
-        with LoggingContext("db.on_new_connection"):
+        with LoggingContext(name="db.on_new_connection", server_name=server_name):
             engine.on_new_connection(
                 LoggingDatabaseConnection(
                     conn=conn,
@@ -218,10 +213,10 @@ class LoggingDatabaseConnection:
     def cursor(
         self,
         *,
-        txn_name: Optional[str] = None,
-        after_callbacks: Optional[List["_CallbackListEntry"]] = None,
-        async_after_callbacks: Optional[List["_AsyncCallbackListEntry"]] = None,
-        exception_callbacks: Optional[List["_CallbackListEntry"]] = None,
+        txn_name: str | None = None,
+        after_callbacks: list["_CallbackListEntry"] | None = None,
+        async_after_callbacks: list["_AsyncCallbackListEntry"] | None = None,
+        exception_callbacks: list["_CallbackListEntry"] | None = None,
     ) -> "LoggingTransaction":
         if not txn_name:
             txn_name = self.default_txn_name
@@ -251,10 +246,10 @@ class LoggingDatabaseConnection:
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_value: Optional[BaseException],
-        traceback: Optional[types.TracebackType],
-    ) -> Optional[bool]:
+        exc_type: type[BaseException] | None,
+        exc_value: BaseException | None,
+        traceback: types.TracebackType | None,
+    ) -> bool | None:
         return self.conn.__exit__(exc_type, exc_value, traceback)
 
     # Proxy through any unknown lookups to the DB conn class.
@@ -263,9 +258,9 @@ class LoggingDatabaseConnection:
 
 
 # The type of entry which goes on our after_callbacks and exception_callbacks lists.
-_CallbackListEntry = Tuple[Callable[..., object], Tuple[object, ...], Dict[str, object]]
-_AsyncCallbackListEntry = Tuple[
-    Callable[..., Awaitable], Tuple[object, ...], Dict[str, object]
+_CallbackListEntry = tuple[Callable[..., object], tuple[object, ...], dict[str, object]]
+_AsyncCallbackListEntry = tuple[
+    Callable[..., Awaitable], tuple[object, ...], dict[str, object]
 ]
 
 P = ParamSpec("P")
@@ -312,9 +307,9 @@ class LoggingTransaction:
         name: str,
         server_name: str,
         database_engine: BaseDatabaseEngine,
-        after_callbacks: Optional[List[_CallbackListEntry]] = None,
-        async_after_callbacks: Optional[List[_AsyncCallbackListEntry]] = None,
-        exception_callbacks: Optional[List[_CallbackListEntry]] = None,
+        after_callbacks: list[_CallbackListEntry] | None = None,
+        async_after_callbacks: list[_AsyncCallbackListEntry] | None = None,
+        exception_callbacks: list[_CallbackListEntry] | None = None,
     ):
         self.txn = txn
         self.name = name
@@ -328,7 +323,7 @@ class LoggingTransaction:
         self, callback: Callable[P, object], *args: P.args, **kwargs: P.kwargs
     ) -> None:
         """Call the given callback on the main twisted thread after the transaction has
-        finished.
+        finished successfully.
 
         Mostly used to invalidate the caches on the correct thread.
 
@@ -349,7 +344,7 @@ class LoggingTransaction:
         self, callback: Callable[P, Awaitable], *args: P.args, **kwargs: P.kwargs
     ) -> None:
         """Call the given asynchronous callback on the main twisted thread after
-        the transaction has finished (but before those added in `call_after`).
+        the transaction has finished successfully (but before those added in `call_after`).
 
         Mostly used to invalidate remote caches after transactions.
 
@@ -384,16 +379,16 @@ class LoggingTransaction:
         assert self.exception_callbacks is not None
         self.exception_callbacks.append((callback, args, kwargs))
 
-    def fetchone(self) -> Optional[Tuple]:
+    def fetchone(self) -> tuple | None:
         return self.txn.fetchone()
 
-    def fetchmany(self, size: Optional[int] = None) -> List[Tuple]:
+    def fetchmany(self, size: int | None = None) -> list[tuple]:
         return self.txn.fetchmany(size=size)
 
-    def fetchall(self) -> List[Tuple]:
+    def fetchall(self) -> list[tuple]:
         return self.txn.fetchall()
 
-    def __iter__(self) -> Iterator[Tuple]:
+    def __iter__(self) -> Iterator[tuple]:
         return self.txn.__iter__()
 
     @property
@@ -403,7 +398,7 @@ class LoggingTransaction:
     @property
     def description(
         self,
-    ) -> Optional[Sequence[Any]]:
+    ) -> Sequence[Any] | None:
         return self.txn.description
 
     def execute_batch(self, sql: str, args: Iterable[Iterable[Any]]) -> None:
@@ -434,9 +429,9 @@ class LoggingTransaction:
         self,
         sql: str,
         values: Iterable[Iterable[Any]],
-        template: Optional[str] = None,
+        template: str | None = None,
         fetch: bool = True,
-    ) -> List[Tuple]:
+    ) -> list[tuple]:
         """Corresponds to psycopg2.extras.execute_values. Only available when
         using postgres.
 
@@ -541,17 +536,17 @@ class LoggingTransaction:
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_value: Optional[BaseException],
-        traceback: Optional[types.TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_value: BaseException | None,
+        traceback: types.TracebackType | None,
     ) -> None:
         self.close()
 
 
 class PerformanceCounters:
     def __init__(self) -> None:
-        self.current_counters: Dict[str, Tuple[int, float]] = {}
-        self.previous_counters: Dict[str, Tuple[int, float]] = {}
+        self.current_counters: dict[str, tuple[int, float]] = {}
+        self.previous_counters: dict[str, tuple[int, float]] = {}
 
     def update(self, key: str, duration_secs: float) -> None:
         count, cum_time = self.current_counters.get(key, (0, 0.0))
@@ -611,19 +606,13 @@ class DatabasePool:
         )
 
         self.updates = BackgroundUpdater(hs, self)
-        LaterGauge(
-            name="synapse_background_update_status",
-            desc="Background update status",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {(self.server_name,): self.updates.get_status()},
-        )
 
         self._previous_txn_total_time = 0.0
         self._current_txn_total_time = 0.0
         self._previous_loop_ts = 0.0
 
         # Transaction counter: key is the twisted thread id, value is the current count
-        self._txn_counters: Dict[int, int] = defaultdict(int)
+        self._txn_counters: dict[int, int] = defaultdict(int)
 
         # TODO(paul): These can eventually be removed once the metrics code
         #   is running in mainline, and we have some nice monitoring frontends
@@ -643,13 +632,18 @@ class DatabasePool:
         # Check ASAP (and then later, every 1s) to see if we have finished
         # background updates of tables that aren't safe to update.
         self._clock.call_later(
-            0.0,
-            run_as_background_process,
+            Duration(seconds=0),
+            self.hs.run_as_background_process,
             "upsert_safety_check",
-            self.server_name,
             self._check_safe_to_upsert,
         )
 
+    def stop_background_updates(self) -> None:
+        """
+        Stops the database from running any further background updates.
+        """
+        self.updates.shutdown()
+
     def name(self) -> str:
         "Return the name of this database"
         return self._database_config.name
@@ -668,7 +662,7 @@ class DatabasePool:
         If the background updates have not completed, wait 15 sec and check again.
         """
         updates = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.simple_select_list(
                 "background_updates",
                 keyvalues=None,
@@ -686,10 +680,9 @@ class DatabasePool:
         # If there's any updates still running, reschedule to run.
         if background_update_names:
             self._clock.call_later(
-                15.0,
-                run_as_background_process,
+                Duration(seconds=15),
+                self.hs.run_as_background_process,
                 "upsert_safety_check",
-                self.server_name,
                 self._check_safe_to_upsert,
             )
 
@@ -714,15 +707,15 @@ class DatabasePool:
                 "Total database time: %.3f%% {%s}", ratio * 100, top_three_counters
             )
 
-        self._clock.looping_call(loop, 10000)
+        self._clock.looping_call(loop, Duration(seconds=10))
 
     def new_transaction(
         self,
         conn: LoggingDatabaseConnection,
         desc: str,
-        after_callbacks: List[_CallbackListEntry],
-        async_after_callbacks: List[_AsyncCallbackListEntry],
-        exception_callbacks: List[_CallbackListEntry],
+        after_callbacks: list[_CallbackListEntry],
+        async_after_callbacks: list[_AsyncCallbackListEntry],
+        exception_callbacks: list[_CallbackListEntry],
         func: Callable[Concatenate[LoggingTransaction, P], R],
         *args: P.args,
         **kwargs: P.kwargs,
@@ -807,9 +800,8 @@ class DatabasePool:
         transaction_logger.debug("[TXN START] {%s}", name)
 
         try:
-            i = 0
-            N = 5
-            while True:
+            MAX_NUMBER_OF_ATTEMPTS = 5
+            for attempt_number in range(1, MAX_NUMBER_OF_ATTEMPTS + 1):
                 cursor = conn.cursor(
                     txn_name=name,
                     after_callbacks=after_callbacks,
@@ -835,34 +827,37 @@ class DatabasePool:
                         "[TXN OPERROR] {%s} %s %d/%d",
                         name,
                         e,
-                        i,
-                        N,
+                        attempt_number,
+                        MAX_NUMBER_OF_ATTEMPTS,
                     )
-                    if i < N:
-                        i += 1
-                        try:
-                            with opentracing.start_active_span("db.rollback"):
-                                conn.rollback()
-                        except self.engine.module.Error as e1:
-                            transaction_logger.warning("[TXN EROLL] {%s} %s", name, e1)
+                    try:
+                        with opentracing.start_active_span("db.rollback"):
+                            conn.rollback()
+                    except self.engine.module.Error as e1:
+                        transaction_logger.warning("[TXN EROLL] {%s} %s", name, e1)
+                    # Keep retrying if we haven't reached max attempts
+                    if attempt_number < MAX_NUMBER_OF_ATTEMPTS:
                         continue
                     raise
                 except self.engine.module.DatabaseError as e:
                     if self.engine.is_deadlock(e):
                         transaction_logger.warning(
-                            "[TXN DEADLOCK] {%s} %d/%d", name, i, N
+                            "[TXN DEADLOCK] {%s} %d/%d",
+                            name,
+                            attempt_number,
+                            MAX_NUMBER_OF_ATTEMPTS,
                         )
-                        if i < N:
-                            i += 1
-                            try:
-                                with opentracing.start_active_span("db.rollback"):
-                                    conn.rollback()
-                            except self.engine.module.Error as e1:
-                                transaction_logger.warning(
-                                    "[TXN EROLL] {%s} %s",
-                                    name,
-                                    e1,
-                                )
+                        try:
+                            with opentracing.start_active_span("db.rollback"):
+                                conn.rollback()
+                        except self.engine.module.Error as e1:
+                            transaction_logger.warning(
+                                "[TXN EROLL] {%s} %s",
+                                name,
+                                e1,
+                            )
+                        # Keep retrying if we haven't reached max attempts
+                        if attempt_number < MAX_NUMBER_OF_ATTEMPTS:
                             continue
                     raise
                 finally:
@@ -899,6 +894,21 @@ class DatabasePool:
                     # [1]: https://github.com/python/cpython/blob/v3.8.0/Modules/_sqlite/connection.c#L465
                     # [2]: https://github.com/python/cpython/blob/v3.8.0/Modules/_sqlite/cursor.c#L236
                     cursor.close()
+            else:
+                # To appease the linter, we mark this as unreachable. Unreachable
+                # because we expect the code above to always return from the loop or
+                # raise an exception. `mypy` just doesn't understand our logic above.
+                #
+                # The Python docs
+                # (https://typing.python.org/en/latest/guides/unreachable.html#marking-code-as-unreachable)
+                # suggest `assert False` but that also gets linted to suggest raising an
+                # `AssertionError`. I'm not sure this has the same "unreachable"
+                # semantics, but it works anyway to solve the linter complaint because
+                # we're raising an exception.
+                raise AssertionError(
+                    "We expect this to be unreachable because the code above should either return or raise. "
+                    "This is a logic error in Synapse itself."
+                )
         except Exception as e:
             transaction_logger.debug("[TXN FAIL] {%s} %s", name, e)
             raise
@@ -927,7 +937,7 @@ class DatabasePool:
         func: Callable[..., R],
         *args: Any,
         db_autocommit: bool = False,
-        isolation_level: Optional[int] = None,
+        isolation_level: int | None = None,
         **kwargs: Any,
     ) -> R:
         """Starts a transaction on the database and runs a given function
@@ -959,9 +969,9 @@ class DatabasePool:
         """
 
         async def _runInteraction() -> R:
-            after_callbacks: List[_CallbackListEntry] = []
-            async_after_callbacks: List[_AsyncCallbackListEntry] = []
-            exception_callbacks: List[_CallbackListEntry] = []
+            after_callbacks: list[_CallbackListEntry] = []
+            async_after_callbacks: list[_AsyncCallbackListEntry] = []
+            exception_callbacks: list[_CallbackListEntry] = []
 
             if not current_context():
                 logger.warning("Starting db txn '%s' from sentinel context", desc)
@@ -1009,7 +1019,7 @@ class DatabasePool:
         func: Callable[Concatenate[LoggingDatabaseConnection, P], R],
         *args: Any,
         db_autocommit: bool = False,
-        isolation_level: Optional[int] = None,
+        isolation_level: int | None = None,
         **kwargs: Any,
     ) -> R:
         """Wraps the .runWithConnection() method on the underlying db_pool.
@@ -1049,7 +1059,9 @@ class DatabasePool:
             assert not self.engine.in_transaction(conn)
 
             with LoggingContext(
-                str(curr_context), parent_context=parent_context
+                name=str(curr_context),
+                server_name=self.server_name,
+                parent_context=parent_context,
             ) as context:
                 with opentracing.start_active_span(
                     operation_name="db.connection",
@@ -1106,7 +1118,7 @@ class DatabasePool:
             self._db_pool.runWithConnection(inner_func, *args, **kwargs)
         )
 
-    async def execute(self, desc: str, query: str, *args: Any) -> List[Tuple[Any, ...]]:
+    async def execute(self, desc: str, query: str, *args: Any) -> list[tuple[Any, ...]]:
         """Runs a single query for a result set.
 
         Args:
@@ -1117,7 +1129,7 @@ class DatabasePool:
             The result of decoder(results)
         """
 
-        def interaction(txn: LoggingTransaction) -> List[Tuple[Any, ...]]:
+        def interaction(txn: LoggingTransaction) -> list[tuple[Any, ...]]:
             txn.execute(query, args)
             return txn.fetchall()
 
@@ -1129,7 +1141,7 @@ class DatabasePool:
     async def simple_insert(
         self,
         table: str,
-        values: Dict[str, Any],
+        values: dict[str, Any],
         desc: str = "simple_insert",
     ) -> None:
         """Executes an INSERT query on the named table.
@@ -1143,7 +1155,7 @@ class DatabasePool:
 
     @staticmethod
     def simple_insert_txn(
-        txn: LoggingTransaction, table: str, values: Dict[str, Any]
+        txn: LoggingTransaction, table: str, values: dict[str, Any]
     ) -> None:
         keys, vals = zip(*values.items())
 
@@ -1159,43 +1171,24 @@ class DatabasePool:
     def simple_insert_returning_txn(
         txn: LoggingTransaction,
         table: str,
-        values: Dict[str, Any],
+        values: dict[str, Any],
         returning: StrCollection,
-    ) -> Tuple[Any, ...]:
+    ) -> tuple[Any, ...]:
         """Executes a `INSERT INTO... RETURNING...` statement (or equivalent for
         SQLite versions that don't support it).
         """
 
-        if txn.database_engine.supports_returning:
-            sql = "INSERT INTO %s (%s) VALUES(%s) RETURNING %s" % (
-                table,
-                ", ".join(k for k in values.keys()),
-                ", ".join("?" for _ in values.keys()),
-                ", ".join(k for k in returning),
-            )
+        sql = "INSERT INTO %s (%s) VALUES(%s) RETURNING %s" % (
+            table,
+            ", ".join(k for k in values.keys()),
+            ", ".join("?" for _ in values.keys()),
+            ", ".join(k for k in returning),
+        )
 
-            txn.execute(sql, list(values.values()))
-            row = txn.fetchone()
-            assert row is not None
-            return row
-        else:
-            # For old versions of SQLite we do a standard insert and then can
-            # use `last_insert_rowid` to get at the row we just inserted
-            DatabasePool.simple_insert_txn(
-                txn,
-                table=table,
-                values=values,
-            )
-            txn.execute("SELECT last_insert_rowid()")
-            row = txn.fetchone()
-            assert row is not None
-            (rowid,) = row
-
-            row = DatabasePool.simple_select_one_txn(
-                txn, table=table, keyvalues={"rowid": rowid}, retcols=returning
-            )
-            assert row is not None
-            return row
+        txn.execute(sql, list(values.values()))
+        row = txn.fetchone()
+        assert row is not None
+        return row
 
     async def simple_insert_many(
         self,
@@ -1262,10 +1255,10 @@ class DatabasePool:
     async def simple_upsert(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
-        values: Dict[str, Any],
-        insertion_values: Optional[Dict[str, Any]] = None,
-        where_clause: Optional[str] = None,
+        keyvalues: dict[str, Any],
+        values: dict[str, Any],
+        insertion_values: dict[str, Any] | None = None,
+        where_clause: str | None = None,
         desc: str = "simple_upsert",
     ) -> bool:
         """Insert a row with values + insertion_values; on conflict, update with values.
@@ -1358,8 +1351,8 @@ class DatabasePool:
         table: str,
         keyvalues: Mapping[str, Any],
         values: Mapping[str, Any],
-        insertion_values: Optional[Mapping[str, Any]] = None,
-        where_clause: Optional[str] = None,
+        insertion_values: Mapping[str, Any] | None = None,
+        where_clause: str | None = None,
     ) -> bool:
         """
         Pick the UPSERT method which works best on the platform. Either the
@@ -1403,8 +1396,8 @@ class DatabasePool:
         table: str,
         keyvalues: Mapping[str, Any],
         values: Mapping[str, Any],
-        insertion_values: Optional[Mapping[str, Any]] = None,
-        where_clause: Optional[str] = None,
+        insertion_values: Mapping[str, Any] | None = None,
+        where_clause: str | None = None,
         lock: bool = True,
     ) -> bool:
         """
@@ -1464,7 +1457,7 @@ class DatabasePool:
                 return True
 
         # We didn't find any existing rows, so insert a new one
-        allvalues: Dict[str, Any] = {}
+        allvalues: dict[str, Any] = {}
         allvalues.update(keyvalues)
         allvalues.update(values)
         allvalues.update(insertion_values)
@@ -1484,8 +1477,8 @@ class DatabasePool:
         table: str,
         keyvalues: Mapping[str, Any],
         values: Mapping[str, Any],
-        insertion_values: Optional[Mapping[str, Any]] = None,
-        where_clause: Optional[str] = None,
+        insertion_values: Mapping[str, Any] | None = None,
+        where_clause: str | None = None,
     ) -> bool:
         """
         Use the native UPSERT functionality in PostgreSQL.
@@ -1501,7 +1494,7 @@ class DatabasePool:
             Returns True if a row was inserted or updated (i.e. if `values` is
             not empty then this always returns True)
         """
-        allvalues: Dict[str, Any] = {}
+        allvalues: dict[str, Any] = {}
         allvalues.update(keyvalues)
         allvalues.update(insertion_values or {})
 
@@ -1695,7 +1688,7 @@ class DatabasePool:
             value_values: A list of each row's value column values.
                 Ignored if value_names is empty.
         """
-        allnames: List[str] = []
+        allnames: list[str] = []
         allnames.extend(key_names)
         allnames.extend(value_names)
 
@@ -1738,30 +1731,30 @@ class DatabasePool:
     async def simple_select_one(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcols: Collection[str],
         allow_none: Literal[False] = False,
         desc: str = "simple_select_one",
-    ) -> Tuple[Any, ...]: ...
+    ) -> tuple[Any, ...]: ...
 
     @overload
     async def simple_select_one(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcols: Collection[str],
         allow_none: Literal[True] = True,
         desc: str = "simple_select_one",
-    ) -> Optional[Tuple[Any, ...]]: ...
+    ) -> tuple[Any, ...] | None: ...
 
     async def simple_select_one(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcols: Collection[str],
         allow_none: bool = False,
         desc: str = "simple_select_one",
-    ) -> Optional[Tuple[Any, ...]]:
+    ) -> tuple[Any, ...] | None:
         """Executes a SELECT query on the named table, which is expected to
         return a single row, returning multiple columns from it.
 
@@ -1787,7 +1780,7 @@ class DatabasePool:
     async def simple_select_one_onecol(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcol: str,
         allow_none: Literal[False] = False,
         desc: str = "simple_select_one_onecol",
@@ -1797,20 +1790,20 @@ class DatabasePool:
     async def simple_select_one_onecol(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcol: str,
         allow_none: Literal[True] = True,
         desc: str = "simple_select_one_onecol",
-    ) -> Optional[Any]: ...
+    ) -> Any | None: ...
 
     async def simple_select_one_onecol(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcol: str,
         allow_none: bool = False,
         desc: str = "simple_select_one_onecol",
-    ) -> Optional[Any]:
+    ) -> Any | None:
         """Executes a SELECT query on the named table, which is expected to
         return a single row, returning a single column from it.
 
@@ -1838,7 +1831,7 @@ class DatabasePool:
         cls,
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcol: str,
         allow_none: Literal[False] = False,
     ) -> Any: ...
@@ -1849,20 +1842,20 @@ class DatabasePool:
         cls,
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcol: str,
         allow_none: Literal[True] = True,
-    ) -> Optional[Any]: ...
+    ) -> Any | None: ...
 
     @classmethod
     def simple_select_one_onecol_txn(
         cls,
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcol: str,
         allow_none: bool = False,
-    ) -> Optional[Any]:
+    ) -> Any | None:
         ret = cls.simple_select_onecol_txn(
             txn, table=table, keyvalues=keyvalues, retcol=retcol
         )
@@ -1879,9 +1872,9 @@ class DatabasePool:
     def simple_select_onecol_txn(
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcol: str,
-    ) -> List[Any]:
+    ) -> list[Any]:
         sql = ("SELECT %(retcol)s FROM %(table)s") % {"retcol": retcol, "table": table}
 
         if keyvalues:
@@ -1895,10 +1888,10 @@ class DatabasePool:
     async def simple_select_onecol(
         self,
         table: str,
-        keyvalues: Optional[Dict[str, Any]],
+        keyvalues: dict[str, Any] | None,
         retcol: str,
         desc: str = "simple_select_onecol",
-    ) -> List[Any]:
+    ) -> list[Any]:
         """Executes a SELECT query on the named table, which returns a list
         comprising of the values of the named column from the selected rows.
 
@@ -1923,10 +1916,10 @@ class DatabasePool:
     async def simple_select_list(
         self,
         table: str,
-        keyvalues: Optional[Dict[str, Any]],
+        keyvalues: dict[str, Any] | None,
         retcols: Collection[str],
         desc: str = "simple_select_list",
-    ) -> List[Tuple[Any, ...]]:
+    ) -> list[tuple[Any, ...]]:
         """Executes a SELECT query on the named table, which may return zero or
         more rows, returning the result as a list of tuples.
 
@@ -1955,9 +1948,9 @@ class DatabasePool:
         cls,
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Optional[Dict[str, Any]],
+        keyvalues: dict[str, Any] | None,
         retcols: Iterable[str],
-    ) -> List[Tuple[Any, ...]]:
+    ) -> list[tuple[Any, ...]]:
         """Executes a SELECT query on the named table, which may return zero or
         more rows, returning the result as a list of tuples.
 
@@ -1991,10 +1984,10 @@ class DatabasePool:
         column: str,
         iterable: Iterable[Any],
         retcols: Collection[str],
-        keyvalues: Optional[Dict[str, Any]] = None,
+        keyvalues: dict[str, Any] | None = None,
         desc: str = "simple_select_many_batch",
         batch_size: int = 100,
-    ) -> List[Tuple[Any, ...]]:
+    ) -> list[tuple[Any, ...]]:
         """Executes a SELECT query on the named table, which may return zero or
         more rows.
 
@@ -2014,7 +2007,7 @@ class DatabasePool:
         """
         keyvalues = keyvalues or {}
 
-        results: List[Tuple[Any, ...]] = []
+        results: list[tuple[Any, ...]] = []
 
         for chunk in batch_iter(iterable, batch_size):
             rows = await self.runInteraction(
@@ -2039,9 +2032,9 @@ class DatabasePool:
         table: str,
         column: str,
         iterable: Collection[Any],
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcols: Iterable[str],
-    ) -> List[Tuple[Any, ...]]:
+    ) -> list[tuple[Any, ...]]:
         """Executes a SELECT query on the named table, which may return zero or
         more rows.
 
@@ -2081,8 +2074,8 @@ class DatabasePool:
     async def simple_update(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
-        updatevalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
+        updatevalues: dict[str, Any],
         desc: str,
     ) -> int:
         """
@@ -2218,8 +2211,8 @@ class DatabasePool:
     async def simple_update_one(
         self,
         table: str,
-        keyvalues: Dict[str, Any],
-        updatevalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
+        updatevalues: dict[str, Any],
         desc: str = "simple_update_one",
     ) -> None:
         """Executes an UPDATE query on the named table, setting new values for
@@ -2245,8 +2238,8 @@ class DatabasePool:
         cls,
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
-        updatevalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
+        updatevalues: dict[str, Any],
     ) -> None:
         rowcount = cls.simple_update_txn(txn, table, keyvalues, updatevalues)
 
@@ -2260,29 +2253,29 @@ class DatabasePool:
     def simple_select_one_txn(
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcols: Collection[str],
         allow_none: Literal[False] = False,
-    ) -> Tuple[Any, ...]: ...
+    ) -> tuple[Any, ...]: ...
 
     @overload
     @staticmethod
     def simple_select_one_txn(
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcols: Collection[str],
         allow_none: Literal[True] = True,
-    ) -> Optional[Tuple[Any, ...]]: ...
+    ) -> tuple[Any, ...] | None: ...
 
     @staticmethod
     def simple_select_one_txn(
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         retcols: Collection[str],
         allow_none: bool = False,
-    ) -> Optional[Tuple[Any, ...]]:
+    ) -> tuple[Any, ...] | None:
         select_sql = "SELECT %s FROM %s" % (", ".join(retcols), table)
 
         if keyvalues:
@@ -2303,7 +2296,7 @@ class DatabasePool:
         return row
 
     async def simple_delete_one(
-        self, table: str, keyvalues: Dict[str, Any], desc: str = "simple_delete_one"
+        self, table: str, keyvalues: dict[str, Any], desc: str = "simple_delete_one"
     ) -> None:
         """Executes a DELETE query on the named table, expecting to delete a
         single row.
@@ -2323,7 +2316,7 @@ class DatabasePool:
 
     @staticmethod
     def simple_delete_one_txn(
-        txn: LoggingTransaction, table: str, keyvalues: Dict[str, Any]
+        txn: LoggingTransaction, table: str, keyvalues: dict[str, Any]
     ) -> None:
         """Executes a DELETE query on the named table, expecting to delete a
         single row.
@@ -2344,7 +2337,7 @@ class DatabasePool:
             raise StoreError(500, "More than one row matched (%s)" % (table,))
 
     async def simple_delete(
-        self, table: str, keyvalues: Dict[str, Any], desc: str
+        self, table: str, keyvalues: dict[str, Any], desc: str
     ) -> int:
         """Executes a DELETE query on the named table.
 
@@ -2364,7 +2357,7 @@ class DatabasePool:
 
     @staticmethod
     def simple_delete_txn(
-        txn: LoggingTransaction, table: str, keyvalues: Dict[str, Any]
+        txn: LoggingTransaction, table: str, keyvalues: dict[str, Any]
     ) -> int:
         """Executes a DELETE query on the named table.
 
@@ -2390,7 +2383,7 @@ class DatabasePool:
         table: str,
         column: str,
         iterable: Collection[Any],
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
         desc: str,
     ) -> int:
         """Executes a DELETE query on the named table.
@@ -2424,7 +2417,7 @@ class DatabasePool:
         table: str,
         column: str,
         values: Collection[Any],
-        keyvalues: Dict[str, Any],
+        keyvalues: dict[str, Any],
     ) -> int:
         """Executes a DELETE query on the named table.
 
@@ -2504,7 +2497,7 @@ class DatabasePool:
         stream_column: str,
         max_value: int,
         limit: int = 100000,
-    ) -> Tuple[Dict[Any, int], int]:
+    ) -> tuple[dict[Any, int], int]:
         """Gets roughly the last N changes in the given stream table as a
         map from entity to the stream ID of the most recent change.
 
@@ -2529,7 +2522,7 @@ class DatabasePool:
 
         # The rows come out in reverse stream ID order, so we want to keep the
         # stream ID of the first row for each entity.
-        cache: Dict[Any, int] = {}
+        cache: dict[Any, int] = {}
         for row in txn:
             cache.setdefault(row[0], int(row[1]))
 
@@ -2553,11 +2546,11 @@ class DatabasePool:
         start: int,
         limit: int,
         retcols: Iterable[str],
-        filters: Optional[Dict[str, Any]] = None,
-        keyvalues: Optional[Dict[str, Any]] = None,
-        exclude_keyvalues: Optional[Dict[str, Any]] = None,
+        filters: dict[str, Any] | None = None,
+        keyvalues: dict[str, Any] | None = None,
+        exclude_keyvalues: dict[str, Any] | None = None,
         order_direction: str = "ASC",
-    ) -> List[Tuple[Any, ...]]:
+    ) -> list[tuple[Any, ...]]:
         """
         Executes a SELECT query on the named table with start and limit,
         of row numbers, which may return zero or number of rows from start to limit,
@@ -2592,7 +2585,7 @@ class DatabasePool:
             raise ValueError("order_direction must be one of 'ASC' or 'DESC'.")
 
         where_clause = "WHERE " if filters or keyvalues or exclude_keyvalues else ""
-        arg_list: List[Any] = []
+        arg_list: list[Any] = []
         if filters:
             where_clause += " AND ".join("%s LIKE ?" % (k,) for k in filters)
             arg_list += list(filters.values())
@@ -2622,7 +2615,7 @@ def make_in_list_sql_clause(
     iterable: Collection[Any],
     *,
     negative: bool = False,
-) -> Tuple[str, list]:
+) -> tuple[str, list]:
     """Returns an SQL clause that checks the given column is in the iterable.
 
     On SQLite this expands to `column IN (?, ?, ...)`, whereas on Postgres
@@ -2659,20 +2652,27 @@ def make_in_list_sql_clause(
 
 
 # These overloads ensure that `columns` and `iterable` values have the same length.
-# Suppress "Single overload definition, multiple required" complaint.
-@overload  # type: ignore[misc]
+@overload
 def make_tuple_in_list_sql_clause(
     database_engine: BaseDatabaseEngine,
-    columns: Tuple[str, str],
-    iterable: Collection[Tuple[Any, Any]],
-) -> Tuple[str, list]: ...
+    columns: tuple[str, str],
+    iterable: Collection[tuple[Any, Any]],
+) -> tuple[str, list]: ...
+
+
+@overload
+def make_tuple_in_list_sql_clause(
+    database_engine: BaseDatabaseEngine,
+    columns: tuple[str, str, str],
+    iterable: Collection[tuple[Any, Any, Any]],
+) -> tuple[str, list]: ...
 
 
 def make_tuple_in_list_sql_clause(
     database_engine: BaseDatabaseEngine,
-    columns: Tuple[str, ...],
-    iterable: Collection[Tuple[Any, ...]],
-) -> Tuple[str, list]:
+    columns: tuple[str, ...],
+    iterable: Collection[tuple[Any, ...]],
+) -> tuple[str, list]:
     """Returns an SQL clause that checks the given tuple of columns is in the iterable.
 
     Args:
@@ -2720,7 +2720,7 @@ def make_tuple_in_list_sql_clause(
 KV = TypeVar("KV")
 
 
-def make_tuple_comparison_clause(keys: List[Tuple[str, KV]]) -> Tuple[str, List[KV]]:
+def make_tuple_comparison_clause(keys: list[tuple[str, KV]]) -> tuple[str, list[KV]]:
     """Returns a tuple comparison SQL clause
 
     Builds a SQL clause that looks like "(a, b) > (?, ?)"
diff --git a/synapse/storage/databases/__init__.py b/synapse/storage/databases/__init__.py
index 6442ab6c7a..b44b84b913 100644
--- a/synapse/storage/databases/__init__.py
+++ b/synapse/storage/databases/__init__.py
@@ -20,8 +20,9 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Generic, List, Optional, Type, TypeVar
+from typing import TYPE_CHECKING, Generic, TypeVar
 
+from synapse.metrics import SERVER_NAME_LABEL, LaterGauge
 from synapse.storage._base import SQLBaseStore
 from synapse.storage.database import DatabasePool, make_conn
 from synapse.storage.databases.main.events import PersistEventsStore
@@ -40,6 +41,13 @@ logger = logging.getLogger(__name__)
 DataStoreT = TypeVar("DataStoreT", bound=SQLBaseStore, covariant=True)
 
 
+background_update_status = LaterGauge(
+    name="synapse_background_update_status",
+    desc="Background update status",
+    labelnames=["database_name", SERVER_NAME_LABEL],
+)
+
+
 class Databases(Generic[DataStoreT]):
     """The various databases.
 
@@ -53,21 +61,21 @@ class Databases(Generic[DataStoreT]):
         state_deletion
     """
 
-    databases: List[DatabasePool]
+    databases: list[DatabasePool]
     main: "DataStore"  # FIXME: https://github.com/matrix-org/synapse/issues/11165: actually an instance of `main_store_class`
     state: StateGroupDataStore
-    persist_events: Optional[PersistEventsStore]
+    persist_events: PersistEventsStore | None
     state_deletion: StateDeletionDataStore
 
-    def __init__(self, main_store_class: Type[DataStoreT], hs: "HomeServer"):
+    def __init__(self, main_store_class: type[DataStoreT], hs: "HomeServer"):
         # Note we pass in the main store class here as workers use a different main
         # store.
 
         self.databases = []
-        main: Optional[DataStoreT] = None
-        state: Optional[StateGroupDataStore] = None
-        state_deletion: Optional[StateDeletionDataStore] = None
-        persist_events: Optional[PersistEventsStore] = None
+        main: DataStoreT | None = None
+        state: StateGroupDataStore | None = None
+        state_deletion: StateDeletionDataStore | None = None
+        persist_events: PersistEventsStore | None = None
 
         server_name = hs.hostname
 
@@ -143,6 +151,15 @@ class Databases(Generic[DataStoreT]):
 
             db_conn.close()
 
+        # Track the background update status for each database
+        background_update_status.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {
+                (database.name(), server_name): database.updates.get_status()
+                for database in self.databases
+            },
+        )
+
         # Sanity check that we have actually configured all the required stores.
         if not main:
             raise Exception("No 'main' database configured")
diff --git a/synapse/storage/databases/main/__init__.py b/synapse/storage/databases/main/__init__.py
index de55c452ae..9f8d4debbe 100644
--- a/synapse/storage/databases/main/__init__.py
+++ b/synapse/storage/databases/main/__init__.py
@@ -20,7 +20,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, List, Optional, Tuple, Union, cast
+from typing import TYPE_CHECKING, cast
 
 import attr
 
@@ -34,6 +34,7 @@ from synapse.storage.database import (
 )
 from synapse.storage.databases.main.sliding_sync import SlidingSyncStore
 from synapse.storage.databases.main.stats import UserSortOrder
+from synapse.storage.databases.main.sticky_events import StickyEventsWorkerStore
 from synapse.storage.databases.main.thread_subscriptions import (
     ThreadSubscriptionsWorkerStore,
 )
@@ -99,14 +100,14 @@ class UserPaginateResponse:
     """This is very similar to UserInfo, but not quite the same."""
 
     name: str
-    user_type: Optional[str]
+    user_type: str | None
     is_guest: bool
     admin: bool
     deactivated: bool
     shadow_banned: bool
-    displayname: Optional[str]
-    avatar_url: Optional[str]
-    creation_ts: Optional[int]
+    displayname: str | None
+    avatar_url: str | None
+    creation_ts: int | None
     approved: bool
     erased: bool
     last_seen_ts: int
@@ -144,6 +145,7 @@ class DataStore(
     TagsStore,
     AccountDataStore,
     ThreadSubscriptionsWorkerStore,
+    StickyEventsWorkerStore,
     PushRulesWorkerStore,
     StreamWorkerStore,
     OpenIdStore,
@@ -180,17 +182,17 @@ class DataStore(
         self,
         start: int,
         limit: int,
-        user_id: Optional[str] = None,
-        name: Optional[str] = None,
+        user_id: str | None = None,
+        name: str | None = None,
         guests: bool = True,
-        deactivated: Optional[bool] = None,
-        admins: Optional[bool] = None,
+        deactivated: bool | None = None,
+        admins: bool | None = None,
         order_by: str = UserSortOrder.NAME.value,
         direction: Direction = Direction.FORWARDS,
         approved: bool = True,
-        not_user_types: Optional[List[str]] = None,
+        not_user_types: list[str] | None = None,
         locked: bool = False,
-    ) -> Tuple[List[UserPaginateResponse], int]:
+    ) -> tuple[list[UserPaginateResponse], int]:
         """Function to retrieve a paginated list of users from
         users list. This will return a json list of users and the
         total number of users matching the filter criteria.
@@ -216,7 +218,7 @@ class DataStore(
 
         def get_users_paginate_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[UserPaginateResponse], int]:
+        ) -> tuple[list[UserPaginateResponse], int]:
             filters = []
             args: list = []
 
@@ -299,20 +301,25 @@ class DataStore(
                 FROM users as u
                 LEFT JOIN profiles AS p ON u.name = p.full_user_id
                 LEFT JOIN erased_users AS eu ON u.name = eu.user_id
+                LEFT JOIN (
+                    SELECT user_id, MAX(last_seen) AS last_seen_ts
+                    FROM devices GROUP BY user_id
+                ) lsd ON u.name = lsd.user_id
                 LEFT JOIN (
                     SELECT user_id, MAX(last_seen) AS last_seen_ts
                     FROM user_ips GROUP BY user_id
-                ) ls ON u.name = ls.user_id
+                ) lsi ON u.name = lsi.user_id
                 {where_clause}
                 """
             sql = "SELECT COUNT(*) as total_users " + sql_base
             txn.execute(sql, args)
-            count = cast(Tuple[int], txn.fetchone())[0]
+            count = cast(tuple[int], txn.fetchone())[0]
 
             sql = f"""
                 SELECT name, user_type, is_guest, admin, deactivated, shadow_banned,
                 displayname, avatar_url, creation_ts * 1000 as creation_ts, approved,
-                eu.user_id is not null as erased, last_seen_ts, locked
+                eu.user_id is not null as erased,
+                COALESCE(lsd.last_seen_ts, lsi.last_seen_ts) as last_seen_ts, locked
                 {sql_base}
                 ORDER BY {order_by_column} {order}, u.name ASC
                 LIMIT ? OFFSET ?
@@ -346,9 +353,7 @@ class DataStore(
 
     async def search_users(
         self, term: str
-    ) -> List[
-        Tuple[str, Optional[str], Union[int, bool], Union[int, bool], Optional[str]]
-    ]:
+    ) -> list[tuple[str, str | None, int | bool, int | bool, str | None]]:
         """Function to search users list for one or more users with
         the matched term.
 
@@ -361,9 +366,7 @@ class DataStore(
 
         def search_users(
             txn: LoggingTransaction,
-        ) -> List[
-            Tuple[str, Optional[str], Union[int, bool], Union[int, bool], Optional[str]]
-        ]:
+        ) -> list[tuple[str, str | None, int | bool, int | bool, str | None]]:
             search_term = "%%" + term + "%%"
 
             sql = """
@@ -374,13 +377,13 @@ class DataStore(
             txn.execute(sql, (search_term,))
 
             return cast(
-                List[
-                    Tuple[
+                list[
+                    tuple[
                         str,
-                        Optional[str],
-                        Union[int, bool],
-                        Union[int, bool],
-                        Optional[str],
+                        str | None,
+                        int | bool,
+                        int | bool,
+                        str | None,
                     ]
                 ],
                 txn.fetchall(),
diff --git a/synapse/storage/databases/main/account_data.py b/synapse/storage/databases/main/account_data.py
index c049789e44..538280137b 100644
--- a/synapse/storage/databases/main/account_data.py
+++ b/synapse/storage/databases/main/account_data.py
@@ -23,13 +23,8 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Any,
-    Dict,
-    FrozenSet,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Tuple,
     cast,
 )
 
@@ -45,12 +40,17 @@ from synapse.storage.database import (
 )
 from synapse.storage.databases.main.cache import CacheInvalidationWorkerStore
 from synapse.storage.databases.main.push_rule import PushRulesWorkerStore
-from synapse.storage.invite_rule import InviteRulesConfig
+from synapse.storage.invite_rule import (
+    AllowAllInviteRulesConfig,
+    InviteRulesConfig,
+    MSC4155InviteRulesConfig,
+    MSC4380InviteRulesConfig,
+)
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
 from synapse.types import JsonDict, JsonMapping
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached
 from synapse.util.caches.stream_change_cache import StreamChangeCache
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -140,7 +140,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_global_account_data_for_user(
             txn: LoggingTransaction,
-        ) -> Dict[str, JsonDict]:
+        ) -> dict[str, JsonDict]:
             # The 'content != '{}' condition below prevents us from using
             # `simple_select_list_txn` here, as it doesn't support conditions
             # other than 'equals'.
@@ -185,7 +185,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_room_account_data_for_user_txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, Dict[str, JsonMapping]]:
+        ) -> dict[str, dict[str, JsonMapping]]:
             # The 'content != '{}' condition below prevents us from using
             # `simple_select_list_txn` here, as it doesn't support conditions
             # other than 'equals'.
@@ -202,7 +202,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
             txn.execute(sql, (user_id,))
 
-            by_room: Dict[str, Dict[str, JsonMapping]] = {}
+            by_room: dict[str, dict[str, JsonMapping]] = {}
             for room_id, account_data_type, content in txn:
                 room_data = by_room.setdefault(room_id, {})
 
@@ -217,7 +217,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
     @cached(num_args=2, max_entries=5000, tree=True)
     async def get_global_account_data_by_type_for_user(
         self, user_id: str, data_type: str
-    ) -> Optional[JsonMapping]:
+    ) -> JsonMapping | None:
         """
         Returns:
             The account data.
@@ -237,7 +237,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
     async def get_latest_stream_id_for_global_account_data_by_type_for_user(
         self, user_id: str, data_type: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """
         Returns:
             The stream ID of the account data,
@@ -246,7 +246,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_latest_stream_id_for_global_account_data_by_type_for_user_txn(
             txn: LoggingTransaction,
-        ) -> Optional[int]:
+        ) -> int | None:
             sql = """
                 SELECT stream_id FROM account_data
                 WHERE user_id = ? AND account_data_type = ?
@@ -281,9 +281,9 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_account_data_for_room_txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, JsonMapping]:
+        ) -> dict[str, JsonMapping]:
             rows = cast(
-                List[Tuple[str, str]],
+                list[tuple[str, str]],
                 self.db_pool.simple_select_list_txn(
                     txn,
                     table="room_account_data",
@@ -304,7 +304,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
     @cached(num_args=3, max_entries=5000, tree=True)
     async def get_account_data_for_room_and_type(
         self, user_id: str, room_id: str, account_data_type: str
-    ) -> Optional[JsonMapping]:
+    ) -> JsonMapping | None:
         """Get the client account_data of given type for a user for a room.
 
         Args:
@@ -317,7 +317,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_account_data_for_room_and_type_txn(
             txn: LoggingTransaction,
-        ) -> Optional[JsonDict]:
+        ) -> JsonDict | None:
             content_json = self.db_pool.simple_select_one_onecol_txn(
                 txn,
                 table="room_account_data",
@@ -338,7 +338,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
     async def get_updated_global_account_data(
         self, last_id: int, current_id: int, limit: int
-    ) -> List[Tuple[int, str, str]]:
+    ) -> list[tuple[int, str, str]]:
         """Get the global account_data that has changed, for the account_data stream
 
         Args:
@@ -355,14 +355,14 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_updated_global_account_data_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str]]:
+        ) -> list[tuple[int, str, str]]:
             sql = (
                 "SELECT stream_id, user_id, account_data_type"
                 " FROM account_data WHERE ? < stream_id AND stream_id <= ?"
                 " ORDER BY stream_id ASC LIMIT ?"
             )
             txn.execute(sql, (last_id, current_id, limit))
-            return cast(List[Tuple[int, str, str]], txn.fetchall())
+            return cast(list[tuple[int, str, str]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_updated_global_account_data", get_updated_global_account_data_txn
@@ -370,7 +370,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
     async def get_updated_room_account_data(
         self, last_id: int, current_id: int, limit: int
-    ) -> List[Tuple[int, str, str, str]]:
+    ) -> list[tuple[int, str, str, str]]:
         """Get the global account_data that has changed, for the account_data stream
 
         Args:
@@ -387,14 +387,14 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_updated_room_account_data_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str, str]]:
+        ) -> list[tuple[int, str, str, str]]:
             sql = (
                 "SELECT stream_id, user_id, room_id, account_data_type"
                 " FROM room_account_data WHERE ? < stream_id AND stream_id <= ?"
                 " ORDER BY stream_id ASC LIMIT ?"
             )
             txn.execute(sql, (last_id, current_id, limit))
-            return cast(List[Tuple[int, str, str, str]], txn.fetchall())
+            return cast(list[tuple[int, str, str, str]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_updated_room_account_data", get_updated_room_account_data_txn
@@ -402,7 +402,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
     async def get_updated_global_account_data_for_user(
         self, user_id: str, stream_id: int
-    ) -> Dict[str, JsonMapping]:
+    ) -> dict[str, JsonMapping]:
         """Get all the global account_data that's changed for a user.
 
         Args:
@@ -415,7 +415,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_updated_global_account_data_for_user(
             txn: LoggingTransaction,
-        ) -> Dict[str, JsonMapping]:
+        ) -> dict[str, JsonMapping]:
             sql = """
                 SELECT account_data_type, content FROM account_data
                 WHERE user_id = ? AND stream_id > ?
@@ -437,7 +437,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
     async def get_updated_room_account_data_for_user(
         self, user_id: str, stream_id: int
-    ) -> Dict[str, Dict[str, JsonMapping]]:
+    ) -> dict[str, dict[str, JsonMapping]]:
         """Get all the room account_data that's changed for a user.
 
         Args:
@@ -450,14 +450,14 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_updated_room_account_data_for_user_txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, Dict[str, JsonMapping]]:
+        ) -> dict[str, dict[str, JsonMapping]]:
             sql = """
                 SELECT room_id, account_data_type, content FROM room_account_data
                 WHERE user_id = ? AND stream_id > ?
             """
             txn.execute(sql, (user_id, stream_id))
 
-            account_data_by_room: Dict[str, Dict[str, JsonMapping]] = {}
+            account_data_by_room: dict[str, dict[str, JsonMapping]] = {}
             for row in txn:
                 room_account_data = account_data_by_room.setdefault(row[0], {})
                 room_account_data[row[1]] = db_to_json(row[2])
@@ -484,7 +484,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
         room_id: str,
         from_stream_id: int,
         to_stream_id: int,
-    ) -> Dict[str, JsonMapping]:
+    ) -> dict[str, JsonMapping]:
         """Get the room account_data that's changed for a user in a room.
 
         (> `from_stream_id` and <= `to_stream_id`)
@@ -501,14 +501,14 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
         def get_updated_room_account_data_for_user_for_room_txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, JsonMapping]:
+        ) -> dict[str, JsonMapping]:
             sql = """
                 SELECT account_data_type, content FROM room_account_data
                 WHERE user_id = ? AND room_id = ? AND stream_id > ? AND stream_id <= ?
             """
             txn.execute(sql, (user_id, room_id, from_stream_id, to_stream_id))
 
-            room_account_data: Dict[str, JsonMapping] = {}
+            room_account_data: dict[str, JsonMapping] = {}
             for row in txn:
                 room_account_data[row[0]] = db_to_json(row[1])
 
@@ -526,7 +526,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
         )
 
     @cached(max_entries=5000, iterable=True)
-    async def ignored_by(self, user_id: str) -> FrozenSet[str]:
+    async def ignored_by(self, user_id: str) -> frozenset[str]:
         """
         Get users which ignore the given user.
 
@@ -546,7 +546,7 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
         )
 
     @cached(max_entries=5000, iterable=True)
-    async def ignored_users(self, user_id: str) -> FrozenSet[str]:
+    async def ignored_users(self, user_id: str) -> frozenset[str]:
         """
         Get users which the given user ignores.
 
@@ -567,20 +567,27 @@ class AccountDataWorkerStore(PushRulesWorkerStore, CacheInvalidationWorkerStore)
 
     async def get_invite_config_for_user(self, user_id: str) -> InviteRulesConfig:
         """
-        Get the invite configuration for the current user.
+        Get the invite configuration for the given user.
 
         Args:
-            user_id:
+            user_id: The user whose invite configuration should be returned.
         """
-
-        if not self._msc4155_enabled:
-            # This equates to allowing all invites, as if the setting was off.
-            return InviteRulesConfig(None)
-
         data = await self.get_global_account_data_by_type_for_user(
-            user_id, AccountDataTypes.MSC4155_INVITE_PERMISSION_CONFIG
+            user_id, AccountDataTypes.INVITE_PERMISSION_CONFIG
         )
-        return InviteRulesConfig(data)
+        # If the user has an MSC4380-style config setting, prioritise that
+        # above an MSC4155 one
+        if data is not None:
+            return MSC4380InviteRulesConfig.from_account_data(data)
+
+        if self._msc4155_enabled:
+            data = await self.get_global_account_data_by_type_for_user(
+                user_id, AccountDataTypes.MSC4155_INVITE_PERMISSION_CONFIG
+            )
+            if data is not None:
+                return MSC4155InviteRulesConfig(data)
+
+        return AllowAllInviteRulesConfig()
 
     async def get_admin_client_config_for_user(self, user_id: str) -> AdminClientConfig:
         """
diff --git a/synapse/storage/databases/main/appservice.py b/synapse/storage/databases/main/appservice.py
index 9862e574fd..6c2bf90b37 100644
--- a/synapse/storage/databases/main/appservice.py
+++ b/synapse/storage/databases/main/appservice.py
@@ -20,7 +20,7 @@
 #
 import logging
 import re
-from typing import TYPE_CHECKING, List, Optional, Pattern, Sequence, Tuple, cast
+from typing import TYPE_CHECKING, Pattern, Sequence, cast
 
 from synapse.appservice import (
     ApplicationService,
@@ -42,8 +42,8 @@ from synapse.storage.databases.main.roommember import RoomMemberWorkerStore
 from synapse.storage.types import Cursor
 from synapse.storage.util.sequence import build_sequence_generator
 from synapse.types import DeviceListUpdates, JsonMapping
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import _CacheContext, cached
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -52,8 +52,8 @@ logger = logging.getLogger(__name__)
 
 
 def _make_exclusive_regex(
-    services_cache: List[ApplicationService],
-) -> Optional[Pattern]:
+    services_cache: list[ApplicationService],
+) -> Pattern | None:
     # We precompile a regex constructed from all the regexes that the AS's
     # have registered for exclusive users.
     exclusive_user_regexes = [
@@ -63,7 +63,7 @@ def _make_exclusive_regex(
     ]
     if exclusive_user_regexes:
         exclusive_user_regex = "|".join("(" + r + ")" for r in exclusive_user_regexes)
-        exclusive_user_pattern: Optional[Pattern] = re.compile(exclusive_user_regex)
+        exclusive_user_pattern: Pattern | None = re.compile(exclusive_user_regex)
     else:
         # We handle this case specially otherwise the constructed regex
         # will always match
@@ -83,13 +83,17 @@ class ApplicationServiceWorkerStore(RoomMemberWorkerStore):
             hs.hostname, hs.config.appservice.app_service_config_files
         )
         self.exclusive_user_regex = _make_exclusive_regex(self.services_cache)
+        # When OAuth is enabled, force all appservices to enable MSC4190 too.
+        if hs.config.mas.enabled or hs.config.experimental.msc3861.enabled:
+            for appservice in self.services_cache:
+                appservice.msc4190_device_management = True
 
         def get_max_as_txn_id(txn: Cursor) -> int:
             logger.warning("Falling back to slow query, you should port to postgres")
             txn.execute(
                 "SELECT COALESCE(max(txn_id), 0) FROM application_services_txns"
             )
-            return cast(Tuple[int], txn.fetchone())[0]
+            return cast(tuple[int], txn.fetchone())[0]
 
         self._as_txn_seq_gen = build_sequence_generator(
             db_conn,
@@ -102,7 +106,7 @@ class ApplicationServiceWorkerStore(RoomMemberWorkerStore):
 
         super().__init__(database, db_conn, hs)
 
-    def get_app_services(self) -> List[ApplicationService]:
+    def get_app_services(self) -> list[ApplicationService]:
         return self.services_cache
 
     def get_if_app_services_interested_in_user(self, user_id: str) -> bool:
@@ -112,7 +116,7 @@ class ApplicationServiceWorkerStore(RoomMemberWorkerStore):
         else:
             return False
 
-    def get_app_service_by_user_id(self, user_id: str) -> Optional[ApplicationService]:
+    def get_app_service_by_user_id(self, user_id: str) -> ApplicationService | None:
         """Retrieve an application service from their user ID.
 
         All application services have associated with them a particular user ID.
@@ -130,7 +134,7 @@ class ApplicationServiceWorkerStore(RoomMemberWorkerStore):
                 return service
         return None
 
-    def get_app_service_by_token(self, token: str) -> Optional[ApplicationService]:
+    def get_app_service_by_token(self, token: str) -> ApplicationService | None:
         """Get the application service with the given appservice token.
 
         Args:
@@ -143,7 +147,7 @@ class ApplicationServiceWorkerStore(RoomMemberWorkerStore):
                 return service
         return None
 
-    def get_app_service_by_id(self, as_id: str) -> Optional[ApplicationService]:
+    def get_app_service_by_id(self, as_id: str) -> ApplicationService | None:
         """Get the application service with the given appservice ID.
 
         Args:
@@ -195,7 +199,7 @@ class ApplicationServiceTransactionWorkerStore(
 ):
     async def get_appservices_by_state(
         self, state: ApplicationServiceState
-    ) -> List[ApplicationService]:
+    ) -> list[ApplicationService]:
         """Get a list of application services based on their state.
 
         Args:
@@ -204,7 +208,7 @@ class ApplicationServiceTransactionWorkerStore(
             A list of ApplicationServices, which may be empty.
         """
         results = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.db_pool.simple_select_list(
                 table="application_services_state",
                 keyvalues={"state": state.value},
@@ -223,7 +227,7 @@ class ApplicationServiceTransactionWorkerStore(
 
     async def get_appservice_state(
         self, service: ApplicationService
-    ) -> Optional[ApplicationServiceState]:
+    ) -> ApplicationServiceState | None:
         """Get the application service state.
 
         Args:
@@ -269,8 +273,8 @@ class ApplicationServiceTransactionWorkerStore(
         self,
         service: ApplicationService,
         events: Sequence[EventBase],
-        ephemeral: List[JsonMapping],
-        to_device_messages: List[JsonMapping],
+        ephemeral: list[JsonMapping],
+        to_device_messages: list[JsonMapping],
         one_time_keys_count: TransactionOneTimeKeysCount,
         unused_fallback_keys: TransactionUnusedFallbackKeys,
         device_list_summary: DeviceListUpdates,
@@ -343,7 +347,7 @@ class ApplicationServiceTransactionWorkerStore(
 
     async def get_oldest_unsent_txn(
         self, service: ApplicationService
-    ) -> Optional[AppServiceTransaction]:
+    ) -> AppServiceTransaction | None:
         """Get the oldest transaction which has not been sent for this service.
 
         Args:
@@ -354,7 +358,7 @@ class ApplicationServiceTransactionWorkerStore(
 
         def _get_oldest_unsent_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Tuple[int, str]]:
+        ) -> tuple[int, str] | None:
             # Monotonically increasing txn ids, so just select the smallest
             # one in the txns table (we delete them when they are sent)
             txn.execute(
@@ -362,7 +366,7 @@ class ApplicationServiceTransactionWorkerStore(
                 " ORDER BY txn_id ASC LIMIT 1",
                 (service.id,),
             )
-            return cast(Optional[Tuple[int, str]], txn.fetchone())
+            return cast(tuple[int, str] | None, txn.fetchone())
 
         entry = await self.db_pool.runInteraction(
             "get_oldest_unsent_appservice_txn", _get_oldest_unsent_txn
@@ -443,7 +447,7 @@ class ApplicationServiceTransactionWorkerStore(
         )
 
     async def set_appservice_stream_type_pos(
-        self, service: ApplicationService, stream_type: str, pos: Optional[int]
+        self, service: ApplicationService, stream_type: str, pos: int | None
     ) -> None:
         if stream_type not in ("read_receipt", "presence", "to_device", "device_list"):
             raise ValueError(
diff --git a/synapse/storage/databases/main/cache.py b/synapse/storage/databases/main/cache.py
index 7794926812..a4530796f2 100644
--- a/synapse/storage/databases/main/cache.py
+++ b/synapse/storage/databases/main/cache.py
@@ -21,8 +21,9 @@
 
 
 import itertools
+import json
 import logging
-from typing import TYPE_CHECKING, Any, Collection, Iterable, List, Optional, Tuple
+from typing import TYPE_CHECKING, Any, Collection, Iterable
 
 from synapse.api.constants import EventTypes
 from synapse.config._base import Config
@@ -44,6 +45,7 @@ from synapse.storage.database import (
 from synapse.storage.engines import PostgresEngine
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
 from synapse.util.caches.descriptors import CachedFunction
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
 
 if TYPE_CHECKING:
@@ -62,13 +64,19 @@ PURGE_HISTORY_CACHE_NAME = "ph_cache_fake"
 # As above, but for invalidating room caches on room deletion
 DELETE_ROOM_CACHE_NAME = "dr_cache_fake"
 
+# This cache takes a list of tuples as its first argument, which requires
+# special handling.
+GET_E2E_CROSS_SIGNING_SIGNATURES_FOR_DEVICE_CACHE_NAME = (
+    "_get_e2e_cross_signing_signatures_for_device"
+)
+
 # How long between cache invalidation table cleanups, once we have caught up
 # with the backlog.
-REGULAR_CLEANUP_INTERVAL_MS = Config.parse_duration("1h")
+REGULAR_CLEANUP_INTERVAL = Duration(hours=1)
 
 # How long between cache invalidation table cleanups, before we have caught
 # up with the backlog.
-CATCH_UP_CLEANUP_INTERVAL_MS = Config.parse_duration("1m")
+CATCH_UP_CLEANUP_INTERVAL = Duration(minutes=1)
 
 # Maximum number of cache invalidation rows to delete at once.
 CLEAN_UP_MAX_BATCH_SIZE = 20_000
@@ -97,7 +105,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
             psql_only=True,  # The table is only on postgres DBs.
         )
 
-        self._cache_id_gen: Optional[MultiWriterIdGenerator]
+        self._cache_id_gen: MultiWriterIdGenerator | None
         if isinstance(self.database_engine, PostgresEngine):
             # We set the `writers` to an empty list here as we don't care about
             # missing updates over restarts, as we'll not have anything in our
@@ -132,13 +140,13 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
             self.database_engine, PostgresEngine
         ):
             self.hs.get_clock().call_later(
-                CATCH_UP_CLEANUP_INTERVAL_MS / 1000,
+                CATCH_UP_CLEANUP_INTERVAL,
                 self._clean_up_cache_invalidation_wrapper,
             )
 
     async def get_all_updated_caches(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         """Get updates for caches replication stream.
 
         Args:
@@ -165,7 +173,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
 
         def get_all_updated_caches_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple]], int, bool]:
             # We purposefully don't bound by the current token, as we want to
             # send across cache invalidations as quickly as possible. Cache
             # invalidations are idempotent, so duplicates are fine.
@@ -270,6 +278,33 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
                     # room membership.
                     #
                     # self._membership_stream_cache.all_entities_changed(token)  # type: ignore[attr-defined]
+                elif (
+                    row.cache_func
+                    == GET_E2E_CROSS_SIGNING_SIGNATURES_FOR_DEVICE_CACHE_NAME
+                ):
+                    # "keys" is a list of strings, where each string is a
+                    # JSON-encoded representation of the tuple keys, i.e.
+                    # keys: ['["@userid:domain", "DEVICEID"]','["@userid2:domain", "DEVICEID2"]']
+                    #
+                    # This is a side-effect of not being able to send nested
+                    # information over replication.
+                    for json_str in row.keys:
+                        try:
+                            user_id, device_id = json.loads(json_str)
+                        except (json.JSONDecodeError, TypeError):
+                            logger.error(
+                                "Failed to deserialise cache key as valid JSON: %s",
+                                json_str,
+                            )
+                            continue
+
+                        # Invalidate each key.
+                        #
+                        # Note: .invalidate takes a tuple of arguments, hence the need
+                        # to nest our tuple in another tuple.
+                        self._get_e2e_cross_signing_signatures_for_device.invalidate(  # type: ignore[attr-defined]
+                            ((user_id, device_id),)
+                        )
                 else:
                     self._attempt_to_invalidate_cache(row.cache_func, row.keys)
 
@@ -347,9 +382,9 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
         event_id: str,
         room_id: str,
         etype: str,
-        state_key: Optional[str],
-        redacts: Optional[str],
-        relates_to: Optional[str],
+        state_key: str | None,
+        redacts: str | None,
+        relates_to: str | None,
         backfilled: bool,
     ) -> None:
         # This is needed to avoid a circular import.
@@ -563,7 +598,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
         self._invalidate_state_caches_all(room_id)
 
     async def invalidate_cache_and_stream(
-        self, cache_name: str, keys: Tuple[Any, ...]
+        self, cache_name: str, keys: tuple[Any, ...]
     ) -> None:
         """Invalidates the cache and adds it to the cache stream so other workers
         will know to invalidate their caches.
@@ -586,7 +621,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
         self,
         txn: LoggingTransaction,
         cache_func: CachedFunction,
-        keys: Tuple[Any, ...],
+        keys: tuple[Any, ...],
     ) -> None:
         """Invalidates the cache and adds it to the cache stream so other workers
         will know to invalidate their caches.
@@ -602,7 +637,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
         self,
         txn: LoggingTransaction,
         cache_func: CachedFunction,
-        key_tuples: Collection[Tuple[Any, ...]],
+        key_tuples: Collection[tuple[Any, ...]],
     ) -> None:
         """A bulk version of _invalidate_cache_and_stream.
 
@@ -665,7 +700,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
             )
 
     async def send_invalidation_to_replication(
-        self, cache_name: str, keys: Optional[Collection[Any]]
+        self, cache_name: str, keys: Collection[Any] | None
     ) -> None:
         await self.db_pool.runInteraction(
             "send_invalidation_to_replication",
@@ -675,7 +710,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
         )
 
     def _send_invalidation_to_replication(
-        self, txn: LoggingTransaction, cache_name: str, keys: Optional[Iterable[Any]]
+        self, txn: LoggingTransaction, cache_name: str, keys: Iterable[Any] | None
     ) -> None:
         """Notifies replication that given cache has been invalidated.
 
@@ -717,7 +752,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
                     "instance_name": self._instance_name,
                     "cache_func": cache_name,
                     "keys": keys,
-                    "invalidation_ts": self._clock.time_msec(),
+                    "invalidation_ts": self.clock.time_msec(),
                 },
             )
 
@@ -725,7 +760,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
         self,
         txn: LoggingTransaction,
         cache_name: str,
-        key_tuples: Collection[Tuple[Any, ...]],
+        key_tuples: Collection[tuple[Any, ...]],
     ) -> None:
         """Announce the invalidation of multiple (but not all) cache entries.
 
@@ -744,7 +779,7 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
             assert self._cache_id_gen is not None
 
             stream_ids = self._cache_id_gen.get_next_mult_txn(txn, len(key_tuples))
-            ts = self._clock.time_msec()
+            ts = self.clock.time_msec()
             txn.call_after(self.hs.get_notifier().on_new_replication_data)
             self.db_pool.simple_insert_many_txn(
                 txn,
@@ -791,12 +826,13 @@ class CacheInvalidationWorkerStore(SQLBaseStore):
         # Vary how long we wait before calling again depending on whether we
         # are still sifting through backlog or we have caught up.
         if in_backlog:
-            next_interval = CATCH_UP_CLEANUP_INTERVAL_MS
+            next_interval = CATCH_UP_CLEANUP_INTERVAL
         else:
-            next_interval = REGULAR_CLEANUP_INTERVAL_MS
+            next_interval = REGULAR_CLEANUP_INTERVAL
 
         self.hs.get_clock().call_later(
-            next_interval / 1000, self._clean_up_cache_invalidation_wrapper
+            next_interval,
+            self._clean_up_cache_invalidation_wrapper,
         )
 
     async def _clean_up_batch_of_old_cache_invalidations(
diff --git a/synapse/storage/databases/main/censor_events.py b/synapse/storage/databases/main/censor_events.py
index 5b15fd707d..a5ae4bf506 100644
--- a/synapse/storage/databases/main/censor_events.py
+++ b/synapse/storage/databases/main/censor_events.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from synapse.events.utils import prune_event_dict
 from synapse.metrics.background_process_metrics import wrap_as_background_process
@@ -32,7 +32,8 @@ from synapse.storage.database import (
 )
 from synapse.storage.databases.main.cache import CacheInvalidationWorkerStore
 from synapse.storage.databases.main.events_worker import EventsWorkerStore
-from synapse.util import json_encoder
+from synapse.util.duration import Duration
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -54,7 +55,7 @@ class CensorEventsStore(EventsWorkerStore, CacheInvalidationWorkerStore, SQLBase
             hs.config.worker.run_background_tasks
             and self.hs.config.server.redaction_retention_period is not None
         ):
-            hs.get_clock().looping_call(self._censor_redactions, 5 * 60 * 1000)
+            hs.get_clock().looping_call(self._censor_redactions, Duration(minutes=5))
 
     @wrap_as_background_process("_censor_redactions")
     async def _censor_redactions(self) -> None:
@@ -77,7 +78,7 @@ class CensorEventsStore(EventsWorkerStore, CacheInvalidationWorkerStore, SQLBase
             return
 
         before_ts = (
-            self._clock.time_msec() - self.hs.config.server.redaction_retention_period
+            self.clock.time_msec() - self.hs.config.server.redaction_retention_period
         )
 
         # We fetch all redactions that:
@@ -121,7 +122,7 @@ class CensorEventsStore(EventsWorkerStore, CacheInvalidationWorkerStore, SQLBase
                 and original_event.internal_metadata.is_redacted()
             ):
                 # Redaction was allowed
-                pruned_json: Optional[str] = json_encoder.encode(
+                pruned_json: str | None = json_encoder.encode(
                     prune_event_dict(
                         original_event.room_version, original_event.get_dict()
                     )
diff --git a/synapse/storage/databases/main/client_ips.py b/synapse/storage/databases/main/client_ips.py
index cf7bc4ac69..7cd3667a2b 100644
--- a/synapse/storage/databases/main/client_ips.py
+++ b/synapse/storage/databases/main/client_ips.py
@@ -22,13 +22,8 @@
 import logging
 from typing import (
     TYPE_CHECKING,
-    Dict,
-    List,
     Mapping,
-    Optional,
-    Tuple,
     TypedDict,
-    Union,
     cast,
 )
 
@@ -47,6 +42,7 @@ from synapse.storage.databases.main.monthly_active_users import (
 )
 from synapse.types import JsonDict, UserID
 from synapse.util.caches.lrucache import LruCache
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -67,9 +63,9 @@ class DeviceLastConnectionInfo:
     user_id: str
     device_id: str
 
-    ip: Optional[str]
-    user_agent: Optional[str]
-    last_seen: Optional[int]
+    ip: str | None
+    user_agent: str | None
+    last_seen: int | None
 
 
 class LastConnectionInfo(TypedDict):
@@ -179,7 +175,7 @@ class ClientIpBackgroundUpdateStore(SQLBaseStore):
         # Fetch the start of the batch
         begin_last_seen: int = progress.get("last_seen", 0)
 
-        def get_last_seen(txn: LoggingTransaction) -> Optional[int]:
+        def get_last_seen(txn: LoggingTransaction) -> int | None:
             txn.execute(
                 """
                 SELECT last_seen FROM user_ips
@@ -190,7 +186,7 @@ class ClientIpBackgroundUpdateStore(SQLBaseStore):
                 """,
                 (begin_last_seen, batch_size),
             )
-            row = cast(Optional[Tuple[int]], txn.fetchone())
+            row = cast(tuple[int] | None, txn.fetchone())
             if row:
                 return row[0]
             else:
@@ -222,7 +218,7 @@ class ClientIpBackgroundUpdateStore(SQLBaseStore):
 
             # Define the search space, which requires handling the last batch in
             # a different way
-            args: Tuple[int, ...]
+            args: tuple[int, ...]
             if last:
                 clause = "? <= last_seen"
                 args = (begin_last_seen,)
@@ -251,7 +247,7 @@ class ClientIpBackgroundUpdateStore(SQLBaseStore):
                 args,
             )
             res = cast(
-                List[Tuple[str, str, str, Optional[str], str, int, int]], txn.fetchall()
+                list[tuple[str, str, str, str | None, str, int, int]], txn.fetchall()
             )
 
             # We've got some duplicates
@@ -361,7 +357,7 @@ class ClientIpBackgroundUpdateStore(SQLBaseStore):
             #      we'll just end up updating the same device row multiple
             #      times, which is fine.
 
-            where_args: List[Union[str, int]]
+            where_args: list[str | int]
             where_clause, where_args = make_tuple_comparison_clause(
                 [("user_id", last_user_id), ("device_id", last_device_id)],
             )
@@ -383,7 +379,7 @@ class ClientIpBackgroundUpdateStore(SQLBaseStore):
             """ % {"where_clause": where_clause}
             txn.execute(sql, where_args + [batch_size])
 
-            rows = cast(List[Tuple[int, str, str, str, str]], txn.fetchall())
+            rows = cast(list[tuple[int, str, str, str, str]], txn.fetchall())
             if not rows:
                 return 0
 
@@ -434,29 +430,30 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
         self.user_ips_max_age = hs.config.server.user_ips_max_age
 
         # (user_id, access_token, ip,) -> last_seen
-        self.client_ip_last_seen = LruCache[Tuple[str, str, str], int](
+        self.client_ip_last_seen = LruCache[tuple[str, str, str], int](
             cache_name="client_ip_last_seen",
             server_name=self.server_name,
             max_size=50000,
+            clock=hs.get_clock(),
         )
 
         if hs.config.worker.run_background_tasks and self.user_ips_max_age:
-            self._clock.looping_call(self._prune_old_user_ips, 5 * 1000)
+            self.clock.looping_call(self._prune_old_user_ips, Duration(seconds=5))
 
         if self._update_on_this_worker:
             # This is the designated worker that can write to the client IP
             # tables.
 
             # (user_id, access_token, ip,) -> (user_agent, device_id, last_seen)
-            self._batch_row_update: Dict[
-                Tuple[str, str, str], Tuple[str, Optional[str], int]
+            self._batch_row_update: dict[
+                tuple[str, str, str], tuple[str, str | None, int]
             ] = {}
 
-            self._client_ip_looper = self._clock.looping_call(
-                self._update_client_ips_batch, 5 * 1000
-            )
-            self.hs.get_reactor().addSystemEventTrigger(
-                "before", "shutdown", self._update_client_ips_batch
+            self.clock.looping_call(self._update_client_ips_batch, Duration(seconds=5))
+            hs.register_async_shutdown_handler(
+                phase="before",
+                eventType="shutdown",
+                shutdown_func=self._update_client_ips_batch,
             )
 
     @wrap_as_background_process("prune_old_user_ips")
@@ -492,7 +489,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
             )
         """
 
-        timestamp = self._clock.time_msec() - self.user_ips_max_age
+        timestamp = self.clock.time_msec() - self.user_ips_max_age
 
         def _prune_old_user_ips_txn(txn: LoggingTransaction) -> None:
             txn.execute(sql, (timestamp,))
@@ -502,8 +499,8 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
         )
 
     async def _get_last_client_ip_by_device_from_database(
-        self, user_id: str, device_id: Optional[str]
-    ) -> Dict[Tuple[str, str], DeviceLastConnectionInfo]:
+        self, user_id: str, device_id: str | None
+    ) -> dict[tuple[str, str], DeviceLastConnectionInfo]:
         """For each device_id listed, give the user_ip it was last seen on.
 
         The result might be slightly out of date as client IPs are inserted in batches.
@@ -521,7 +518,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
             keyvalues["device_id"] = device_id
 
         res = cast(
-            List[Tuple[str, Optional[str], Optional[str], str, Optional[int]]],
+            list[tuple[str, str | None, str | None, str, int | None]],
             await self.db_pool.simple_select_list(
                 table="devices",
                 keyvalues=keyvalues,
@@ -542,7 +539,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
 
     async def _get_user_ip_and_agents_from_database(
         self, user: UserID, since_ts: int = 0
-    ) -> List[LastConnectionInfo]:
+    ) -> list[LastConnectionInfo]:
         """Fetch the IPs and user agents for a user since the given timestamp.
 
         The result might be slightly out of date as client IPs are inserted in batches.
@@ -566,7 +563,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
         """
         user_id = user.to_string()
 
-        def get_recent(txn: LoggingTransaction) -> List[Tuple[str, str, str, int]]:
+        def get_recent(txn: LoggingTransaction) -> list[tuple[str, str, str, int]]:
             txn.execute(
                 """
                 SELECT access_token, ip, user_agent, last_seen FROM user_ips
@@ -576,7 +573,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
                 """,
                 (since_ts, user_id),
             )
-            return cast(List[Tuple[str, str, str, int]], txn.fetchall())
+            return cast(list[tuple[str, str, str, int]], txn.fetchall())
 
         rows = await self.db_pool.runInteraction(
             desc="get_user_ip_and_agents", func=get_recent
@@ -598,8 +595,8 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
         access_token: str,
         ip: str,
         user_agent: str,
-        device_id: Optional[str],
-        now: Optional[int] = None,
+        device_id: str | None,
+        now: int | None = None,
     ) -> None:
         """Record that `user_id` used `access_token` from this `ip` address.
 
@@ -628,7 +625,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
             return
 
         if not now:
-            now = int(self._clock.time_msec())
+            now = int(self.clock.time_msec())
         key = (user_id, access_token, ip)
 
         try:
@@ -672,7 +669,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
     def _update_client_ips_batch_txn(
         self,
         txn: LoggingTransaction,
-        to_update: Mapping[Tuple[str, str, str], Tuple[str, Optional[str], int]],
+        to_update: Mapping[tuple[str, str, str], tuple[str, str | None, int]],
     ) -> None:
         assert self._update_on_this_worker, (
             "This worker is not designated to update client IPs"
@@ -717,8 +714,8 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
             )
 
     async def get_last_client_ip_by_device(
-        self, user_id: str, device_id: Optional[str]
-    ) -> Dict[Tuple[str, str], DeviceLastConnectionInfo]:
+        self, user_id: str, device_id: str | None
+    ) -> dict[tuple[str, str], DeviceLastConnectionInfo]:
         """For each device_id listed, give the user_ip it was last seen on
 
         Args:
@@ -758,7 +755,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
 
     async def get_user_ip_and_agents(
         self, user: UserID, since_ts: int = 0
-    ) -> List[LastConnectionInfo]:
+    ) -> list[LastConnectionInfo]:
         """Fetch the IPs and user agents for a user since the given timestamp.
 
         Args:
@@ -785,7 +782,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
             # the result
             return rows_from_db
 
-        results: Dict[Tuple[str, str], LastConnectionInfo] = {
+        results: dict[tuple[str, str], LastConnectionInfo] = {
             (connection["access_token"], connection["ip"]): connection
             for connection in rows_from_db
         }
@@ -807,7 +804,7 @@ class ClientIpWorkerStore(ClientIpBackgroundUpdateStore, MonthlyActiveUsersWorke
 
         return list(results.values())
 
-    async def get_last_seen_for_user_id(self, user_id: str) -> Optional[int]:
+    async def get_last_seen_for_user_id(self, user_id: str) -> int | None:
         """Get the last seen timestamp for a user, if we have it."""
 
         return await self.db_pool.simple_select_one_onecol(
diff --git a/synapse/storage/databases/main/delayed_events.py b/synapse/storage/databases/main/delayed_events.py
index c88682d55c..1727f589e2 100644
--- a/synapse/storage/databases/main/delayed_events.py
+++ b/synapse/storage/databases/main/delayed_events.py
@@ -13,16 +13,25 @@
 #
 
 import logging
-from typing import List, NewType, Optional, Tuple
+from typing import TYPE_CHECKING, NewType
 
 import attr
 
 from synapse.api.errors import NotFoundError
 from synapse.storage._base import SQLBaseStore, db_to_json
-from synapse.storage.database import LoggingTransaction, StoreError
+from synapse.storage.database import (
+    DatabasePool,
+    LoggingDatabaseConnection,
+    LoggingTransaction,
+    StoreError,
+)
 from synapse.storage.engines import PostgresEngine
 from synapse.types import JsonDict, RoomID
-from synapse.util import json_encoder, stringutils as stringutils
+from synapse.util import stringutils
+from synapse.util.json import json_encoder
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
 
 logger = logging.getLogger(__name__)
 
@@ -41,10 +50,11 @@ Timestamp = NewType("Timestamp", int)
 class EventDetails:
     room_id: RoomID
     type: EventType
-    state_key: Optional[StateKey]
-    origin_server_ts: Optional[Timestamp]
+    state_key: StateKey | None
+    origin_server_ts: Timestamp | None
     content: JsonDict
-    device_id: Optional[DeviceID]
+    device_id: DeviceID | None
+    sticky_duration_ms: int | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -54,6 +64,27 @@ class DelayedEventDetails(EventDetails):
 
 
 class DelayedEventsStore(SQLBaseStore):
+    def __init__(
+        self,
+        database: DatabasePool,
+        db_conn: LoggingDatabaseConnection,
+        hs: "HomeServer",
+    ):
+        super().__init__(database, db_conn, hs)
+
+        # Set delayed events to be uniquely identifiable by their delay_id.
+        # In practice, delay_ids are already unique because they are generated
+        # from cryptographically strong random strings.
+        # Therefore, adding this constraint is not expected to ever fail,
+        # despite the current pkey technically allowing non-unique delay_ids.
+        self.db_pool.updates.register_background_index_update(
+            update_name="delayed_events_idx",
+            index_name="delayed_events_idx",
+            table="delayed_events",
+            columns=("delay_id",),
+            unique=True,
+        )
+
     async def get_delayed_events_stream_pos(self) -> int:
         """
         Gets the stream position of the background process to watch for state events
@@ -66,7 +97,7 @@ class DelayedEventsStore(SQLBaseStore):
             desc="get_delayed_events_stream_pos",
         )
 
-    async def update_delayed_events_stream_pos(self, stream_id: Optional[int]) -> None:
+    async def update_delayed_events_stream_pos(self, stream_id: int | None) -> None:
         """
         Updates the stream position of the background process to watch for state events
         that target the same piece of state as any pending delayed events.
@@ -84,15 +115,16 @@ class DelayedEventsStore(SQLBaseStore):
         self,
         *,
         user_localpart: str,
-        device_id: Optional[str],
+        device_id: str | None,
         creation_ts: Timestamp,
         room_id: str,
         event_type: str,
-        state_key: Optional[str],
-        origin_server_ts: Optional[int],
+        state_key: str | None,
+        origin_server_ts: int | None,
         content: JsonDict,
         delay: int,
-    ) -> Tuple[DelayID, Timestamp]:
+        sticky_duration_ms: int | None,
+    ) -> tuple[DelayID, Timestamp]:
         """
         Inserts a new delayed event in the DB.
 
@@ -118,6 +150,7 @@ class DelayedEventsStore(SQLBaseStore):
                     "state_key": state_key,
                     "origin_server_ts": origin_server_ts,
                     "content": json_encoder.encode(content),
+                    "sticky_duration_ms": sticky_duration_ms,
                 },
             )
 
@@ -133,9 +166,7 @@ class DelayedEventsStore(SQLBaseStore):
 
     async def restart_delayed_event(
         self,
-        *,
         delay_id: str,
-        user_localpart: str,
         current_ts: Timestamp,
     ) -> Timestamp:
         """
@@ -144,7 +175,6 @@ class DelayedEventsStore(SQLBaseStore):
 
         Args:
             delay_id: The ID of the delayed event to restart.
-            user_localpart: The localpart of the delayed event's owner.
             current_ts: The current time, which will be used to calculate the new send time.
 
         Returns: The send time of the next delayed event to be sent,
@@ -162,13 +192,11 @@ class DelayedEventsStore(SQLBaseStore):
                 """
                 UPDATE delayed_events
                 SET send_ts = ? + delay
-                WHERE delay_id = ? AND user_localpart = ?
-                    AND NOT is_processed
+                WHERE delay_id = ? AND NOT is_processed
                 """,
                 (
                     current_ts,
                     delay_id,
-                    user_localpart,
                 ),
             )
             if txn.rowcount == 0:
@@ -182,10 +210,25 @@ class DelayedEventsStore(SQLBaseStore):
             "restart_delayed_event", restart_delayed_event_txn
         )
 
+    async def get_count_of_delayed_events(self) -> int:
+        """Returns the number of pending delayed events in the DB."""
+
+        def _get_count_of_delayed_events(txn: LoggingTransaction) -> int:
+            sql = "SELECT count(*) FROM delayed_events"
+
+            txn.execute(sql)
+            resp = txn.fetchone()
+            return resp[0] if resp is not None else 0
+
+        return await self.db_pool.runInteraction(
+            "get_count_of_delayed_events",
+            _get_count_of_delayed_events,
+        )
+
     async def get_all_delayed_events_for_user(
         self,
         user_localpart: str,
-    ) -> List[JsonDict]:
+    ) -> list[JsonDict]:
         """Returns all pending delayed events owned by the given user."""
         # TODO: Support Pagination stream API ("next_batch" field)
         rows = await self.db_pool.execute(
@@ -219,24 +262,34 @@ class DelayedEventsStore(SQLBaseStore):
         ]
 
     async def process_timeout_delayed_events(
-        self, current_ts: Timestamp
-    ) -> Tuple[
-        List[DelayedEventDetails],
-        Optional[Timestamp],
+        self, current_ts: Timestamp, reprocess_events: bool = False
+    ) -> tuple[
+        list[DelayedEventDetails],
+        Timestamp | None,
     ]:
         """
         Marks for processing all delayed events that should have been sent prior to the provided time
         that haven't already been marked as such.
 
+        Args:
+            current_ts: The current timestamp.
+            reprocess_events: Whether to reprocess already-processed delayed
+                events. If set to True, events which are marked as processed
+                will have their `send_ts` re-checked.
+
+                This is mainly useful for recovering from a server restart;
+                which could have occurred between an event being marked as
+                processed and the event actually being sent.
+
         Returns: The details of all newly-processed delayed events,
             and the send time of the next delayed event to be sent, if any.
         """
 
         def process_timeout_delayed_events_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[
-            List[DelayedEventDetails],
-            Optional[Timestamp],
+        ) -> tuple[
+            list[DelayedEventDetails],
+            Timestamp | None,
         ]:
             sql_cols = ", ".join(
                 (
@@ -249,10 +302,16 @@ class DelayedEventsStore(SQLBaseStore):
                     "send_ts",
                     "content",
                     "device_id",
+                    "sticky_duration_ms",
                 )
             )
             sql_update = "UPDATE delayed_events SET is_processed = TRUE"
-            sql_where = "WHERE send_ts <= ? AND NOT is_processed"
+            sql_where = "WHERE send_ts <= ?"
+
+            if not reprocess_events:
+                # Skip already-processed events.
+                sql_where += " AND NOT is_processed"
+
             sql_args = (current_ts,)
             sql_order = "ORDER BY send_ts"
             if isinstance(self.database_engine, PostgresEngine):
@@ -289,6 +348,7 @@ class DelayedEventsStore(SQLBaseStore):
                     Timestamp(row[5] if row[5] is not None else row[6]),
                     db_to_json(row[7]),
                     DeviceID(row[8]) if row[8] is not None else None,
+                    int(row[9]) if row[9] is not None else None,
                     DelayID(row[0]),
                     UserLocalpart(row[1]),
                 )
@@ -303,21 +363,15 @@ class DelayedEventsStore(SQLBaseStore):
 
     async def process_target_delayed_event(
         self,
-        *,
         delay_id: str,
-        user_localpart: str,
-    ) -> Tuple[
-        EventDetails,
-        Optional[Timestamp],
+    ) -> tuple[
+        DelayedEventDetails,
+        Timestamp | None,
     ]:
         """
         Marks for processing the matching delayed event, regardless of its timeout time,
         as long as it has not already been marked as such.
 
-        Args:
-            delay_id: The ID of the delayed event to restart.
-            user_localpart: The localpart of the delayed event's owner.
-
         Returns: The details of the matching delayed event,
             and the send time of the next delayed event to be sent, if any.
 
@@ -327,45 +381,41 @@ class DelayedEventsStore(SQLBaseStore):
 
         def process_target_delayed_event_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[
-            EventDetails,
-            Optional[Timestamp],
+        ) -> tuple[
+            DelayedEventDetails,
+            Timestamp | None,
         ]:
-            sql_cols = ", ".join(
-                (
-                    "room_id",
-                    "event_type",
-                    "state_key",
-                    "origin_server_ts",
-                    "content",
-                    "device_id",
-                )
-            )
-            sql_update = "UPDATE delayed_events SET is_processed = TRUE"
-            sql_where = "WHERE delay_id = ? AND user_localpart = ? AND NOT is_processed"
-            sql_args = (delay_id, user_localpart)
             txn.execute(
-                (
-                    f"{sql_update} {sql_where} RETURNING {sql_cols}"
-                    if self.database_engine.supports_returning
-                    else f"SELECT {sql_cols} FROM delayed_events {sql_where}"
-                ),
-                sql_args,
+                """
+                UPDATE delayed_events
+                SET is_processed = TRUE
+                WHERE delay_id = ? AND NOT is_processed
+                RETURNING
+                    room_id,
+                    event_type,
+                    state_key,
+                    origin_server_ts,
+                    content,
+                    device_id,
+                    sticky_duration_ms,
+                    user_localpart
+                """,
+                (delay_id,),
             )
             row = txn.fetchone()
             if row is None:
                 raise NotFoundError("Delayed event not found")
-            elif not self.database_engine.supports_returning:
-                txn.execute(f"{sql_update} {sql_where}", sql_args)
-                assert txn.rowcount == 1
 
-            event = EventDetails(
+            event = DelayedEventDetails(
                 RoomID.from_string(row[0]),
                 EventType(row[1]),
                 StateKey(row[2]) if row[2] is not None else None,
                 Timestamp(row[3]) if row[3] is not None else None,
                 db_to_json(row[4]),
                 DeviceID(row[5]) if row[5] is not None else None,
+                int(row[6]) if row[6] is not None else None,
+                DelayID(delay_id),
+                UserLocalpart(row[7]),
             )
 
             return event, self._get_next_delayed_event_send_ts_txn(txn)
@@ -374,19 +424,10 @@ class DelayedEventsStore(SQLBaseStore):
             "process_target_delayed_event", process_target_delayed_event_txn
         )
 
-    async def cancel_delayed_event(
-        self,
-        *,
-        delay_id: str,
-        user_localpart: str,
-    ) -> Optional[Timestamp]:
+    async def cancel_delayed_event(self, delay_id: str) -> Timestamp | None:
         """
         Cancels the matching delayed event, i.e. remove it as long as it hasn't been processed.
 
-        Args:
-            delay_id: The ID of the delayed event to restart.
-            user_localpart: The localpart of the delayed event's owner.
-
         Returns: The send time of the next delayed event to be sent, if any.
 
         Raises:
@@ -395,14 +436,13 @@ class DelayedEventsStore(SQLBaseStore):
 
         def cancel_delayed_event_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Timestamp]:
+        ) -> Timestamp | None:
             try:
                 self.db_pool.simple_delete_one_txn(
                     txn,
                     table="delayed_events",
                     keyvalues={
                         "delay_id": delay_id,
-                        "user_localpart": user_localpart,
                         "is_processed": False,
                     },
                 )
@@ -425,7 +465,7 @@ class DelayedEventsStore(SQLBaseStore):
         event_type: str,
         state_key: str,
         not_from_localpart: str,
-    ) -> Optional[Timestamp]:
+    ) -> Timestamp | None:
         """
         Cancels all matching delayed state events, i.e. remove them as long as they haven't been processed.
 
@@ -441,7 +481,7 @@ class DelayedEventsStore(SQLBaseStore):
 
         def cancel_delayed_state_events_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Timestamp]:
+        ) -> Timestamp | None:
             txn.execute(
                 """
                 DELETE FROM delayed_events
@@ -462,11 +502,7 @@ class DelayedEventsStore(SQLBaseStore):
             "cancel_delayed_state_events", cancel_delayed_state_events_txn
         )
 
-    async def delete_processed_delayed_event(
-        self,
-        delay_id: DelayID,
-        user_localpart: UserLocalpart,
-    ) -> None:
+    async def delete_processed_delayed_event(self, delay_id: DelayID) -> None:
         """
         Delete the matching delayed event, as long as it has been marked as processed.
 
@@ -477,7 +513,6 @@ class DelayedEventsStore(SQLBaseStore):
             table="delayed_events",
             keyvalues={
                 "delay_id": delay_id,
-                "user_localpart": user_localpart,
                 "is_processed": True,
             },
             desc="delete_processed_delayed_event",
@@ -515,7 +550,7 @@ class DelayedEventsStore(SQLBaseStore):
             desc="unprocess_delayed_events",
         )
 
-    async def get_next_delayed_event_send_ts(self) -> Optional[Timestamp]:
+    async def get_next_delayed_event_send_ts(self) -> Timestamp | None:
         """
         Returns the send time of the next delayed event to be sent, if any.
         """
@@ -527,7 +562,7 @@ class DelayedEventsStore(SQLBaseStore):
 
     def _get_next_delayed_event_send_ts_txn(
         self, txn: LoggingTransaction
-    ) -> Optional[Timestamp]:
+    ) -> Timestamp | None:
         result = self.db_pool.simple_select_one_onecol_txn(
             txn,
             table="delayed_events",
@@ -543,7 +578,7 @@ def _generate_delay_id() -> DelayID:
 
     # We use the following format for delay IDs:
     #    syd_<random string>
-    # They are scoped to user localparts, so it is possible for
-    # the same ID to exist for multiple users.
+    # They are not scoped to user localparts, but the random string
+    # is expected to be sufficiently random to be globally unique.
 
     return DelayID(f"syd_{stringutils.random_string(20)}")
diff --git a/synapse/storage/databases/main/deviceinbox.py b/synapse/storage/databases/main/deviceinbox.py
index c10e2d2611..fc61f46c1c 100644
--- a/synapse/storage/databases/main/deviceinbox.py
+++ b/synapse/storage/databases/main/deviceinbox.py
@@ -24,12 +24,7 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Collection,
-    Dict,
     Iterable,
-    List,
-    Optional,
-    Set,
-    Tuple,
     cast,
 )
 
@@ -53,10 +48,11 @@ from synapse.storage.database import (
 )
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
 from synapse.types import JsonDict, StrCollection
-from synapse.util import Duration, json_encoder
 from synapse.util.caches.expiringcache import ExpiringCache
 from synapse.util.caches.stream_change_cache import StreamChangeCache
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
+from synapse.util.json import json_encoder
 from synapse.util.stringutils import parse_and_validate_server_name
 
 if TYPE_CHECKING:
@@ -66,10 +62,10 @@ logger = logging.getLogger(__name__)
 
 
 # How long to keep messages in the device federation inbox before deleting them.
-DEVICE_FEDERATION_INBOX_CLEANUP_DELAY_MS = 7 * Duration.DAY_MS
+DEVICE_FEDERATION_INBOX_CLEANUP_DELAY = Duration(days=7)
 
 # How often to run the task to clean up old device_federation_inbox rows.
-DEVICE_FEDERATION_INBOX_CLEANUP_INTERVAL_MS = 5 * Duration.MINUTE_MS
+DEVICE_FEDERATION_INBOX_CLEANUP_INTERVAL = Duration(minutes=5)
 
 # Update name for the device federation inbox received timestamp index.
 DEVICE_FEDERATION_INBOX_RECEIVED_INDEX_UPDATE = (
@@ -90,14 +86,15 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
         # Map of (user_id, device_id) to the last stream_id that has been
         # deleted up to. This is so that we can no op deletions.
-        self._last_device_delete_cache: ExpiringCache[
-            Tuple[str, Optional[str]], int
-        ] = ExpiringCache(
-            cache_name="last_device_delete_cache",
-            server_name=self.server_name,
-            clock=self._clock,
-            max_len=10000,
-            expiry_ms=30 * 60 * 1000,
+        self._last_device_delete_cache: ExpiringCache[tuple[str, str | None], int] = (
+            ExpiringCache(
+                cache_name="last_device_delete_cache",
+                server_name=self.server_name,
+                hs=hs,
+                clock=self.clock,
+                max_len=10000,
+                expiry_ms=30 * 60 * 1000,
+            )
         )
 
         self._can_write_to_device = (
@@ -153,9 +150,9 @@ class DeviceInboxWorkerStore(SQLBaseStore):
         )
 
         if hs.config.worker.run_background_tasks:
-            self._clock.looping_call(
+            self.clock.looping_call(
                 run_as_background_process,
-                DEVICE_FEDERATION_INBOX_CLEANUP_INTERVAL_MS,
+                DEVICE_FEDERATION_INBOX_CLEANUP_INTERVAL,
                 "_delete_old_federation_inbox_rows",
                 self.server_name,
                 self._delete_old_federation_inbox_rows,
@@ -201,7 +198,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
         user_ids: Collection[str],
         from_stream_id: int,
         to_stream_id: int,
-    ) -> Dict[Tuple[str, str], List[JsonDict]]:
+    ) -> dict[tuple[str, str], list[JsonDict]]:
         """
         Retrieve to-device messages for a given set of users.
 
@@ -240,7 +237,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
         from_stream_id: int,
         to_stream_id: int,
         limit: int = 100,
-    ) -> Tuple[List[JsonDict], int]:
+    ) -> tuple[list[JsonDict], int]:
         """
         Retrieve to-device messages for a single user device.
 
@@ -269,7 +266,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
         def get_device_messages_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[JsonDict], int]:
+        ) -> tuple[list[JsonDict], int]:
             sql = """
                 SELECT stream_id, message_json FROM device_inbox
                 WHERE user_id = ? AND device_id = ?
@@ -282,7 +279,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
             # Create and fill a dictionary of (user ID, device ID) -> list of messages
             # intended for each device.
             last_processed_stream_pos = to_stream_id
-            to_device_messages: List[JsonDict] = []
+            to_device_messages: list[JsonDict] = []
             rowcount = 0
             for row in txn:
                 rowcount += 1
@@ -329,7 +326,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
         user_ids: Collection[str],
         from_stream_id: int,
         to_stream_id: int,
-    ) -> Tuple[Dict[Tuple[str, str], List[JsonDict]], int]:
+    ) -> tuple[dict[tuple[str, str], list[JsonDict]], int]:
         """
         Retrieve pending to-device messages for a collection of user devices.
 
@@ -361,7 +358,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
             logger.warning("No users provided upon querying for device IDs")
             return {}, to_stream_id
 
-        user_ids_to_query: Set[str] = set()
+        user_ids_to_query: set[str] = set()
 
         # Determine which users have devices with pending messages
         for user_id in user_ids:
@@ -376,7 +373,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
         def get_device_messages_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[Dict[Tuple[str, str], List[JsonDict]], int]:
+        ) -> tuple[dict[tuple[str, str], list[JsonDict]], int]:
             # Build a query to select messages from any of the given devices that
             # are between the given stream id bounds.
 
@@ -387,7 +384,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
             # since device_inbox has an index on `(user_id, device_id, stream_id)`
 
             user_device_dicts = cast(
-                List[Tuple[str]],
+                list[tuple[str]],
                 self.db_pool.simple_select_many_txn(
                     txn,
                     table="devices",
@@ -434,7 +431,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
             # Create and fill a dictionary of (user ID, device ID) -> list of messages
             # intended for each device.
-            recipient_device_to_messages: Dict[Tuple[str, str], List[JsonDict]] = {}
+            recipient_device_to_messages: dict[tuple[str, str], list[JsonDict]] = {}
             rowcount = 0
             for row in txn:
                 rowcount += 1
@@ -471,7 +468,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
     async def delete_messages_for_device(
         self,
         user_id: str,
-        device_id: Optional[str],
+        device_id: str | None,
         up_to_stream_id: int,
     ) -> int:
         """
@@ -529,11 +526,11 @@ class DeviceInboxWorkerStore(SQLBaseStore):
     async def delete_messages_for_device_between(
         self,
         user_id: str,
-        device_id: Optional[str],
-        from_stream_id: Optional[int],
+        device_id: str | None,
+        from_stream_id: int | None,
         to_stream_id: int,
         limit: int,
-    ) -> Tuple[Optional[int], int]:
+    ) -> tuple[int | None, int]:
         """Delete N device messages between the stream IDs, returning the
         highest stream ID deleted (or None if all messages in the range have
         been deleted) and the number of messages deleted.
@@ -553,7 +550,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
         def delete_messages_for_device_between_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[Optional[int], int]:
+        ) -> tuple[int | None, int]:
             txn.execute(
                 """
                 SELECT MAX(stream_id) FROM (
@@ -596,7 +593,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
     @trace
     async def get_new_device_msgs_for_remote(
         self, destination: str, last_stream_id: int, current_stream_id: int, limit: int
-    ) -> Tuple[List[JsonDict], int]:
+    ) -> tuple[list[JsonDict], int]:
         """
         Args:
             destination: The name of the remote server.
@@ -626,7 +623,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
         @trace
         def get_new_messages_for_remote_destination_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[JsonDict], int]:
+        ) -> tuple[list[JsonDict], int]:
             sql = (
                 "SELECT stream_id, messages_json FROM device_federation_outbox"
                 " WHERE destination = ?"
@@ -682,7 +679,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
     async def get_all_new_device_messages(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         """Get updates for to device replication stream.
 
         Args:
@@ -709,7 +706,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
         def get_all_new_device_messages_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple]], int, bool]:
             # We limit like this as we might have multiple rows per stream_id, and
             # we want to make sure we always get all entries for any stream_id
             # we return.
@@ -744,8 +741,8 @@ class DeviceInboxWorkerStore(SQLBaseStore):
     @trace
     async def add_messages_to_device_inbox(
         self,
-        local_messages_by_user_then_device: Dict[str, Dict[str, JsonDict]],
-        remote_messages_by_destination: Dict[str, JsonDict],
+        local_messages_by_user_then_device: dict[str, dict[str, JsonDict]],
+        remote_messages_by_destination: dict[str, JsonDict],
     ) -> int:
         """Used to send messages from this server.
 
@@ -825,7 +822,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
                             )
 
         async with self._to_device_msg_id_gen.get_next() as stream_id:
-            now_ms = self._clock.time_msec()
+            now_ms = self.clock.time_msec()
             await self.db_pool.runInteraction(
                 "add_messages_to_device_inbox", add_messages_txn, now_ms, stream_id
             )
@@ -842,7 +839,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
         self,
         origin: str,
         message_id: str,
-        local_messages_by_user_then_device: Dict[str, Dict[str, JsonDict]],
+        local_messages_by_user_then_device: dict[str, dict[str, JsonDict]],
     ) -> int:
         assert self._can_write_to_device
 
@@ -880,7 +877,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
             )
 
         async with self._to_device_msg_id_gen.get_next() as stream_id:
-            now_ms = self._clock.time_msec()
+            now_ms = self.clock.time_msec()
             await self.db_pool.runInteraction(
                 "add_messages_from_remote_to_device_inbox",
                 add_messages_txn,
@@ -896,7 +893,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
         self,
         txn: LoggingTransaction,
         stream_id: int,
-        messages_by_user_then_device: Dict[str, Dict[str, JsonDict]],
+        messages_by_user_then_device: dict[str, dict[str, JsonDict]],
     ) -> None:
         assert self._can_write_to_device
 
@@ -927,7 +924,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
                 # We exclude hidden devices (such as cross-signing keys) here as they are
                 # not expected to receive to-device messages.
                 rows = cast(
-                    List[Tuple[str]],
+                    list[tuple[str]],
                     self.db_pool.simple_select_many_txn(
                         txn,
                         table="devices",
@@ -999,9 +996,10 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
         def _delete_old_federation_inbox_rows_txn(txn: LoggingTransaction) -> bool:
             # We delete at most 100 rows that are older than
-            # DEVICE_FEDERATION_INBOX_CLEANUP_DELAY_MS
+            # DEVICE_FEDERATION_INBOX_CLEANUP_DELAY
             delete_before_ts = (
-                self._clock.time_msec() - DEVICE_FEDERATION_INBOX_CLEANUP_DELAY_MS
+                self.clock.time_msec()
+                - DEVICE_FEDERATION_INBOX_CLEANUP_DELAY.as_millis()
             )
             sql = """
                 WITH to_delete AS (
@@ -1031,7 +1029,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
 
             # We sleep a bit so that we don't hammer the database in a tight
             # loop first time we run this.
-            await self._clock.sleep(1)
+            await self.clock.sleep(Duration(seconds=1))
 
     async def get_devices_with_messages(
         self, user_id: str, device_ids: StrCollection
@@ -1053,7 +1051,7 @@ class DeviceInboxWorkerStore(SQLBaseStore):
             txn.execute(sql, args)
             return {row[0] for row in txn}
 
-        results: Set[str] = set()
+        results: set[str] = set()
         for batch_device_ids in batch_iter(device_ids, 1000):
             batch_results = await self.db_pool.runInteraction(
                 "get_devices_with_messages",
@@ -1141,7 +1139,7 @@ class DeviceInboxBackgroundUpdateStore(SQLBaseStore):
 
         def _remove_dead_devices_from_device_inbox_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[int, bool]:
+        ) -> tuple[int, bool]:
             if "max_stream_id" in progress:
                 max_stream_id = progress["max_stream_id"]
             else:
@@ -1149,7 +1147,7 @@ class DeviceInboxBackgroundUpdateStore(SQLBaseStore):
                 # There's a type mismatch here between how we want to type the row and
                 # what fetchone says it returns, but we silence it because we know that
                 # res can't be None.
-                res = cast(Tuple[Optional[int]], txn.fetchone())
+                res = cast(tuple[int | None], txn.fetchone())
                 if res[0] is None:
                     # this can only happen if the `device_inbox` table is empty, in which
                     # case we have no work to do.
@@ -1212,7 +1210,7 @@ class DeviceInboxBackgroundUpdateStore(SQLBaseStore):
                 max_stream_id = progress["max_stream_id"]
             else:
                 txn.execute("SELECT max(stream_id) FROM device_federation_outbox")
-                res = cast(Tuple[Optional[int]], txn.fetchone())
+                res = cast(tuple[int | None], txn.fetchone())
                 if res[0] is None:
                     # this can only happen if the `device_inbox` table is empty, in which
                     # case we have no work to do.
diff --git a/synapse/storage/databases/main/devices.py b/synapse/storage/databases/main/devices.py
index a28cc40a95..e9ecf46411 100644
--- a/synapse/storage/databases/main/devices.py
+++ b/synapse/storage/databases/main/devices.py
@@ -24,13 +24,8 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
     cast,
 )
 
@@ -64,11 +59,12 @@ from synapse.types import (
     StrCollection,
     get_verify_key_from_cross_signing_key,
 )
-from synapse.util import json_decoder, json_encoder
 from synapse.util.caches.descriptors import cached, cachedList
 from synapse.util.caches.stream_change_cache import StreamChangeCache
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
+from synapse.util.json import json_decoder, json_encoder
 from synapse.util.stringutils import shortstr
 
 if TYPE_CHECKING:
@@ -195,8 +191,8 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             )
 
         if hs.config.worker.run_background_tasks:
-            self._clock.looping_call(
-                self._prune_old_outbound_device_pokes, 60 * 60 * 1000
+            self.clock.looping_call(
+                self._prune_old_outbound_device_pokes, Duration(hours=1)
             )
 
     def process_replication_rows(
@@ -258,7 +254,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         return self._device_list_id_gen
 
     async def count_devices_by_users(
-        self, user_ids: Optional[Collection[str]] = None
+        self, user_ids: Collection[str] | None = None
     ) -> int:
         """Retrieve number of all devices of given users.
         Only returns number of devices that are not marked as hidden.
@@ -284,7 +280,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             )
 
             txn.execute(sql + clause, args)
-            return cast(Tuple[int], txn.fetchone())[0]
+            return cast(tuple[int], txn.fetchone())[0]
 
         if not user_ids:
             return 0
@@ -297,9 +293,9 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         self,
         user_id: str,
         device_id: str,
-        initial_device_display_name: Optional[str],
-        auth_provider_id: Optional[str] = None,
-        auth_provider_session_id: Optional[str] = None,
+        initial_device_display_name: str | None,
+        auth_provider_id: str | None = None,
+        auth_provider_session_id: str | None = None,
     ) -> bool:
         """Ensure the given device is known; add it to the store if not
 
@@ -381,7 +377,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             device_ids: The IDs of the devices to delete
         """
 
-        def _delete_devices_txn(txn: LoggingTransaction, device_ids: List[str]) -> None:
+        def _delete_devices_txn(txn: LoggingTransaction, device_ids: list[str]) -> None:
             self.db_pool.simple_delete_many_txn(
                 txn,
                 table="devices",
@@ -445,7 +441,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             )
 
     async def update_device(
-        self, user_id: str, device_id: str, new_display_name: Optional[str] = None
+        self, user_id: str, device_id: str, new_display_name: str | None = None
     ) -> None:
         """Update a device. Only updates the device if it is not marked as
         hidden.
@@ -473,7 +469,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
     @cached(tree=True)
     async def get_device(
         self, user_id: str, device_id: str
-    ) -> Optional[Mapping[str, Any]]:
+    ) -> Mapping[str, Any] | None:
         """Retrieve a device. Only returns devices that are not marked as
         hidden.
 
@@ -497,7 +493,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_devices_by_user(
         self, user_id: str
-    ) -> Dict[str, Dict[str, Optional[str]]]:
+    ) -> dict[str, dict[str, str | None]]:
         """Retrieve all of a user's registered devices. Only returns devices
         that are not marked as hidden.
 
@@ -508,7 +504,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             and "display_name" for each device. Display name may be null.
         """
         devices = cast(
-            List[Tuple[str, str, Optional[str]]],
+            list[tuple[str, str, str | None]],
             await self.db_pool.simple_select_list(
                 table="devices",
                 keyvalues={"user_id": user_id, "hidden": False},
@@ -524,7 +520,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_devices_by_auth_provider_session_id(
         self, auth_provider_id: str, auth_provider_session_id: str
-    ) -> List[Tuple[str, str]]:
+    ) -> list[tuple[str, str]]:
         """Retrieve the list of devices associated with a SSO IdP session ID.
 
         Args:
@@ -534,7 +530,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             A list of dicts containing the device_id and the user_id of each device
         """
         return cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="device_auth_providers",
                 keyvalues={
@@ -549,7 +545,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
     @trace
     async def get_device_updates_by_remote(
         self, destination: str, from_stream_id: int, limit: int
-    ) -> Tuple[int, List[Tuple[str, JsonDict]]]:
+    ) -> tuple[int, list[tuple[str, JsonDict]]]:
         """Get a stream of device updates to send to the given remote server.
 
         Args:
@@ -659,8 +655,8 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         last_processed_stream_id = from_stream_id
 
         # A map of (user ID, device ID) to (stream ID, context).
-        query_map: Dict[Tuple[str, str], Tuple[int, Optional[str]]] = {}
-        cross_signing_keys_by_user: Dict[str, Dict[str, object]] = {}
+        query_map: dict[tuple[str, str], tuple[int, str | None]] = {}
+        cross_signing_keys_by_user: dict[str, dict[str, object]] = {}
         for user_id, device_id, update_stream_id, update_context in updates:
             # Calculate the remaining length budget.
             # Note that, for now, each entry in `cross_signing_keys_by_user`
@@ -766,7 +762,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         from_stream_id: int,
         now_stream_id: int,
         limit: int,
-    ) -> List[Tuple[str, str, int, Optional[str]]]:
+    ) -> list[tuple[str, str, int, str | None]]:
         """Return device update information for a given remote destination
 
         Args:
@@ -792,14 +788,14 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         """
         txn.execute(sql, (destination, from_stream_id, now_stream_id, limit))
 
-        return cast(List[Tuple[str, str, int, Optional[str]]], txn.fetchall())
+        return cast(list[tuple[str, str, int, str | None]], txn.fetchall())
 
     async def _get_device_update_edus_by_remote(
         self,
         destination: str,
         from_stream_id: int,
-        query_map: Dict[Tuple[str, str], Tuple[int, Optional[str]]],
-    ) -> List[Tuple[str, dict]]:
+        query_map: dict[tuple[str, str], tuple[int, str | None]],
+    ) -> list[tuple[str, dict]]:
         """Returns a list of device update EDUs as well as E2EE keys
 
         Args:
@@ -933,7 +929,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         txn.execute(sql, (destination, stream_id))
 
     async def add_user_signature_change_to_streams(
-        self, from_user_id: str, user_ids: List[str]
+        self, from_user_id: str, user_ids: list[str]
     ) -> int:
         """Persist that a user has made new signatures
 
@@ -962,7 +958,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         self,
         txn: LoggingTransaction,
         from_user_id: str,
-        user_ids: List[str],
+        user_ids: list[str],
         stream_id: int,
     ) -> None:
         txn.call_after(
@@ -984,8 +980,8 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
     @trace
     @cancellable
     async def get_user_devices_from_cache(
-        self, user_ids: Set[str], user_and_device_ids: List[Tuple[str, str]]
-    ) -> Tuple[Set[str], Dict[str, Mapping[str, JsonMapping]]]:
+        self, user_ids: set[str], user_and_device_ids: list[tuple[str, str]]
+    ) -> tuple[set[str], dict[str, Mapping[str, JsonMapping]]]:
         """Get the devices (and keys if any) for remote users from the cache.
 
         Args:
@@ -1005,13 +1001,13 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         user_ids_not_in_cache = unique_user_ids - user_ids_in_cache
 
         # First fetch all the users which all devices are to be returned.
-        results: Dict[str, Mapping[str, JsonMapping]] = {}
+        results: dict[str, Mapping[str, JsonMapping]] = {}
         for user_id in user_ids:
             if user_id in user_ids_in_cache:
                 results[user_id] = await self.get_cached_devices_for_user(user_id)
         # Then fetch all device-specific requests, but skip users we've already
         # fetched all devices for.
-        device_specific_results: Dict[str, Dict[str, JsonMapping]] = {}
+        device_specific_results: dict[str, dict[str, JsonMapping]] = {}
         for user_id, device_id in user_and_device_ids:
             if user_id in user_ids_in_cache and user_id not in user_ids:
                 device = await self._get_cached_user_device(user_id, device_id)
@@ -1025,7 +1021,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_users_whose_devices_are_cached(
         self, user_ids: StrCollection
-    ) -> Set[str]:
+    ) -> set[str]:
         """Checks which of the given users we have cached the devices for."""
         user_map = await self.get_device_list_last_stream_id_for_remotes(user_ids)
 
@@ -1056,7 +1052,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         self, user_id: str
     ) -> Mapping[str, JsonMapping]:
         devices = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="device_lists_remote_cache",
                 keyvalues={"user_id": user_id},
@@ -1071,7 +1067,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         self,
         from_key: MultiWriterStreamToken,
         to_key: MultiWriterStreamToken,
-    ) -> Set[str]:
+    ) -> set[str]:
         """Get all users whose devices have changed in the given range.
 
         Args:
@@ -1130,8 +1126,8 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         self,
         from_key: MultiWriterStreamToken,
         user_ids: Collection[str],
-        to_key: Optional[MultiWriterStreamToken] = None,
-    ) -> Set[str]:
+        to_key: MultiWriterStreamToken | None = None,
+    ) -> set[str]:
         """Get set of users whose devices have changed since `from_key` that
         are in the given list of user_ids.
 
@@ -1164,14 +1160,14 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             txn: LoggingTransaction,
             from_key: MultiWriterStreamToken,
             to_key: MultiWriterStreamToken,
-        ) -> Set[str]:
+        ) -> set[str]:
             sql = """
                 SELECT user_id, stream_id, instance_name
                 FROM device_lists_stream
                 WHERE  ? < stream_id AND stream_id <= ? AND %s
             """
 
-            changes: Set[str] = set()
+            changes: set[str] = set()
 
             # Query device changes with a batch of users at a time
             for chunk in batch_iter(user_ids_to_check, 100):
@@ -1204,7 +1200,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_users_whose_signatures_changed(
         self, user_id: str, from_key: MultiWriterStreamToken
-    ) -> Set[str]:
+    ) -> set[str]:
         """Get the users who have new cross-signing signatures made by `user_id` since
         `from_key`.
 
@@ -1243,7 +1239,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_all_device_list_changes_for_remotes(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         """Get updates for device lists replication stream.
 
         Args:
@@ -1270,7 +1266,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
         def _get_all_device_list_changes_for_remotes(
             txn: Cursor,
-        ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple]], int, bool]:
             # This query Does The Right Thing where it'll correctly apply the
             # bounds to the inner queries.
             sql = """
@@ -1302,7 +1298,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
     @cached(max_entries=10000)
     async def get_device_list_last_stream_id_for_remote(
         self, user_id: str
-    ) -> Optional[str]:
+    ) -> str | None:
         """Get the last stream_id we got for a user. May be None if we haven't
         got any information for them.
         """
@@ -1320,9 +1316,9 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
     )
     async def get_device_list_last_stream_id_for_remotes(
         self, user_ids: Iterable[str]
-    ) -> Mapping[str, Optional[str]]:
+    ) -> Mapping[str, str | None]:
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_many_batch(
                 table="device_lists_remote_extremeties",
                 column="user_id",
@@ -1332,15 +1328,15 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             ),
         )
 
-        results: Dict[str, Optional[str]] = dict.fromkeys(user_ids)
+        results: dict[str, str | None] = dict.fromkeys(user_ids)
         results.update(rows)
 
         return results
 
     async def get_user_ids_requiring_device_list_resync(
         self,
-        user_ids: Optional[Collection[str]] = None,
-    ) -> Set[str]:
+        user_ids: Collection[str] | None = None,
+    ) -> set[str]:
         """Given a list of remote users return the list of users that we
         should resync the device lists for. If None is given instead of a list,
         return every user that we should resync the device lists for.
@@ -1350,7 +1346,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         """
         if user_ids:
             rows = cast(
-                List[Tuple[str]],
+                list[tuple[str]],
                 await self.db_pool.simple_select_many_batch(
                     table="device_lists_remote_resync",
                     column="user_id",
@@ -1361,7 +1357,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             )
         else:
             rows = cast(
-                List[Tuple[str]],
+                list[tuple[str]],
                 await self.db_pool.simple_select_list(
                     table="device_lists_remote_resync",
                     keyvalues=None,
@@ -1390,7 +1386,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
                     table="device_lists_remote_resync",
                     keyvalues={"user_id": user_id},
                     values={},
-                    insertion_values={"added_ts": self._clock.time_msec()},
+                    insertion_values={"added_ts": self.clock.time_msec()},
                 )
 
         await self.db_pool.runInteraction(
@@ -1406,7 +1402,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             desc="mark_remote_user_device_cache_as_valid",
         )
 
-    async def handle_potentially_left_users(self, user_ids: Set[str]) -> None:
+    async def handle_potentially_left_users(self, user_ids: set[str]) -> None:
         """Given a set of remote users check if the server still shares a room with
         them. If not then mark those users' device cache as stale.
         """
@@ -1423,7 +1419,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
     def handle_potentially_left_users_txn(
         self,
         txn: LoggingTransaction,
-        user_ids: Set[str],
+        user_ids: set[str],
     ) -> None:
         """Given a set of remote users check if the server still shares a room with
         them. If not then mark those users' device cache as stale.
@@ -1461,9 +1457,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             txn, self.get_device_list_last_stream_id_for_remote, (user_id,)
         )
 
-    async def get_dehydrated_device(
-        self, user_id: str
-    ) -> Optional[Tuple[str, JsonDict]]:
+    async def get_dehydrated_device(self, user_id: str) -> tuple[str, JsonDict] | None:
         """Retrieve the information for a dehydrated device.
 
         Args:
@@ -1488,33 +1482,29 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         device_id: str,
         device_data: str,
         time: int,
-        keys: Optional[JsonDict] = None,
-    ) -> Optional[str]:
-        # TODO: make keys non-optional once support for msc2697 is dropped
-        if keys:
-            device_keys = keys.get("device_keys", None)
-            if device_keys:
-                self._set_e2e_device_keys_txn(
-                    txn, user_id, device_id, time, device_keys
-                )
+        keys: JsonDict,
+    ) -> str | None:
+        device_keys = keys.get("device_keys", None)
+        if device_keys:
+            self._set_e2e_device_keys_txn(txn, user_id, device_id, time, device_keys)
 
-            one_time_keys = keys.get("one_time_keys", None)
-            if one_time_keys:
-                key_list = []
-                for key_id, key_obj in one_time_keys.items():
-                    algorithm, key_id = key_id.split(":")
-                    key_list.append(
-                        (
-                            algorithm,
-                            key_id,
-                            encode_canonical_json(key_obj).decode("ascii"),
-                        )
+        one_time_keys = keys.get("one_time_keys", None)
+        if one_time_keys:
+            key_list = []
+            for key_id, key_obj in one_time_keys.items():
+                algorithm, key_id = key_id.split(":")
+                key_list.append(
+                    (
+                        algorithm,
+                        key_id,
+                        encode_canonical_json(key_obj).decode("ascii"),
                     )
-                self._add_e2e_one_time_keys_txn(txn, user_id, device_id, time, key_list)
+                )
+            self._add_e2e_one_time_keys_txn(txn, user_id, device_id, time, key_list)
 
-            fallback_keys = keys.get("fallback_keys", None)
-            if fallback_keys:
-                self._set_e2e_fallback_keys_txn(txn, user_id, device_id, fallback_keys)
+        fallback_keys = keys.get("fallback_keys", None)
+        if fallback_keys:
+            self._set_e2e_fallback_keys_txn(txn, user_id, device_id, fallback_keys)
 
         old_device_id = self.db_pool.simple_select_one_onecol_txn(
             txn,
@@ -1538,8 +1528,8 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         device_id: str,
         device_data: JsonDict,
         time_now: int,
-        keys: Optional[dict] = None,
-    ) -> Optional[str]:
+        keys: dict,
+    ) -> str | None:
         """Store a dehydrated device for a user.
 
         Args:
@@ -1601,7 +1591,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         that user when the destination comes back. It doesn't matter which device
         we keep.
         """
-        yesterday = self._clock.time_msec() - prune_age
+        yesterday = self.clock.time_msec() - prune_age
 
         def _prune_txn(txn: LoggingTransaction) -> None:
             # look for (user, destination) pairs which have an update older than
@@ -1672,7 +1662,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_local_devices_not_accessed_since(
         self, since_ms: int
-    ) -> Dict[str, List[str]]:
+    ) -> dict[str, list[str]]:
         """Retrieves local devices that haven't been accessed since a given date.
 
         Args:
@@ -1687,20 +1677,20 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
         def get_devices_not_accessed_since_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[str, str]]:
+        ) -> list[tuple[str, str]]:
             sql = """
                 SELECT user_id, device_id
                 FROM devices WHERE last_seen < ? AND hidden = FALSE
             """
             txn.execute(sql, (since_ms,))
-            return cast(List[Tuple[str, str]], txn.fetchall())
+            return cast(list[tuple[str, str]], txn.fetchall())
 
         rows = await self.db_pool.runInteraction(
             "get_devices_not_accessed_since",
             get_devices_not_accessed_since_txn,
         )
 
-        devices: Dict[str, List[str]] = {}
+        devices: dict[str, list[str]] = {}
         for user_id, device_id in rows:
             # Remote devices are never stale from our point of view.
             if self.hs.is_mine_id(user_id):
@@ -1728,7 +1718,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         room_ids: Collection[str],
         from_token: MultiWriterStreamToken,
         to_token: MultiWriterStreamToken,
-    ) -> Optional[Set[str]]:
+    ) -> set[str] | None:
         """Return the set of users whose devices have changed in the given rooms
         since the given stream ID.
 
@@ -1759,7 +1749,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         def _get_device_list_changes_in_rooms_txn(
             txn: LoggingTransaction,
             chunk: list[str],
-        ) -> Set[str]:
+        ) -> set[str]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "room_id", chunk
             )
@@ -1788,7 +1778,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
         return changes
 
-    async def get_all_device_list_changes(self, from_id: int, to_id: int) -> Set[str]:
+    async def get_all_device_list_changes(self, from_id: int, to_id: int) -> set[str]:
         """Return the set of rooms where devices have changed since the given
         stream ID.
 
@@ -1807,7 +1797,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
         def _get_all_device_list_changes_txn(
             txn: LoggingTransaction,
-        ) -> Set[str]:
+        ) -> set[str]:
             txn.execute(sql, (from_id, to_id))
             return {room_id for (room_id,) in txn}
 
@@ -1818,7 +1808,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_device_list_changes_in_room(
         self, room_id: str, min_stream_id: int
-    ) -> Collection[Tuple[str, str]]:
+    ) -> Collection[tuple[str, str]]:
         """Get all device list changes that happened in the room since the given
         stream ID.
 
@@ -1834,9 +1824,9 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
         def get_device_list_changes_in_room_txn(
             txn: LoggingTransaction,
-        ) -> Collection[Tuple[str, str]]:
+        ) -> Collection[tuple[str, str]]:
             txn.execute(sql, (room_id, min_stream_id))
-            return cast(Collection[Tuple[str, str]], txn.fetchall())
+            return cast(Collection[tuple[str, str]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_device_list_changes_in_room",
@@ -1911,7 +1901,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         )
 
     async def update_remote_device_list_cache(
-        self, user_id: str, devices: List[dict], stream_id: int
+        self, user_id: str, devices: list[dict], stream_id: int
     ) -> None:
         """Replace the entire cache of the remote user's devices.
 
@@ -1932,7 +1922,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         )
 
     def _update_remote_device_list_cache_txn(
-        self, txn: LoggingTransaction, user_id: str, devices: List[dict], stream_id: int
+        self, txn: LoggingTransaction, user_id: str, devices: list[dict], stream_id: int
     ) -> None:
         """Replace the list of cached devices for this user with the given list."""
         self.db_pool.simple_delete_txn(
@@ -1967,7 +1957,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         user_id: str,
         device_ids: StrCollection,
         room_ids: StrCollection,
-    ) -> Optional[int]:
+    ) -> int | None:
         """Persist that a user's devices have been updated, and which hosts
         (if any) should be poked.
 
@@ -2016,7 +2006,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
             return stream_ids[-1]
 
-        last_stream_id: Optional[int] = None
+        last_stream_id: int | None = None
         for batch_device_ids in batch_iter(device_ids, 1000):
             last_stream_id = await self.db_pool.runInteraction(
                 "add_device_change_to_stream",
@@ -2031,7 +2021,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         txn: LoggingTransaction,
         user_id: str,
         device_ids: Collection[str],
-        stream_ids: List[int],
+        stream_ids: list[int],
     ) -> None:
         txn.call_after(
             self._device_list_stream_cache.entity_has_changed,
@@ -2076,7 +2066,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         device_id: str,
         hosts: Collection[str],
         stream_id: int,
-        context: Optional[Dict[str, str]],
+        context: dict[str, str] | None,
     ) -> None:
         if self._device_list_federation_stream_cache:
             for host in hosts:
@@ -2086,7 +2076,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
                     stream_id,
                 )
 
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
 
         encoded_context = json_encoder.encode(context)
         mark_sent = not self.hs.is_mine_id(user_id)
@@ -2163,8 +2153,8 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         user_id: str,
         device_ids: StrCollection,
         room_ids: StrCollection,
-        stream_ids: List[int],
-        context: Dict[str, str],
+        stream_ids: list[int],
+        context: dict[str, str],
     ) -> None:
         """Record the user in the room has updated their device."""
 
@@ -2208,7 +2198,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_uncoverted_outbound_room_pokes(
         self, start_stream_id: int, start_room_id: str, limit: int = 10
-    ) -> List[Tuple[str, str, str, int, Optional[Dict[str, str]]]]:
+    ) -> list[tuple[str, str, str, int, dict[str, str] | None]]:
         """Get device list changes by room that have not yet been handled and
         written to `device_lists_outbound_pokes`.
 
@@ -2236,7 +2226,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
         def get_uncoverted_outbound_room_pokes_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[str, str, str, int, Optional[Dict[str, str]]]]:
+        ) -> list[tuple[str, str, str, int, dict[str, str] | None]]:
             txn.execute(
                 sql,
                 (
@@ -2270,7 +2260,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
         device_id: str,
         room_id: str,
         hosts: Collection[str],
-        context: Optional[Dict[str, str]],
+        context: dict[str, str] | None,
     ) -> None:
         """Queue the device update to be sent to the given set of hosts,
         calculated from the room ID.
@@ -2327,7 +2317,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
     async def get_pending_remote_device_list_updates_for_room(
         self, room_id: str
-    ) -> Collection[Tuple[str, str]]:
+    ) -> Collection[tuple[str, str]]:
         """Get the set of remote device list updates from the pending table for
         the room.
         """
@@ -2361,16 +2351,16 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
 
         def get_pending_remote_device_list_updates_for_room_txn(
             txn: LoggingTransaction,
-        ) -> Collection[Tuple[str, str]]:
+        ) -> Collection[tuple[str, str]]:
             txn.execute(sql, (room_id, min_device_stream_id))
-            return cast(Collection[Tuple[str, str]], txn.fetchall())
+            return cast(Collection[tuple[str, str]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_pending_remote_device_list_updates_for_room",
             get_pending_remote_device_list_updates_for_room_txn,
         )
 
-    async def get_device_change_last_converted_pos(self) -> Tuple[int, str]:
+    async def get_device_change_last_converted_pos(self) -> tuple[int, str]:
         """
         Get the position of the last row in `device_list_changes_in_room` that has been
         converted to `device_lists_outbound_pokes`.
@@ -2388,7 +2378,7 @@ class DeviceWorkerStore(RoomMemberWorkerStore, EndToEndKeyWorkerStore):
             retcols=["stream_id", "room_id"],
             desc="get_device_change_last_converted_pos",
         )
-        return cast(Tuple[int, str], min(rows))
+        return cast(tuple[int, str], min(rows))
 
     async def set_device_change_last_converted_pos(
         self,
diff --git a/synapse/storage/databases/main/directory.py b/synapse/storage/databases/main/directory.py
index 49c0575aca..5e14ad4480 100644
--- a/synapse/storage/databases/main/directory.py
+++ b/synapse/storage/databases/main/directory.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Iterable, List, Optional, Sequence, Tuple
+from typing import Iterable, Sequence
 
 import attr
 
@@ -34,13 +34,13 @@ from synapse.util.caches.descriptors import cached
 class RoomAliasMapping:
     room_id: str
     room_alias: str
-    servers: List[str]
+    servers: list[str]
 
 
 class DirectoryWorkerStore(CacheInvalidationWorkerStore):
     async def get_association_from_room_alias(
         self, room_alias: RoomAlias
-    ) -> Optional[RoomAliasMapping]:
+    ) -> RoomAliasMapping | None:
         """Gets the room_id and server list for a given room_alias
 
         Args:
@@ -94,7 +94,7 @@ class DirectoryWorkerStore(CacheInvalidationWorkerStore):
         room_alias: RoomAlias,
         room_id: str,
         servers: Iterable[str],
-        creator: Optional[str] = None,
+        creator: str | None = None,
     ) -> None:
         """Creates an association between a room alias and room_id/servers
 
@@ -136,7 +136,7 @@ class DirectoryWorkerStore(CacheInvalidationWorkerStore):
                 409, "Room alias %s already exists" % room_alias.to_string()
             )
 
-    async def delete_room_alias(self, room_alias: RoomAlias) -> Optional[str]:
+    async def delete_room_alias(self, room_alias: RoomAlias) -> str | None:
         room_id = await self.db_pool.runInteraction(
             "delete_room_alias", self._delete_room_alias_txn, room_alias
         )
@@ -145,7 +145,7 @@ class DirectoryWorkerStore(CacheInvalidationWorkerStore):
 
     def _delete_room_alias_txn(
         self, txn: LoggingTransaction, room_alias: RoomAlias
-    ) -> Optional[str]:
+    ) -> str | None:
         txn.execute(
             "SELECT room_id FROM room_aliases WHERE room_alias = ?",
             (room_alias.to_string(),),
@@ -174,7 +174,7 @@ class DirectoryWorkerStore(CacheInvalidationWorkerStore):
         self,
         old_room_id: str,
         new_room_id: str,
-        creator: Optional[str] = None,
+        creator: str | None = None,
     ) -> None:
         """Repoint all of the aliases for a given room, to a different room.
 
@@ -187,7 +187,7 @@ class DirectoryWorkerStore(CacheInvalidationWorkerStore):
 
         def _update_aliases_for_room_txn(txn: LoggingTransaction) -> None:
             update_creator_sql = ""
-            sql_params: Tuple[str, ...] = (new_room_id, old_room_id)
+            sql_params: tuple[str, ...] = (new_room_id, old_room_id)
             if creator:
                 update_creator_sql = ", creator = ?"
                 sql_params = (new_room_id, creator, old_room_id)
diff --git a/synapse/storage/databases/main/e2e_room_keys.py b/synapse/storage/databases/main/e2e_room_keys.py
index 904ae5cb58..01e9fb4dcf 100644
--- a/synapse/storage/databases/main/e2e_room_keys.py
+++ b/synapse/storage/databases/main/e2e_room_keys.py
@@ -21,13 +21,9 @@
 
 from typing import (
     TYPE_CHECKING,
-    Dict,
     Iterable,
-    List,
     Literal,
     Mapping,
-    Optional,
-    Tuple,
     TypedDict,
     cast,
 )
@@ -41,7 +37,7 @@ from synapse.storage.database import (
     LoggingTransaction,
 )
 from synapse.types import JsonDict, JsonSerializable, StreamKeyType
-from synapse.util import json_encoder
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -195,7 +191,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
         )
 
     async def add_e2e_room_keys(
-        self, user_id: str, version: str, room_keys: Iterable[Tuple[str, str, RoomKey]]
+        self, user_id: str, version: str, room_keys: Iterable[tuple[str, str, RoomKey]]
     ) -> None:
         """Bulk add room keys to a given backup.
 
@@ -255,10 +251,10 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
         self,
         user_id: str,
         version: str,
-        room_id: Optional[str] = None,
-        session_id: Optional[str] = None,
-    ) -> Dict[
-        Literal["rooms"], Dict[str, Dict[Literal["sessions"], Dict[str, RoomKey]]]
+        room_id: str | None = None,
+        session_id: str | None = None,
+    ) -> dict[
+        Literal["rooms"], dict[str, dict[Literal["sessions"], dict[str, RoomKey]]]
     ]:
         """Bulk get the E2E room keys for a given backup, optionally filtered to a given
         room, or a given session.
@@ -290,7 +286,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
                 keyvalues["session_id"] = session_id
 
         rows = cast(
-            List[Tuple[str, str, int, int, int, str]],
+            list[tuple[str, str, int, int, int, str]],
             await self.db_pool.simple_select_list(
                 table="e2e_room_keys",
                 keyvalues=keyvalues,
@@ -306,8 +302,8 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
             ),
         )
 
-        sessions: Dict[
-            Literal["rooms"], Dict[str, Dict[Literal["sessions"], Dict[str, RoomKey]]]
+        sessions: dict[
+            Literal["rooms"], dict[str, dict[Literal["sessions"], dict[str, RoomKey]]]
         ] = {"rooms": {}}
         for (
             room_id,
@@ -333,7 +329,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
         user_id: str,
         version: str,
         room_keys: Mapping[str, Mapping[Literal["sessions"], Iterable[str]]],
-    ) -> Dict[str, Dict[str, RoomKey]]:
+    ) -> dict[str, dict[str, RoomKey]]:
         """Get multiple room keys at a time.  The difference between this function and
         get_e2e_room_keys is that this function can be used to retrieve
         multiple specific keys at a time, whereas get_e2e_room_keys is used for
@@ -370,7 +366,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
         user_id: str,
         version: int,
         room_keys: Mapping[str, Mapping[Literal["sessions"], Iterable[str]]],
-    ) -> Dict[str, Dict[str, RoomKey]]:
+    ) -> dict[str, dict[str, RoomKey]]:
         if not room_keys:
             return {}
 
@@ -400,7 +396,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
 
         txn.execute(sql, params)
 
-        ret: Dict[str, Dict[str, RoomKey]] = {}
+        ret: dict[str, dict[str, RoomKey]] = {}
 
         for row in txn:
             room_id = row[0]
@@ -441,8 +437,8 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
         self,
         user_id: str,
         version: str,
-        room_id: Optional[str] = None,
-        session_id: Optional[str] = None,
+        room_id: str | None = None,
+        session_id: str | None = None,
     ) -> None:
         """Bulk delete the E2E room keys for a given backup, optionally filtered to a given
         room or a given session.
@@ -483,13 +479,13 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
         )
         # `SELECT MAX() FROM ...` will always return 1 row. The value in that row will
         # be `NULL` when there are no available versions.
-        row = cast(Tuple[Optional[int]], txn.fetchone())
+        row = cast(tuple[int | None], txn.fetchone())
         if row[0] is None:
             raise StoreError(404, "No current backup version")
         return row[0]
 
     async def get_e2e_room_keys_version_info(
-        self, user_id: str, version: Optional[str] = None
+        self, user_id: str, version: str | None = None
     ) -> JsonDict:
         """Get info metadata about a version of our room_keys backup.
 
@@ -559,7 +555,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
                 "SELECT MAX(version) FROM e2e_room_keys_versions WHERE user_id=?",
                 (user_id,),
             )
-            current_version = cast(Tuple[Optional[int]], txn.fetchone())[0]
+            current_version = cast(tuple[int | None], txn.fetchone())[0]
             if current_version is None:
                 current_version = 0
 
@@ -587,8 +583,8 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
         self,
         user_id: str,
         version: str,
-        info: Optional[JsonDict] = None,
-        version_etag: Optional[int] = None,
+        info: JsonDict | None = None,
+        version_etag: int | None = None,
     ) -> None:
         """Update a given backup version
 
@@ -600,7 +596,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
             version_etag: etag of the keys in the backup. If None, then the etag
                 is not updated.
         """
-        updatevalues: Dict[str, object] = {}
+        updatevalues: dict[str, object] = {}
 
         if info is not None and "auth_data" in info:
             updatevalues["auth_data"] = json_encoder.encode(info["auth_data"])
@@ -624,7 +620,7 @@ class EndToEndRoomKeyStore(EndToEndRoomKeyBackgroundStore):
 
     @trace
     async def delete_e2e_room_keys_version(
-        self, user_id: str, version: Optional[str] = None
+        self, user_id: str, version: str | None = None
     ) -> None:
         """Delete a given backup version of the user's room keys.
         Doesn't delete their actual key data.
diff --git a/synapse/storage/databases/main/end_to_end_keys.py b/synapse/storage/databases/main/end_to_end_keys.py
index de72e66ceb..c93ebd3dda 100644
--- a/synapse/storage/databases/main/end_to_end_keys.py
+++ b/synapse/storage/databases/main/end_to_end_keys.py
@@ -20,20 +20,15 @@
 #
 #
 import abc
+import json
 from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
     Iterable,
-    List,
     Literal,
     Mapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
-    Union,
     cast,
     overload,
 )
@@ -60,10 +55,10 @@ from synapse.storage.databases.main.cache import CacheInvalidationWorkerStore
 from synapse.storage.engines import PostgresEngine
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
 from synapse.types import JsonDict, JsonMapping, MultiWriterStreamToken
-from synapse.util import json_decoder, json_encoder
 from synapse.util.caches.descriptors import cached, cachedList
 from synapse.util.cancellation import cancellable
 from synapse.util.iterutils import batch_iter
+from synapse.util.json import json_decoder, json_encoder
 
 if TYPE_CHECKING:
     from synapse.handlers.e2e_keys import SignatureListItem
@@ -74,12 +69,12 @@ if TYPE_CHECKING:
 class DeviceKeyLookupResult:
     """The type returned by get_e2e_device_keys_and_signatures"""
 
-    display_name: Optional[str]
+    display_name: str | None
 
     # the key data from e2e_device_keys_json. Typically includes fields like
     # "algorithm", "keys" (including the curve25519 identity key and the ed25519 signing
     # key) and "signatures" (a map from (user id) to (key id/device_id) to signature.)
-    keys: Optional[JsonDict]
+    keys: JsonDict | None
 
 
 class EndToEndKeyBackgroundStore(SQLBaseStore):
@@ -154,7 +149,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
     async def get_e2e_device_keys_for_federation_query(
         self, user_id: str
-    ) -> Tuple[int, Sequence[JsonMapping]]:
+    ) -> tuple[int, Sequence[JsonMapping]]:
         """Get all devices (with any device keys) for a user
 
         Returns:
@@ -240,9 +235,9 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
     @cancellable
     async def get_e2e_device_keys_for_cs_api(
         self,
-        query_list: Collection[Tuple[str, Optional[str]]],
+        query_list: Collection[tuple[str, str | None]],
         include_displaynames: bool = True,
-    ) -> Dict[str, Dict[str, JsonDict]]:
+    ) -> dict[str, dict[str, JsonDict]]:
         """Fetch a list of device keys, formatted suitably for the C/S API.
         Args:
             query_list: List of pairs of user_ids and device_ids.
@@ -261,7 +256,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
         # Build the result structure, un-jsonify the results, and add the
         # "unsigned" section
-        rv: Dict[str, Dict[str, JsonDict]] = {}
+        rv: dict[str, dict[str, JsonDict]] = {}
         for user_id, device_keys in results.items():
             rv[user_id] = {}
             for device_id, device_info in device_keys.items():
@@ -283,37 +278,37 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
     @overload
     async def get_e2e_device_keys_and_signatures(
         self,
-        query_list: Collection[Tuple[str, Optional[str]]],
+        query_list: Collection[tuple[str, str | None]],
         include_all_devices: Literal[False] = False,
-    ) -> Dict[str, Dict[str, DeviceKeyLookupResult]]: ...
+    ) -> dict[str, dict[str, DeviceKeyLookupResult]]: ...
 
     @overload
     async def get_e2e_device_keys_and_signatures(
         self,
-        query_list: Collection[Tuple[str, Optional[str]]],
+        query_list: Collection[tuple[str, str | None]],
         include_all_devices: bool = False,
         include_deleted_devices: Literal[False] = False,
-    ) -> Dict[str, Dict[str, DeviceKeyLookupResult]]: ...
+    ) -> dict[str, dict[str, DeviceKeyLookupResult]]: ...
 
     @overload
     async def get_e2e_device_keys_and_signatures(
         self,
-        query_list: Collection[Tuple[str, Optional[str]]],
+        query_list: Collection[tuple[str, str | None]],
         include_all_devices: Literal[True],
         include_deleted_devices: Literal[True],
-    ) -> Dict[str, Dict[str, Optional[DeviceKeyLookupResult]]]: ...
+    ) -> dict[str, dict[str, DeviceKeyLookupResult | None]]: ...
 
     @trace
     @cancellable
     async def get_e2e_device_keys_and_signatures(
         self,
-        query_list: Collection[Tuple[str, Optional[str]]],
+        query_list: Collection[tuple[str, str | None]],
         include_all_devices: bool = False,
         include_deleted_devices: bool = False,
-    ) -> Union[
-        Dict[str, Dict[str, DeviceKeyLookupResult]],
-        Dict[str, Dict[str, Optional[DeviceKeyLookupResult]]],
-    ]:
+    ) -> (
+        dict[str, dict[str, DeviceKeyLookupResult]]
+        | dict[str, dict[str, DeviceKeyLookupResult | None]]
+    ):
         """Fetch a list of device keys
 
         Any cross-signatures made on the keys by the owner of the device are also
@@ -353,16 +348,21 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             if d is not None and d.keys is not None
         )
 
-        for batch in batch_iter(signature_query, 50):
-            cross_sigs_result = await self.db_pool.runInteraction(
-                "get_e2e_cross_signing_signatures_for_devices",
-                self._get_e2e_cross_signing_signatures_for_devices_txn,
-                batch,
+        # 1000 is an arbitrary batch size. It helped performance on a very
+        # large-scale deployment (matrix.org), but has not been tested against
+        # any other setup.
+        for batch in batch_iter(signature_query, 1000):
+            cross_sigs_result = (
+                await self._get_e2e_cross_signing_signatures_for_devices(batch)
             )
 
             # add each cross-signing signature to the correct device in the result dict.
-            for user_id, key_id, device_id, signature in cross_sigs_result:
+            for (
+                user_id,
+                device_id,
+            ), signature_list in cross_sigs_result.items():
                 target_device_result = result[user_id][device_id]
+
                 # We've only looked up cross-signatures for non-deleted devices with key
                 # data.
                 assert target_device_result is not None
@@ -373,25 +373,27 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
                 signing_user_signatures = target_device_signatures.setdefault(
                     user_id, {}
                 )
-                signing_user_signatures[key_id] = signature
+
+                for key_id, signature in signature_list:
+                    signing_user_signatures[key_id] = signature
 
         log_kv(result)
         return result
 
     async def _get_e2e_device_keys(
         self,
-        query_list: Collection[Tuple[str, Optional[str]]],
+        query_list: Collection[tuple[str, str | None]],
         include_all_devices: bool = False,
         include_deleted_devices: bool = False,
-    ) -> Dict[str, Dict[str, Optional[DeviceKeyLookupResult]]]:
+    ) -> dict[str, dict[str, DeviceKeyLookupResult | None]]:
         """Get information on devices from the database
 
         The results include the device's keys and self-signatures, but *not* any
         cross-signing signatures which have been added subsequently (for which, see
         get_e2e_device_keys_and_signatures)
         """
-        query_clauses: List[str] = []
-        query_params_list: List[List[object]] = []
+        query_clauses: list[str] = []
+        query_params_list: list[list[object]] = []
 
         if include_all_devices is False:
             include_deleted_devices = False
@@ -429,7 +431,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
                 query_clauses.append(user_device_id_in_list_clause)
                 query_params_list.append(user_device_args)
 
-        result: Dict[str, Dict[str, Optional[DeviceKeyLookupResult]]] = {}
+        result: dict[str, dict[str, DeviceKeyLookupResult | None]] = {}
 
         def get_e2e_device_keys_txn(
             txn: LoggingTransaction, query_clause: str, query_params: list
@@ -479,46 +481,88 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
         return result
 
-    def _get_e2e_cross_signing_signatures_for_devices_txn(
-        self, txn: LoggingTransaction, device_query: Iterable[Tuple[str, str]]
-    ) -> List[Tuple[str, str, str, str]]:
-        """Get cross-signing signatures for a given list of devices
-
-        Returns signatures made by the owners of the devices.
-
-        Returns: a list of results; each entry in the list is a tuple of
-            (user_id, key_id, target_device_id, signature).
+    @cached()
+    def _get_e2e_cross_signing_signatures_for_device(
+        self,
+        user_id_and_device_id: tuple[str, str],
+    ) -> Sequence[tuple[str, str]]:
         """
-        signature_query_clauses = []
-        signature_query_params = []
+        The single-item version of `_get_e2e_cross_signing_signatures_for_devices`.
+        See @cachedList for why a separate method is needed.
+        """
+        raise NotImplementedError()
 
-        for user_id, device_id in device_query:
-            signature_query_clauses.append(
-                "target_user_id = ? AND target_device_id = ? AND user_id = ?"
+    @cachedList(
+        cached_method_name="_get_e2e_cross_signing_signatures_for_device",
+        list_name="device_query",
+    )
+    async def _get_e2e_cross_signing_signatures_for_devices(
+        self, device_query: Iterable[tuple[str, str]]
+    ) -> Mapping[tuple[str, str], Sequence[tuple[str, str]]]:
+        """Get cross-signing signatures for a given list of user IDs and devices.
+
+        Args:
+            An iterable containing tuples of (user ID, device ID).
+
+        Returns:
+            A mapping of results. The keys are the original (user_id, device_id)
+            tuple, while the value is the matching list of tuples of
+            (key_id, signature). The value will be an empty list if no
+            signatures exist for the device.
+
+            Given this method is annotated with `@cachedList`, the return dict's
+            keys match the tuples within `device_query`, so that cache entries can
+            be computed from the corresponding values.
+
+            As results are cached, the return type is immutable.
+        """
+
+        def _get_e2e_cross_signing_signatures_for_devices_txn(
+            txn: LoggingTransaction, device_query: Iterable[tuple[str, str]]
+        ) -> Mapping[tuple[str, str], Sequence[tuple[str, str]]]:
+            where_clause_sql, where_clause_params = make_tuple_in_list_sql_clause(
+                self.database_engine,
+                columns=("target_user_id", "target_device_id", "user_id"),
+                iterable=[
+                    (user_id, device_id, user_id) for user_id, device_id in device_query
+                ],
             )
-            signature_query_params.extend([user_id, device_id, user_id])
 
-        signature_sql = """
-            SELECT user_id, key_id, target_device_id, signature
-            FROM e2e_cross_signing_signatures WHERE %s
-            """ % (" OR ".join("(" + q + ")" for q in signature_query_clauses))
+            signature_sql = f"""
+                SELECT user_id, key_id, target_device_id, signature
+                FROM e2e_cross_signing_signatures WHERE {where_clause_sql}
+            """
 
-        txn.execute(signature_sql, signature_query_params)
-        return cast(
-            List[
-                Tuple[
-                    str,
-                    str,
-                    str,
-                    str,
-                ]
-            ],
-            txn.fetchall(),
+            txn.execute(signature_sql, where_clause_params)
+
+            devices_and_signatures: dict[tuple[str, str], list[tuple[str, str]]] = {}
+
+            # `@cachedList` requires we return one key for every item in `device_query`.
+            # Pre-populate `devices_and_signatures` with each key so that none are missing.
+            #
+            # If any are missing, they will be cached as `None`, which is not
+            # what callers expected.
+            for user_id, device_id in device_query:
+                devices_and_signatures.setdefault((user_id, device_id), [])
+
+            # Populate the return dictionary with each found key_id and signature.
+            for user_id, key_id, target_device_id, signature in txn.fetchall():
+                signature_tuple = (key_id, signature)
+                devices_and_signatures[(user_id, target_device_id)].append(
+                    signature_tuple
+                )
+
+            return devices_and_signatures
+
+        return await self.db_pool.runInteraction(
+            "_get_e2e_cross_signing_signatures_for_devices_txn",
+            _get_e2e_cross_signing_signatures_for_devices_txn,
+            device_query,
         )
 
     async def get_e2e_one_time_keys(
-        self, user_id: str, device_id: str, key_ids: List[str]
-    ) -> Dict[Tuple[str, str], str]:
+        self, user_id: str, device_id: str, key_ids: list[str]
+    ) -> dict[tuple[str, str], str]:
         """Retrieve a number of one-time keys for a user
 
         Args:
@@ -531,7 +575,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         """
 
         rows = cast(
-            List[Tuple[str, str, str]],
+            list[tuple[str, str, str]],
             await self.db_pool.simple_select_many_batch(
                 table="e2e_one_time_keys_json",
                 column="key_id",
@@ -550,7 +594,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         user_id: str,
         device_id: str,
         time_now: int,
-        new_keys: Iterable[Tuple[str, str, str]],
+        new_keys: Iterable[tuple[str, str, str]],
     ) -> None:
         """Insert some new one time keys for a device. Errors if any of the
         keys already exist.
@@ -577,7 +621,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         user_id: str,
         device_id: str,
         time_now: int,
-        new_keys: Iterable[Tuple[str, str, str]],
+        new_keys: Iterable[tuple[str, str, str]],
     ) -> None:
         """Insert some new one time keys for a device. Errors if any of the keys already exist.
 
@@ -624,7 +668,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             A mapping from algorithm to number of keys for that algorithm.
         """
 
-        def _count_e2e_one_time_keys(txn: LoggingTransaction) -> Dict[str, int]:
+        def _count_e2e_one_time_keys(txn: LoggingTransaction) -> dict[str, int]:
             sql = (
                 "SELECT algorithm, COUNT(key_id) FROM e2e_one_time_keys_json"
                 " WHERE user_id = ? AND device_id = ?"
@@ -851,8 +895,8 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         )
 
     async def get_e2e_cross_signing_key(
-        self, user_id: str, key_type: str, from_user_id: Optional[str] = None
-    ) -> Optional[JsonMapping]:
+        self, user_id: str, key_type: str, from_user_id: str | None = None
+    ) -> JsonMapping | None:
         """Returns a user's cross-signing key.
 
         Args:
@@ -888,7 +932,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
     )
     async def _get_bare_e2e_cross_signing_keys_bulk(
         self, user_ids: Iterable[str]
-    ) -> Mapping[str, Optional[Mapping[str, JsonMapping]]]:
+    ) -> Mapping[str, Mapping[str, JsonMapping] | None]:
         """Returns the cross-signing keys for a set of users.  The output of this
         function should be passed to _get_e2e_cross_signing_signatures_txn if
         the signatures for the calling user need to be fetched.
@@ -912,7 +956,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         self,
         txn: LoggingTransaction,
         user_ids: Iterable[str],
-    ) -> Dict[str, Dict[str, JsonDict]]:
+    ) -> dict[str, dict[str, JsonDict]]:
         """Returns the cross-signing keys for a set of users.  The output of this
         function should be passed to _get_e2e_cross_signing_signatures_txn if
         the signatures for the calling user need to be fetched.
@@ -927,7 +971,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             the dict.
 
         """
-        result: Dict[str, Dict[str, JsonDict]] = {}
+        result: dict[str, dict[str, JsonDict]] = {}
 
         for user_chunk in batch_iter(user_ids, 100):
             clause, params = make_in_list_sql_clause(
@@ -967,9 +1011,9 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
     def _get_e2e_cross_signing_signatures_txn(
         self,
         txn: LoggingTransaction,
-        keys: Dict[str, Optional[Dict[str, JsonDict]]],
+        keys: dict[str, dict[str, JsonDict] | None],
         from_user_id: str,
-    ) -> Dict[str, Optional[Dict[str, JsonDict]]]:
+    ) -> dict[str, dict[str, JsonDict] | None]:
         """Returns the cross-signing signatures made by a user on a set of keys.
 
         Args:
@@ -987,7 +1031,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         # find out what cross-signing keys (a.k.a. devices) we need to get
         # signatures for.  This is a map of (user_id, device_id) to key type
         # (device_id is the key's public part).
-        devices: Dict[Tuple[str, str], str] = {}
+        devices: dict[tuple[str, str], str] = {}
 
         for user_id, user_keys in keys.items():
             if user_keys is None:
@@ -1050,8 +1094,8 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
     @cancellable
     async def get_e2e_cross_signing_keys_bulk(
-        self, user_ids: List[str], from_user_id: Optional[str] = None
-    ) -> Mapping[str, Optional[Mapping[str, JsonMapping]]]:
+        self, user_ids: list[str], from_user_id: str | None = None
+    ) -> Mapping[str, Mapping[str, JsonMapping] | None]:
         """Returns the cross-signing keys for a set of users.
 
         Args:
@@ -1068,7 +1112,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
         if from_user_id:
             result = cast(
-                Dict[str, Optional[Mapping[str, JsonMapping]]],
+                dict[str, Mapping[str, JsonMapping] | None],
                 await self.db_pool.runInteraction(
                     "get_e2e_cross_signing_signatures",
                     self._get_e2e_cross_signing_signatures_txn,
@@ -1081,7 +1125,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
     async def get_all_user_signature_changes_for_remotes(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         """Get updates for groups replication stream.
 
         Note that the user signature stream represents when a user signs their
@@ -1113,7 +1157,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
         def _get_all_user_signature_changes_for_remotes_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple]], int, bool]:
             sql = """
                 SELECT stream_id, from_user_id AS user_id
                 FROM user_signature_stream
@@ -1144,9 +1188,9 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         ...
 
     async def claim_e2e_one_time_keys(
-        self, query_list: Collection[Tuple[str, str, str, int]]
-    ) -> Tuple[
-        Dict[str, Dict[str, Dict[str, JsonDict]]], List[Tuple[str, str, str, int]]
+        self, query_list: Collection[tuple[str, str, str, int]]
+    ) -> tuple[
+        dict[str, dict[str, dict[str, JsonDict]]], list[tuple[str, str, str, int]]
     ]:
         """Take a list of one time keys out of the database.
 
@@ -1161,12 +1205,12 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
                 may be less than the input counts. In this case, the returned counts
                 are the number of claims that were not fulfilled.
         """
-        results: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
-        missing: List[Tuple[str, str, str, int]] = []
+        results: dict[str, dict[str, dict[str, JsonDict]]] = {}
+        missing: list[tuple[str, str, str, int]] = []
         if isinstance(self.database_engine, PostgresEngine):
             # If we can use execute_values we can use a single batch query
             # in autocommit mode.
-            unfulfilled_claim_counts: Dict[Tuple[str, str, str], int] = {}
+            unfulfilled_claim_counts: dict[tuple[str, str, str], int] = {}
             for user_id, device_id, algorithm, count in query_list:
                 unfulfilled_claim_counts[user_id, device_id, algorithm] = count
 
@@ -1215,8 +1259,8 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         return results, missing
 
     async def claim_e2e_fallback_keys(
-        self, query_list: Iterable[Tuple[str, str, str, bool]]
-    ) -> Dict[str, Dict[str, Dict[str, JsonDict]]]:
+        self, query_list: Iterable[tuple[str, str, str, bool]]
+    ) -> dict[str, dict[str, dict[str, JsonDict]]]:
         """Take a list of fallback keys out of the database.
 
         Args:
@@ -1243,13 +1287,13 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
     def _claim_e2e_fallback_keys_bulk_txn(
         self,
         txn: LoggingTransaction,
-        query_list: Iterable[Tuple[str, str, str, bool]],
-    ) -> Dict[str, Dict[str, Dict[str, JsonDict]]]:
+        query_list: Iterable[tuple[str, str, str, bool]],
+    ) -> dict[str, dict[str, dict[str, JsonDict]]]:
         """Efficient implementation of claim_e2e_fallback_keys for Postgres.
 
         Safe to autocommit: this is a single query.
         """
-        results: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
+        results: dict[str, dict[str, dict[str, JsonDict]]] = {}
 
         sql = """
             WITH claims(user_id, device_id, algorithm, mark_as_used) AS (
@@ -1262,11 +1306,11 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             RETURNING k.user_id, k.device_id, k.algorithm, k.key_id, k.key_json;
         """
         claimed_keys = cast(
-            List[Tuple[str, str, str, str, str]],
+            list[tuple[str, str, str, str, str]],
             txn.execute_values(sql, query_list),
         )
 
-        seen_user_device: Set[Tuple[str, str]] = set()
+        seen_user_device: set[tuple[str, str]] = set()
         for user_id, device_id, algorithm, key_id, key_json in claimed_keys:
             device_results = results.setdefault(user_id, {}).setdefault(device_id, {})
             device_results[f"{algorithm}:{key_id}"] = json_decoder.decode(key_json)
@@ -1280,10 +1324,10 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
     async def _claim_e2e_fallback_keys_simple(
         self,
-        query_list: Iterable[Tuple[str, str, str, bool]],
-    ) -> Dict[str, Dict[str, Dict[str, JsonDict]]]:
+        query_list: Iterable[tuple[str, str, str, bool]],
+    ) -> dict[str, dict[str, dict[str, JsonDict]]]:
         """Naive, inefficient implementation of claim_e2e_fallback_keys for SQLite."""
-        results: Dict[str, Dict[str, Dict[str, JsonDict]]] = {}
+        results: dict[str, dict[str, dict[str, JsonDict]]] = {}
         for user_id, device_id, algorithm, mark_as_used in query_list:
             row = await self.db_pool.simple_select_one(
                 table="e2e_fallback_keys_json",
@@ -1331,7 +1375,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
         device_id: str,
         algorithm: str,
         count: int,
-    ) -> List[Tuple[str, str]]:
+    ) -> list[tuple[str, str]]:
         """Claim OTK for device for DBs that don't support RETURNING.
 
         Returns:
@@ -1376,8 +1420,8 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
     def _claim_e2e_one_time_keys_bulk(
         self,
         txn: LoggingTransaction,
-        query_list: Iterable[Tuple[str, str, str, int]],
-    ) -> List[Tuple[str, str, str, str, str]]:
+        query_list: Iterable[tuple[str, str, str, int]],
+    ) -> list[tuple[str, str, str, str, str]]:
         """Bulk claim OTKs, for DBs that support DELETE FROM... RETURNING.
 
         Args:
@@ -1416,7 +1460,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             RETURNING user_id, device_id, algorithm, key_id, key_json;
         """
         otk_rows = cast(
-            List[Tuple[str, str, str, str, str]], txn.execute_values(sql, query_list)
+            list[tuple[str, str, str, str, str]], txn.execute_values(sql, query_list)
         )
 
         seen_user_device = {
@@ -1432,7 +1476,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
     async def get_master_cross_signing_key_updatable_before(
         self, user_id: str
-    ) -> Tuple[bool, Optional[int]]:
+    ) -> tuple[bool, int | None]:
         """Get time before which a master cross-signing key may be replaced without UIA.
 
         (UIA means "User-Interactive Auth".)
@@ -1453,7 +1497,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
         """
 
-        def impl(txn: LoggingTransaction) -> Tuple[bool, Optional[int]]:
+        def impl(txn: LoggingTransaction) -> tuple[bool, int | None]:
             # We want to distinguish between three cases:
             txn.execute(
                 """
@@ -1465,7 +1509,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             """,
                 (user_id,),
             )
-            row = cast(Optional[Tuple[Optional[int]]], txn.fetchone())
+            row = cast(tuple[int | None] | None, txn.fetchone())
             if row is None:
                 return False, None
             return True, row[0]
@@ -1477,7 +1521,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
     async def delete_old_otks_for_next_user_batch(
         self, after_user_id: str, number_of_users: int
-    ) -> Tuple[List[str], int]:
+    ) -> tuple[list[str], int]:
         """Deletes old OTKs belonging to the next batch of users
 
         Returns:
@@ -1486,7 +1530,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
              * `rows` is the number of deleted rows
         """
 
-        def impl(txn: LoggingTransaction) -> Tuple[List[str], int]:
+        def impl(txn: LoggingTransaction) -> tuple[list[str], int]:
             # Find a batch of users
             txn.execute(
                 """
@@ -1514,7 +1558,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
                 DELETE FROM e2e_one_time_keys_json
                 WHERE {clause} AND ts_added_ms < ? AND length(key_id) = 6
                 """
-            args.append(self._clock.time_msec() - (7 * 24 * 3600 * 1000))
+            args.append(self.clock.time_msec() - (7 * 24 * 3600 * 1000))
             txn.execute(sql, args)
 
             return users, txn.rowcount
@@ -1525,7 +1569,7 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
 
     async def allow_master_cross_signing_key_replacement_without_uia(
         self, user_id: str, duration_ms: int
-    ) -> Optional[int]:
+    ) -> int | None:
         """Mark this user's latest master key as being replaceable without UIA.
 
         Said replacement will only be permitted for a short time after calling this
@@ -1535,9 +1579,9 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             None, if there is no such key.
             Otherwise, the timestamp before which replacement is allowed without UIA.
         """
-        timestamp = self._clock.time_msec() + duration_ms
+        timestamp = self.clock.time_msec() + duration_ms
 
-        def impl(txn: LoggingTransaction) -> Optional[int]:
+        def impl(txn: LoggingTransaction) -> int | None:
             txn.execute(
                 """
                 UPDATE e2e_cross_signing_keys
@@ -1772,26 +1816,71 @@ class EndToEndKeyWorkerStore(EndToEndKeyBackgroundStore, CacheInvalidationWorker
             user_id: the user who made the signatures
             signatures: signatures to add
         """
-        await self.db_pool.simple_insert_many(
-            "e2e_cross_signing_signatures",
-            keys=(
-                "user_id",
-                "key_id",
-                "target_user_id",
-                "target_device_id",
-                "signature",
-            ),
-            values=[
-                (
-                    user_id,
-                    item.signing_key_id,
-                    item.target_user_id,
-                    item.target_device_id,
-                    item.signature,
-                )
+
+        def _store_e2e_cross_signing_signatures(
+            txn: LoggingTransaction,
+            signatures: "Iterable[SignatureListItem]",
+        ) -> None:
+            self.db_pool.simple_insert_many_txn(
+                txn,
+                "e2e_cross_signing_signatures",
+                keys=(
+                    "user_id",
+                    "key_id",
+                    "target_user_id",
+                    "target_device_id",
+                    "signature",
+                ),
+                values=[
+                    (
+                        user_id,
+                        item.signing_key_id,
+                        item.target_user_id,
+                        item.target_device_id,
+                        item.signature,
+                    )
+                    for item in signatures
+                ],
+            )
+
+            to_invalidate = [
+                # Each entry is a tuple of arguments to
+                # `_get_e2e_cross_signing_signatures_for_device`, which
+                # itself takes a tuple. Hence the double-tuple.
+                ((user_id, item.target_device_id),)
                 for item in signatures
-            ],
-            desc="add_e2e_signing_key",
+            ]
+
+            if to_invalidate:
+                # Invalidate the local cache of this worker.
+                for cache_key in to_invalidate:
+                    txn.call_after(
+                        self._get_e2e_cross_signing_signatures_for_device.invalidate,
+                        cache_key,
+                    )
+
+                # Stream cache invalidate keys over replication.
+                #
+                # We can only send a primitive per function argument across
+                # replication.
+                #
+                # Encode the array of strings as a JSON string, and we'll unpack
+                # it on the other side.
+                to_send = [
+                    (json.dumps([user_id, item.target_device_id]),)
+                    for item in signatures
+                ]
+
+                self._send_invalidation_to_replication_bulk(
+                    txn,
+                    cache_name=self._get_e2e_cross_signing_signatures_for_device.__name__,
+                    key_tuples=to_send,
+                )
+
+        await self.db_pool.runInteraction(
+            "add_e2e_signing_key",
+            _store_e2e_cross_signing_signatures,
+            signatures,
         )
 
 
diff --git a/synapse/storage/databases/main/event_federation.py b/synapse/storage/databases/main/event_federation.py
index 26a91109df..cc7083b605 100644
--- a/synapse/storage/databases/main/event_federation.py
+++ b/synapse/storage/databases/main/event_federation.py
@@ -25,15 +25,9 @@ from queue import Empty, PriorityQueue
 from typing import (
     TYPE_CHECKING,
     Collection,
-    Dict,
-    FrozenSet,
     Generator,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
     cast,
 )
 
@@ -59,11 +53,12 @@ from synapse.storage.databases.main.events_worker import EventsWorkerStore
 from synapse.storage.databases.main.signatures import SignatureWorkerStore
 from synapse.storage.engines import PostgresEngine, Sqlite3Engine
 from synapse.types import JsonDict, StrCollection
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached
 from synapse.util.caches.lrucache import LruCache
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -132,9 +127,9 @@ class BackfillQueueNavigationItem:
 @attr.s(frozen=True, slots=True, auto_attribs=True)
 class StateDifference:
     # The event IDs in the auth difference.
-    auth_difference: Set[str]
+    auth_difference: set[str]
     # The event IDs in the conflicted state subgraph. Used in v2.1 only.
-    conflicted_subgraph: Optional[Set[str]]
+    conflicted_subgraph: set[str] | None
 
 
 class _NoChainCoverIndex(Exception):
@@ -147,7 +142,7 @@ class EventFederationWorkerStore(
 ):
     # TODO: this attribute comes from EventPushActionWorkerStore. Should we inherit from
     # that store so that mypy can deduce this for itself?
-    stream_ordering_month_ago: Optional[int]
+    stream_ordering_month_ago: int | None
 
     def __init__(
         self,
@@ -161,12 +156,13 @@ class EventFederationWorkerStore(
 
         if hs.config.worker.run_background_tasks:
             hs.get_clock().looping_call(
-                self._delete_old_forward_extrem_cache, 60 * 60 * 1000
+                self._delete_old_forward_extrem_cache, Duration(hours=1)
             )
 
         # Cache of event ID to list of auth event IDs and their depths.
-        self._event_auth_cache: LruCache[str, List[Tuple[str, int]]] = LruCache(
+        self._event_auth_cache: LruCache[str, list[tuple[str, int]]] = LruCache(
             max_size=500000,
+            clock=self.hs.get_clock(),
             server_name=self.server_name,
             cache_name="_event_auth_cache",
             size_callback=len,
@@ -176,7 +172,9 @@ class EventFederationWorkerStore(
         # index.
         self.tests_allow_no_chain_cover_index = True
 
-        self._clock.looping_call(self._get_stats_for_federation_staging, 30 * 1000)
+        self.clock.looping_call(
+            self._get_stats_for_federation_staging, Duration(seconds=30)
+        )
 
         if isinstance(self.database_engine, PostgresEngine):
             self.db_pool.updates.register_background_validate_constraint_and_delete_rows(
@@ -198,7 +196,7 @@ class EventFederationWorkerStore(
 
     async def get_auth_chain(
         self, room_id: str, event_ids: Collection[str], include_given: bool = False
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         """Get auth events for given event_ids. The events *must* be state events.
 
         Args:
@@ -221,7 +219,7 @@ class EventFederationWorkerStore(
         room_id: str,
         event_ids: Collection[str],
         include_given: bool = False,
-    ) -> Set[str]:
+    ) -> set[str]:
         """Get auth events for given event_ids. The events *must* be state events.
 
         Args:
@@ -266,7 +264,7 @@ class EventFederationWorkerStore(
         room_id: str,
         event_ids: Collection[str],
         include_given: bool,
-    ) -> Set[str]:
+    ) -> set[str]:
         """Calculates the auth chain IDs using the chain index."""
 
         # First we look up the chain ID/sequence numbers for the given events.
@@ -274,10 +272,10 @@ class EventFederationWorkerStore(
         initial_events = set(event_ids)
 
         # All the events that we've found that are reachable from the events.
-        seen_events: Set[str] = set()
+        seen_events: set[str] = set()
 
         # A map from chain ID to max sequence number of the given events.
-        event_chains: Dict[int, int] = {}
+        event_chains: dict[int, int] = {}
 
         sql = """
             SELECT event_id, chain_id, sequence_number
@@ -312,7 +310,7 @@ class EventFederationWorkerStore(
         # are reachable from any event.
 
         # A map from chain ID to max sequence number *reachable* from any event ID.
-        chains: Dict[int, int] = {}
+        chains: dict[int, int] = {}
         for links in self._get_chain_links(txn, set(event_chains.keys())):
             for chain_id in links:
                 if chain_id not in event_chains:
@@ -365,8 +363,8 @@ class EventFederationWorkerStore(
 
     @classmethod
     def _get_chain_links(
-        cls, txn: LoggingTransaction, chains_to_fetch: Set[int]
-    ) -> Generator[Dict[int, List[Tuple[int, int, int]]], None, None]:
+        cls, txn: LoggingTransaction, chains_to_fetch: set[int]
+    ) -> Generator[dict[int, list[tuple[int, int, int]]], None, None]:
         """Fetch all auth chain links from the given set of chains, and all
         links from those chains, recursively.
 
@@ -409,7 +407,7 @@ class EventFederationWorkerStore(
             )
             txn.execute(sql % (clause,), args)
 
-            links: Dict[int, List[Tuple[int, int, int]]] = {}
+            links: dict[int, list[tuple[int, int, int]]] = {}
 
             for (
                 origin_chain_id,
@@ -427,7 +425,7 @@ class EventFederationWorkerStore(
 
     def _get_auth_chain_ids_txn(
         self, txn: LoggingTransaction, event_ids: Collection[str], include_given: bool
-    ) -> Set[str]:
+    ) -> set[str]:
         """Calculates the auth chain IDs.
 
         This is used when we don't have a cover index for the room.
@@ -448,10 +446,10 @@ class EventFederationWorkerStore(
 
         front = set(event_ids)
         while front:
-            new_front: Set[str] = set()
+            new_front: set[str] = set()
             for chunk in batch_iter(front, 100):
                 # Pull the auth events either from the cache or DB.
-                to_fetch: List[str] = []  # Event IDs to fetch from DB
+                to_fetch: list[str] = []  # Event IDs to fetch from DB
                 for event_id in chunk:
                     res = self._event_auth_cache.get(event_id)
                     if res is None:
@@ -467,7 +465,7 @@ class EventFederationWorkerStore(
 
                     # Note we need to batch up the results by event ID before
                     # adding to the cache.
-                    to_cache: Dict[str, List[Tuple[str, int]]] = {}
+                    to_cache: dict[str, list[tuple[str, int]]] = {}
                     for event_id, auth_event_id, auth_event_depth in txn:
                         to_cache.setdefault(event_id, []).append(
                             (auth_event_id, auth_event_depth)
@@ -487,8 +485,8 @@ class EventFederationWorkerStore(
     async def get_auth_chain_difference(
         self,
         room_id: str,
-        state_sets: List[Set[str]],
-    ) -> Set[str]:
+        state_sets: list[set[str]],
+    ) -> set[str]:
         state_diff = await self.get_auth_chain_difference_extended(
             room_id, state_sets, None, None
         )
@@ -497,9 +495,9 @@ class EventFederationWorkerStore(
     async def get_auth_chain_difference_extended(
         self,
         room_id: str,
-        state_sets: List[Set[str]],
-        conflicted_set: Optional[Set[str]],
-        additional_backwards_reachable_conflicted_events: Optional[Set[str]],
+        state_sets: list[set[str]],
+        conflicted_set: set[str] | None,
+        additional_backwards_reachable_conflicted_events: set[str] | None,
     ) -> StateDifference:
         """ "Given sets of state events figure out the auth chain difference (as
         per state res v2 algorithm).
@@ -559,9 +557,9 @@ class EventFederationWorkerStore(
         self,
         txn: LoggingTransaction,
         room_id: str,
-        state_sets: List[Set[str]],
-        conflicted_set: Optional[Set[str]] = None,
-        additional_backwards_reachable_conflicted_events: Optional[Set[str]] = None,
+        state_sets: list[set[str]],
+        conflicted_set: set[str] | None = None,
+        additional_backwards_reachable_conflicted_events: set[str] | None = None,
     ) -> StateDifference:
         """Calculates the auth chain difference using the chain index.
 
@@ -586,14 +584,14 @@ class EventFederationWorkerStore(
                 )
 
         # Map from event_id -> (chain ID, seq no)
-        chain_info: Dict[str, Tuple[int, int]] = {}
+        chain_info: dict[str, tuple[int, int]] = {}
 
         # Map from chain ID -> seq no -> event Id
-        chain_to_event: Dict[int, Dict[int, str]] = {}
+        chain_to_event: dict[int, dict[int, str]] = {}
 
         # All the chains that we've found that are reachable from the state
         # sets.
-        seen_chains: Set[int] = set()
+        seen_chains: set[int] = set()
 
         # Fetch the chain cover index for the initial set of events we're
         # considering.
@@ -620,7 +618,7 @@ class EventFederationWorkerStore(
         events_missing_chain_info = initial_events.difference(chain_info)
 
         # The result set to return, i.e. the auth chain difference.
-        auth_difference_result: Set[str] = set()
+        auth_difference_result: set[str] = set()
 
         if events_missing_chain_info:
             # For some reason we have events we haven't calculated the chain
@@ -651,21 +649,21 @@ class EventFederationWorkerStore(
 
         # A subset of chain_info for conflicted events only, as we need to
         # loop all conflicted chain positions. Map from event_id -> (chain ID, seq no)
-        conflicted_chain_positions: Dict[str, Tuple[int, int]] = {}
+        conflicted_chain_positions: dict[str, tuple[int, int]] = {}
         # For each chain, remember the positions where conflicted events are.
         # We need this for calculating the forward reachable events.
-        conflicted_chain_to_seq: Dict[int, Set[int]] = {}  # chain_id => {seq_num}
+        conflicted_chain_to_seq: dict[int, set[int]] = {}  # chain_id => {seq_num}
         #  A subset of chain_info for additional backwards reachable events only, as we need to
         # loop all additional backwards reachable events for calculating backwards reachable events.
-        additional_backwards_reachable_positions: Dict[
-            str, Tuple[int, int]
+        additional_backwards_reachable_positions: dict[
+            str, tuple[int, int]
         ] = {}  # event_id => (chain_id, seq_num)
         # These next two fields are critical as the intersection of them is the conflicted subgraph.
         # We'll populate them when we walk the chain links.
         # chain_id => max(seq_num) backwards reachable (e.g 4 means 1,2,3,4 are backwards reachable)
-        conflicted_backwards_reachable: Dict[int, int] = {}
+        conflicted_backwards_reachable: dict[int, int] = {}
         # chain_id => min(seq_num) forwards reachable (e.g 4 means 4,5,6..n are forwards reachable)
-        conflicted_forwards_reachable: Dict[int, int] = {}
+        conflicted_forwards_reachable: dict[int, int] = {}
 
         # populate the v2.1 data structures
         if is_state_res_v21:
@@ -687,9 +685,9 @@ class EventFederationWorkerStore(
 
         # Corresponds to `state_sets`, except as a map from chain ID to max
         # sequence number reachable from the state set.
-        set_to_chain: List[Dict[int, int]] = []
+        set_to_chain: list[dict[int, int]] = []
         for state_set in state_sets:
-            chains: Dict[int, int] = {}
+            chains: dict[int, int] = {}
             set_to_chain.append(chains)
 
             for state_id in state_set:
@@ -801,7 +799,7 @@ class EventFederationWorkerStore(
 
         # Mapping from chain ID to the range of sequence numbers that should be
         # pulled from the database.
-        auth_diff_chain_to_gap: Dict[int, Tuple[int, int]] = {}
+        auth_diff_chain_to_gap: dict[int, tuple[int, int]] = {}
 
         for chain_id in seen_chains:
             min_seq_no = min(chains.get(chain_id, 0) for chains in set_to_chain)
@@ -819,10 +817,10 @@ class EventFederationWorkerStore(
                         auth_diff_chain_to_gap[chain_id] = (min_seq_no, max_seq_no)
                         break
 
-        conflicted_subgraph_result: Set[str] = set()
+        conflicted_subgraph_result: set[str] = set()
         # Mapping from chain ID to the range of sequence numbers that should be
         # pulled from the database.
-        conflicted_subgraph_chain_to_gap: Dict[int, Tuple[int, int]] = {}
+        conflicted_subgraph_chain_to_gap: dict[int, tuple[int, int]] = {}
         if is_state_res_v21:
             # also include the conflicted subgraph using backward/forward reachability info from all
             # the conflicted events. To calculate this, we want to extract the intersection between
@@ -881,9 +879,9 @@ class EventFederationWorkerStore(
         )
 
     def _fetch_event_ids_from_chains_txn(
-        self, txn: LoggingTransaction, chains: Dict[int, Tuple[int, int]]
-    ) -> Set[str]:
-        result: Set[str] = set()
+        self, txn: LoggingTransaction, chains: dict[int, tuple[int, int]]
+    ) -> set[str]:
+        result: set[str] = set()
         if isinstance(self.database_engine, PostgresEngine):
             # We can use `execute_values` to efficiently fetch the gaps when
             # using postgres.
@@ -917,10 +915,10 @@ class EventFederationWorkerStore(
         self,
         txn: LoggingTransaction,
         room_id: str,
-        state_sets: List[Set[str]],
-        events_missing_chain_info: Set[str],
+        state_sets: list[set[str]],
+        events_missing_chain_info: set[str],
         events_that_have_chain_index: Collection[str],
-    ) -> Set[str]:
+    ) -> set[str]:
         """Helper for `_get_auth_chain_difference_using_cover_index_txn` to
         handle the case where we haven't calculated the chain cover index for
         all events.
@@ -961,7 +959,7 @@ class EventFederationWorkerStore(
             WHERE tc.room_id = ?
         """
         txn.execute(sql, (room_id,))
-        event_to_auth_ids: Dict[str, Set[str]] = {}
+        event_to_auth_ids: dict[str, set[str]] = {}
         events_that_have_chain_index = set(events_that_have_chain_index)
         for event_id, auth_id, auth_id_has_chain in txn:
             s = event_to_auth_ids.setdefault(event_id, set())
@@ -981,7 +979,7 @@ class EventFederationWorkerStore(
             raise _NoChainCoverIndex(room_id)
 
         # Create a map from event IDs we care about to their partial auth chain.
-        event_id_to_partial_auth_chain: Dict[str, Set[str]] = {}
+        event_id_to_partial_auth_chain: dict[str, set[str]] = {}
         for event_id, auth_ids in event_to_auth_ids.items():
             if not any(event_id in state_set for state_set in state_sets):
                 continue
@@ -1004,7 +1002,7 @@ class EventFederationWorkerStore(
         #   1. Update the state sets to only include indexed events; and
         #   2. Create a new list containing the auth chains of the un-indexed
         #      events
-        unindexed_state_sets: List[Set[str]] = []
+        unindexed_state_sets: list[set[str]] = []
         for state_set in state_sets:
             unindexed_state_set = set()
             for event_id, auth_chain in event_id_to_partial_auth_chain.items():
@@ -1030,8 +1028,8 @@ class EventFederationWorkerStore(
         return union - intersection
 
     def _get_auth_chain_difference_txn(
-        self, txn: LoggingTransaction, state_sets: List[Set[str]]
-    ) -> Set[str]:
+        self, txn: LoggingTransaction, state_sets: list[set[str]]
+    ) -> set[str]:
         """Calculates the auth chain difference using a breadth first search.
 
         This is used when we don't have a cover index for the room.
@@ -1086,7 +1084,7 @@ class EventFederationWorkerStore(
         }
 
         # The sorted list of events whose auth chains we should walk.
-        search: List[Tuple[int, str]] = []
+        search: list[tuple[int, str]] = []
 
         # We need to get the depth of the initial events for sorting purposes.
         sql = """
@@ -1103,13 +1101,13 @@ class EventFederationWorkerStore(
 
             # I think building a temporary list with fetchall is more efficient than
             # just `search.extend(txn)`, but this is unconfirmed
-            search.extend(cast(List[Tuple[int, str]], txn.fetchall()))
+            search.extend(cast(list[tuple[int, str]], txn.fetchall()))
 
         # sort by depth
         search.sort()
 
         # Map from event to its auth events
-        event_to_auth_events: Dict[str, Set[str]] = {}
+        event_to_auth_events: dict[str, set[str]] = {}
 
         base_sql = """
             SELECT a.event_id, auth_id, depth
@@ -1128,8 +1126,8 @@ class EventFederationWorkerStore(
             # currently walking, either from cache or DB.
             search, chunk = search[:-100], search[-100:]
 
-            found: List[Tuple[str, str, int]] = []  # Results found
-            to_fetch: List[str] = []  # Event IDs to fetch from DB
+            found: list[tuple[str, str, int]] = []  # Results found
+            to_fetch: list[str] = []  # Event IDs to fetch from DB
             for _, event_id in chunk:
                 res = self._event_auth_cache.get(event_id)
                 if res is None:
@@ -1146,7 +1144,7 @@ class EventFederationWorkerStore(
                 # We parse the results and add the to the `found` set and the
                 # cache (note we need to batch up the results by event ID before
                 # adding to the cache).
-                to_cache: Dict[str, List[Tuple[str, int]]] = {}
+                to_cache: dict[str, list[tuple[str, int]]] = {}
                 for event_id, auth_event_id, auth_event_depth in txn:
                     to_cache.setdefault(event_id, []).append(
                         (auth_event_id, auth_event_depth)
@@ -1203,7 +1201,7 @@ class EventFederationWorkerStore(
         room_id: str,
         current_depth: int,
         limit: int,
-    ) -> List[Tuple[str, int]]:
+    ) -> list[tuple[str, int]]:
         """
         Get the backward extremities to backfill from in the room along with the
         approximate depth.
@@ -1234,7 +1232,7 @@ class EventFederationWorkerStore(
 
         def get_backfill_points_in_room_txn(
             txn: LoggingTransaction, room_id: str
-        ) -> List[Tuple[str, int]]:
+        ) -> list[tuple[str, int]]:
             # Assemble a tuple lookup of event_id -> depth for the oldest events
             # we know of in the room. Backwards extremeties are the oldest
             # events we know of in the room but we only know of them because
@@ -1328,14 +1326,14 @@ class EventFederationWorkerStore(
                 (
                     room_id,
                     current_depth,
-                    self._clock.time_msec(),
+                    self.clock.time_msec(),
                     BACKFILL_EVENT_EXPONENTIAL_BACKOFF_MAXIMUM_DOUBLING_STEPS,
                     BACKFILL_EVENT_EXPONENTIAL_BACKOFF_STEP_MILLISECONDS,
                     limit,
                 ),
             )
 
-            return cast(List[Tuple[str, int]], txn.fetchall())
+            return cast(list[tuple[str, int]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_backfill_points_in_room",
@@ -1345,14 +1343,14 @@ class EventFederationWorkerStore(
 
     async def get_max_depth_of(
         self, event_ids: Collection[str]
-    ) -> Tuple[Optional[str], int]:
+    ) -> tuple[str | None, int]:
         """Returns the event ID and depth for the event that has the max depth from a set of event IDs
 
         Args:
             event_ids: The event IDs to calculate the max depth of.
         """
         rows = cast(
-            List[Tuple[str, int]],
+            list[tuple[str, int]],
             await self.db_pool.simple_select_many_batch(
                 table="events",
                 column="event_id",
@@ -1377,14 +1375,14 @@ class EventFederationWorkerStore(
 
             return max_depth_event_id, current_max_depth
 
-    async def get_min_depth_of(self, event_ids: List[str]) -> Tuple[Optional[str], int]:
+    async def get_min_depth_of(self, event_ids: list[str]) -> tuple[str | None, int]:
         """Returns the event ID and depth for the event that has the min depth from a set of event IDs
 
         Args:
             event_ids: The event IDs to calculate the max depth of.
         """
         rows = cast(
-            List[Tuple[str, int]],
+            list[tuple[str, int]],
             await self.db_pool.simple_select_many_batch(
                 table="events",
                 column="event_id",
@@ -1409,7 +1407,7 @@ class EventFederationWorkerStore(
 
             return min_depth_event_id, current_min_depth
 
-    async def get_prev_events_for_room(self, room_id: str) -> List[str]:
+    async def get_prev_events_for_room(self, room_id: str) -> list[str]:
         """
         Gets a subset of the current forward extremities in the given room.
 
@@ -1430,7 +1428,7 @@ class EventFederationWorkerStore(
 
     def _get_prev_events_for_room_txn(
         self, txn: LoggingTransaction, room_id: str
-    ) -> List[str]:
+    ) -> list[str]:
         # we just use the 10 newest events. Older events will become
         # prev_events of future events.
 
@@ -1448,7 +1446,7 @@ class EventFederationWorkerStore(
 
     async def get_rooms_with_many_extremities(
         self, min_count: int, limit: int, room_id_filter: Iterable[str]
-    ) -> List[str]:
+    ) -> list[str]:
         """Get the top rooms with at least N extremities.
 
         Args:
@@ -1461,7 +1459,7 @@ class EventFederationWorkerStore(
             sorted by extremity count.
         """
 
-        def _get_rooms_with_many_extremities_txn(txn: LoggingTransaction) -> List[str]:
+        def _get_rooms_with_many_extremities_txn(txn: LoggingTransaction) -> list[str]:
             where_clause = "1=1"
             if room_id_filter:
                 where_clause = "room_id NOT IN (%s)" % (
@@ -1486,7 +1484,7 @@ class EventFederationWorkerStore(
         )
 
     @cached(max_entries=5000, iterable=True)
-    async def get_latest_event_ids_in_room(self, room_id: str) -> FrozenSet[str]:
+    async def get_latest_event_ids_in_room(self, room_id: str) -> frozenset[str]:
         event_ids = await self.db_pool.simple_select_onecol(
             table="event_forward_extremities",
             keyvalues={"room_id": room_id},
@@ -1495,7 +1493,7 @@ class EventFederationWorkerStore(
         )
         return frozenset(event_ids)
 
-    async def get_min_depth(self, room_id: str) -> Optional[int]:
+    async def get_min_depth(self, room_id: str) -> int | None:
         """For the given room, get the minimum depth we have seen for it."""
         return await self.db_pool.runInteraction(
             "get_min_depth", self._get_min_depth_interaction, room_id
@@ -1503,7 +1501,7 @@ class EventFederationWorkerStore(
 
     def _get_min_depth_interaction(
         self, txn: LoggingTransaction, room_id: str
-    ) -> Optional[int]:
+    ) -> int | None:
         min_depth = self.db_pool.simple_select_one_onecol_txn(
             txn,
             table="room_depth",
@@ -1609,7 +1607,7 @@ class EventFederationWorkerStore(
                 WHERE room_id = ?
         """
 
-        def get_forward_extremeties_for_room_txn(txn: LoggingTransaction) -> List[str]:
+        def get_forward_extremeties_for_room_txn(txn: LoggingTransaction) -> list[str]:
             txn.execute(sql, (stream_ordering, room_id))
             return [event_id for (event_id,) in txn]
 
@@ -1626,7 +1624,7 @@ class EventFederationWorkerStore(
 
     def _get_connected_prev_event_backfill_results_txn(
         self, txn: LoggingTransaction, event_id: str, limit: int
-    ) -> List[BackfillQueueNavigationItem]:
+    ) -> list[BackfillQueueNavigationItem]:
         """
         Find any events connected by prev_event the specified event_id.
 
@@ -1674,8 +1672,8 @@ class EventFederationWorkerStore(
         ]
 
     async def get_backfill_events(
-        self, room_id: str, seed_event_id_list: List[str], limit: int
-    ) -> List[EventBase]:
+        self, room_id: str, seed_event_id_list: list[str], limit: int
+    ) -> list[EventBase]:
         """Get a list of Events for a given topic that occurred before (and
         including) the events in seed_event_id_list. Return a list of max size `limit`
 
@@ -1693,7 +1691,7 @@ class EventFederationWorkerStore(
         )
         events = await self.get_events_as_list(event_ids)
         return sorted(
-            # type-ignore: mypy doesn't like negating the Optional[int] stream_ordering.
+            # type-ignore: mypy doesn't like negating the int | None stream_ordering.
             # But it's never None, because these events were previously persisted to the DB.
             events,
             key=lambda e: (-e.depth, -e.internal_metadata.stream_ordering),  # type: ignore[operator]
@@ -1703,9 +1701,9 @@ class EventFederationWorkerStore(
         self,
         txn: LoggingTransaction,
         room_id: str,
-        seed_event_id_list: List[str],
+        seed_event_id_list: list[str],
         limit: int,
-    ) -> Set[str]:
+    ) -> set[str]:
         """
         We want to make sure that we do a breadth-first, "depth" ordered search.
         We also handle navigating historical branches of history connected by
@@ -1718,7 +1716,7 @@ class EventFederationWorkerStore(
             limit,
         )
 
-        event_id_results: Set[str] = set()
+        event_id_results: set[str] = set()
 
         # In a PriorityQueue, the lowest valued entries are retrieved first.
         # We're using depth as the priority in the queue and tie-break based on
@@ -1726,7 +1724,7 @@ class EventFederationWorkerStore(
         # highest and newest-in-time message. We add events to the queue with a
         # negative depth so that we process the newest-in-time messages first
         # going backwards in time. stream_ordering follows the same pattern.
-        queue: "PriorityQueue[Tuple[int, int, str, str]]" = PriorityQueue()
+        queue: "PriorityQueue[tuple[int, int, str, str]]" = PriorityQueue()
 
         for seed_event_id in seed_event_id_list:
             event_lookup_result = self.db_pool.simple_select_one_txn(
@@ -1841,12 +1839,12 @@ class EventFederationWorkerStore(
                 last_cause=EXCLUDED.last_cause;
         """
 
-        txn.execute(sql, (room_id, event_id, 1, self._clock.time_msec(), cause))
+        txn.execute(sql, (room_id, event_id, 1, self.clock.time_msec(), cause))
 
     @trace
     async def get_event_ids_with_failed_pull_attempts(
         self, event_ids: StrCollection
-    ) -> Set[str]:
+    ) -> set[str]:
         """
         Filter the given list of `event_ids` and return events which have any failed
         pull attempts.
@@ -1859,7 +1857,7 @@ class EventFederationWorkerStore(
         """
 
         rows = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.db_pool.simple_select_many_batch(
                 table="event_failed_pull_attempts",
                 column="event_id",
@@ -1876,7 +1874,7 @@ class EventFederationWorkerStore(
         self,
         room_id: str,
         event_ids: Collection[str],
-    ) -> Dict[str, int]:
+    ) -> dict[str, int]:
         """
         Filter down the events to ones that we've failed to pull before recently. Uses
         exponential backoff.
@@ -1890,7 +1888,7 @@ class EventFederationWorkerStore(
             next timestamp at which we may try pulling them again.
         """
         event_failed_pull_attempts = cast(
-            List[Tuple[str, int, int]],
+            list[tuple[str, int, int]],
             await self.db_pool.simple_select_many_batch(
                 table="event_failed_pull_attempts",
                 column="event_id",
@@ -1905,7 +1903,7 @@ class EventFederationWorkerStore(
             ),
         )
 
-        current_time = self._clock.time_msec()
+        current_time = self.clock.time_msec()
 
         event_ids_with_backoff = {}
         for event_id, last_attempt_ts, num_attempts in event_failed_pull_attempts:
@@ -1931,10 +1929,10 @@ class EventFederationWorkerStore(
     async def get_missing_events(
         self,
         room_id: str,
-        earliest_events: List[str],
-        latest_events: List[str],
+        earliest_events: list[str],
+        latest_events: list[str],
         limit: int,
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         ids = await self.db_pool.runInteraction(
             "get_missing_events",
             self._get_missing_events,
@@ -1949,13 +1947,13 @@ class EventFederationWorkerStore(
         self,
         txn: LoggingTransaction,
         room_id: str,
-        earliest_events: List[str],
-        latest_events: List[str],
+        earliest_events: list[str],
+        latest_events: list[str],
         limit: int,
-    ) -> List[str]:
+    ) -> list[str]:
         seen_events = set(earliest_events)
         front = set(latest_events) - seen_events
-        event_results: List[str] = []
+        event_results: list[str] = []
 
         query = (
             "SELECT prev_event_id FROM event_edges "
@@ -1982,7 +1980,7 @@ class EventFederationWorkerStore(
 
     @trace
     @tag_args
-    async def get_successor_events(self, event_id: str) -> List[str]:
+    async def get_successor_events(self, event_id: str) -> list[str]:
         """Fetch all events that have the given event as a prev event
 
         Args:
@@ -2025,7 +2023,7 @@ class EventFederationWorkerStore(
             values={},
             insertion_values={
                 "room_id": event.room_id,
-                "received_ts": self._clock.time_msec(),
+                "received_ts": self.clock.time_msec(),
                 "event_json": json_encoder.encode(event.get_dict()),
                 "internal_metadata": json_encoder.encode(
                     event.internal_metadata.get_dict()
@@ -2038,72 +2036,40 @@ class EventFederationWorkerStore(
         self,
         origin: str,
         event_id: str,
-    ) -> Optional[int]:
+    ) -> int | None:
         """Remove the given event from the staging area.
 
         Returns:
             The received_ts of the row that was deleted, if any.
         """
-        if self.db_pool.engine.supports_returning:
 
-            def _remove_received_event_from_staging_txn(
-                txn: LoggingTransaction,
-            ) -> Optional[int]:
-                sql = """
-                    DELETE FROM federation_inbound_events_staging
-                    WHERE origin = ? AND event_id = ?
-                    RETURNING received_ts
-                """
+        def _remove_received_event_from_staging_txn(
+            txn: LoggingTransaction,
+        ) -> int | None:
+            sql = """
+                DELETE FROM federation_inbound_events_staging
+                WHERE origin = ? AND event_id = ?
+                RETURNING received_ts
+            """
 
-                txn.execute(sql, (origin, event_id))
-                row = cast(Optional[Tuple[int]], txn.fetchone())
+            txn.execute(sql, (origin, event_id))
+            row = cast(tuple[int] | None, txn.fetchone())
 
-                if row is None:
-                    return None
+            if row is None:
+                return None
 
-                return row[0]
+            return row[0]
 
-            return await self.db_pool.runInteraction(
-                "remove_received_event_from_staging",
-                _remove_received_event_from_staging_txn,
-                db_autocommit=True,
-            )
-
-        else:
-
-            def _remove_received_event_from_staging_txn(
-                txn: LoggingTransaction,
-            ) -> Optional[int]:
-                received_ts = self.db_pool.simple_select_one_onecol_txn(
-                    txn,
-                    table="federation_inbound_events_staging",
-                    keyvalues={
-                        "origin": origin,
-                        "event_id": event_id,
-                    },
-                    retcol="received_ts",
-                    allow_none=True,
-                )
-                self.db_pool.simple_delete_txn(
-                    txn,
-                    table="federation_inbound_events_staging",
-                    keyvalues={
-                        "origin": origin,
-                        "event_id": event_id,
-                    },
-                )
-
-                return received_ts
-
-            return await self.db_pool.runInteraction(
-                "remove_received_event_from_staging",
-                _remove_received_event_from_staging_txn,
-            )
+        return await self.db_pool.runInteraction(
+            "remove_received_event_from_staging",
+            _remove_received_event_from_staging_txn,
+            db_autocommit=True,
+        )
 
     async def get_next_staged_event_id_for_room(
         self,
         room_id: str,
-    ) -> Optional[Tuple[str, str]]:
+    ) -> tuple[str, str] | None:
         """
         Get the next event ID in the staging area for the given room.
 
@@ -2113,7 +2079,7 @@ class EventFederationWorkerStore(
 
         def _get_next_staged_event_id_for_room_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Tuple[str, str]]:
+        ) -> tuple[str, str] | None:
             sql = """
                 SELECT origin, event_id
                 FROM federation_inbound_events_staging
@@ -2124,7 +2090,7 @@ class EventFederationWorkerStore(
 
             txn.execute(sql, (room_id,))
 
-            return cast(Optional[Tuple[str, str]], txn.fetchone())
+            return cast(tuple[str, str] | None, txn.fetchone())
 
         return await self.db_pool.runInteraction(
             "get_next_staged_event_id_for_room", _get_next_staged_event_id_for_room_txn
@@ -2134,12 +2100,12 @@ class EventFederationWorkerStore(
         self,
         room_id: str,
         room_version: RoomVersion,
-    ) -> Optional[Tuple[str, EventBase]]:
+    ) -> tuple[str, EventBase] | None:
         """Get the next event in the staging area for the given room."""
 
         def _get_next_staged_event_for_room_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Tuple[str, str, str]]:
+        ) -> tuple[str, str, str] | None:
             sql = """
                 SELECT event_json, internal_metadata, origin
                 FROM federation_inbound_events_staging
@@ -2149,7 +2115,7 @@ class EventFederationWorkerStore(
             """
             txn.execute(sql, (room_id,))
 
-            return cast(Optional[Tuple[str, str, str]], txn.fetchone())
+            return cast(tuple[str, str, str] | None, txn.fetchone())
 
         row = await self.db_pool.runInteraction(
             "get_next_staged_event_for_room", _get_next_staged_event_for_room_txn
@@ -2198,7 +2164,7 @@ class EventFederationWorkerStore(
         # by other events in the queue). We do this so that we can always
         # backpaginate in all the events we have dropped.
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="federation_inbound_events_staging",
                 keyvalues={"room_id": room_id},
@@ -2209,8 +2175,8 @@ class EventFederationWorkerStore(
 
         # Find the set of events referenced by those in the queue, as well as
         # collecting all the event IDs in the queue.
-        referenced_events: Set[str] = set()
-        seen_events: Set[str] = set()
+        referenced_events: set[str] = set()
+        seen_events: set[str] = set()
         for event_id, event_json in rows:
             seen_events.add(event_id)
             event_d = db_to_json(event_json)
@@ -2271,7 +2237,7 @@ class EventFederationWorkerStore(
 
         return True
 
-    async def get_all_rooms_with_staged_incoming_events(self) -> List[str]:
+    async def get_all_rooms_with_staged_incoming_events(self) -> list[str]:
         """Get the room IDs of all events currently staged."""
         return await self.db_pool.simple_select_onecol(
             table="federation_inbound_events_staging",
@@ -2286,20 +2252,20 @@ class EventFederationWorkerStore(
 
         def _get_stats_for_federation_staging_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[int, int]:
+        ) -> tuple[int, int]:
             txn.execute("SELECT count(*) FROM federation_inbound_events_staging")
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
 
             txn.execute(
                 "SELECT min(received_ts) FROM federation_inbound_events_staging"
             )
 
-            (received_ts,) = cast(Tuple[Optional[int]], txn.fetchone())
+            (received_ts,) = cast(tuple[int | None], txn.fetchone())
 
             # If there is nothing in the staging area default it to 0.
             age = 0
             if received_ts is not None:
-                age = self._clock.time_msec() - received_ts
+                age = self.clock.time_msec() - received_ts
 
             return count, age
 
@@ -2408,8 +2374,8 @@ class EventFederationStore(EventFederationWorkerStore):
 def _materialize(
     origin_chain_id: int,
     origin_sequence_number: int,
-    links: Dict[int, List[Tuple[int, int, int]]],
-    materialized: Dict[int, int],
+    links: dict[int, list[tuple[int, int, int]]],
+    materialized: dict[int, int],
     backwards: bool = True,
 ) -> None:
     """Helper function for fetching auth chain links. For a given origin chain
@@ -2467,10 +2433,10 @@ def _materialize(
 
 
 def _generate_forward_links(
-    links: Dict[int, List[Tuple[int, int, int]]],
-) -> Dict[int, List[Tuple[int, int, int]]]:
+    links: dict[int, list[tuple[int, int, int]]],
+) -> dict[int, list[tuple[int, int, int]]]:
     """Reverse the input links from the given backwards links"""
-    new_links: Dict[int, List[Tuple[int, int, int]]] = {}
+    new_links: dict[int, list[tuple[int, int, int]]] = {}
     for origin_chain_id, chain_links in links.items():
         for origin_seq_num, target_chain_id, target_seq_num in chain_links:
             new_links.setdefault(target_chain_id, []).append(
@@ -2480,9 +2446,9 @@ def _generate_forward_links(
 
 
 def accumulate_forwards_reachable_events(
-    conflicted_forwards_reachable: Dict[int, int],
-    back_links: Dict[int, List[Tuple[int, int, int]]],
-    conflicted_chain_positions: Dict[str, Tuple[int, int]],
+    conflicted_forwards_reachable: dict[int, int],
+    back_links: dict[int, list[tuple[int, int, int]]],
+    conflicted_chain_positions: dict[str, tuple[int, int]],
 ) -> None:
     """Accumulate new forwards reachable events using the back_links provided.
 
diff --git a/synapse/storage/databases/main/event_push_actions.py b/synapse/storage/databases/main/event_push_actions.py
index f42023418e..a66caa672c 100644
--- a/synapse/storage/databases/main/event_push_actions.py
+++ b/synapse/storage/databases/main/event_push_actions.py
@@ -84,17 +84,14 @@ from collections import defaultdict
 from typing import (
     TYPE_CHECKING,
     Collection,
-    Dict,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Union,
     cast,
 )
 
 import attr
 
+from twisted.internet.task import LoopingCall
+
 from synapse.api.constants import MAIN_TIMELINE, ReceiptTypes
 from synapse.metrics.background_process_metrics import wrap_as_background_process
 from synapse.storage._base import SQLBaseStore, db_to_json, make_in_list_sql_clause
@@ -107,8 +104,9 @@ from synapse.storage.database import (
 from synapse.storage.databases.main.receipts import ReceiptsWorkerStore
 from synapse.storage.databases.main.stream import StreamWorkerStore
 from synapse.types import JsonDict, StrCollection
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached
+from synapse.util.duration import Duration
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -116,11 +114,11 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
-DEFAULT_NOTIF_ACTION: List[Union[dict, str]] = [
+DEFAULT_NOTIF_ACTION: list[dict | str] = [
     "notify",
     {"set_tweak": "highlight", "value": False},
 ]
-DEFAULT_HIGHLIGHT_ACTION: List[Union[dict, str]] = [
+DEFAULT_HIGHLIGHT_ACTION: list[dict | str] = [
     "notify",
     {"set_tweak": "sound", "value": "default"},
     {"set_tweak": "highlight"},
@@ -136,7 +134,7 @@ class _RoomReceipt:
 
     unthreaded_stream_ordering: int = 0
     # threaded_stream_ordering includes the main pseudo-thread.
-    threaded_stream_ordering: Dict[str, int] = attr.Factory(dict)
+    threaded_stream_ordering: dict[str, int] = attr.Factory(dict)
 
     def is_unread(self, thread_id: str, stream_ordering: int) -> bool:
         """Returns True if the stream ordering is unread according to the receipt information."""
@@ -163,7 +161,7 @@ class HttpPushAction:
     event_id: str
     room_id: str
     stream_ordering: int
-    actions: List[Union[dict, str]]
+    actions: list[dict | str]
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -173,7 +171,7 @@ class EmailPushAction(HttpPushAction):
     push notification.
     """
 
-    received_ts: Optional[int]
+    received_ts: int | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -222,9 +220,7 @@ class RoomNotifCounts:
 _EMPTY_ROOM_NOTIF_COUNTS = RoomNotifCounts(NotifCounts(), {})
 
 
-def _serialize_action(
-    actions: Collection[Union[Mapping, str]], is_highlight: bool
-) -> str:
+def _serialize_action(actions: Collection[Mapping | str], is_highlight: bool) -> str:
     """Custom serializer for actions. This allows us to "compress" common actions.
 
     We use the fact that most users have the same actions for notifs (and for
@@ -242,7 +238,7 @@ def _serialize_action(
     return json_encoder.encode(actions)
 
 
-def _deserialize_action(actions: str, is_highlight: bool) -> List[Union[dict, str]]:
+def _deserialize_action(actions: str, is_highlight: bool) -> list[dict | str]:
     """Custom deserializer for actions. This allows us to "compress" common actions"""
     if actions:
         return db_to_json(actions)
@@ -254,6 +250,8 @@ def _deserialize_action(actions: str, is_highlight: bool) -> List[Union[dict, st
 
 
 class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBaseStore):
+    _background_tasks: list[LoopingCall] = []
+
     def __init__(
         self,
         database: DatabasePool,
@@ -263,29 +261,27 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         super().__init__(database, db_conn, hs)
 
         # Track when the process started.
-        self._started_ts = self._clock.time_msec()
+        self._started_ts = self.clock.time_msec()
 
         # These get correctly set by _find_stream_orderings_for_times_txn
-        self.stream_ordering_month_ago: Optional[int] = None
-        self.stream_ordering_day_ago: Optional[int] = None
+        self.stream_ordering_month_ago: int | None = None
+        self.stream_ordering_day_ago: int | None = None
 
         cur = db_conn.cursor(txn_name="_find_stream_orderings_for_times_txn")
         self._find_stream_orderings_for_times_txn(cur)
         cur.close()
 
-        self.find_stream_orderings_looping_call = self._clock.looping_call(
-            self._find_stream_orderings_for_times, 10 * 60 * 1000
+        self.clock.looping_call(
+            self._find_stream_orderings_for_times, Duration(minutes=10)
         )
 
         self._rotate_count = 10000
         self._doing_notif_rotation = False
         if hs.config.worker.run_background_tasks:
-            self._rotate_notif_loop = self._clock.looping_call(
-                self._rotate_notifs, 30 * 1000
-            )
+            self.clock.looping_call(self._rotate_notifs, Duration(seconds=30))
 
-            self._clear_old_staging_loop = self._clock.looping_call(
-                self._clear_old_push_actions_staging, 30 * 60 * 1000
+            self.clock.looping_call(
+                self._clear_old_push_actions_staging, Duration(minutes=30)
             )
 
         self.db_pool.updates.register_background_index_update(
@@ -351,7 +347,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         )
         return 0
 
-    async def get_unread_counts_by_room_for_user(self, user_id: str) -> Dict[str, int]:
+    async def get_unread_counts_by_room_for_user(self, user_id: str) -> dict[str, int]:
         """Get the notification count by room for a user. Only considers notifications,
         not highlight or unread counts, and threads are currently aggregated under their room.
 
@@ -373,7 +369,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
 
     def _get_unread_counts_by_room_for_user_txn(
         self, txn: LoggingTransaction, user_id: str
-    ) -> Dict[str, int]:
+    ) -> dict[str, int]:
         receipt_types_clause, args = make_in_list_sql_clause(
             self.database_engine,
             "receipt_type",
@@ -440,7 +436,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         txn.execute(sql, args)
 
         seen_thread_ids = set()
-        room_to_count: Dict[str, int] = defaultdict(int)
+        room_to_count: dict[str, int] = defaultdict(int)
 
         for room_id, thread_id, notif_count in txn:
             room_to_count[room_id] += notif_count
@@ -585,7 +581,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         """
 
         main_counts = NotifCounts()
-        thread_counts: Dict[str, NotifCounts] = {}
+        thread_counts: dict[str, NotifCounts] = {}
 
         def _get_thread(thread_id: str) -> NotifCounts:
             if thread_id == MAIN_TIMELINE:
@@ -776,9 +772,9 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         room_id: str,
         user_id: str,
         stream_ordering: int,
-        max_stream_ordering: Optional[int] = None,
-        thread_id: Optional[str] = None,
-    ) -> List[Tuple[int, int, str]]:
+        max_stream_ordering: int | None = None,
+        thread_id: str | None = None,
+    ) -> list[tuple[int, int, str]]:
         """Returns the notify and unread counts from `event_push_actions` for
         the given user/room in the given range.
 
@@ -840,12 +836,12 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         """
 
         txn.execute(sql, args)
-        return cast(List[Tuple[int, int, str]], txn.fetchall())
+        return cast(list[tuple[int, int, str]], txn.fetchall())
 
     async def get_push_action_users_in_range(
         self, min_stream_ordering: int, max_stream_ordering: int
-    ) -> List[str]:
-        def f(txn: LoggingTransaction) -> List[str]:
+    ) -> list[str]:
+        def f(txn: LoggingTransaction) -> list[str]:
             sql = (
                 "SELECT DISTINCT(user_id) FROM event_push_actions WHERE"
                 " stream_ordering >= ? AND stream_ordering <= ? AND notif = 1"
@@ -861,7 +857,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         user_id: str,
         room_ids: StrCollection,
         thread_ids: StrCollection,
-    ) -> Dict[str, _RoomReceipt]:
+    ) -> dict[str, _RoomReceipt]:
         """
         Get (private) read receipts for a user in each of the given room IDs
         and thread IDs.
@@ -936,7 +932,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
 
         txn.execute(sql, args)
 
-        result: Dict[str, _RoomReceipt] = {}
+        result: dict[str, _RoomReceipt] = {}
         for room_id, thread_id, stream_ordering in txn:
             room_receipt = result.setdefault(room_id, _RoomReceipt())
             if thread_id is None:
@@ -952,7 +948,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         min_stream_ordering: int,
         max_stream_ordering: int,
         limit: int = 20,
-    ) -> List[HttpPushAction]:
+    ) -> list[HttpPushAction]:
         """Get a list of the most recent unread push actions for a given user,
         within the given stream ordering range. Called by the httppusher.
 
@@ -971,7 +967,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
 
         def get_push_actions_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[str, str, str, int, str, bool]]:
+        ) -> list[tuple[str, str, str, int, str, bool]]:
             sql = """
                 SELECT ep.event_id, ep.room_id, ep.thread_id, ep.stream_ordering,
                     ep.actions, ep.highlight
@@ -984,7 +980,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
                 ORDER BY ep.stream_ordering ASC LIMIT ?
             """
             txn.execute(sql, (user_id, min_stream_ordering, max_stream_ordering, limit))
-            return cast(List[Tuple[str, str, str, int, str, bool]], txn.fetchall())
+            return cast(list[tuple[str, str, str, int, str, bool]], txn.fetchall())
 
         push_actions = await self.db_pool.runInteraction(
             "get_unread_push_actions_for_user_in_range_http", get_push_actions_txn
@@ -1040,7 +1036,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         min_stream_ordering: int,
         max_stream_ordering: int,
         limit: int = 20,
-    ) -> List[EmailPushAction]:
+    ) -> list[EmailPushAction]:
         """Get a list of the most recent unread push actions for a given user,
         within the given stream ordering range. Called by the emailpusher
 
@@ -1059,7 +1055,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
 
         def get_push_actions_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[str, str, str, int, str, bool, int]]:
+        ) -> list[tuple[str, str, str, int, str, bool, int]]:
             sql = """
                 SELECT ep.event_id, ep.room_id, ep.thread_id, ep.stream_ordering,
                     ep.actions, ep.highlight, e.received_ts
@@ -1073,7 +1069,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
                 ORDER BY ep.stream_ordering DESC LIMIT ?
             """
             txn.execute(sql, (user_id, min_stream_ordering, max_stream_ordering, limit))
-            return cast(List[Tuple[str, str, str, int, str, bool, int]], txn.fetchall())
+            return cast(list[tuple[str, str, str, int, str, bool, int]], txn.fetchall())
 
         push_actions = await self.db_pool.runInteraction(
             "get_unread_push_actions_for_user_in_range_email", get_push_actions_txn
@@ -1159,7 +1155,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
     async def add_push_actions_to_staging(
         self,
         event_id: str,
-        user_id_actions: Dict[str, Collection[Union[Mapping, str]]],
+        user_id_actions: dict[str, Collection[Mapping | str]],
         count_as_unread: bool,
         thread_id: str,
     ) -> None:
@@ -1178,8 +1174,8 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         # This is a helper function for generating the necessary tuple that
         # can be used to insert into the `event_push_actions_staging` table.
         def _gen_entry(
-            user_id: str, actions: Collection[Union[Mapping, str]]
-        ) -> Tuple[str, str, str, int, int, int, str, int]:
+            user_id: str, actions: Collection[Mapping | str]
+        ) -> tuple[str, str, str, int, int, int, str, int]:
             is_highlight = 1 if _action_has_highlight(actions) else 0
             notif = 1 if "notify" in actions else 0
             return (
@@ -1190,7 +1186,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
                 is_highlight,  # highlight column
                 int(count_as_unread),  # unread column
                 thread_id,  # thread_id column
-                self._clock.time_msec(),  # inserted_ts column
+                self.clock.time_msec(),  # inserted_ts column
             )
 
         await self.db_pool.simple_insert_many(
@@ -1241,14 +1237,14 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
     def _find_stream_orderings_for_times_txn(self, txn: LoggingTransaction) -> None:
         logger.info("Searching for stream ordering 1 month ago")
         self.stream_ordering_month_ago = self._find_first_stream_ordering_after_ts_txn(
-            txn, self._clock.time_msec() - 30 * 24 * 60 * 60 * 1000
+            txn, self.clock.time_msec() - 30 * 24 * 60 * 60 * 1000
         )
         logger.info(
             "Found stream ordering 1 month ago: it's %d", self.stream_ordering_month_ago
         )
         logger.info("Searching for stream ordering 1 day ago")
         self.stream_ordering_day_ago = self._find_first_stream_ordering_after_ts_txn(
-            txn, self._clock.time_msec() - 24 * 60 * 60 * 1000
+            txn, self.clock.time_msec() - 24 * 60 * 60 * 1000
         )
         logger.info(
             "Found stream ordering 1 day ago: it's %d", self.stream_ordering_day_ago
@@ -1296,7 +1292,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
             The stream ordering
         """
         txn.execute("SELECT MAX(stream_ordering) FROM events")
-        max_stream_ordering = cast(Tuple[Optional[int]], txn.fetchone())[0]
+        max_stream_ordering = cast(tuple[int | None], txn.fetchone())[0]
 
         if max_stream_ordering is None:
             return 0
@@ -1354,8 +1350,8 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
 
     async def get_time_of_last_push_action_before(
         self, stream_ordering: int
-    ) -> Optional[int]:
-        def f(txn: LoggingTransaction) -> Optional[Tuple[int]]:
+    ) -> int | None:
+        def f(txn: LoggingTransaction) -> tuple[int] | None:
             sql = """
                 SELECT e.received_ts
                 FROM event_push_actions AS ep
@@ -1365,7 +1361,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
                 LIMIT 1
             """
             txn.execute(sql, (stream_ordering,))
-            return cast(Optional[Tuple[int]], txn.fetchone())
+            return cast(tuple[int] | None, txn.fetchone())
 
         result = await self.db_pool.runInteraction(
             "get_time_of_last_push_action_before", f
@@ -1457,7 +1453,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
                 limit,
             ),
         )
-        rows = cast(List[Tuple[int, str, str, Optional[str], int]], txn.fetchall())
+        rows = cast(list[tuple[int, str, str, str | None, int]], txn.fetchall())
 
         # For each new read receipt we delete push actions from before it and
         # recalculate the summary.
@@ -1469,7 +1465,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
                 continue
 
             thread_clause = ""
-            thread_args: Tuple = ()
+            thread_args: tuple = ()
             if thread_id is not None:
                 thread_clause = "AND thread_id = ?"
                 thread_args = (thread_id,)
@@ -1654,7 +1650,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
         # object because we might not have the same amount of rows in each of them. To do
         # this, we use a dict indexed on the user ID and room ID to make it easier to
         # populate.
-        summaries: Dict[Tuple[str, str, str], _EventPushSummary] = {}
+        summaries: dict[tuple[str, str, str], _EventPushSummary] = {}
         for row in txn:
             summaries[(row[0], row[1], row[2])] = _EventPushSummary(
                 unread_count=row[3],
@@ -1787,7 +1783,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
 
         # We delete anything more than an hour old, on the assumption that we'll
         # never take more than an hour to persist an event.
-        delete_before_ts = self._clock.time_msec() - 60 * 60 * 1000
+        delete_before_ts = self.clock.time_msec() - 60 * 60 * 1000
 
         if self._started_ts > delete_before_ts:
             # We need to wait for at least an hour before we started deleting,
@@ -1824,18 +1820,18 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
                 return
 
             # We sleep to ensure that we don't overwhelm the DB.
-            await self._clock.sleep(1.0)
+            await self.clock.sleep(Duration(seconds=1))
 
     async def get_push_actions_for_user(
         self,
         user_id: str,
-        before: Optional[int] = None,
+        before: int | None = None,
         limit: int = 50,
         only_highlight: bool = False,
-    ) -> List[UserPushAction]:
+    ) -> list[UserPushAction]:
         def f(
             txn: LoggingTransaction,
-        ) -> List[Tuple[str, str, int, int, str, bool, str, int]]:
+        ) -> list[tuple[str, str, int, int, str, bool, str, int]]:
             before_clause = ""
             if before:
                 before_clause = "AND epa.stream_ordering < ?"
@@ -1863,7 +1859,7 @@ class EventPushActionsWorkerStore(ReceiptsWorkerStore, StreamWorkerStore, SQLBas
             """ % (before_clause,)
             txn.execute(sql, args)
             return cast(
-                List[Tuple[str, str, int, int, str, bool, str, int]], txn.fetchall()
+                list[tuple[str, str, int, int, str, bool, str, int]], txn.fetchall()
             )
 
         push_actions = await self.db_pool.runInteraction("get_push_actions_for_user", f)
@@ -1918,7 +1914,7 @@ class EventPushActionsStore(EventPushActionsWorkerStore):
         )
 
 
-def _action_has_highlight(actions: Collection[Union[Mapping, str]]) -> bool:
+def _action_has_highlight(actions: Collection[Mapping | str]) -> bool:
     for action in actions:
         if not isinstance(action, dict):
             continue
diff --git a/synapse/storage/databases/main/events.py b/synapse/storage/databases/main/events.py
index a50e889b9d..941a5f9f3a 100644
--- a/synapse/storage/databases/main/events.py
+++ b/synapse/storage/databases/main/events.py
@@ -27,14 +27,9 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
     Generator,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
     TypedDict,
     cast,
 )
@@ -79,13 +74,12 @@ from synapse.types import (
     MutableStateMap,
     StateMap,
     StrCollection,
-    get_domain_from_id,
 )
 from synapse.types.handlers import SLIDING_SYNC_DEFAULT_BUMP_EVENT_TYPES
 from synapse.types.state import StateFilter
-from synapse.util import json_encoder
 from synapse.util.events import get_plain_text_topic_from_event_content
 from synapse.util.iterutils import batch_iter, sorted_topologically
+from synapse.util.json import json_encoder
 from synapse.util.stringutils import non_null_str_or_none
 
 if TYPE_CHECKING:
@@ -101,9 +95,28 @@ persist_event_counter = Counter(
 event_counter = Counter(
     "synapse_storage_events_persisted_events_sep",
     "",
-    labelnames=["type", "origin_type", "origin_entity", SERVER_NAME_LABEL],
+    labelnames=[
+        "type",  # The event type or "*other*" for types we don't track
+        "origin_type",
+        SERVER_NAME_LABEL,
+    ],
 )
 
+# Event types that we track in the `events_counter` metric above.
+#
+# This list is chosen to balance tracking the most common event types that are
+# useful to monitor (and are likely to spike), while keeping the cardinality of
+# the metric low enough to avoid wasted resources.
+TRACKED_EVENT_TYPES = {
+    EventTypes.Message,
+    EventTypes.Encrypted,
+    EventTypes.Member,
+    EventTypes.ThirdPartyInvite,
+    EventTypes.Redaction,
+    EventTypes.Create,
+    EventTypes.Tombstone,
+}
+
 # State event type/key pairs that we need to gather to fill in the
 # `sliding_sync_joined_rooms`/`sliding_sync_membership_snapshots` tables.
 SLIDING_SYNC_RELEVANT_STATE_SET = (
@@ -129,7 +142,7 @@ class DeltaState:
             should e.g. be removed from `current_state_events` table.
     """
 
-    to_delete: List[Tuple[str, str]]
+    to_delete: list[tuple[str, str]]
     to_insert: StateMap[str]
     no_longer_in_room: bool = False
 
@@ -145,10 +158,10 @@ class SlidingSyncStateInsertValues(TypedDict, total=False):
     `sliding_sync_membership_snapshots` database tables.
     """
 
-    room_type: Optional[str]
-    is_encrypted: Optional[bool]
-    room_name: Optional[str]
-    tombstone_successor_room_id: Optional[str]
+    room_type: str | None
+    is_encrypted: bool | None
+    room_name: str | None
+    tombstone_successor_room_id: str | None
 
 
 class SlidingSyncMembershipSnapshotSharedInsertValues(
@@ -159,7 +172,7 @@ class SlidingSyncMembershipSnapshotSharedInsertValues(
     multiple memberships
     """
 
-    has_known_state: Optional[bool]
+    has_known_state: bool | None
 
 
 @attr.s(slots=True, auto_attribs=True)
@@ -197,7 +210,7 @@ class SlidingSyncTableChanges:
     # foreground update for
     # `sliding_sync_joined_rooms`/`sliding_sync_membership_snapshots` (tracked by
     # https://github.com/element-hq/synapse/issues/17623)
-    joined_room_bump_stamp_to_fully_insert: Optional[int]
+    joined_room_bump_stamp_to_fully_insert: int | None
     # Values to upsert into `sliding_sync_joined_rooms`
     joined_room_updates: SlidingSyncStateInsertValues
 
@@ -207,9 +220,9 @@ class SlidingSyncTableChanges:
         SlidingSyncMembershipSnapshotSharedInsertValues
     )
     # List of membership to insert into `sliding_sync_membership_snapshots`
-    to_insert_membership_snapshots: List[SlidingSyncMembershipInfo]
+    to_insert_membership_snapshots: list[SlidingSyncMembershipInfo]
     # List of user_id to delete from `sliding_sync_membership_snapshots`
-    to_delete_membership_snapshots: List[str]
+    to_delete_membership_snapshots: list[str]
 
 
 @attr.s(slots=True, auto_attribs=True)
@@ -226,7 +239,7 @@ class NewEventChainLinks:
     chain_id: int
     sequence_number: int
 
-    links: List[Tuple[int, int]] = attr.Factory(list)
+    links: list[tuple[int, int]] = attr.Factory(list)
 
 
 class PersistEventsStore:
@@ -251,6 +264,7 @@ class PersistEventsStore:
         self.database_engine = db.engine
         self._clock = hs.get_clock()
         self._instance_name = hs.get_instance_name()
+        self._msc4354_enabled = hs.config.experimental.msc4354_enabled
 
         self._ephemeral_messages_enabled = hs.config.server.enable_ephemeral_messages
         self.is_mine_id = hs.is_mine_id
@@ -274,11 +288,11 @@ class PersistEventsStore:
     async def _persist_events_and_state_updates(
         self,
         room_id: str,
-        events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
         *,
-        state_delta_for_room: Optional[DeltaState],
-        new_forward_extremities: Optional[Set[str]],
-        new_event_links: Dict[str, NewEventChainLinks],
+        state_delta_for_room: DeltaState | None,
+        new_forward_extremities: set[str] | None,
+        new_event_links: dict[str, NewEventChainLinks],
         use_negative_stream_ordering: bool = False,
         inhibit_local_membership_updates: bool = False,
     ) -> None:
@@ -379,19 +393,21 @@ class PersistEventsStore:
 
             for event, context in events_and_contexts:
                 if context.app_service:
-                    origin_type = "local"
-                    origin_entity = context.app_service.id
+                    origin_type = "application_service"
                 elif self.hs.is_mine_id(event.sender):
                     origin_type = "local"
-                    origin_entity = "*client*"
                 else:
                     origin_type = "remote"
-                    origin_entity = get_domain_from_id(event.sender)
+
+                # We only track a subset of event types, to avoid high
+                # cardinality in the metrics.
+                metrics_event_type = (
+                    event.type if event.type in TRACKED_EVENT_TYPES else "*other*"
+                )
 
                 event_counter.labels(
-                    type=event.type,
+                    type=metrics_event_type,
                     origin_type=origin_type,
-                    origin_entity=origin_entity,
                     **{SERVER_NAME_LABEL: self.server_name},
                 ).inc()
 
@@ -585,21 +601,21 @@ class PersistEventsStore:
         ]
 
         membership_snapshot_shared_insert_values: SlidingSyncMembershipSnapshotSharedInsertValues = {}
-        membership_infos_to_insert_membership_snapshots: List[
+        membership_infos_to_insert_membership_snapshots: list[
             SlidingSyncMembershipInfo
         ] = []
         if to_insert:
-            membership_event_id_to_user_id_map: Dict[str, str] = {}
+            membership_event_id_to_user_id_map: dict[str, str] = {}
             for state_key, event_id in to_insert.items():
                 if state_key[0] == EventTypes.Member and self.is_mine_id(state_key[1]):
                     membership_event_id_to_user_id_map[event_id] = state_key[1]
 
-            membership_event_map: Dict[str, EventBase] = {}
+            membership_event_map: dict[str, EventBase] = {}
             # In normal event persist scenarios, we should be able to find the
             # membership events in the `events_and_contexts` given to us but it's
             # possible a state reset happened which added us to the room without a
             # corresponding new membership event (reset back to a previous membership).
-            missing_membership_event_ids: Set[str] = set()
+            missing_membership_event_ids: set[str] = set()
             for membership_event_id in membership_event_id_to_user_id_map.keys():
                 membership_event = event_map.get(membership_event_id)
                 if membership_event:
@@ -668,7 +684,7 @@ class PersistEventsStore:
                 # these state events in `events_and_contexts` since we don't generally
                 # batch up local membership changes with other events, but it can
                 # happen.
-                missing_state_event_ids: Set[str] = set()
+                missing_state_event_ids: set[str] = set()
                 for state_key, event_id in current_state_ids_map.items():
                     event = event_map.get(event_id)
                     if event:
@@ -721,7 +737,7 @@ class PersistEventsStore:
         # `_update_sliding_sync_tables_with_new_persisted_events_txn()`)
         #
         joined_room_updates: SlidingSyncStateInsertValues = {}
-        bump_stamp_to_fully_insert: Optional[int] = None
+        bump_stamp_to_fully_insert: int | None = None
         if not delta_state.no_longer_in_room:
             current_state_ids_map = {}
 
@@ -780,7 +796,7 @@ class PersistEventsStore:
             # events in the `events_and_contexts` given to us but it's possible a state
             # reset happened which that reset back to a previous state.
             current_state_map = {}
-            missing_event_ids: Set[str] = set()
+            missing_event_ids: set[str] = set()
             for state_key, event_id in current_state_ids_map.items():
                 event = event_map.get(event_id)
                 if event:
@@ -826,7 +842,7 @@ class PersistEventsStore:
 
     async def calculate_chain_cover_index_for_events(
         self, room_id: str, events: Collection[EventBase]
-    ) -> Dict[str, NewEventChainLinks]:
+    ) -> dict[str, NewEventChainLinks]:
         # Filter to state events, and ensure there are no duplicates.
         state_events = []
         seen_events = set()
@@ -849,7 +865,7 @@ class PersistEventsStore:
 
     def calculate_chain_cover_index_for_events_txn(
         self, txn: LoggingTransaction, room_id: str, state_events: Collection[EventBase]
-    ) -> Dict[str, NewEventChainLinks]:
+    ) -> dict[str, NewEventChainLinks]:
         # We now calculate chain ID/sequence numbers for any state events we're
         # persisting. We ignore out of band memberships as we're not in the room
         # and won't have their auth chain (we'll fix it up later if we join the
@@ -905,7 +921,7 @@ class PersistEventsStore:
             event_to_auth_chain,
         )
 
-    async def _get_events_which_are_prevs(self, event_ids: Iterable[str]) -> List[str]:
+    async def _get_events_which_are_prevs(self, event_ids: Iterable[str]) -> list[str]:
         """Filter the supplied list of event_ids to get those which are prev_events of
         existing (non-outlier/rejected) events.
 
@@ -915,7 +931,7 @@ class PersistEventsStore:
         Returns:
             Filtered event ids
         """
-        results: List[str] = []
+        results: list[str] = []
 
         def _get_events_which_are_prevs_txn(
             txn: LoggingTransaction, batch: Collection[str]
@@ -946,7 +962,7 @@ class PersistEventsStore:
 
         return results
 
-    async def _get_prevs_before_rejected(self, event_ids: Iterable[str]) -> Set[str]:
+    async def _get_prevs_before_rejected(self, event_ids: Iterable[str]) -> set[str]:
         """Get soft-failed ancestors to remove from the extremities.
 
         Given a set of events, find all those that have been soft-failed or
@@ -967,7 +983,7 @@ class PersistEventsStore:
 
         # The set of event_ids to return. This includes all soft-failed events
         # and their prev events.
-        existing_prevs: Set[str] = set()
+        existing_prevs: set[str] = set()
 
         def _get_prevs_before_rejected_txn(
             txn: LoggingTransaction, batch: Collection[str]
@@ -1016,12 +1032,12 @@ class PersistEventsStore:
         txn: LoggingTransaction,
         *,
         room_id: str,
-        events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
         inhibit_local_membership_updates: bool,
-        state_delta_for_room: Optional[DeltaState],
-        new_forward_extremities: Optional[Set[str]],
-        new_event_links: Dict[str, NewEventChainLinks],
-        sliding_sync_table_changes: Optional[SlidingSyncTableChanges],
+        state_delta_for_room: DeltaState | None,
+        new_forward_extremities: set[str] | None,
+        new_event_links: dict[str, NewEventChainLinks],
+        sliding_sync_table_changes: SlidingSyncTableChanges | None,
     ) -> None:
         """Insert some number of room events into the necessary database tables.
 
@@ -1170,6 +1186,11 @@ class PersistEventsStore:
                 sliding_sync_table_changes,
             )
 
+        if self._msc4354_enabled:
+            self.store.insert_sticky_events_txn(
+                txn, [ev for ev, _ in events_and_contexts]
+            )
+
         # We only update the sliding sync tables for non-backfilled events.
         self._update_sliding_sync_tables_with_new_persisted_events_txn(
             txn, room_id, events_and_contexts
@@ -1178,8 +1199,8 @@ class PersistEventsStore:
     def _persist_event_auth_chain_txn(
         self,
         txn: LoggingTransaction,
-        events: List[EventBase],
-        new_event_links: Dict[str, NewEventChainLinks],
+        events: list[EventBase],
+        new_event_links: dict[str, NewEventChainLinks],
     ) -> None:
         if new_event_links:
             self._persist_chain_cover_index(txn, self.db_pool, new_event_links)
@@ -1212,9 +1233,9 @@ class PersistEventsStore:
         txn: LoggingTransaction,
         db_pool: DatabasePool,
         event_chain_id_gen: SequenceGenerator,
-        event_to_room_id: Dict[str, str],
-        event_to_types: Dict[str, Tuple[str, str]],
-        event_to_auth_chain: Dict[str, StrCollection],
+        event_to_room_id: dict[str, str],
+        event_to_types: dict[str, tuple[str, str]],
+        event_to_auth_chain: dict[str, StrCollection],
     ) -> None:
         """Calculate and persist the chain cover index for the given events.
 
@@ -1241,10 +1262,10 @@ class PersistEventsStore:
         txn: LoggingTransaction,
         db_pool: DatabasePool,
         event_chain_id_gen: SequenceGenerator,
-        event_to_room_id: Dict[str, str],
-        event_to_types: Dict[str, Tuple[str, str]],
-        event_to_auth_chain: Dict[str, StrCollection],
-    ) -> Dict[str, NewEventChainLinks]:
+        event_to_room_id: dict[str, str],
+        event_to_types: dict[str, tuple[str, str]],
+        event_to_auth_chain: dict[str, StrCollection],
+    ) -> dict[str, NewEventChainLinks]:
         """Calculate the chain cover index for the given events.
 
         Args:
@@ -1259,7 +1280,7 @@ class PersistEventsStore:
         """
 
         # Map from event ID to chain ID/sequence number.
-        chain_map: Dict[str, Tuple[int, int]] = {}
+        chain_map: dict[str, tuple[int, int]] = {}
 
         # Set of event IDs to calculate chain ID/seq numbers for.
         events_to_calc_chain_id_for = set(event_to_room_id)
@@ -1268,7 +1289,7 @@ class PersistEventsStore:
         # we're looking at. These should just be out of band memberships, where
         # we didn't have the auth chain when we first persisted.
         auth_chain_to_calc_rows = cast(
-            List[Tuple[str, str, str]],
+            list[tuple[str, str, str]],
             db_pool.simple_select_many_txn(
                 txn,
                 table="event_auth_chain_to_calculate",
@@ -1490,7 +1511,7 @@ class PersistEventsStore:
         cls,
         txn: LoggingTransaction,
         db_pool: DatabasePool,
-        new_event_links: Dict[str, NewEventChainLinks],
+        new_event_links: dict[str, NewEventChainLinks],
     ) -> None:
         db_pool.simple_insert_many_txn(
             txn,
@@ -1536,12 +1557,12 @@ class PersistEventsStore:
         txn: LoggingTransaction,
         db_pool: DatabasePool,
         event_chain_id_gen: SequenceGenerator,
-        event_to_room_id: Dict[str, str],
-        event_to_types: Dict[str, Tuple[str, str]],
-        event_to_auth_chain: Dict[str, StrCollection],
-        events_to_calc_chain_id_for: Set[str],
-        chain_map: Dict[str, Tuple[int, int]],
-    ) -> Dict[str, Tuple[int, int]]:
+        event_to_room_id: dict[str, str],
+        event_to_types: dict[str, tuple[str, str]],
+        event_to_auth_chain: dict[str, StrCollection],
+        events_to_calc_chain_id_for: set[str],
+        chain_map: dict[str, tuple[int, int]],
+    ) -> dict[str, tuple[int, int]]:
         """Allocates, but does not persist, chain ID/sequence numbers for the
         events in `events_to_calc_chain_id_for`. (c.f. _add_chain_cover_index
         for info on args)
@@ -1573,8 +1594,8 @@ class PersistEventsStore:
         #      new chain if the sequence number has already been allocated.
         #
 
-        existing_chains: Set[int] = set()
-        tree: List[Tuple[str, Optional[str]]] = []
+        existing_chains: set[int] = set()
+        tree: list[tuple[str, str | None]] = []
 
         # We need to do this in a topologically sorted order as we want to
         # generate chain IDs/sequence numbers of an event's auth events before
@@ -1604,7 +1625,7 @@ class PersistEventsStore:
         )
         txn.execute(sql % (clause,), args)
 
-        chain_to_max_seq_no: Dict[Any, int] = {row[0]: row[1] for row in txn}
+        chain_to_max_seq_no: dict[Any, int] = {row[0]: row[1] for row in txn}
 
         # Allocate the new events chain ID/sequence numbers.
         #
@@ -1614,8 +1635,8 @@ class PersistEventsStore:
         # number of new chain IDs in one call, replacing all temporary
         # objects with real allocated chain IDs.
 
-        unallocated_chain_ids: Set[object] = set()
-        new_chain_tuples: Dict[str, Tuple[Any, int]] = {}
+        unallocated_chain_ids: set[object] = set()
+        new_chain_tuples: dict[str, tuple[Any, int]] = {}
         for event_id, auth_event_id in tree:
             # If we reference an auth_event_id we fetch the allocated chain ID,
             # either from the existing `chain_map` or the newly generated
@@ -1626,7 +1647,7 @@ class PersistEventsStore:
                 if not existing_chain_id:
                     existing_chain_id = chain_map[auth_event_id]
 
-            new_chain_tuple: Optional[Tuple[Any, int]] = None
+            new_chain_tuple: tuple[Any, int] | None = None
             if existing_chain_id:
                 # We found a chain ID/sequence number candidate, check its
                 # not already taken.
@@ -1653,7 +1674,7 @@ class PersistEventsStore:
         )
 
         # Map from potentially temporary chain ID to real chain ID
-        chain_id_to_allocated_map: Dict[Any, int] = dict(
+        chain_id_to_allocated_map: dict[Any, int] = dict(
             zip(unallocated_chain_ids, newly_allocated_chain_ids)
         )
         chain_id_to_allocated_map.update((c, c) for c in existing_chains)
@@ -1666,12 +1687,12 @@ class PersistEventsStore:
     def _persist_transaction_ids_txn(
         self,
         txn: LoggingTransaction,
-        events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
     ) -> None:
         """Persist the mapping from transaction IDs to event IDs (if defined)."""
 
         inserted_ts = self._clock.time_msec()
-        to_insert_device_id: List[Tuple[str, str, str, str, str, int]] = []
+        to_insert_device_id: list[tuple[str, str, str, str, str, int]] = []
         for event, _ in events_and_contexts:
             txn_id = getattr(event.internal_metadata, "txn_id", None)
             device_id = getattr(event.internal_metadata, "device_id", None)
@@ -1899,7 +1920,7 @@ class PersistEventsStore:
                     sliding_sync_table_changes.joined_room_updates.values()
                 )
 
-                args: List[Any] = [
+                args: list[Any] = [
                     room_id,
                     room_id,
                     sliding_sync_table_changes.joined_room_bump_stamp_to_fully_insert,
@@ -2316,7 +2337,7 @@ class PersistEventsStore:
         self,
         txn: LoggingTransaction,
         room_id: str,
-        events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
     ) -> None:
         """
         Update the latest `event_stream_ordering`/`bump_stamp` columns in the
@@ -2427,7 +2448,7 @@ class PersistEventsStore:
         self,
         txn: LoggingTransaction,
         room_id: str,
-        new_forward_extremities: Set[str],
+        new_forward_extremities: set[str],
         max_stream_order: int,
     ) -> None:
         self.db_pool.simple_delete_txn(
@@ -2456,8 +2477,8 @@ class PersistEventsStore:
 
     @classmethod
     def _filter_events_and_contexts_for_duplicates(
-        cls, events_and_contexts: List[EventPersistencePair]
-    ) -> List[EventPersistencePair]:
+        cls, events_and_contexts: list[EventPersistencePair]
+    ) -> list[EventPersistencePair]:
         """Ensure that we don't have the same event twice.
 
         Pick the earliest non-outlier if there is one, else the earliest one.
@@ -2486,7 +2507,7 @@ class PersistEventsStore:
         self,
         txn: LoggingTransaction,
         room_id: str,
-        events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
     ) -> None:
         """Update min_depth for each room
 
@@ -2495,7 +2516,7 @@ class PersistEventsStore:
             room_id: The room ID
             events_and_contexts: events we are persisting
         """
-        stream_ordering: Optional[int] = None
+        stream_ordering: int | None = None
         depth_update = 0
         for event, context in events_and_contexts:
             # Don't update the stream ordering for backfilled events because
@@ -2528,8 +2549,8 @@ class PersistEventsStore:
     def _update_outliers_txn(
         self,
         txn: LoggingTransaction,
-        events_and_contexts: List[EventPersistencePair],
-    ) -> List[EventPersistencePair]:
+        events_and_contexts: list[EventPersistencePair],
+    ) -> list[EventPersistencePair]:
         """Update any outliers with new event info.
 
         This turns outliers into ex-outliers (unless the new event was rejected), and
@@ -2547,7 +2568,7 @@ class PersistEventsStore:
                 a room that has been un-partial stated.
         """
         rows = cast(
-            List[Tuple[str, bool]],
+            list[tuple[str, bool]],
             self.db_pool.simple_select_many_txn(
                 txn,
                 "events",
@@ -2631,6 +2652,11 @@ class PersistEventsStore:
                 # event isn't an outlier any more.
                 self._update_backward_extremeties(txn, [event])
 
+                if self._msc4354_enabled and event.sticky_duration():
+                    # The de-outliered event is sticky. Update the sticky events table to ensure
+                    # we deliver this down /sync.
+                    self.store.insert_sticky_events_txn(txn, [event])
+
         return [ec for ec in events_and_contexts if ec[0] not in to_remove]
 
     def _store_event_txn(
@@ -2740,8 +2766,8 @@ class PersistEventsStore:
     def _store_rejected_events_txn(
         self,
         txn: LoggingTransaction,
-        events_and_contexts: List[EventPersistencePair],
-    ) -> List[EventPersistencePair]:
+        events_and_contexts: list[EventPersistencePair],
+    ) -> list[EventPersistencePair]:
         """Add rows to the 'rejections' table for received events which were
         rejected
 
@@ -2768,8 +2794,8 @@ class PersistEventsStore:
         self,
         txn: LoggingTransaction,
         *,
-        events_and_contexts: List[EventPersistencePair],
-        all_events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
+        all_events_and_contexts: list[EventPersistencePair],
         inhibit_local_membership_updates: bool = False,
     ) -> None:
         """Update all the miscellaneous tables for new events
@@ -2863,9 +2889,9 @@ class PersistEventsStore:
     def _add_to_cache(
         self,
         txn: LoggingTransaction,
-        events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
     ) -> None:
-        to_prefill: List[EventCacheEntry] = []
+        to_prefill: list[EventCacheEntry] = []
 
         ev_map = {e.event_id: e for e, _ in events_and_contexts}
         if not ev_map:
@@ -2918,6 +2944,7 @@ class PersistEventsStore:
             values={
                 "redacts": event.redacts,
                 "received_ts": self._clock.time_msec(),
+                "recheck": event.internal_metadata.need_to_check_redaction(),
             },
         )
 
@@ -2925,7 +2952,7 @@ class PersistEventsStore:
         self,
         txn: LoggingTransaction,
         event_id: str,
-        labels: List[str],
+        labels: list[str],
         room_id: str,
         topological_ordering: int,
     ) -> None:
@@ -2967,7 +2994,7 @@ class PersistEventsStore:
     def _store_room_members_txn(
         self,
         txn: LoggingTransaction,
-        events: List[EventBase],
+        events: list[EventBase],
         *,
         inhibit_local_membership_updates: bool = False,
     ) -> None:
@@ -3336,8 +3363,8 @@ class PersistEventsStore:
     def _set_push_actions_for_event_and_users_txn(
         self,
         txn: LoggingTransaction,
-        events_and_contexts: List[EventPersistencePair],
-        all_events_and_contexts: List[EventPersistencePair],
+        events_and_contexts: list[EventPersistencePair],
+        all_events_and_contexts: list[EventPersistencePair],
     ) -> None:
         """Handles moving push actions from staging table to main
         event_push_actions table for all events in `events_and_contexts`.
@@ -3517,7 +3544,7 @@ class PersistEventsStore:
         )
 
     def _handle_mult_prev_events(
-        self, txn: LoggingTransaction, events: List[EventBase]
+        self, txn: LoggingTransaction, events: list[EventBase]
     ) -> None:
         """
         For the given event, update the event edges table and forward and
@@ -3535,7 +3562,7 @@ class PersistEventsStore:
         self._update_backward_extremeties(txn, events)
 
     def _update_backward_extremeties(
-        self, txn: LoggingTransaction, events: List[EventBase]
+        self, txn: LoggingTransaction, events: list[EventBase]
     ) -> None:
         """Updates the event_backward_extremities tables based on the new/updated
         events being persisted.
@@ -3637,16 +3664,16 @@ class _LinkMap:
 
     # Stores the set of links as nested maps: source chain ID -> target chain ID
     # -> source sequence number -> target sequence number.
-    maps: Dict[int, Dict[int, Dict[int, int]]] = attr.Factory(dict)
+    maps: dict[int, dict[int, dict[int, int]]] = attr.Factory(dict)
 
     # Stores the links that have been added (with new set to true), as tuples of
     # `(source chain ID, source sequence no, target chain ID, target sequence no.)`
-    additions: Set[Tuple[int, int, int, int]] = attr.Factory(set)
+    additions: set[tuple[int, int, int, int]] = attr.Factory(set)
 
     def add_link(
         self,
-        src_tuple: Tuple[int, int],
-        target_tuple: Tuple[int, int],
+        src_tuple: tuple[int, int],
+        target_tuple: tuple[int, int],
         new: bool = True,
     ) -> bool:
         """Add a new link between two chains, ensuring no redundant links are added.
@@ -3701,7 +3728,7 @@ class _LinkMap:
         current_links[src_seq] = target_seq
         return True
 
-    def get_additions(self) -> Generator[Tuple[int, int, int, int], None, None]:
+    def get_additions(self) -> Generator[tuple[int, int, int, int], None, None]:
         """Gets any newly added links.
 
         Yields:
@@ -3715,8 +3742,8 @@ class _LinkMap:
 
     def exists_path_from(
         self,
-        src_tuple: Tuple[int, int],
-        target_tuple: Tuple[int, int],
+        src_tuple: tuple[int, int],
+        target_tuple: tuple[int, int],
     ) -> bool:
         """Checks if there is a path between the source chain ID/sequence and
         target chain ID/sequence.
@@ -3728,7 +3755,7 @@ class _LinkMap:
             return target_seq <= src_seq
 
         # We have to graph traverse the links to check for indirect paths.
-        visited_chains: Dict[int, int] = collections.Counter()
+        visited_chains: dict[int, int] = collections.Counter()
         search = [(src_chain, src_seq)]
         while search:
             chain, seq = search.pop()
diff --git a/synapse/storage/databases/main/events_bg_updates.py b/synapse/storage/databases/main/events_bg_updates.py
index 8a59091da0..934cd157ca 100644
--- a/synapse/storage/databases/main/events_bg_updates.py
+++ b/synapse/storage/databases/main/events_bg_updates.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Dict, List, Optional, Set, Tuple, cast
+from typing import TYPE_CHECKING, cast
 
 import attr
 
@@ -58,8 +58,8 @@ from synapse.types import JsonDict, RoomStreamToken, StateMap, StrCollection
 from synapse.types.handlers import SLIDING_SYNC_DEFAULT_BUMP_EVENT_TYPES
 from synapse.types.state import StateFilter
 from synapse.types.storage import _BackgroundUpdates
-from synapse.util import json_encoder
 from synapse.util.iterutils import batch_iter
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -97,7 +97,7 @@ class _CalculateChainCover:
     # Map from room_id to last depth/stream processed for each room that we have
     # processed all events for (i.e. the rooms we can flip the
     # `has_auth_chain_index` for)
-    finished_room_map: Dict[str, Tuple[int, int]]
+    finished_room_map: dict[str, tuple[int, int]]
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -109,7 +109,7 @@ class _JoinedRoomStreamOrderingUpdate:
     # The most recent event stream_ordering for the room
     most_recent_event_stream_ordering: int
     # The most recent event `bump_stamp` for the room
-    most_recent_bump_stamp: Optional[int]
+    most_recent_bump_stamp: int | None
 
 
 class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseStore):
@@ -159,6 +159,11 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             "redactions_received_ts", self._redactions_received_ts
         )
 
+        self.db_pool.updates.register_background_update_handler(
+            _BackgroundUpdates.REDACTIONS_RECHECK_BG_UPDATE,
+            self._redactions_recheck_bg_update,
+        )
+
         # This index gets deleted in `event_fix_redactions_bytes` update
         self.db_pool.updates.register_background_index_update(
             "event_fix_redactions_bytes_create_index",
@@ -451,7 +456,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             chunks = [event_ids[i : i + 100] for i in range(0, len(event_ids), 100)]
             for chunk in chunks:
                 ev_rows = cast(
-                    List[Tuple[str, str]],
+                    list[tuple[str, str]],
                     self.db_pool.simple_select_many_txn(
                         txn,
                         table="event_json",
@@ -527,8 +532,8 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             # The set of extremity event IDs that we're checking this round
             original_set = set()
 
-            # A dict[str, Set[str]] of event ID to their prev events.
-            graph: Dict[str, Set[str]] = {}
+            # A dict[str, set[str]] of event ID to their prev events.
+            graph: dict[str, set[str]] = {}
 
             # The set of descendants of the original set that are not rejected
             # nor soft-failed. Ancestors of these events should be removed
@@ -647,7 +652,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             if deleted:
                 # We now need to invalidate the caches of these rooms
                 rows = cast(
-                    List[Tuple[str]],
+                    list[tuple[str]],
                     self.db_pool.simple_select_many_txn(
                         txn,
                         table="events",
@@ -730,7 +735,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
                 WHERE ? <= event_id AND event_id <= ?
             """
 
-            txn.execute(sql, (self._clock.time_msec(), last_event_id, upper_event_id))
+            txn.execute(sql, (self.clock.time_msec(), last_event_id, upper_event_id))
 
             self.db_pool.updates._background_update_progress_txn(
                 txn, "redactions_received_ts", {"last_event_id": upper_event_id}
@@ -747,6 +752,66 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
 
         return count
 
+    async def _redactions_recheck_bg_update(
+        self, progress: JsonDict, batch_size: int
+    ) -> int:
+        """Fills in the `recheck` column of the `redactions` table based on
+        the `recheck_redaction` field in each event's internal metadata."""
+        last_event_id = progress.get("last_event_id", "")
+
+        def _txn(txn: LoggingTransaction) -> int:
+            sql = """
+                SELECT r.event_id, ej.internal_metadata
+                FROM redactions AS r
+                LEFT JOIN event_json AS ej USING (event_id)
+                WHERE r.event_id > ?
+                ORDER BY r.event_id ASC
+                LIMIT ?
+            """
+            txn.execute(sql, (last_event_id, batch_size))
+            rows = txn.fetchall()
+            if not rows:
+                return 0
+
+            updates = []
+            for event_id, internal_metadata_json in rows:
+                if internal_metadata_json is not None:
+                    internal_metadata = db_to_json(internal_metadata_json)
+                    recheck = bool(internal_metadata.get("recheck_redaction", False))
+                else:
+                    recheck = False
+                if not recheck:
+                    # Column defaults to true, so we only need to update rows
+                    # where recheck should be false.
+                    updates.append((event_id, recheck))
+
+            self.db_pool.simple_update_many_txn(
+                txn,
+                table="redactions",
+                key_names=("event_id",),
+                key_values=[(event_id,) for event_id, _ in updates],
+                value_names=("recheck",),
+                value_values=[(recheck,) for _, recheck in updates],
+            )
+
+            upper_event_id = rows[-1][0]
+            self.db_pool.updates._background_update_progress_txn(
+                txn,
+                _BackgroundUpdates.REDACTIONS_RECHECK_BG_UPDATE,
+                {"last_event_id": upper_event_id},
+            )
+
+            return len(rows)
+
+        count = await self.db_pool.runInteraction("_redactions_recheck_bg_update", _txn)
+
+        if not count:
+            await self.db_pool.updates._end_background_update(
+                _BackgroundUpdates.REDACTIONS_RECHECK_BG_UPDATE
+            )
+
+        return count
+
     async def _event_fix_redactions_bytes(
         self, progress: JsonDict, batch_size: int
     ) -> int:
@@ -851,7 +916,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
 
         def get_rejected_events(
             txn: Cursor,
-        ) -> List[Tuple[str, str, JsonDict, bool, bool]]:
+        ) -> list[tuple[str, str, JsonDict, bool, bool]]:
             # Fetch rejected event json, their room version and whether we have
             # inserted them into the state_events or auth_events tables.
             #
@@ -883,7 +948,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             )
 
             return cast(
-                List[Tuple[str, str, JsonDict, bool, bool]],
+                list[tuple[str, str, JsonDict, bool, bool]],
                 [(row[0], row[1], db_to_json(row[2]), row[3], row[4]) for row in txn],
             )
 
@@ -1038,7 +1103,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
         last_room_id: str,
         last_depth: int,
         last_stream: int,
-        batch_size: Optional[int],
+        batch_size: int | None,
         single_room: bool,
     ) -> _CalculateChainCover:
         """Calculate the chain cover for `batch_size` events, ordered by
@@ -1126,7 +1191,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
 
         # We also need to fetch the auth events for them.
         auth_events = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             self.db_pool.simple_select_many_txn(
                 txn,
                 table="event_auth",
@@ -1137,7 +1202,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             ),
         )
 
-        event_to_auth_chain: Dict[str, List[str]] = {}
+        event_to_auth_chain: dict[str, list[str]] = {}
         for event_id, auth_id in auth_events:
             event_to_auth_chain.setdefault(event_id, []).append(auth_id)
 
@@ -1151,7 +1216,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             self.event_chain_id_gen,
             event_to_room_id,
             event_to_types,
-            cast(Dict[str, StrCollection], event_to_auth_chain),
+            cast(dict[str, StrCollection], event_to_auth_chain),
         )
 
         return _CalculateChainCover(
@@ -1256,7 +1321,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
 
             results = list(txn)
             # (event_id, parent_id, rel_type) for each relation
-            relations_to_insert: List[Tuple[str, str, str, str]] = []
+            relations_to_insert: list[tuple[str, str, str, str]] = []
             for event_id, event_json_raw in results:
                 try:
                     event_json = db_to_json(event_json_raw)
@@ -1636,7 +1701,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
         # We don't need to fetch any progress state because we just grab the next N
         # events in `sliding_sync_joined_rooms_to_recalculate`
 
-        def _get_rooms_to_update_txn(txn: LoggingTransaction) -> List[Tuple[str]]:
+        def _get_rooms_to_update_txn(txn: LoggingTransaction) -> list[tuple[str]]:
             """
             Returns:
                 A list of room ID's to update along with the progress value
@@ -1658,7 +1723,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
                 (batch_size,),
             )
 
-            rooms_to_update_rows = cast(List[Tuple[str]], txn.fetchall())
+            rooms_to_update_rows = cast(list[tuple[str]], txn.fetchall())
 
             return rooms_to_update_rows
 
@@ -1674,9 +1739,9 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             return 0
 
         # Map from room_id to insert/update state values in the `sliding_sync_joined_rooms` table.
-        joined_room_updates: Dict[str, SlidingSyncStateInsertValues] = {}
+        joined_room_updates: dict[str, SlidingSyncStateInsertValues] = {}
         # Map from room_id to stream_ordering/bump_stamp, etc values
-        joined_room_stream_ordering_updates: Dict[
+        joined_room_stream_ordering_updates: dict[
             str, _JoinedRoomStreamOrderingUpdate
         ] = {}
         # As long as we get this value before we fetch the current state, we can use it
@@ -1886,17 +1951,17 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
 
         def _find_memberships_to_update_txn(
             txn: LoggingTransaction,
-        ) -> List[
-            Tuple[
+        ) -> list[
+            tuple[
                 str,
-                Optional[str],
-                Optional[str],
+                str | None,
+                str | None,
                 str,
                 str,
                 str,
                 str,
                 int,
-                Optional[str],
+                str | None,
                 bool,
             ]
         ]:
@@ -1979,17 +2044,17 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
                 raise Exception("last_event_stream_ordering should not be None")
 
             memberships_to_update_rows = cast(
-                List[
-                    Tuple[
+                list[
+                    tuple[
                         str,
-                        Optional[str],
-                        Optional[str],
+                        str | None,
+                        str | None,
                         str,
                         str,
                         str,
                         str,
                         int,
-                        Optional[str],
+                        str | None,
                         bool,
                     ]
                 ],
@@ -2023,7 +2088,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
 
         def _find_previous_invite_or_knock_membership_txn(
             txn: LoggingTransaction, room_id: str, user_id: str, event_id: str
-        ) -> Optional[Tuple[str, str]]:
+        ) -> tuple[str, str] | None:
             # Find the previous invite/knock event before the leave event
             #
             # Here are some notes on how we landed on this query:
@@ -2085,11 +2150,11 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             return event_id, membership
 
         # Map from (room_id, user_id) to ...
-        to_insert_membership_snapshots: Dict[
-            Tuple[str, str], SlidingSyncMembershipSnapshotSharedInsertValues
+        to_insert_membership_snapshots: dict[
+            tuple[str, str], SlidingSyncMembershipSnapshotSharedInsertValues
         ] = {}
-        to_insert_membership_infos: Dict[
-            Tuple[str, str], SlidingSyncMembershipInfoWithEventPos
+        to_insert_membership_infos: dict[
+            tuple[str, str], SlidingSyncMembershipInfoWithEventPos
         ] = {}
         for (
             room_id,
@@ -2510,7 +2575,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             )
 
             memberships_to_update_rows = cast(
-                List[Tuple[str, str, str, int, int]],
+                list[tuple[str, str, str, int, int]],
                 txn.fetchall(),
             )
             if not memberships_to_update_rows:
@@ -2519,9 +2584,9 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             # Assemble the values to update
             #
             # (room_id, user_id)
-            key_values: List[Tuple[str, str]] = []
+            key_values: list[tuple[str, str]] = []
             # (forgotten,)
-            value_values: List[Tuple[int]] = []
+            value_values: list[tuple[int]] = []
             for (
                 room_id,
                 user_id,
@@ -2585,7 +2650,7 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
 
         room_id_bound = progress.get("room_id", "")
 
-        def redo_max_depth_bg_update_txn(txn: LoggingTransaction) -> Tuple[bool, int]:
+        def redo_max_depth_bg_update_txn(txn: LoggingTransaction) -> tuple[bool, int]:
             txn.execute(
                 """
                 SELECT room_id, room_version FROM rooms
@@ -2597,8 +2662,8 @@ class EventsBackgroundUpdatesStore(StreamWorkerStore, StateDeltasStore, SQLBaseS
             )
 
             # Find the next room ID to process, with a relevant room version.
-            room_ids: List[str] = []
-            max_room_id: Optional[str] = None
+            room_ids: list[str] = []
+            max_room_id: str | None = None
             for room_id, room_version_str in txn:
                 max_room_id = room_id
 
@@ -2704,7 +2769,7 @@ def _resolve_stale_data_in_sliding_sync_joined_rooms_table(
 
     # If we have nothing written to the `sliding_sync_joined_rooms` table, there is
     # nothing to clean up
-    row = cast(Optional[Tuple[int]], txn.fetchone())
+    row = cast(tuple[int] | None, txn.fetchone())
     max_stream_ordering_sliding_sync_joined_rooms_table = None
     depends_on = None
     if row is not None:
@@ -2830,7 +2895,7 @@ def _resolve_stale_data_in_sliding_sync_membership_snapshots_table(
 
     # If we have nothing written to the `sliding_sync_membership_snapshots` table,
     # there is nothing to clean up
-    row = cast(Optional[Tuple[int]], txn.fetchone())
+    row = cast(tuple[int] | None, txn.fetchone())
     max_stream_ordering_sliding_sync_membership_snapshots_table = None
     if row is not None:
         (max_stream_ordering_sliding_sync_membership_snapshots_table,) = row
diff --git a/synapse/storage/databases/main/events_forward_extremities.py b/synapse/storage/databases/main/events_forward_extremities.py
index bd763885d7..9908244dbf 100644
--- a/synapse/storage/databases/main/events_forward_extremities.py
+++ b/synapse/storage/databases/main/events_forward_extremities.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import List, Optional, Tuple, cast
+from typing import cast
 
 from synapse.api.errors import SynapseError
 from synapse.storage.database import LoggingTransaction
@@ -98,7 +98,7 @@ class EventForwardExtremitiesStore(
 
     async def get_forward_extremities_for_room(
         self, room_id: str
-    ) -> List[Tuple[str, int, int, Optional[int]]]:
+    ) -> list[tuple[str, int, int, int | None]]:
         """
         Get list of forward extremities for a room.
 
@@ -108,7 +108,7 @@ class EventForwardExtremitiesStore(
 
         def get_forward_extremities_for_room_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[str, int, int, Optional[int]]]:
+        ) -> list[tuple[str, int, int, int | None]]:
             sql = """
                 SELECT event_id, state_group, depth, received_ts
                 FROM event_forward_extremities
@@ -118,7 +118,7 @@ class EventForwardExtremitiesStore(
             """
 
             txn.execute(sql, (room_id,))
-            return cast(List[Tuple[str, int, int, Optional[int]]], txn.fetchall())
+            return cast(list[tuple[str, int, int, int | None]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_forward_extremities_for_room",
diff --git a/synapse/storage/databases/main/events_worker.py b/synapse/storage/databases/main/events_worker.py
index cc031d8996..cc79b8042b 100644
--- a/synapse/storage/databases/main/events_worker.py
+++ b/synapse/storage/databases/main/events_worker.py
@@ -27,15 +27,10 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
     Iterable,
-    List,
     Literal,
     Mapping,
     MutableMapping,
-    Optional,
-    Set,
-    Tuple,
     cast,
     overload,
 )
@@ -70,7 +65,6 @@ from synapse.logging.opentracing import (
 )
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.replication.tcp.streams import BackfillStream, UnPartialStatedEventStream
@@ -98,6 +92,7 @@ from synapse.util.caches.descriptors import cached, cachedList
 from synapse.util.caches.lrucache import AsyncLruCache
 from synapse.util.caches.stream_change_cache import StreamChangeCache
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
 from synapse.util.metrics import Measure
 
@@ -137,6 +132,11 @@ EVENT_QUEUE_ITERATIONS = 3  # No. times we block waiting for requests for events
 EVENT_QUEUE_TIMEOUT_S = 0.1  # Timeout when waiting for requests for events
 
 
+# Number of iterations in a loop before we yield to the reactor to allow other
+# things to be processed, otherwise we can end up tight looping.
+ITERATIONS_BEFORE_YIELDING = 500
+
+
 event_fetch_ongoing_gauge = Gauge(
     "synapse_event_fetch_ongoing",
     "The number of event fetchers that are running",
@@ -151,7 +151,7 @@ class InvalidEventError(Exception):
 @attr.s(slots=True, auto_attribs=True)
 class EventCacheEntry:
     event: EventBase
-    redacted_event: Optional[EventBase]
+    redacted_event: EventBase | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -179,7 +179,11 @@ class _EventRow:
 
         rejected_reason: if the event was rejected, the reason why.
 
-        redactions: a list of event-ids which (claim to) redact this event.
+        unconfirmed_redactions: a list of event-ids which (claim to) redact this event
+            and need to be rechecked.
+
+        confirmed_redactions: a list of event-ids which redact this event and have been
+            confirmed as valid redactions.
 
         outlier: True if this event is an outlier.
     """
@@ -189,10 +193,11 @@ class _EventRow:
     instance_name: str
     json: str
     internal_metadata: str
-    format_version: Optional[int]
-    room_version_id: Optional[str]
-    rejected_reason: Optional[str]
-    redactions: List[str]
+    format_version: int | None
+    room_version_id: str | None
+    rejected_reason: str | None
+    unconfirmed_redactions: list[str]
+    confirmed_redactions: list[str]
     outlier: bool
 
 
@@ -282,13 +287,14 @@ class EventsWorkerStore(SQLBaseStore):
 
         if hs.config.worker.run_background_tasks:
             # We periodically clean out old transaction ID mappings
-            self._clock.looping_call(
+            self.clock.looping_call(
                 self._cleanup_old_transaction_ids,
-                5 * 60 * 1000,
+                Duration(minutes=5),
             )
 
-        self._get_event_cache: AsyncLruCache[Tuple[str], EventCacheEntry] = (
+        self._get_event_cache: AsyncLruCache[tuple[str], EventCacheEntry] = (
             AsyncLruCache(
+                clock=hs.get_clock(),
                 server_name=self.server_name,
                 cache_name="*getEvent*",
                 max_size=hs.config.caches.event_cache_size,
@@ -300,8 +306,8 @@ class EventsWorkerStore(SQLBaseStore):
         # Map from event ID to a deferred that will result in a map from event
         # ID to cache entry. Note that the returned dict may not have the
         # requested event in it if the event isn't in the DB.
-        self._current_event_fetches: Dict[
-            str, ObservableDeferred[Dict[str, EventCacheEntry]]
+        self._current_event_fetches: dict[
+            str, ObservableDeferred[dict[str, EventCacheEntry]]
         ] = {}
 
         # We keep track of the events we have currently loaded in memory so that
@@ -311,8 +317,8 @@ class EventsWorkerStore(SQLBaseStore):
         self._event_ref: MutableMapping[str, EventBase] = weakref.WeakValueDictionary()
 
         self._event_fetch_lock = threading.Condition()
-        self._event_fetch_list: List[
-            Tuple[Iterable[str], "defer.Deferred[Dict[str, _EventRow]]"]
+        self._event_fetch_list: list[
+            tuple[Iterable[str], "defer.Deferred[dict[str, _EventRow]]"]
         ] = []
         self._event_fetch_ongoing = 0
         event_fetch_ongoing_gauge.labels(**{SERVER_NAME_LABEL: self.server_name}).set(
@@ -323,7 +329,7 @@ class EventsWorkerStore(SQLBaseStore):
         # the DataStore and PersistEventStore.
         def get_chain_id_txn(txn: Cursor) -> int:
             txn.execute("SELECT COALESCE(max(chain_id), 0) FROM event_auth_chains")
-            return cast(Tuple[int], txn.fetchone())[0]
+            return cast(tuple[int], txn.fetchone())[0]
 
         self.event_chain_id_gen = build_sequence_generator(
             db_conn,
@@ -387,7 +393,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_un_partial_stated_events_from_stream(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, Tuple[str, bool]]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple[str, bool]]], int, bool]:
         """Get updates for the un-partial-stated events replication stream.
 
         Args:
@@ -414,7 +420,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         def get_un_partial_stated_events_from_stream_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, Tuple[str, bool]]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple[str, bool]]], int, bool]:
             sql = """
                 SELECT stream_id, event_id, rejection_status_changed
                 FROM un_partial_stated_event_stream
@@ -505,7 +511,7 @@ class EventsWorkerStore(SQLBaseStore):
         get_prev_content: bool = ...,
         allow_rejected: bool = ...,
         allow_none: Literal[False] = ...,
-        check_room_id: Optional[str] = ...,
+        check_room_id: str | None = ...,
     ) -> EventBase: ...
 
     @overload
@@ -516,8 +522,8 @@ class EventsWorkerStore(SQLBaseStore):
         get_prev_content: bool = ...,
         allow_rejected: bool = ...,
         allow_none: Literal[True] = ...,
-        check_room_id: Optional[str] = ...,
-    ) -> Optional[EventBase]: ...
+        check_room_id: str | None = ...,
+    ) -> EventBase | None: ...
 
     @cancellable
     async def get_event(
@@ -527,8 +533,8 @@ class EventsWorkerStore(SQLBaseStore):
         get_prev_content: bool = False,
         allow_rejected: bool = False,
         allow_none: bool = False,
-        check_room_id: Optional[str] = None,
-    ) -> Optional[EventBase]:
+        check_room_id: str | None = None,
+    ) -> EventBase | None:
         """Get an event from the database by event_id.
 
         Events for unknown room versions will also be filtered out.
@@ -585,7 +591,7 @@ class EventsWorkerStore(SQLBaseStore):
         redact_behaviour: EventRedactBehaviour = EventRedactBehaviour.redact,
         get_prev_content: bool = False,
         allow_rejected: bool = False,
-    ) -> Dict[str, EventBase]:
+    ) -> dict[str, EventBase]:
         """Get events from the database
 
         Unknown events will be omitted from the response.
@@ -633,7 +639,7 @@ class EventsWorkerStore(SQLBaseStore):
         redact_behaviour: EventRedactBehaviour = EventRedactBehaviour.redact,
         get_prev_content: bool = False,
         allow_rejected: bool = False,
-    ) -> List[EventBase]:
+    ) -> list[EventBase]:
         """Get events from the database and return in a list in the same order
         as given by `event_ids` arg.
 
@@ -792,7 +798,7 @@ class EventsWorkerStore(SQLBaseStore):
         self,
         event_ids: Collection[str],
         allow_rejected: bool = False,
-    ) -> Dict[str, EventCacheEntry]:
+    ) -> dict[str, EventCacheEntry]:
         """Fetch a bunch of events from the cache or the database.
 
         Note that the events pulled by this function will not have any redactions
@@ -821,7 +827,7 @@ class EventsWorkerStore(SQLBaseStore):
         # may be called repeatedly for the same event so at this point we cannot reach
         # out to any external cache for performance reasons. The external cache is
         # checked later on in the `get_missing_events_from_cache_or_db` function below.
-        event_entry_map = self._get_events_from_local_cache(
+        event_entry_map = await self._get_events_from_local_cache(
             event_ids,
         )
 
@@ -836,9 +842,9 @@ class EventsWorkerStore(SQLBaseStore):
         # avoid extraneous work (if we don't do this we can end up in a n^2 mode
         # when we wait on the same Deferred N times, then try and merge the
         # same dict into itself N times).
-        already_fetching_ids: Set[str] = set()
-        already_fetching_deferreds: Set[
-            ObservableDeferred[Dict[str, EventCacheEntry]]
+        already_fetching_ids: set[str] = set()
+        already_fetching_deferreds: set[
+            ObservableDeferred[dict[str, EventCacheEntry]]
         ] = set()
 
         for event_id in missing_events_ids:
@@ -853,7 +859,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         if missing_events_ids:
 
-            async def get_missing_events_from_cache_or_db() -> Dict[
+            async def get_missing_events_from_cache_or_db() -> dict[
                 str, EventCacheEntry
             ]:
                 """Fetches the events in `missing_event_ids` from the database.
@@ -869,7 +875,7 @@ class EventsWorkerStore(SQLBaseStore):
                 # to all the events we pulled from the DB (this will result in this
                 # function returning more events than requested, but that can happen
                 # already due to `_get_events_from_db`).
-                fetching_deferred: ObservableDeferred[Dict[str, EventCacheEntry]] = (
+                fetching_deferred: ObservableDeferred[dict[str, EventCacheEntry]] = (
                     ObservableDeferred(defer.Deferred(), consumeErrors=True)
                 )
                 for event_id in missing_events_ids:
@@ -908,7 +914,7 @@ class EventsWorkerStore(SQLBaseStore):
             # We must allow the database fetch to complete in the presence of
             # cancellations, since multiple `_get_events_from_cache_or_db` calls can
             # reuse the same fetch.
-            missing_events: Dict[str, EventCacheEntry] = await delay_cancellation(
+            missing_events: dict[str, EventCacheEntry] = await delay_cancellation(
                 get_missing_events_from_cache_or_db()
             )
             event_entry_map.update(missing_events)
@@ -999,7 +1005,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def _get_events_from_cache(
         self, events: Iterable[str], update_metrics: bool = True
-    ) -> Dict[str, EventCacheEntry]:
+    ) -> dict[str, EventCacheEntry]:
         """Fetch events from the caches, both in memory and any external.
 
         May return rejected events.
@@ -1008,7 +1014,7 @@ class EventsWorkerStore(SQLBaseStore):
             events: list of event_ids to fetch
             update_metrics: Whether to update the cache hit ratio metrics
         """
-        event_map = self._get_events_from_local_cache(
+        event_map = await self._get_events_from_local_cache(
             events, update_metrics=update_metrics
         )
 
@@ -1025,7 +1031,7 @@ class EventsWorkerStore(SQLBaseStore):
     @trace
     async def _get_events_from_external_cache(
         self, events: Collection[str], update_metrics: bool = True
-    ) -> Dict[str, EventCacheEntry]:
+    ) -> dict[str, EventCacheEntry]:
         """Fetch events from any configured external cache.
 
         May return rejected events.
@@ -1049,9 +1055,9 @@ class EventsWorkerStore(SQLBaseStore):
 
         return event_map
 
-    def _get_events_from_local_cache(
+    async def _get_events_from_local_cache(
         self, events: Iterable[str], update_metrics: bool = True
-    ) -> Dict[str, EventCacheEntry]:
+    ) -> dict[str, EventCacheEntry]:
         """Fetch events from the local, in memory, caches.
 
         May return rejected events.
@@ -1062,7 +1068,15 @@ class EventsWorkerStore(SQLBaseStore):
         """
         event_map = {}
 
+        i = 0
         for event_id in events:
+            i += 1
+
+            # Yield to the reactor to allow other things to be processed,
+            # otherwise we can end up tight looping.
+            if i % ITERATIONS_BEFORE_YIELDING == 0:
+                await self.clock.sleep(Duration(seconds=0))
+
             # First check if it's in the event cache
             ret = self._get_event_cache.get_local(
                 (event_id,), None, update_metrics=update_metrics
@@ -1094,8 +1108,8 @@ class EventsWorkerStore(SQLBaseStore):
         self,
         context: EventContext,
         state_keys_to_include: StateFilter,
-        membership_user_id: Optional[str] = None,
-    ) -> List[JsonDict]:
+        membership_user_id: str | None = None,
+    ) -> list[JsonDict]:
         """
         Retrieve the stripped state from a room, given an event context to retrieve state
         from as well as the state types to include. Optionally, include the membership
@@ -1154,9 +1168,7 @@ class EventsWorkerStore(SQLBaseStore):
                 should_start = False
 
         if should_start:
-            run_as_background_process(
-                "fetch_events", self.server_name, self._fetch_thread
-            )
+            self.hs.run_as_background_process("fetch_events", self._fetch_thread)
 
     async def _fetch_thread(self) -> None:
         """Services requests for events from `_event_fetch_list`."""
@@ -1259,7 +1271,7 @@ class EventsWorkerStore(SQLBaseStore):
     def _fetch_event_list(
         self,
         conn: LoggingDatabaseConnection,
-        event_list: List[Tuple[Iterable[str], "defer.Deferred[Dict[str, _EventRow]]"]],
+        event_list: list[tuple[Iterable[str], "defer.Deferred[dict[str, _EventRow]]"]],
     ) -> None:
         """Handle a load of requests from the _event_fetch_list queue
 
@@ -1276,7 +1288,7 @@ class EventsWorkerStore(SQLBaseStore):
                 were not part of this request.
         """
         with Measure(
-            self._clock, name="_fetch_event_list", server_name=self.server_name
+            self.clock, name="_fetch_event_list", server_name=self.server_name
         ):
             try:
                 events_to_fetch = {
@@ -1314,7 +1326,7 @@ class EventsWorkerStore(SQLBaseStore):
     @trace
     async def _get_events_from_db(
         self, event_ids: Collection[str]
-    ) -> Dict[str, EventCacheEntry]:
+    ) -> dict[str, EventCacheEntry]:
         """Fetch a bunch of events from the database.
 
         May return rejected events.
@@ -1335,8 +1347,8 @@ class EventsWorkerStore(SQLBaseStore):
             str(len(event_ids)),
         )
 
-        fetched_event_ids: Set[str] = set()
-        fetched_events: Dict[str, _EventRow] = {}
+        fetched_event_ids: set[str] = set()
+        fetched_events: dict[str, _EventRow] = {}
 
         @trace
         async def _fetch_event_ids_and_get_outstanding_redactions(
@@ -1352,14 +1364,20 @@ class EventsWorkerStore(SQLBaseStore):
             )
             row_map = await self._enqueue_events(event_ids_to_fetch)
 
-            # we need to recursively fetch any redactions of those events
-            redaction_ids: Set[str] = set()
+            # we need to recursively fetch redaction events that require
+            # rechecking, so we can validate them
+            redaction_ids: set[str] = set()
             for event_id in event_ids_to_fetch:
                 row = row_map.get(event_id)
                 fetched_event_ids.add(event_id)
                 if row:
                     fetched_events[event_id] = row
-                    redaction_ids.update(row.redactions)
+
+                    # If this event only has unconfirmed redactions we fetch
+                    # them from the DB so that we check them to see if any are
+                    # valid.
+                    if not row.confirmed_redactions:
+                        redaction_ids.update(row.unconfirmed_redactions)
 
             event_ids_to_fetch = redaction_ids.difference(fetched_event_ids)
             return event_ids_to_fetch
@@ -1380,8 +1398,16 @@ class EventsWorkerStore(SQLBaseStore):
                 )
 
         # build a map from event_id to EventBase
-        event_map: Dict[str, EventBase] = {}
+        event_map: dict[str, EventBase] = {}
+        i = 0
         for event_id, row in fetched_events.items():
+            i += 1
+
+            # Yield to the reactor to allow other things to be processed,
+            # otherwise we can end up tight looping.
+            if i % ITERATIONS_BEFORE_YIELDING == 0:
+                await self.clock.sleep(Duration(seconds=0))
+
             assert row.event_id == event_id
 
             rejected_reason = row.rejected_reason
@@ -1409,7 +1435,7 @@ class EventsWorkerStore(SQLBaseStore):
 
             room_version_id = row.room_version_id
 
-            room_version: Optional[RoomVersion]
+            room_version: RoomVersion | None
             if not room_version_id:
                 # this should only happen for out-of-band membership events which
                 # arrived before https://github.com/matrix-org/synapse/issues/6983
@@ -1493,11 +1519,14 @@ class EventsWorkerStore(SQLBaseStore):
 
         # finally, we can decide whether each one needs redacting, and build
         # the cache entries.
-        result_map: Dict[str, EventCacheEntry] = {}
+        result_map: dict[str, EventCacheEntry] = {}
         for event_id, original_ev in event_map.items():
-            redactions = fetched_events[event_id].redactions
+            row = fetched_events[event_id]
             redacted_event = self._maybe_redact_event_row(
-                original_ev, redactions, event_map
+                original_ev,
+                row.unconfirmed_redactions,
+                row.confirmed_redactions,
+                event_map,
             )
 
             cache_entry = EventCacheEntry(
@@ -1513,7 +1542,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         return result_map
 
-    async def _enqueue_events(self, events: Collection[str]) -> Dict[str, _EventRow]:
+    async def _enqueue_events(self, events: Collection[str]) -> dict[str, _EventRow]:
         """Fetches events from the database using the _event_fetch_list. This
         allows batch and bulk fetching of events - it allows us to fetch events
         without having to create a new transaction for each request for events.
@@ -1526,7 +1555,7 @@ class EventsWorkerStore(SQLBaseStore):
             that weren't requested.
         """
 
-        events_d: "defer.Deferred[Dict[str, _EventRow]]" = defer.Deferred()
+        events_d: "defer.Deferred[dict[str, _EventRow]]" = defer.Deferred()
         with self._event_fetch_lock:
             self._event_fetch_list.append((events, events_d))
             self._event_fetch_lock.notify()
@@ -1542,7 +1571,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     def _fetch_event_rows(
         self, txn: LoggingTransaction, event_ids: Iterable[str]
-    ) -> Dict[str, _EventRow]:
+    ) -> dict[str, _EventRow]:
         """Fetch event rows from the database
 
         Events which are not found are omitted from the result.
@@ -1591,34 +1620,41 @@ class EventsWorkerStore(SQLBaseStore):
                     format_version=row[5],
                     room_version_id=row[6],
                     rejected_reason=row[7],
-                    redactions=[],
+                    unconfirmed_redactions=[],
+                    confirmed_redactions=[],
                     outlier=bool(row[8]),  # This is an int in SQLite3
                 )
 
             # check for redactions
-            redactions_sql = "SELECT event_id, redacts FROM redactions WHERE "
+            redactions_sql = "SELECT event_id, redacts, recheck FROM redactions WHERE "
 
             clause, args = make_in_list_sql_clause(txn.database_engine, "redacts", evs)
 
             txn.execute(redactions_sql + clause, args)
 
-            for redacter, redacted in txn:
+            for redacter, redacted, recheck in txn:
                 d = event_dict.get(redacted)
                 if d:
-                    d.redactions.append(redacter)
+                    if recheck:
+                        d.unconfirmed_redactions.append(redacter)
+                    else:
+                        d.confirmed_redactions.append(redacter)
 
-            # check for MSC4932 redactions
+            # check for MSC4293 redactions
             to_check = []
-            events: List[_EventRow] = []
+            events: list[_EventRow] = []
             for e in evs:
-                event = event_dict.get(e)
-                if not event:
-                    continue
-                events.append(event)
-                event_json = json.loads(event.json)
-                room_id = event_json.get("room_id")
-                user_id = event_json.get("sender")
-                to_check.append((room_id, user_id))
+                try:
+                    event = event_dict.get(e)
+                    if not event:
+                        continue
+                    events.append(event)
+                    event_json = json.loads(event.json)
+                    room_id = event_json.get("room_id")
+                    user_id = event_json.get("sender")
+                    to_check.append((room_id, user_id))
+                except Exception as exc:
+                    raise InvalidEventError(f"Invalid event {event_id}") from exc
 
             # likely that some of these events may be for the same room/user combo, in
             # which case we don't need to do redundant queries
@@ -1651,24 +1687,28 @@ class EventsWorkerStore(SQLBaseStore):
                         # backfilled events, as they have a negative stream ordering
                         if e_row.stream_ordering >= redact_end_ordering:
                             continue
-                    e_row.redactions.append(redacting_event_id)
+                    e_row.unconfirmed_redactions.append(redacting_event_id)
         return event_dict
 
     def _maybe_redact_event_row(
         self,
         original_ev: EventBase,
-        redactions: Iterable[str],
-        event_map: Dict[str, EventBase],
-    ) -> Optional[EventBase]:
-        """Given an event object and a list of possible redacting event ids,
+        unconfirmed_redactions: Iterable[str],
+        confirmed_redactions: Iterable[str],
+        event_map: dict[str, EventBase],
+    ) -> EventBase | None:
+        """Given an event object and lists of possible redacting event ids,
         determine whether to honour any of those redactions and if so return a redacted
         event.
 
         Args:
              original_ev: The original event.
-             redactions: list of event ids of potential redaction events
+             unconfirmed_redactions: list of event ids of redaction events that need
+                domain rechecking (room v3+).
+             confirmed_redactions: list of event ids of redaction events that have
+                already been validated and do not need rechecking.
              event_map: other events which have been fetched, in which we can
-                look up the redaaction events. Map from event id to event.
+                look up the redaction events. Map from event id to event.
 
         Returns:
             If the event should be redacted, a pruned event object. Otherwise, None.
@@ -1677,7 +1717,12 @@ class EventsWorkerStore(SQLBaseStore):
             # we choose to ignore redactions of m.room.create events.
             return None
 
-        for redaction_id in redactions:
+        for redaction_id in confirmed_redactions:
+            redacted_event = prune_event(original_ev)
+            redacted_event.internal_metadata.redacted_by = redaction_id
+            return redacted_event
+
+        for redaction_id in unconfirmed_redactions:
             redaction_event = event_map.get(redaction_id)
             if not redaction_event or redaction_event.rejected_reason:
                 # we don't have the redaction event, or the redaction event was not
@@ -1718,23 +1763,21 @@ class EventsWorkerStore(SQLBaseStore):
 
             # we found a good redaction event. Redact!
             redacted_event = prune_event(original_ev)
-            redacted_event.unsigned["redacted_by"] = redaction_id
-
-            # It's fine to add the event directly, since get_pdu_json
-            # will serialise this field correctly
-            redacted_event.unsigned["redacted_because"] = redaction_event
+            redacted_event.internal_metadata.redacted_by = redaction_id
 
+            # Note: The `redacted_because` field will later be populated by
+            # `EventClientSerializer.serialize_event`.
             return redacted_event
 
         # no valid redaction found for this event
         return None
 
-    async def have_events_in_timeline(self, event_ids: Iterable[str]) -> Set[str]:
+    async def have_events_in_timeline(self, event_ids: Iterable[str]) -> set[str]:
         """Given a list of event ids, check if we have already processed and
         stored them as non outliers.
         """
         rows = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.db_pool.simple_select_many_batch(
                 table="events",
                 retcols=("event_id",),
@@ -1751,7 +1794,7 @@ class EventsWorkerStore(SQLBaseStore):
     @tag_args
     async def have_seen_events(
         self, room_id: str, event_ids: Iterable[str]
-    ) -> Set[str]:
+    ) -> set[str]:
         """Given a list of event ids, check if we have already processed them.
 
         The room_id is only used to structure the cache (so that it can later be
@@ -1770,7 +1813,7 @@ class EventsWorkerStore(SQLBaseStore):
         # we break it down. However, each batch requires its own index scan, so we make
         # the batches as big as possible.
 
-        results: Set[str] = set()
+        results: set[str] = set()
         for event_ids_chunk in batch_iter(event_ids, 500):
             events_seen_dict = await self._have_seen_events_dict(
                 room_id, event_ids_chunk
@@ -1800,7 +1843,7 @@ class EventsWorkerStore(SQLBaseStore):
         #  not being invalidated when purging events from a room. The optimisation can
         #  be re-added after https://github.com/matrix-org/synapse/issues/13476
 
-        def have_seen_events_txn(txn: LoggingTransaction) -> Dict[str, bool]:
+        def have_seen_events_txn(txn: LoggingTransaction) -> dict[str, bool]:
             # we deliberately do *not* query the database for room_id, to make the
             # query an index-only lookup on `events_event_id_key`.
             #
@@ -1852,7 +1895,7 @@ class EventsWorkerStore(SQLBaseStore):
             room_id,
         )
 
-    async def get_room_complexity(self, room_id: str) -> Dict[str, float]:
+    async def get_room_complexity(self, room_id: str) -> dict[str, float]:
         """
         Get a rough approximation of the complexity of the room. This is used by
         remote servers to decide whether they wish to join the room or not.
@@ -1875,7 +1918,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_all_new_forward_event_rows(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> List[Tuple[int, str, str, str, str, str, str, str, bool, bool]]:
+    ) -> list[tuple[int, str, str, str, str, str, str, str, bool, bool]]:
         """Returns new events, for the Events replication stream
 
         Args:
@@ -1891,7 +1934,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         def get_all_new_forward_event_rows(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str, str, str, str, str, str, bool, bool]]:
+        ) -> list[tuple[int, str, str, str, str, str, str, str, bool, bool]]:
             sql = (
                 "SELECT e.stream_ordering, e.event_id, e.room_id, e.type,"
                 " se.state_key, redacts, relates_to_id, membership, rejections.reason IS NOT NULL,"
@@ -1909,7 +1952,7 @@ class EventsWorkerStore(SQLBaseStore):
             )
             txn.execute(sql, (last_id, current_id, instance_name, limit))
             return cast(
-                List[Tuple[int, str, str, str, str, str, str, str, bool, bool]],
+                list[tuple[int, str, str, str, str, str, str, str, bool, bool]],
                 txn.fetchall(),
             )
 
@@ -1919,7 +1962,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_ex_outlier_stream_rows(
         self, instance_name: str, last_id: int, current_id: int
-    ) -> List[Tuple[int, str, str, str, str, str, str, str, bool, bool]]:
+    ) -> list[tuple[int, str, str, str, str, str, str, str, bool, bool]]:
         """Returns de-outliered events, for the Events replication stream
 
         Args:
@@ -1934,7 +1977,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         def get_ex_outlier_stream_rows_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str, str, str, str, str, str, bool, bool]]:
+        ) -> list[tuple[int, str, str, str, str, str, str, str, bool, bool]]:
             sql = (
                 "SELECT out.event_stream_ordering, e.event_id, e.room_id, e.type,"
                 " se.state_key, redacts, relates_to_id, membership, rejections.reason IS NOT NULL,"
@@ -1956,7 +1999,7 @@ class EventsWorkerStore(SQLBaseStore):
 
             txn.execute(sql, (last_id, current_id, instance_name))
             return cast(
-                List[Tuple[int, str, str, str, str, str, str, str, bool, bool]],
+                list[tuple[int, str, str, str, str, str, str, str, bool, bool]],
                 txn.fetchall(),
             )
 
@@ -1966,7 +2009,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_all_new_backfill_event_rows(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, Tuple[str, str, str, str, str, str]]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple[str, str, str, str, str, str]]], int, bool]:
         """Get updates for backfill replication stream, including all new
         backfilled events and events that have gone from being outliers to not.
 
@@ -1996,7 +2039,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         def get_all_new_backfill_event_rows(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, Tuple[str, str, str, str, str, str]]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple[str, str, str, str, str, str]]], int, bool]:
             sql = (
                 "SELECT -e.stream_ordering, e.event_id, e.room_id, e.type,"
                 " se.state_key, redacts, relates_to_id"
@@ -2010,10 +2053,10 @@ class EventsWorkerStore(SQLBaseStore):
                 " LIMIT ?"
             )
             txn.execute(sql, (-last_id, -current_id, instance_name, limit))
-            new_event_updates: List[
-                Tuple[int, Tuple[str, str, str, str, str, str]]
+            new_event_updates: list[
+                tuple[int, tuple[str, str, str, str, str, str]]
             ] = []
-            row: Tuple[int, str, str, str, str, str, str]
+            row: tuple[int, str, str, str, str, str, str]
             # Type safety: iterating over `txn` yields `Tuple`, i.e.
             # `Tuple[Any, ...]` of arbitrary length. Mypy detects assigning a
             # variadic tuple to a fixed length tuple and flags it up as an error.
@@ -2059,7 +2102,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_all_updated_current_state_deltas(
         self, instance_name: str, from_token: int, to_token: int, target_row_count: int
-    ) -> Tuple[List[Tuple[int, str, str, str, str]], int, bool]:
+    ) -> tuple[list[tuple[int, str, str, str, str]], int, bool]:
         """Fetch updates from current_state_delta_stream
 
         Args:
@@ -2081,7 +2124,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         def get_all_updated_current_state_deltas_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str, str, str]]:
+        ) -> list[tuple[int, str, str, str, str]]:
             sql = """
                 SELECT stream_id, room_id, type, state_key, event_id
                 FROM current_state_delta_stream
@@ -2090,23 +2133,23 @@ class EventsWorkerStore(SQLBaseStore):
                 ORDER BY stream_id ASC LIMIT ?
             """
             txn.execute(sql, (from_token, to_token, instance_name, target_row_count))
-            return cast(List[Tuple[int, str, str, str, str]], txn.fetchall())
+            return cast(list[tuple[int, str, str, str, str]], txn.fetchall())
 
         def get_deltas_for_stream_id_txn(
             txn: LoggingTransaction, stream_id: int
-        ) -> List[Tuple[int, str, str, str, str]]:
+        ) -> list[tuple[int, str, str, str, str]]:
             sql = """
                 SELECT stream_id, room_id, type, state_key, event_id
                 FROM current_state_delta_stream
                 WHERE stream_id = ?
             """
             txn.execute(sql, [stream_id])
-            return cast(List[Tuple[int, str, str, str, str]], txn.fetchall())
+            return cast(list[tuple[int, str, str, str, str]], txn.fetchall())
 
         # we need to make sure that, for every stream id in the results, we get *all*
         # the rows with that stream id.
 
-        rows: List[Tuple[int, str, str, str, str]] = await self.db_pool.runInteraction(
+        rows: list[tuple[int, str, str, str, str]] = await self.db_pool.runInteraction(
             "get_all_updated_current_state_deltas",
             get_all_updated_current_state_deltas_txn,
         )
@@ -2135,8 +2178,41 @@ class EventsWorkerStore(SQLBaseStore):
 
         return rows, to_token, True
 
+    async def get_senders_for_event_ids(
+        self, event_ids: Collection[str]
+    ) -> dict[str, str | None]:
+        """
+        Given a sequence of event IDs, return the sender associated with each.
+
+        Args:
+            event_ids: A collection of event IDs as strings.
+
+        Returns:
+            A dict of event ID -> sender of the event.
+
+        If a given event ID does not exist in the `events` table, then no entry
+        for that event ID will be returned.
+        """
+
+        def _get_senders_for_event_ids(
+            txn: LoggingTransaction,
+        ) -> dict[str, str | None]:
+            rows = self.db_pool.simple_select_many_txn(
+                txn=txn,
+                table="events",
+                column="event_id",
+                iterable=event_ids,
+                keyvalues={},
+                retcols=["event_id", "sender"],
+            )
+            return dict(rows)
+
+        return await self.db_pool.runInteraction(
+            "get_senders_for_event_ids", _get_senders_for_event_ids
+        )
+
     @cached(max_entries=5000)
-    async def get_event_ordering(self, event_id: str, room_id: str) -> Tuple[int, int]:
+    async def get_event_ordering(self, event_id: str, room_id: str) -> tuple[int, int]:
         res = await self.db_pool.simple_select_one(
             table="events",
             retcols=["topological_ordering", "stream_ordering"],
@@ -2151,7 +2227,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         return int(res[0]), int(res[1])
 
-    async def get_next_event_to_expire(self) -> Optional[Tuple[str, int]]:
+    async def get_next_event_to_expire(self) -> tuple[str, int] | None:
         """Retrieve the entry with the lowest expiry timestamp in the event_expiry
         table, or None if there's no more event to expire.
 
@@ -2163,7 +2239,7 @@ class EventsWorkerStore(SQLBaseStore):
 
         def get_next_event_to_expire_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Tuple[str, int]]:
+        ) -> tuple[str, int] | None:
             txn.execute(
                 """
                 SELECT event_id, expiry_ts FROM event_expiry
@@ -2171,7 +2247,7 @@ class EventsWorkerStore(SQLBaseStore):
                 """
             )
 
-            return cast(Optional[Tuple[str, int]], txn.fetchone())
+            return cast(tuple[str, int] | None, txn.fetchone())
 
         return await self.db_pool.runInteraction(
             desc="get_next_event_to_expire", func=get_next_event_to_expire_txn
@@ -2179,7 +2255,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_event_id_from_transaction_id_and_device_id(
         self, room_id: str, user_id: str, device_id: str, txn_id: str
-    ) -> Optional[str]:
+    ) -> str | None:
         """Look up if we have already persisted an event for the transaction ID,
         returning the event ID if so.
         """
@@ -2198,7 +2274,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_already_persisted_events(
         self, events: Iterable[EventBase]
-    ) -> Dict[str, str]:
+    ) -> dict[str, str]:
         """Look up if we have already persisted an event for the transaction ID,
         returning a mapping from event ID in the given list to the event ID of
         an existing event.
@@ -2208,7 +2284,7 @@ class EventsWorkerStore(SQLBaseStore):
         """
 
         mapping = {}
-        txn_id_to_event: Dict[Tuple[str, str, str, str], str] = {}
+        txn_id_to_event: dict[tuple[str, str, str, str], str] = {}
 
         for event in events:
             device_id = getattr(event.internal_metadata, "device_id", None)
@@ -2245,7 +2321,7 @@ class EventsWorkerStore(SQLBaseStore):
         """Cleans out transaction id mappings older than 24hrs."""
 
         def _cleanup_old_transaction_ids_txn(txn: LoggingTransaction) -> None:
-            one_day_ago = self._clock.time_msec() - 24 * 60 * 60 * 1000
+            one_day_ago = self.clock.time_msec() - 24 * 60 * 60 * 1000
             sql = """
                 DELETE FROM event_txn_id_device_id
                 WHERE inserted_ts < ?
@@ -2400,7 +2476,7 @@ class EventsWorkerStore(SQLBaseStore):
 
     async def get_event_id_for_timestamp(
         self, room_id: str, timestamp: int, direction: Direction
-    ) -> Optional[str]:
+    ) -> str | None:
         """Find the closest event to the given timestamp in the given direction.
 
         Args:
@@ -2454,7 +2530,7 @@ class EventsWorkerStore(SQLBaseStore):
             LIMIT 1;
         """
 
-        def get_event_id_for_timestamp_txn(txn: LoggingTransaction) -> Optional[str]:
+        def get_event_id_for_timestamp_txn(txn: LoggingTransaction) -> str | None:
             txn.execute(
                 sql_template,
                 (room_id, timestamp),
@@ -2485,7 +2561,7 @@ class EventsWorkerStore(SQLBaseStore):
             any of the events which are unknown (or are outliers).
         """
         result = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.db_pool.simple_select_many_batch(
                 table="partial_state_events",
                 column="event_id",
@@ -2510,7 +2586,7 @@ class EventsWorkerStore(SQLBaseStore):
         )
         return result is not None
 
-    async def get_partial_state_events_batch(self, room_id: str) -> List[str]:
+    async def get_partial_state_events_batch(self, room_id: str) -> list[str]:
         """
         Get a list of events in the given room that:
         - have partial state; and
@@ -2529,7 +2605,7 @@ class EventsWorkerStore(SQLBaseStore):
     @staticmethod
     def _get_partial_state_events_batch_txn(
         txn: LoggingTransaction, room_id: str
-    ) -> List[str]:
+    ) -> list[str]:
         # we want to work through the events from oldest to newest, so
         # we only want events whose prev_events do *not* have partial state - hence
         # the 'NOT EXISTS' clause in the below.
@@ -2564,7 +2640,7 @@ class EventsWorkerStore(SQLBaseStore):
         self,
         txn: LoggingTransaction,
         event_id: str,
-        rejection_reason: Optional[str],
+        rejection_reason: str | None,
     ) -> None:
         """Mark an event that was previously accepted as rejected, or vice versa
 
@@ -2600,7 +2676,7 @@ class EventsWorkerStore(SQLBaseStore):
                 keyvalues={"event_id": event_id},
                 values={
                     "reason": rejection_reason,
-                    "last_check": self._clock.time_msec(),
+                    "last_check": self.clock.time_msec(),
                 },
             )
         self.db_pool.simple_update_txn(
@@ -2613,8 +2689,8 @@ class EventsWorkerStore(SQLBaseStore):
         self.invalidate_get_event_cache_after_txn(txn, event_id)
 
     async def get_events_sent_by_user_in_room(
-        self, user_id: str, room_id: str, limit: int, filter: Optional[List[str]] = None
-    ) -> Optional[List[str]]:
+        self, user_id: str, room_id: str, limit: int, filter: list[str] | None = None
+    ) -> list[str] | None:
         """
         Get a list of event ids of events sent by the user in the specified room
 
@@ -2629,10 +2705,10 @@ class EventsWorkerStore(SQLBaseStore):
             txn: LoggingTransaction,
             user_id: str,
             room_id: str,
-            filter: Optional[List[str]],
+            filter: list[str] | None,
             batch_size: int,
             offset: int,
-        ) -> Tuple[Optional[List[str]], int]:
+        ) -> tuple[list[str] | None, int]:
             if filter:
                 base_clause, args = make_in_list_sql_clause(
                     txn.database_engine, "type", filter
@@ -2665,7 +2741,7 @@ class EventsWorkerStore(SQLBaseStore):
         if batch_size > limit:
             batch_size = limit
 
-        selected_ids: List[str] = []
+        selected_ids: list[str] = []
         while offset < limit:
             res, offset = await self.db_pool.runInteraction(
                 "get_events_by_user",
@@ -2740,7 +2816,7 @@ class EventsWorkerStore(SQLBaseStore):
     @cached(tree=True)
     async def get_metadata_for_event(
         self, room_id: str, event_id: str
-    ) -> Optional[EventMetadata]:
+    ) -> EventMetadata | None:
         row = await self.db_pool.simple_select_one(
             table="events",
             keyvalues={"room_id": room_id, "event_id": event_id},
diff --git a/synapse/storage/databases/main/experimental_features.py b/synapse/storage/databases/main/experimental_features.py
index d980c57fa8..77b6c36884 100644
--- a/synapse/storage/databases/main/experimental_features.py
+++ b/synapse/storage/databases/main/experimental_features.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import TYPE_CHECKING, Dict, FrozenSet, List, Tuple, cast
+from typing import TYPE_CHECKING, cast
 
 from synapse.storage.database import (
     DatabasePool,
@@ -44,7 +44,7 @@ class ExperimentalFeaturesStore(CacheInvalidationWorkerStore):
         super().__init__(database, db_conn, hs)
 
     @cached()
-    async def list_enabled_features(self, user_id: str) -> FrozenSet[str]:
+    async def list_enabled_features(self, user_id: str) -> frozenset[str]:
         """
         Checks to see what features are enabled for a given user
         Args:
@@ -54,7 +54,7 @@ class ExperimentalFeaturesStore(CacheInvalidationWorkerStore):
             the features currently enabled for the user
         """
         enabled = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.db_pool.simple_select_list(
                 table="per_user_experimental_features",
                 keyvalues={"user_id": user_id, "enabled": True},
@@ -67,7 +67,7 @@ class ExperimentalFeaturesStore(CacheInvalidationWorkerStore):
     async def set_features_for_user(
         self,
         user: str,
-        features: Dict["ExperimentalFeature", bool],
+        features: dict["ExperimentalFeature", bool],
     ) -> None:
         """
         Enables or disables features for a given user
diff --git a/synapse/storage/databases/main/filtering.py b/synapse/storage/databases/main/filtering.py
index af9634bad4..2019ad9904 100644
--- a/synapse/storage/databases/main/filtering.py
+++ b/synapse/storage/databases/main/filtering.py
@@ -20,7 +20,7 @@
 #
 #
 
-from typing import TYPE_CHECKING, Optional, Tuple, Union, cast
+from typing import TYPE_CHECKING, cast
 
 from canonicaljson import encode_canonical_json
 
@@ -72,7 +72,7 @@ class FilteringWorkerStore(SQLBaseStore):
 
         lower_bound_id = progress.get("lower_bound_id", "")
 
-        def _get_last_id(txn: LoggingTransaction) -> Optional[str]:
+        def _get_last_id(txn: LoggingTransaction) -> str | None:
             sql = """
                     SELECT user_id FROM user_filters
                     WHERE user_id > ?
@@ -151,7 +151,7 @@ class FilteringWorkerStore(SQLBaseStore):
 
     @cached(num_args=2)
     async def get_user_filter(
-        self, user_id: UserID, filter_id: Union[int, str]
+        self, user_id: UserID, filter_id: int | str
     ) -> JsonMapping:
         # filter_id is BIGINT UNSIGNED, so if it isn't a number, fail
         # with a coherent error message rather than 500 M_UNKNOWN.
@@ -187,7 +187,7 @@ class FilteringWorkerStore(SQLBaseStore):
 
             sql = "SELECT MAX(filter_id) FROM user_filters WHERE full_user_id = ?"
             txn.execute(sql, (user_id.to_string(),))
-            max_id = cast(Tuple[Optional[int]], txn.fetchone())[0]
+            max_id = cast(tuple[int | None], txn.fetchone())[0]
             if max_id is None:
                 filter_id = 0
             else:
diff --git a/synapse/storage/databases/main/keys.py b/synapse/storage/databases/main/keys.py
index 2a99a97dd6..f81257b5a1 100644
--- a/synapse/storage/databases/main/keys.py
+++ b/synapse/storage/databases/main/keys.py
@@ -22,7 +22,7 @@
 import itertools
 import json
 import logging
-from typing import Dict, Iterable, List, Mapping, Optional, Tuple, Union, cast
+from typing import Iterable, Mapping, cast
 
 from canonicaljson import encode_canonical_json
 from signedjson.key import decode_verify_key_bytes
@@ -50,7 +50,7 @@ class KeyStore(CacheInvalidationWorkerStore):
         server_name: str,
         from_server: str,
         ts_added_ms: int,
-        verify_keys: Dict[str, FetchKeyResult],
+        verify_keys: dict[str, FetchKeyResult],
         response_json: JsonDict,
     ) -> None:
         """Stores the keys for the given server that we got from `from_server`.
@@ -130,7 +130,7 @@ class KeyStore(CacheInvalidationWorkerStore):
 
     @cached()
     def _get_server_keys_json(
-        self, server_name_and_key_id: Tuple[str, str]
+        self, server_name_and_key_id: tuple[str, str]
     ) -> FetchKeyResult:
         raise NotImplementedError()
 
@@ -138,8 +138,8 @@ class KeyStore(CacheInvalidationWorkerStore):
         cached_method_name="_get_server_keys_json", list_name="server_name_and_key_ids"
     )
     async def get_server_keys_json(
-        self, server_name_and_key_ids: Iterable[Tuple[str, str]]
-    ) -> Mapping[Tuple[str, str], FetchKeyResult]:
+        self, server_name_and_key_ids: Iterable[tuple[str, str]]
+    ) -> Mapping[tuple[str, str], FetchKeyResult]:
         """
         Args:
             server_name_and_key_ids:
@@ -151,7 +151,7 @@ class KeyStore(CacheInvalidationWorkerStore):
         """
         keys = {}
 
-        def _get_keys(txn: Cursor, batch: Tuple[Tuple[str, str], ...]) -> None:
+        def _get_keys(txn: Cursor, batch: tuple[tuple[str, str], ...]) -> None:
             """Processes a batch of keys to fetch, and adds the result to `keys`."""
 
             # batch_iter always returns tuples so it's safe to do len(batch)
@@ -189,7 +189,7 @@ class KeyStore(CacheInvalidationWorkerStore):
                     valid_until_ts=ts_valid_until_ms,
                 )
 
-        def _txn(txn: Cursor) -> Dict[Tuple[str, str], FetchKeyResult]:
+        def _txn(txn: Cursor) -> dict[tuple[str, str], FetchKeyResult]:
             for batch in batch_iter(server_name_and_key_ids, 50):
                 _get_keys(txn, batch)
             return keys
@@ -201,7 +201,7 @@ class KeyStore(CacheInvalidationWorkerStore):
         self,
         server_name: str,
         key_id: str,
-    ) -> Optional[FetchKeyResultForRemote]:
+    ) -> FetchKeyResultForRemote | None:
         raise NotImplementedError()
 
     @cachedList(
@@ -209,13 +209,13 @@ class KeyStore(CacheInvalidationWorkerStore):
     )
     async def get_server_keys_json_for_remote(
         self, server_name: str, key_ids: Iterable[str]
-    ) -> Mapping[str, Optional[FetchKeyResultForRemote]]:
+    ) -> Mapping[str, FetchKeyResultForRemote | None]:
         """Fetch the cached keys for the given server/key IDs.
 
         If we have multiple entries for a given key ID, returns the most recent.
         """
         rows = cast(
-            List[Tuple[str, str, int, int, Union[bytes, memoryview]]],
+            list[tuple[str, str, int, int, bytes | memoryview]],
             await self.db_pool.simple_select_many_batch(
                 table="server_keys_json",
                 column="key_id",
@@ -252,13 +252,13 @@ class KeyStore(CacheInvalidationWorkerStore):
     async def get_all_server_keys_json_for_remote(
         self,
         server_name: str,
-    ) -> Dict[str, FetchKeyResultForRemote]:
+    ) -> dict[str, FetchKeyResultForRemote]:
         """Fetch the cached keys for the given server.
 
         If we have multiple entries for a given key ID, returns the most recent.
         """
         rows = cast(
-            List[Tuple[str, str, int, int, Union[bytes, memoryview]]],
+            list[tuple[str, str, int, int, bytes | memoryview]],
             await self.db_pool.simple_select_list(
                 table="server_keys_json",
                 keyvalues={"server_name": server_name},
diff --git a/synapse/storage/databases/main/lock.py b/synapse/storage/databases/main/lock.py
index e733f65cb1..dd49f98366 100644
--- a/synapse/storage/databases/main/lock.py
+++ b/synapse/storage/databases/main/lock.py
@@ -21,14 +21,13 @@
 import logging
 from contextlib import AsyncExitStack
 from types import TracebackType
-from typing import TYPE_CHECKING, Collection, Optional, Set, Tuple, Type
+from typing import TYPE_CHECKING, Collection, Optional
 from weakref import WeakValueDictionary
 
 from twisted.internet import defer
 from twisted.internet.task import LoopingCall
 
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.storage._base import SQLBaseStore
@@ -38,7 +37,8 @@ from synapse.storage.database import (
     LoggingTransaction,
 )
 from synapse.types import ISynapseReactor
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.stringutils import random_string
 
 if TYPE_CHECKING:
@@ -50,11 +50,13 @@ logger = logging.getLogger(__name__)
 
 # How often to renew an acquired lock by updating the `last_renewed_ts` time in
 # the lock table.
-_RENEWAL_INTERVAL_MS = 30 * 1000
+_RENEWAL_INTERVAL = Duration(seconds=30)
 
 # How long before an acquired lock times out.
 _LOCK_TIMEOUT_MS = 2 * 60 * 1000
 
+_LOCK_REAP_INTERVAL = Duration(milliseconds=_LOCK_TIMEOUT_MS / 10.0)
+
 
 class LockStore(SQLBaseStore):
     """Provides a best effort distributed lock between worker instances.
@@ -83,7 +85,7 @@ class LockStore(SQLBaseStore):
 
         # A map from `(lock_name, lock_key)` to lock that we think we
         # currently hold.
-        self._live_lock_tokens: WeakValueDictionary[Tuple[str, str], Lock] = (
+        self._live_lock_tokens: WeakValueDictionary[tuple[str, str], Lock] = (
             WeakValueDictionary()
         )
 
@@ -92,24 +94,22 @@ class LockStore(SQLBaseStore):
         # multiple read locks at a time but only one write lock (no mixing read
         # and write locks at the same time).
         self._live_read_write_lock_tokens: WeakValueDictionary[
-            Tuple[str, str, str], Lock
+            tuple[str, str, str], Lock
         ] = WeakValueDictionary()
 
         # When we shut down we want to remove the locks. Technically this can
         # lead to a race, as we may drop the lock while we are still processing.
         # However, a) it should be a small window, b) the lock is best effort
         # anyway and c) we want to really avoid leaking locks when we restart.
-        hs.get_reactor().addSystemEventTrigger(
-            "before",
-            "shutdown",
-            self._on_shutdown,
+        hs.register_async_shutdown_handler(
+            phase="before",
+            eventType="shutdown",
+            shutdown_func=self._on_shutdown,
         )
 
-        self._acquiring_locks: Set[Tuple[str, str]] = set()
+        self._acquiring_locks: set[tuple[str, str]] = set()
 
-        self._clock.looping_call(
-            self._reap_stale_read_write_locks, _LOCK_TIMEOUT_MS / 10.0
-        )
+        self.clock.looping_call(self._reap_stale_read_write_locks, _LOCK_REAP_INTERVAL)
 
     @wrap_as_background_process("LockStore._on_shutdown")
     async def _on_shutdown(self) -> None:
@@ -153,7 +153,7 @@ class LockStore(SQLBaseStore):
         if lock and await lock.is_still_valid():
             return None
 
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
         token = random_string(6)
 
         def _try_acquire_lock_txn(txn: LoggingTransaction) -> bool:
@@ -202,7 +202,8 @@ class LockStore(SQLBaseStore):
         lock = Lock(
             self.server_name,
             self._reactor,
-            self._clock,
+            self.hs,
+            self.clock,
             self,
             read_write=False,
             lock_name=lock_name,
@@ -251,7 +252,7 @@ class LockStore(SQLBaseStore):
         # constraints. If it doesn't then we have acquired the lock,
         # otherwise we haven't.
 
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
         token = random_string(6)
 
         self.db_pool.simple_insert_txn(
@@ -270,7 +271,8 @@ class LockStore(SQLBaseStore):
         lock = Lock(
             self.server_name,
             self._reactor,
-            self._clock,
+            self.hs,
+            self.clock,
             self,
             read_write=True,
             lock_name=lock_name,
@@ -287,9 +289,9 @@ class LockStore(SQLBaseStore):
 
     async def try_acquire_multi_read_write_lock(
         self,
-        lock_names: Collection[Tuple[str, str]],
+        lock_names: Collection[tuple[str, str]],
         write: bool,
-    ) -> Optional[AsyncExitStack]:
+    ) -> AsyncExitStack | None:
         """Try to acquire multiple locks for the given names/keys. Will return
         an async context manager if the locks are successfully acquired, which
         *must* be used (otherwise the lock will leak).
@@ -317,7 +319,7 @@ class LockStore(SQLBaseStore):
     def _try_acquire_multi_read_write_lock_txn(
         self,
         txn: LoggingTransaction,
-        lock_names: Collection[Tuple[str, str]],
+        lock_names: Collection[tuple[str, str]],
         write: bool,
     ) -> Collection["Lock"]:
         locks = []
@@ -338,7 +340,7 @@ class LockStore(SQLBaseStore):
         """
 
         def reap_stale_read_write_locks_txn(txn: LoggingTransaction) -> None:
-            txn.execute(delete_sql, (self._clock.time_msec() - _LOCK_TIMEOUT_MS,))
+            txn.execute(delete_sql, (self.clock.time_msec() - _LOCK_TIMEOUT_MS,))
             if txn.rowcount:
                 logger.info("Reaped %d stale locks", txn.rowcount)
 
@@ -374,6 +376,7 @@ class Lock:
         self,
         server_name: str,
         reactor: ISynapseReactor,
+        hs: "HomeServer",
         clock: Clock,
         store: LockStore,
         read_write: bool,
@@ -387,6 +390,7 @@ class Lock:
         """
         self._server_name = server_name
         self._reactor = reactor
+        self._hs = hs
         self._clock = clock
         self._store = store
         self._read_write = read_write
@@ -399,7 +403,7 @@ class Lock:
 
         # We might be called from a non-main thread, so we defer setting up the
         # looping call.
-        self._looping_call: Optional[LoopingCall] = None
+        self._looping_call: LoopingCall | None = None
         reactor.callFromThread(self._setup_looping_call)
 
         self._dropped = False
@@ -407,9 +411,10 @@ class Lock:
     def _setup_looping_call(self) -> None:
         self._looping_call = self._clock.looping_call(
             self._renew,
-            _RENEWAL_INTERVAL_MS,
+            _RENEWAL_INTERVAL,
             self._server_name,
             self._store,
+            self._hs,
             self._clock,
             self._read_write,
             self._lock_name,
@@ -421,6 +426,7 @@ class Lock:
     def _renew(
         server_name: str,
         store: LockStore,
+        hs: "HomeServer",
         clock: Clock,
         read_write: bool,
         lock_name: str,
@@ -457,9 +463,8 @@ class Lock:
                 desc="renew_lock",
             )
 
-        return run_as_background_process(
+        return hs.run_as_background_process(
             "Lock._renew",
-            server_name,
             _internal_renew,
             store,
             clock,
@@ -493,9 +498,9 @@ class Lock:
 
     async def __aexit__(
         self,
-        _exctype: Optional[Type[BaseException]],
-        _excinst: Optional[BaseException],
-        _exctb: Optional[TracebackType],
+        _exctype: type[BaseException] | None,
+        _excinst: BaseException | None,
+        _exctb: TracebackType | None,
     ) -> bool:
         await self.release()
 
diff --git a/synapse/storage/databases/main/media_repository.py b/synapse/storage/databases/main/media_repository.py
index f726846e57..50664d63e5 100644
--- a/synapse/storage/databases/main/media_repository.py
+++ b/synapse/storage/databases/main/media_repository.py
@@ -25,10 +25,6 @@ from typing import (
     TYPE_CHECKING,
     Collection,
     Iterable,
-    List,
-    Optional,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -59,16 +55,16 @@ logger = logging.getLogger(__name__)
 class LocalMedia:
     media_id: str
     media_type: str
-    media_length: Optional[int]
+    media_length: int | None
     upload_name: str
     created_ts: int
-    url_cache: Optional[str]
+    url_cache: str | None
     last_access_ts: int
-    quarantined_by: Optional[str]
+    quarantined_by: str | None
     safe_from_quarantine: bool
-    user_id: Optional[str]
-    authenticated: Optional[bool]
-    sha256: Optional[str]
+    user_id: str | None
+    authenticated: bool | None
+    sha256: str | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -77,20 +73,20 @@ class RemoteMedia:
     media_id: str
     media_type: str
     media_length: int
-    upload_name: Optional[str]
+    upload_name: str | None
     filesystem_id: str
     created_ts: int
     last_access_ts: int
-    quarantined_by: Optional[str]
-    authenticated: Optional[bool]
-    sha256: Optional[str]
+    quarantined_by: str | None
+    authenticated: bool | None
+    sha256: str | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class UrlCache:
     response_code: int
     expires_ts: int
-    og: Union[str, bytes]
+    og: str | bytes
 
 
 class MediaSortOrder(Enum):
@@ -185,7 +181,7 @@ class MediaRepositoryBackgroundUpdateStore(SQLBaseStore):
         )
 
         if hs.config.media.can_load_media_repo:
-            self.unused_expiration_time: Optional[int] = (
+            self.unused_expiration_time: int | None = (
                 hs.config.media.unused_expiration_time
             )
         else:
@@ -226,7 +222,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         super().__init__(database, db_conn, hs)
         self.server_name: str = hs.hostname
 
-    async def get_local_media(self, media_id: str) -> Optional[LocalMedia]:
+    async def get_local_media(self, media_id: str) -> LocalMedia | None:
         """Get the metadata for a local piece of media
 
         Returns:
@@ -275,7 +271,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         user_id: str,
         order_by: str = MediaSortOrder.CREATED_TS.value,
         direction: Direction = Direction.FORWARDS,
-    ) -> Tuple[List[LocalMedia], int]:
+    ) -> tuple[list[LocalMedia], int]:
         """Get a paginated list of metadata for a local piece of media
         which an user_id has uploaded
 
@@ -292,7 +288,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
 
         def get_local_media_by_user_paginate_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[LocalMedia], int]:
+        ) -> tuple[list[LocalMedia], int]:
             # Set ordering
             order_by_column = MediaSortOrder(order_by).value
 
@@ -301,14 +297,14 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             else:
                 order = "ASC"
 
-            args: List[Union[str, int]] = [user_id]
+            args: list[str | int] = [user_id]
             sql = """
                 SELECT COUNT(*) as total_media
                 FROM local_media_repository
                 WHERE user_id = ?
             """
             txn.execute(sql, args)
-            count = cast(Tuple[int], txn.fetchone())[0]
+            count = cast(tuple[int], txn.fetchone())[0]
 
             sql = """
                 SELECT
@@ -365,7 +361,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         keep_profiles: bool,
         include_quarantined_media: bool,
         include_protected_media: bool,
-    ) -> List[str]:
+    ) -> list[str]:
         """
         Retrieve a list of media IDs from the local media store.
 
@@ -437,7 +433,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
                 AND NOT safe_from_quarantine
             """
 
-        def _get_local_media_ids_txn(txn: LoggingTransaction) -> List[str]:
+        def _get_local_media_ids_txn(txn: LoggingTransaction) -> list[str]:
             txn.execute(sql, (before_ts, before_ts, size_gt))
             return [row[0] for row in txn]
 
@@ -474,12 +470,12 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         media_id: str,
         media_type: str,
         time_now_ms: int,
-        upload_name: Optional[str],
+        upload_name: str | None,
         media_length: int,
         user_id: UserID,
-        url_cache: Optional[str] = None,
-        sha256: Optional[str] = None,
-        quarantined_by: Optional[str] = None,
+        url_cache: str | None = None,
+        sha256: str | None = None,
+        quarantined_by: str | None = None,
     ) -> None:
         if self.hs.config.media.enable_authenticated_media:
             authenticated = True
@@ -507,12 +503,12 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         self,
         media_id: str,
         media_type: str,
-        upload_name: Optional[str],
+        upload_name: str | None,
         media_length: int,
         user_id: UserID,
         sha256: str,
-        url_cache: Optional[str] = None,
-        quarantined_by: Optional[str] = None,
+        url_cache: str | None = None,
+        quarantined_by: str | None = None,
     ) -> None:
         updatevalues = {
             "media_type": media_type,
@@ -544,7 +540,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             desc="mark_local_media_as_safe",
         )
 
-    async def count_pending_media(self, user_id: UserID) -> Tuple[int, int]:
+    async def count_pending_media(self, user_id: UserID) -> tuple[int, int]:
         """Count the number of pending media for a user.
 
         Returns:
@@ -552,7 +548,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             expiration timestamp.
         """
 
-        def get_pending_media_txn(txn: LoggingTransaction) -> Tuple[int, int]:
+        def get_pending_media_txn(txn: LoggingTransaction) -> tuple[int, int]:
             sql = """
             SELECT COUNT(*), MIN(created_ts)
             FROM local_media_repository
@@ -565,7 +561,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
                 sql,
                 (
                     user_id.to_string(),
-                    self._clock.time_msec() - self.unused_expiration_time,
+                    self.clock.time_msec() - self.unused_expiration_time,
                 ),
             )
             row = txn.fetchone()
@@ -577,13 +573,13 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             "get_pending_media", get_pending_media_txn
         )
 
-    async def get_url_cache(self, url: str, ts: int) -> Optional[UrlCache]:
+    async def get_url_cache(self, url: str, ts: int) -> UrlCache | None:
         """Get the media_id and ts for a cached URL as of the given timestamp
         Returns:
             None if the URL isn't cached.
         """
 
-        def get_url_cache_txn(txn: LoggingTransaction) -> Optional[UrlCache]:
+        def get_url_cache_txn(txn: LoggingTransaction) -> UrlCache | None:
             # get the most recently cached result (relative to the given ts)
             sql = """
                 SELECT response_code, expires_ts, og
@@ -617,7 +613,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         self,
         url: str,
         response_code: int,
-        etag: Optional[str],
+        etag: str | None,
         expires_ts: int,
         og: str,
         media_id: str,
@@ -637,9 +633,9 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             desc="store_url_cache",
         )
 
-    async def get_local_media_thumbnails(self, media_id: str) -> List[ThumbnailInfo]:
+    async def get_local_media_thumbnails(self, media_id: str) -> list[ThumbnailInfo]:
         rows = cast(
-            List[Tuple[int, int, str, str, int]],
+            list[tuple[int, int, str, str, int]],
             await self.db_pool.simple_select_list(
                 "local_media_repository_thumbnails",
                 {"media_id": media_id},
@@ -685,7 +681,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
 
     async def get_cached_remote_media(
         self, origin: str, media_id: str
-    ) -> Optional[RemoteMedia]:
+    ) -> RemoteMedia | None:
         row = await self.db_pool.simple_select_one(
             "remote_media_cache",
             {"media_origin": origin, "media_id": media_id},
@@ -726,9 +722,9 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         media_type: str,
         media_length: int,
         time_now_ms: int,
-        upload_name: Optional[str],
+        upload_name: str | None,
         filesystem_id: str,
-        sha256: Optional[str],
+        sha256: str | None,
     ) -> None:
         if self.hs.config.media.enable_authenticated_media:
             authenticated = True
@@ -755,7 +751,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
     async def update_cached_last_access_time(
         self,
         local_media: Iterable[str],
-        remote_media: Iterable[Tuple[str, str]],
+        remote_media: Iterable[tuple[str, str]],
         time_ms: int,
     ) -> None:
         """Updates the last access time of the given media
@@ -793,9 +789,9 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
 
     async def get_remote_media_thumbnails(
         self, origin: str, media_id: str
-    ) -> List[ThumbnailInfo]:
+    ) -> list[ThumbnailInfo]:
         rows = cast(
-            List[Tuple[int, int, str, str, int]],
+            list[tuple[int, int, str, str, int]],
             await self.db_pool.simple_select_list(
                 "remote_media_cache_thumbnails",
                 {"media_origin": origin, "media_id": media_id},
@@ -824,7 +820,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
         t_width: int,
         t_height: int,
         t_type: str,
-    ) -> Optional[ThumbnailInfo]:
+    ) -> ThumbnailInfo | None:
         """Fetch the thumbnail info of given width, height and type."""
 
         row = await self.db_pool.simple_select_one(
@@ -881,7 +877,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
 
     async def get_remote_media_ids(
         self, before_ts: int, include_quarantined_media: bool
-    ) -> List[Tuple[str, str, str]]:
+    ) -> list[tuple[str, str, str]]:
         """
         Retrieve a list of server name, media ID tuples from the remote media cache.
 
@@ -911,7 +907,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             """
 
         return cast(
-            List[Tuple[str, str, str]],
+            list[tuple[str, str, str]],
             await self.db_pool.execute("get_remote_media_ids", sql, before_ts),
         )
 
@@ -932,7 +928,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             "delete_remote_media", delete_remote_media_txn
         )
 
-    async def get_expired_url_cache(self, now_ts: int) -> List[str]:
+    async def get_expired_url_cache(self, now_ts: int) -> list[str]:
         sql = (
             "SELECT media_id FROM local_media_repository_url_cache"
             " WHERE expires_ts < ?"
@@ -940,7 +936,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             " LIMIT 500"
         )
 
-        def _get_expired_url_cache_txn(txn: LoggingTransaction) -> List[str]:
+        def _get_expired_url_cache_txn(txn: LoggingTransaction) -> list[str]:
             txn.execute(sql, (now_ts,))
             return [row[0] for row in txn]
 
@@ -959,7 +955,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
 
         await self.db_pool.runInteraction("delete_url_cache", _delete_url_cache_txn)
 
-    async def get_url_cache_media_before(self, before_ts: int) -> List[str]:
+    async def get_url_cache_media_before(self, before_ts: int) -> list[str]:
         sql = (
             "SELECT media_id FROM local_media_repository"
             " WHERE created_ts < ? AND url_cache IS NOT NULL"
@@ -967,7 +963,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             " LIMIT 500"
         )
 
-        def _get_url_cache_media_before_txn(txn: LoggingTransaction) -> List[str]:
+        def _get_url_cache_media_before_txn(txn: LoggingTransaction) -> list[str]:
             txn.execute(sql, (before_ts,))
             return [row[0] for row in txn]
 
@@ -1059,7 +1055,7 @@ class MediaRepositoryStore(MediaRepositoryBackgroundUpdateStore):
             txn: LoggingTransaction,
         ) -> int:
             # Calculate the timestamp for the start of the time period
-            start_ts = self._clock.time_msec() - time_period_ms
+            start_ts = self.clock.time_msec() - time_period_ms
             txn.execute(sql, (user_id, start_ts))
             row = txn.fetchone()
             if row is None:
diff --git a/synapse/storage/databases/main/metrics.py b/synapse/storage/databases/main/metrics.py
index a3467bff3d..b2b4561247 100644
--- a/synapse/storage/databases/main/metrics.py
+++ b/synapse/storage/databases/main/metrics.py
@@ -21,7 +21,7 @@
 import calendar
 import logging
 import time
-from typing import TYPE_CHECKING, Dict, List, Tuple, cast
+from typing import TYPE_CHECKING, cast
 
 from synapse.metrics import SERVER_NAME_LABEL, GaugeBucketCollector
 from synapse.metrics.background_process_metrics import wrap_as_background_process
@@ -34,6 +34,7 @@ from synapse.storage.database import (
 from synapse.storage.databases.main.event_push_actions import (
     EventPushActionsWorkerStore,
 )
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -78,14 +79,14 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
 
         # Read the extrems every 60 minutes
         if hs.config.worker.run_background_tasks:
-            self._clock.looping_call(self._read_forward_extremities, 60 * 60 * 1000)
+            self.clock.looping_call(self._read_forward_extremities, Duration(hours=1))
 
         # Used in _generate_user_daily_visits to keep track of progress
         self._last_user_visit_update = self._get_start_of_day()
 
     @wrap_as_background_process("read_forward_extremities")
     async def _read_forward_extremities(self) -> None:
-        def fetch(txn: LoggingTransaction) -> List[Tuple[int, int]]:
+        def fetch(txn: LoggingTransaction) -> list[tuple[int, int]]:
             txn.execute(
                 """
                 SELECT t1.c, t2.c
@@ -98,7 +99,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
                 ) t2 ON t1.room_id = t2.room_id
                 """
             )
-            return cast(List[Tuple[int, int]], txn.fetchall())
+            return cast(list[tuple[int, int]], txn.fetchall())
 
         res = await self.db_pool.runInteraction("read_forward_extremities", fetch)
 
@@ -125,7 +126,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
                 AND stream_ordering > ?
             """
             txn.execute(sql, (self.stream_ordering_day_ago,))
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction("count_e2ee_messages", _count_messages)
@@ -144,7 +145,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
             """
 
             txn.execute(sql, (like_clause, self.stream_ordering_day_ago))
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction(
@@ -159,7 +160,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
                 AND stream_ordering > ?
             """
             txn.execute(sql, (self.stream_ordering_day_ago,))
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction(
@@ -181,7 +182,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
                 AND stream_ordering > ?
             """
             txn.execute(sql, (self.stream_ordering_day_ago,))
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction("count_messages", _count_messages)
@@ -200,7 +201,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
             """
 
             txn.execute(sql, (like_clause, self.stream_ordering_day_ago))
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction(
@@ -215,7 +216,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
                 AND stream_ordering > ?
             """
             txn.execute(sql, (self.stream_ordering_day_ago,))
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction("count_daily_active_rooms", _count)
@@ -224,7 +225,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
         """
         Counts the number of users who used this homeserver in the last 24 hours.
         """
-        yesterday = int(self._clock.time_msec()) - (1000 * 60 * 60 * 24)
+        yesterday = int(self.clock.time_msec()) - (1000 * 60 * 60 * 24)
         return await self.db_pool.runInteraction(
             "count_daily_users", self._count_users, yesterday
         )
@@ -236,7 +237,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
         from the mau figure in synapse.storage.monthly_active_users which,
         amongst other things, includes a 3 day grace period before a user counts.
         """
-        thirty_days_ago = int(self._clock.time_msec()) - (1000 * 60 * 60 * 24 * 30)
+        thirty_days_ago = int(self.clock.time_msec()) - (1000 * 60 * 60 * 24 * 30)
         return await self.db_pool.runInteraction(
             "count_monthly_users", self._count_users, thirty_days_ago
         )
@@ -256,10 +257,10 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
         # Mypy knows that fetchone() might return None if there are no rows.
         # We know better: "SELECT COUNT(...) FROM ..." without any GROUP BY always
         # returns exactly one row.
-        (count,) = cast(Tuple[int], txn.fetchone())
+        (count,) = cast(tuple[int], txn.fetchone())
         return count
 
-    async def count_r30v2_users(self) -> Dict[str, int]:
+    async def count_r30v2_users(self) -> dict[str, int]:
         """
         Counts the number of 30 day retained users, defined as users that:
          - Appear more than once in the past 60 days
@@ -279,9 +280,9 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
               - "web" (any web application -- it's not possible to distinguish Element Web here)
         """
 
-        def _count_r30v2_users(txn: LoggingTransaction) -> Dict[str, int]:
+        def _count_r30v2_users(txn: LoggingTransaction) -> dict[str, int]:
             thirty_days_in_secs = 86400 * 30
-            now = int(self._clock.time())
+            now = int(self.clock.time())
             sixty_days_ago_in_secs = now - 2 * thirty_days_in_secs
             one_day_from_now_in_secs = now + 86400
 
@@ -376,7 +377,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
                     thirty_days_in_secs * 1000,
                 ),
             )
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             results["all"] = count
 
             return results
@@ -389,7 +390,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
         """
         Returns millisecond unixtime for start of UTC day.
         """
-        now = time.gmtime(self._clock.time())
+        now = time.gmtime(self.clock.time())
         today_start = calendar.timegm((now.tm_year, now.tm_mon, now.tm_mday, 0, 0, 0))
         return today_start * 1000
 
@@ -403,7 +404,7 @@ class ServerMetricsStore(EventPushActionsWorkerStore, SQLBaseStore):
             logger.info("Calling _generate_user_daily_visits")
             today_start = self._get_start_of_day()
             a_day_in_milliseconds = 24 * 60 * 60 * 1000
-            now = self._clock.time_msec()
+            now = self.clock.time_msec()
 
             # A note on user_agent. Technically a given device can have multiple
             # user agents, so we need to decide which one to pick. We could have
diff --git a/synapse/storage/databases/main/monthly_active_users.py b/synapse/storage/databases/main/monthly_active_users.py
index f5a6b98be7..b51edd5d0c 100644
--- a/synapse/storage/databases/main/monthly_active_users.py
+++ b/synapse/storage/databases/main/monthly_active_users.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import TYPE_CHECKING, Dict, List, Mapping, Optional, Tuple, cast
+from typing import TYPE_CHECKING, Mapping, cast
 
 from synapse.metrics.background_process_metrics import wrap_as_background_process
 from synapse.storage.database import (
@@ -49,7 +49,6 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
         hs: "HomeServer",
     ):
         super().__init__(database, db_conn, hs)
-        self._clock = hs.get_clock()
         self.hs = hs
 
         if hs.config.redis.redis_enabled:
@@ -95,7 +94,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
                 WHERE (users.appservice_id IS NULL OR users.appservice_id = '');
             """
             txn.execute(sql)
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction("count_users", _count_users)
@@ -113,7 +112,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
 
         """
 
-        def _count_users_by_service(txn: LoggingTransaction) -> Dict[str, int]:
+        def _count_users_by_service(txn: LoggingTransaction) -> dict[str, int]:
             sql = """
                 SELECT COALESCE(appservice_id, 'native'), COUNT(*)
                 FROM monthly_active_users
@@ -122,7 +121,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
             """
 
             txn.execute(sql)
-            result = cast(List[Tuple[str, int]], txn.fetchall())
+            result = cast(list[tuple[str, int]], txn.fetchall())
             return dict(result)
 
         return await self.db_pool.runInteraction(
@@ -130,8 +129,8 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
         )
 
     async def get_monthly_active_users_by_service(
-        self, start_timestamp: Optional[int] = None, end_timestamp: Optional[int] = None
-    ) -> List[Tuple[str, str]]:
+        self, start_timestamp: int | None = None, end_timestamp: int | None = None
+    ) -> list[tuple[str, str]]:
         """Generates list of monthly active users and their services.
         Please see "get_monthly_active_count_by_service" docstring for more details
         about services.
@@ -161,7 +160,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
             where_clause = ""
             query_params = []
 
-        def _list_users(txn: LoggingTransaction) -> List[Tuple[str, str]]:
+        def _list_users(txn: LoggingTransaction) -> list[tuple[str, str]]:
             sql = f"""
                     SELECT COALESCE(appservice_id, 'native'), user_id
                     FROM monthly_active_users
@@ -170,11 +169,11 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
                 """
 
             txn.execute(sql, query_params)
-            return cast(List[Tuple[str, str]], txn.fetchall())
+            return cast(list[tuple[str, str]], txn.fetchall())
 
         return await self.db_pool.runInteraction("list_users", _list_users)
 
-    async def get_registered_reserved_users(self) -> List[str]:
+    async def get_registered_reserved_users(self) -> list[str]:
         """Of the reserved threepids defined in config, retrieve those that are associated
         with registered users
 
@@ -195,7 +194,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
         return users
 
     @cached(num_args=1)
-    async def user_last_seen_monthly_active(self, user_id: str) -> Optional[int]:
+    async def user_last_seen_monthly_active(self, user_id: str) -> int | None:
         """
         Checks if a given user is part of the monthly active user group
 
@@ -220,13 +219,13 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
         entries exist.
         """
 
-        def _reap_users(txn: LoggingTransaction, reserved_users: List[str]) -> None:
+        def _reap_users(txn: LoggingTransaction, reserved_users: list[str]) -> None:
             """
             Args:
                 reserved_users: reserved users to preserve
             """
 
-            thirty_days_ago = int(self._clock.time_msec()) - (1000 * 60 * 60 * 24 * 30)
+            thirty_days_ago = int(self.clock.time_msec()) - (1000 * 60 * 60 * 24 * 30)
 
             in_clause, in_clause_args = make_in_list_sql_clause(
                 self.database_engine, "user_id", reserved_users
@@ -295,7 +294,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
         )
 
     def _initialise_reserved_users(
-        self, txn: LoggingTransaction, threepids: List[dict]
+        self, txn: LoggingTransaction, threepids: list[dict]
     ) -> None:
         """Ensures that reserved threepids are accounted for in the MAU table, should
         be called on start up.
@@ -328,7 +327,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
                         txn,
                         table="monthly_active_users",
                         keyvalues={"user_id": user_id},
-                        values={"timestamp": int(self._clock.time_msec())},
+                        values={"timestamp": int(self.clock.time_msec())},
                     )
             else:
                 logger.warning("mau limit reserved threepid %s not found in db", tp)
@@ -391,7 +390,7 @@ class MonthlyActiveUsersWorkerStore(RegistrationWorkerStore):
             txn,
             table="monthly_active_users",
             keyvalues={"user_id": user_id},
-            values={"timestamp": int(self._clock.time_msec())},
+            values={"timestamp": int(self.clock.time_msec())},
         )
 
         self._invalidate_cache_and_stream(txn, self.get_monthly_active_count, ())
diff --git a/synapse/storage/databases/main/openid.py b/synapse/storage/databases/main/openid.py
index 0db7f73730..15c47a2562 100644
--- a/synapse/storage/databases/main/openid.py
+++ b/synapse/storage/databases/main/openid.py
@@ -19,7 +19,6 @@
 #
 #
 
-from typing import Optional
 
 from synapse.storage._base import SQLBaseStore
 from synapse.storage.database import LoggingTransaction
@@ -41,8 +40,8 @@ class OpenIdStore(SQLBaseStore):
 
     async def get_user_id_for_open_id_token(
         self, token: str, ts_now_ms: int
-    ) -> Optional[str]:
-        def get_user_id_for_token_txn(txn: LoggingTransaction) -> Optional[str]:
+    ) -> str | None:
+        def get_user_id_for_token_txn(txn: LoggingTransaction) -> str | None:
             sql = (
                 "SELECT user_id FROM open_id_tokens"
                 " WHERE token = ? AND ? <= ts_valid_until_ms"
diff --git a/synapse/storage/databases/main/presence.py b/synapse/storage/databases/main/presence.py
index 587f51df2c..75ca9e40d7 100644
--- a/synapse/storage/databases/main/presence.py
+++ b/synapse/storage/databases/main/presence.py
@@ -21,13 +21,8 @@
 from typing import (
     TYPE_CHECKING,
     Any,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -116,8 +111,8 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
         )
 
     async def update_presence(
-        self, presence_states: List[UserPresenceState]
-    ) -> Tuple[int, int]:
+        self, presence_states: list[UserPresenceState]
+    ) -> tuple[int, int]:
         assert self._can_persist_presence
 
         stream_ordering_manager = self._presence_id_gen.get_next_mult(
@@ -142,8 +137,8 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
     def _update_presence_txn(
         self,
         txn: LoggingTransaction,
-        stream_orderings: List[int],
-        presence_states: List[UserPresenceState],
+        stream_orderings: list[int],
+        presence_states: list[UserPresenceState],
     ) -> None:
         for stream_id, state in zip(stream_orderings, presence_states):
             txn.call_after(
@@ -193,7 +188,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
 
     async def get_all_presence_updates(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, list]], int, bool]:
+    ) -> tuple[list[tuple[int, list]], int, bool]:
         """Get updates for presence replication stream.
 
         Args:
@@ -220,7 +215,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
 
         def get_all_presence_updates_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, list]], int, bool]:
+        ) -> tuple[list[tuple[int, list]], int, bool]:
             sql = """
                 SELECT stream_id, user_id, state, last_active_ts,
                     last_federation_update_ts, last_user_sync_ts,
@@ -232,7 +227,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
             """
             txn.execute(sql, (last_id, current_id, limit))
             updates = cast(
-                List[Tuple[int, list]],
+                list[tuple[int, list]],
                 [(row[0], row[1:]) for row in txn],
             )
 
@@ -263,7 +258,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
         # TODO All these columns are nullable, but we don't expect that:
         #      https://github.com/matrix-org/synapse/issues/16467
         rows = cast(
-            List[Tuple[str, str, int, int, int, Optional[str], Union[int, bool]]],
+            list[tuple[str, str, int, int, int, str | None, int | bool]],
             await self.db_pool.simple_select_many_batch(
                 table="presence_stream",
                 column="user_id",
@@ -320,7 +315,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
     @cached()
     async def _get_full_presence_stream_token_for_user(
         self, user_id: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """Get the presence token corresponding to the last full presence update
         for this user.
 
@@ -375,7 +370,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
     async def get_presence_for_all_users(
         self,
         include_offline: bool = True,
-    ) -> Dict[str, UserPresenceState]:
+    ) -> dict[str, UserPresenceState]:
         """Retrieve the current presence state for all users.
 
         Note that the presence_stream table is culled frequently, so it should only
@@ -402,7 +397,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
             # TODO All these columns are nullable, but we don't expect that:
             #      https://github.com/matrix-org/synapse/issues/16467
             rows = cast(
-                List[Tuple[str, str, int, int, int, Optional[str], Union[int, bool]]],
+                list[tuple[str, str, int, int, int, str | None, int | bool]],
                 await self.db_pool.runInteraction(
                     "get_presence_for_all_users",
                     self.db_pool.simple_select_list_paginate_txn,
@@ -457,7 +452,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
     def get_presence_stream_id_gen(self) -> MultiWriterIdGenerator:
         return self._presence_id_gen
 
-    def _get_active_presence(self, db_conn: Connection) -> List[UserPresenceState]:
+    def _get_active_presence(self, db_conn: Connection) -> list[UserPresenceState]:
         """Fetch non-offline presence from the database so that we can register
         the appropriate time outs.
         """
@@ -488,7 +483,7 @@ class PresenceStore(PresenceBackgroundUpdateStore, CacheInvalidationWorkerStore)
             for user_id, state, last_active_ts, last_federation_update_ts, last_user_sync_ts, status_msg, currently_active in rows
         ]
 
-    def take_presence_startup_info(self) -> List[UserPresenceState]:
+    def take_presence_startup_info(self) -> list[UserPresenceState]:
         active_on_startup = self._presence_on_startup
         self._presence_on_startup = []
         return active_on_startup
diff --git a/synapse/storage/databases/main/profile.py b/synapse/storage/databases/main/profile.py
index 30d8a58d96..9b787e19a3 100644
--- a/synapse/storage/databases/main/profile.py
+++ b/synapse/storage/databases/main/profile.py
@@ -19,7 +19,7 @@
 #
 #
 import json
-from typing import TYPE_CHECKING, Dict, Optional, Tuple, cast
+from typing import TYPE_CHECKING, cast
 
 from canonicaljson import encode_canonical_json
 
@@ -75,7 +75,7 @@ class ProfileWorkerStore(SQLBaseStore):
 
         lower_bound_id = progress.get("lower_bound_id", "")
 
-        def _get_last_id(txn: LoggingTransaction) -> Optional[str]:
+        def _get_last_id(txn: LoggingTransaction) -> str | None:
             sql = """
                     SELECT user_id FROM profiles
                     WHERE user_id > ?
@@ -176,7 +176,7 @@ class ProfileWorkerStore(SQLBaseStore):
 
         return ProfileInfo(avatar_url=profile[1], display_name=profile[0])
 
-    async def get_profile_displayname(self, user_id: UserID) -> Optional[str]:
+    async def get_profile_displayname(self, user_id: UserID) -> str | None:
         """
         Fetch the display name of a user.
 
@@ -193,7 +193,7 @@ class ProfileWorkerStore(SQLBaseStore):
             desc="get_profile_displayname",
         )
 
-    async def get_profile_avatar_url(self, user_id: UserID) -> Optional[str]:
+    async def get_profile_avatar_url(self, user_id: UserID) -> str | None:
         """
         Fetch the avatar URL of a user.
 
@@ -240,7 +240,7 @@ class ProfileWorkerStore(SQLBaseStore):
 
                 # Test exists first since value being None is used for both
                 # missing and a null JSON value.
-                exists, value = cast(Tuple[bool, JsonValue], txn.fetchone())
+                exists, value = cast(tuple[bool, JsonValue], txn.fetchone())
                 if not exists:
                     raise StoreError(404, "No row found")
                 return value
@@ -257,9 +257,7 @@ class ProfileWorkerStore(SQLBaseStore):
                 )
 
                 # If value_type is None, then the value did not exist.
-                value_type, value = cast(
-                    Tuple[Optional[str], JsonValue], txn.fetchone()
-                )
+                value_type, value = cast(tuple[str | None, JsonValue], txn.fetchone())
                 if not value_type:
                     raise StoreError(404, "No row found")
                 # If value_type is object or array, then need to deserialize the JSON.
@@ -271,7 +269,7 @@ class ProfileWorkerStore(SQLBaseStore):
 
         return await self.db_pool.runInteraction("get_profile_field", get_profile_field)
 
-    async def get_profile_fields(self, user_id: UserID) -> Dict[str, str]:
+    async def get_profile_fields(self, user_id: UserID) -> dict[str, str]:
         """
         Get all custom profile fields for a user.
 
@@ -346,7 +344,7 @@ class ProfileWorkerStore(SQLBaseStore):
                 # possible due to the grammar.
                 (f'$."{new_field_name}"', user_id.localpart),
             )
-        row = cast(Tuple[Optional[int], Optional[int], Optional[int]], txn.fetchone())
+        row = cast(tuple[int | None, int | None, int | None], txn.fetchone())
 
         # The values return null if the column is null.
         total_bytes = (
@@ -373,7 +371,7 @@ class ProfileWorkerStore(SQLBaseStore):
             raise StoreError(400, "Profile too large", Codes.PROFILE_TOO_LARGE)
 
     async def set_profile_displayname(
-        self, user_id: UserID, new_displayname: Optional[str]
+        self, user_id: UserID, new_displayname: str | None
     ) -> None:
         """
         Set the display name of a user.
@@ -406,7 +404,7 @@ class ProfileWorkerStore(SQLBaseStore):
         )
 
     async def set_profile_avatar_url(
-        self, user_id: UserID, new_avatar_url: Optional[str]
+        self, user_id: UserID, new_avatar_url: str | None
     ) -> None:
         """
         Set the avatar of a user.
@@ -536,6 +534,18 @@ class ProfileWorkerStore(SQLBaseStore):
 
         await self.db_pool.runInteraction("delete_profile_field", delete_profile_field)
 
+    async def delete_profile(self, user_id: UserID) -> None:
+        """
+        Deletes an entire user profile, including displayname, avatar_url and all custom fields.
+        Used at user deactivation when erasure is requested.
+        """
+
+        await self.db_pool.simple_delete(
+            desc="delete_profile",
+            table="profiles",
+            keyvalues={"full_user_id": user_id.to_string()},
+        )
+
 
 class ProfileStore(ProfileWorkerStore):
     pass
diff --git a/synapse/storage/databases/main/purge_events.py b/synapse/storage/databases/main/purge_events.py
index d4642a1309..d55ea5cf7d 100644
--- a/synapse/storage/databases/main/purge_events.py
+++ b/synapse/storage/databases/main/purge_events.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import Any, Set, Tuple, cast
+from typing import Any, cast
 
 from synapse.api.errors import SynapseError
 from synapse.storage.database import LoggingTransaction
@@ -103,7 +103,7 @@ The tables with a `room_id` column regardless of whether they have a useful inde
 class PurgeEventsStore(StateGroupWorkerStore, CacheInvalidationWorkerStore):
     async def purge_history(
         self, room_id: str, token: str, delete_local_events: bool
-    ) -> Set[int]:
+    ) -> set[int]:
         """Deletes room history before a certain point.
 
         Note that only a single purge can occur at once, this is guaranteed via
@@ -137,7 +137,7 @@ class PurgeEventsStore(StateGroupWorkerStore, CacheInvalidationWorkerStore):
         room_id: str,
         token: RoomStreamToken,
         delete_local_events: bool,
-    ) -> Set[int]:
+    ) -> set[int]:
         # Tables that should be pruned:
         #     event_auth
         #     event_backward_extremities
@@ -204,7 +204,7 @@ class PurgeEventsStore(StateGroupWorkerStore, CacheInvalidationWorkerStore):
         logger.info("[purge] looking for events to delete")
 
         should_delete_expr = "state_events.state_key IS NULL"
-        should_delete_params: Tuple[Any, ...] = ()
+        should_delete_params: tuple[Any, ...] = ()
         if not delete_local_events:
             should_delete_expr += " AND event_id NOT LIKE ?"
 
@@ -239,6 +239,16 @@ class PurgeEventsStore(StateGroupWorkerStore, CacheInvalidationWorkerStore):
 
         txn.execute("SELECT event_id, should_delete FROM events_to_purge")
         event_rows = txn.fetchall()
+
+        if len(event_rows) == 0:
+            logger.info("[purge] no events found to purge")
+
+            # For the sake of cleanliness: drop the temp table.
+            # This will commit the txn in sqlite, so make sure to keep this actually last.
+            txn.execute("DROP TABLE events_to_purge")
+            # no referenced state groups
+            return set()
+
         logger.info(
             "[purge] found %i events before cutoff, of which %i can be deleted",
             len(event_rows),
@@ -355,7 +365,7 @@ class PurgeEventsStore(StateGroupWorkerStore, CacheInvalidationWorkerStore):
         """,
             (room_id,),
         )
-        (min_depth,) = cast(Tuple[int], txn.fetchone())
+        (min_depth,) = cast(tuple[int], txn.fetchone())
 
         logger.info("[purge] updating room_depth to %d", min_depth)
 
diff --git a/synapse/storage/databases/main/push_rule.py b/synapse/storage/databases/main/push_rule.py
index d686140556..d361166cec 100644
--- a/synapse/storage/databases/main/push_rule.py
+++ b/synapse/storage/databases/main/push_rule.py
@@ -23,14 +23,9 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -56,10 +51,11 @@ from synapse.storage.push_rule import InconsistentRuleException, RuleNotFoundExc
 from synapse.storage.util.id_generators import IdGenerator, MultiWriterIdGenerator
 from synapse.synapse_rust.push import FilteredPushRules, PushRule, PushRules
 from synapse.types import JsonDict
-from synapse.util import json_encoder, unwrapFirstError
+from synapse.util import unwrapFirstError
 from synapse.util.async_helpers import gather_results
 from synapse.util.caches.descriptors import cached, cachedList
 from synapse.util.caches.stream_change_cache import StreamChangeCache
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -68,8 +64,8 @@ logger = logging.getLogger(__name__)
 
 
 def _load_rules(
-    rawrules: List[Tuple[str, int, str, str]],
-    enabled_map: Dict[str, bool],
+    rawrules: list[tuple[str, int, str, str]],
+    enabled_map: dict[str, bool],
     experimental_config: ExperimentalConfig,
 ) -> FilteredPushRules:
     """Take the DB rows returned from the DB and convert them into a full
@@ -205,7 +201,7 @@ class PushRulesWorkerStore(
     @cached(max_entries=5000)
     async def get_push_rules_for_user(self, user_id: str) -> FilteredPushRules:
         rows = cast(
-            List[Tuple[str, int, int, str, str]],
+            list[tuple[str, int, int, str, str]],
             await self.db_pool.simple_select_list(
                 table="push_rules",
                 keyvalues={"user_name": user_id},
@@ -231,9 +227,9 @@ class PushRulesWorkerStore(
             self.hs.config.experimental,
         )
 
-    async def get_push_rules_enabled_for_user(self, user_id: str) -> Dict[str, bool]:
+    async def get_push_rules_enabled_for_user(self, user_id: str) -> dict[str, bool]:
         results = cast(
-            List[Tuple[str, Optional[Union[int, bool]]]],
+            list[tuple[str, int | bool | None]],
             await self.db_pool.simple_select_list(
                 table="push_rules_enable",
                 keyvalues={"user_name": user_id},
@@ -256,7 +252,7 @@ class PushRulesWorkerStore(
                     " WHERE user_id = ? AND ? < stream_id"
                 )
                 txn.execute(sql, (user_id, last_id))
-                (count,) = cast(Tuple[int], txn.fetchone())
+                (count,) = cast(tuple[int], txn.fetchone())
                 return bool(count)
 
             return await self.db_pool.runInteraction(
@@ -270,7 +266,7 @@ class PushRulesWorkerStore(
         if not user_ids:
             return {}
 
-        raw_rules: Dict[str, List[Tuple[str, int, str, str]]] = {
+        raw_rules: dict[str, list[tuple[str, int, str, str]]] = {
             user_id: [] for user_id in user_ids
         }
 
@@ -279,7 +275,7 @@ class PushRulesWorkerStore(
             gather_results(
                 (
                     cast(
-                        "defer.Deferred[List[Tuple[str, str, int, int, str, str]]]",
+                        "defer.Deferred[list[tuple[str, str, int, int, str, str]]]",
                         run_in_background(
                             self.db_pool.simple_select_many_batch,
                             table="push_rules",
@@ -311,7 +307,7 @@ class PushRulesWorkerStore(
                 (rule_id, priority_class, conditions, actions)
             )
 
-        results: Dict[str, FilteredPushRules] = {}
+        results: dict[str, FilteredPushRules] = {}
 
         for user_id, rules in raw_rules.items():
             results[user_id] = _load_rules(
@@ -322,14 +318,14 @@ class PushRulesWorkerStore(
 
     async def bulk_get_push_rules_enabled(
         self, user_ids: Collection[str]
-    ) -> Dict[str, Dict[str, bool]]:
+    ) -> dict[str, dict[str, bool]]:
         if not user_ids:
             return {}
 
-        results: Dict[str, Dict[str, bool]] = {user_id: {} for user_id in user_ids}
+        results: dict[str, dict[str, bool]] = {user_id: {} for user_id in user_ids}
 
         rows = cast(
-            List[Tuple[str, str, Optional[int]]],
+            list[tuple[str, str, int | None]],
             await self.db_pool.simple_select_many_batch(
                 table="push_rules_enable",
                 column="user_name",
@@ -345,7 +341,7 @@ class PushRulesWorkerStore(
 
     async def get_all_push_rule_updates(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, Tuple[str]]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple[str]]], int, bool]:
         """Get updates for push_rules replication stream.
 
         Args:
@@ -372,7 +368,7 @@ class PushRulesWorkerStore(
 
         def get_all_push_rule_updates_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, Tuple[str]]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple[str]]], int, bool]:
             sql = """
                 SELECT stream_id, user_id
                 FROM push_rules_stream
@@ -382,7 +378,7 @@ class PushRulesWorkerStore(
             """
             txn.execute(sql, (last_id, current_id, limit))
             updates = cast(
-                List[Tuple[int, Tuple[str]]],
+                list[tuple[int, tuple[str]]],
                 [(stream_id, (user_id,)) for stream_id, user_id in txn],
             )
 
@@ -404,9 +400,9 @@ class PushRulesWorkerStore(
         rule_id: str,
         priority_class: int,
         conditions: Sequence[Mapping[str, str]],
-        actions: Sequence[Union[Mapping[str, Any], str]],
-        before: Optional[str] = None,
-        after: Optional[str] = None,
+        actions: Sequence[Mapping[str, Any] | str],
+        before: str | None = None,
+        after: str | None = None,
     ) -> None:
         if not self._is_push_writer:
             raise Exception("Not a push writer")
@@ -793,7 +789,7 @@ class PushRulesWorkerStore(
         self,
         user_id: str,
         rule_id: str,
-        actions: List[Union[dict, str]],
+        actions: list[dict | str],
         is_default_rule: bool,
     ) -> None:
         """
@@ -884,7 +880,7 @@ class PushRulesWorkerStore(
         user_id: str,
         rule_id: str,
         op: str,
-        data: Optional[JsonDict] = None,
+        data: JsonDict | None = None,
     ) -> None:
         if not self._is_push_writer:
             raise Exception("Not a push writer")
diff --git a/synapse/storage/databases/main/pusher.py b/synapse/storage/databases/main/pusher.py
index 9a0a12b5c1..e7ab7f64f9 100644
--- a/synapse/storage/databases/main/pusher.py
+++ b/synapse/storage/databases/main/pusher.py
@@ -23,12 +23,8 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Any,
-    Dict,
     Iterable,
     Iterator,
-    List,
-    Optional,
-    Tuple,
     cast,
 )
 
@@ -42,8 +38,8 @@ from synapse.storage.database import (
 )
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
 from synapse.types import JsonDict
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -51,10 +47,10 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 # The type of a row in the pushers table.
-PusherRow = Tuple[
+PusherRow = tuple[
     int,  # id
     str,  # user_name
-    Optional[int],  # access_token
+    int | None,  # access_token
     str,  # profile_tag
     str,  # kind
     str,  # app_id
@@ -192,7 +188,7 @@ class PusherWorkerStore(SQLBaseStore):
     async def get_pushers_by_user_id(self, user_id: str) -> Iterator[PusherConfig]:
         return await self.get_pushers_by({"user_name": user_id})
 
-    async def get_pushers_by(self, keyvalues: Dict[str, Any]) -> Iterator[PusherConfig]:
+    async def get_pushers_by(self, keyvalues: dict[str, Any]) -> Iterator[PusherConfig]:
         """Retrieve pushers that match the given criteria.
 
         Args:
@@ -202,7 +198,7 @@ class PusherWorkerStore(SQLBaseStore):
             The pushers for which the given columns have the given values.
         """
 
-        def get_pushers_by_txn(txn: LoggingTransaction) -> List[PusherRow]:
+        def get_pushers_by_txn(txn: LoggingTransaction) -> list[PusherRow]:
             # We could technically use simple_select_list here, but we need to call
             # COALESCE on the 'enabled' column. While it is technically possible to give
             # simple_select_list the whole `COALESCE(...) AS ...` as a column name, it
@@ -220,7 +216,7 @@ class PusherWorkerStore(SQLBaseStore):
 
             txn.execute(sql, list(keyvalues.values()))
 
-            return cast(List[PusherRow], txn.fetchall())
+            return cast(list[PusherRow], txn.fetchall())
 
         ret = await self.db_pool.runInteraction(
             desc="get_pushers_by",
@@ -230,7 +226,7 @@ class PusherWorkerStore(SQLBaseStore):
         return self._decode_pushers_rows(ret)
 
     async def get_enabled_pushers(self) -> Iterator[PusherConfig]:
-        def get_enabled_pushers_txn(txn: LoggingTransaction) -> List[PusherRow]:
+        def get_enabled_pushers_txn(txn: LoggingTransaction) -> list[PusherRow]:
             txn.execute(
                 """
                 SELECT id, user_name, access_token, profile_tag, kind, app_id,
@@ -240,7 +236,7 @@ class PusherWorkerStore(SQLBaseStore):
                 FROM pushers WHERE COALESCE(enabled, TRUE)
                 """
             )
-            return cast(List[PusherRow], txn.fetchall())
+            return cast(list[PusherRow], txn.fetchall())
 
         return self._decode_pushers_rows(
             await self.db_pool.runInteraction(
@@ -250,7 +246,7 @@ class PusherWorkerStore(SQLBaseStore):
 
     async def get_all_updated_pushers_rows(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple]], int, bool]:
         """Get updates for pushers replication stream.
 
         Args:
@@ -277,7 +273,7 @@ class PusherWorkerStore(SQLBaseStore):
 
         def get_all_updated_pushers_rows_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, tuple]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple]], int, bool]:
             sql = """
                 SELECT id, user_name, app_id, pushkey
                 FROM pushers
@@ -286,7 +282,7 @@ class PusherWorkerStore(SQLBaseStore):
             """
             txn.execute(sql, (last_id, current_id, limit))
             updates = cast(
-                List[Tuple[int, tuple]],
+                list[tuple[int, tuple]],
                 [
                     (stream_id, (user_name, app_id, pushkey, False))
                     for stream_id, user_name, app_id, pushkey in txn
@@ -368,7 +364,7 @@ class PusherWorkerStore(SQLBaseStore):
         return bool(updated)
 
     async def update_pusher_failing_since(
-        self, app_id: str, pushkey: str, user_id: str, failing_since: Optional[int]
+        self, app_id: str, pushkey: str, user_id: str, failing_since: int | None
     ) -> None:
         await self.db_pool.simple_update(
             table="pushers",
@@ -379,9 +375,9 @@ class PusherWorkerStore(SQLBaseStore):
 
     async def get_throttle_params_by_room(
         self, pusher_id: int
-    ) -> Dict[str, ThrottleParams]:
+    ) -> dict[str, ThrottleParams]:
         res = cast(
-            List[Tuple[str, Optional[int], Optional[int]]],
+            list[tuple[str, int | None, int | None]],
             await self.db_pool.simple_select_list(
                 "pusher_throttle",
                 {"pusher": pusher_id},
@@ -610,7 +606,7 @@ class PusherBackgroundUpdatesStore(SQLBaseStore):
                 (last_pusher_id, batch_size),
             )
 
-            rows = cast(List[Tuple[int, Optional[str], Optional[str]]], txn.fetchall())
+            rows = cast(list[tuple[int, str | None, str | None]], txn.fetchall())
             if len(rows) == 0:
                 return 0
 
@@ -669,13 +665,13 @@ class PusherStore(PusherWorkerStore, PusherBackgroundUpdatesStore):
         device_display_name: str,
         pushkey: str,
         pushkey_ts: int,
-        lang: Optional[str],
-        data: Optional[JsonDict],
+        lang: str | None,
+        data: JsonDict | None,
         last_stream_ordering: int,
         profile_tag: str = "",
         enabled: bool = True,
-        device_id: Optional[str] = None,
-        access_token_id: Optional[int] = None,
+        device_id: str | None = None,
+        access_token_id: int | None = None,
     ) -> None:
         async with self._pushers_id_gen.get_next() as stream_id:
             await self.db_pool.simple_upsert(
@@ -764,7 +760,7 @@ class PusherStore(PusherWorkerStore, PusherBackgroundUpdatesStore):
         # account.
         pushers = list(await self.get_pushers_by_user_id(user_id))
 
-        def delete_pushers_txn(txn: LoggingTransaction, stream_ids: List[int]) -> None:
+        def delete_pushers_txn(txn: LoggingTransaction, stream_ids: list[int]) -> None:
             self._invalidate_cache_and_stream(  # type: ignore[attr-defined]
                 txn, self.get_if_user_has_pusher, (user_id,)
             )
diff --git a/synapse/storage/databases/main/receipts.py b/synapse/storage/databases/main/receipts.py
index d74bb0184a..ba5e07a051 100644
--- a/synapse/storage/databases/main/receipts.py
+++ b/synapse/storage/databases/main/receipts.py
@@ -24,14 +24,9 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
     cast,
 )
 
@@ -55,10 +50,10 @@ from synapse.types import (
     PersistedPosition,
     StrCollection,
 )
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached, cachedList
 from synapse.util.caches.stream_change_cache import StreamChangeCache
 from synapse.util.iterutils import batch_iter
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -71,7 +66,7 @@ class ReceiptInRoom:
     receipt_type: str
     user_id: str
     event_id: str
-    thread_id: Optional[str]
+    thread_id: str | None
     data: JsonMapping
 
     @staticmethod
@@ -92,14 +87,14 @@ class ReceiptInRoom:
         # matching threaded receipts.
 
         # Set of (user_id, event_id)
-        unthreaded_receipts: Set[Tuple[str, str]] = {
+        unthreaded_receipts: set[tuple[str, str]] = {
             (receipt.user_id, receipt.event_id)
             for receipt in receipts
             if receipt.thread_id is None
         }
 
         # event_id -> receipt_type -> user_id -> receipt data
-        content: Dict[str, Dict[str, Dict[str, JsonMapping]]] = {}
+        content: dict[str, dict[str, dict[str, JsonMapping]]] = {}
         for receipt in receipts:
             data = receipt.data
             if receipt.thread_id is not None:
@@ -180,7 +175,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         user_id: str,
         room_id: str,
         receipt_types: Collection[str],
-    ) -> Optional[Tuple[str, int]]:
+    ) -> tuple[str, int] | None:
         """
         Fetch the event ID and stream_ordering for the latest unthreaded receipt
         in a room with one of the given receipt types.
@@ -212,11 +207,11 @@ class ReceiptsWorkerStore(SQLBaseStore):
         args.extend((user_id, room_id))
         txn.execute(sql, args)
 
-        return cast(Optional[Tuple[str, int]], txn.fetchone())
+        return cast(tuple[str, int] | None, txn.fetchone())
 
     async def get_receipts_for_user(
         self, user_id: str, receipt_types: Iterable[str]
-    ) -> Dict[str, str]:
+    ) -> dict[str, str]:
         """
         Fetch the event IDs for the latest receipts sent by the given user.
 
@@ -285,7 +280,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
             A map of room ID to the latest receipt information.
         """
 
-        def f(txn: LoggingTransaction) -> List[Tuple[str, str, int, int]]:
+        def f(txn: LoggingTransaction) -> list[tuple[str, str, int, int]]:
             sql = (
                 "SELECT rl.room_id, rl.event_id,"
                 " e.topological_ordering, e.stream_ordering"
@@ -297,7 +292,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
                 " AND receipt_type = ?"
             )
             txn.execute(sql, (user_id, receipt_type))
-            return cast(List[Tuple[str, str, int, int]], txn.fetchall())
+            return cast(list[tuple[str, str, int, int]], txn.fetchall())
 
         rows = await self.db_pool.runInteraction(
             "get_receipts_for_user_with_orderings", f
@@ -315,8 +310,8 @@ class ReceiptsWorkerStore(SQLBaseStore):
         self,
         room_ids: Iterable[str],
         to_key: MultiWriterStreamToken,
-        from_key: Optional[MultiWriterStreamToken] = None,
-    ) -> List[JsonMapping]:
+        from_key: MultiWriterStreamToken | None = None,
+    ) -> list[JsonMapping]:
         """Get receipts for multiple rooms for sending to clients.
 
         Args:
@@ -347,7 +342,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         self,
         room_id: str,
         to_key: MultiWriterStreamToken,
-        from_key: Optional[MultiWriterStreamToken] = None,
+        from_key: MultiWriterStreamToken | None = None,
     ) -> Sequence[JsonMapping]:
         """Get receipts for a single room for sending to clients.
 
@@ -375,11 +370,11 @@ class ReceiptsWorkerStore(SQLBaseStore):
         self,
         room_id: str,
         to_key: MultiWriterStreamToken,
-        from_key: Optional[MultiWriterStreamToken] = None,
+        from_key: MultiWriterStreamToken | None = None,
     ) -> Sequence[JsonMapping]:
         """See get_linearized_receipts_for_room"""
 
-        def f(txn: LoggingTransaction) -> List[Tuple[str, str, str, str]]:
+        def f(txn: LoggingTransaction) -> list[tuple[str, str, str, str]]:
             if from_key:
                 sql = """
                     SELECT stream_id, instance_name, receipt_type, user_id, event_id, data
@@ -429,7 +424,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         self,
         room_ids: Collection[str],
         to_key: MultiWriterStreamToken,
-        from_key: Optional[MultiWriterStreamToken] = None,
+        from_key: MultiWriterStreamToken | None = None,
     ) -> Mapping[str, Sequence[JsonMapping]]:
         if not room_ids:
             return {}
@@ -466,7 +461,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
 
                 txn.execute(sql + clause, [to_key.get_max_stream_pos()] + list(args))
 
-            results: Dict[str, List[ReceiptInRoom]] = {}
+            results: dict[str, list[ReceiptInRoom]] = {}
             for (
                 stream_id,
                 instance_name,
@@ -515,7 +510,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
 
     async def get_linearized_receipts_for_events(
         self,
-        room_and_event_ids: Collection[Tuple[str, str]],
+        room_and_event_ids: Collection[tuple[str, str]],
     ) -> Mapping[str, Sequence[ReceiptInRoom]]:
         """Get all receipts for the given set of events.
 
@@ -531,8 +526,8 @@ class ReceiptsWorkerStore(SQLBaseStore):
 
         def get_linearized_receipts_for_events_txn(
             txn: LoggingTransaction,
-            room_id_event_id_tuples: Collection[Tuple[str, str]],
-        ) -> List[Tuple[str, str, str, str, Optional[str], str]]:
+            room_id_event_id_tuples: Collection[tuple[str, str]],
+        ) -> list[tuple[str, str, str, str, str | None, str]]:
             clause, args = make_tuple_in_list_sql_clause(
                 self.database_engine, ("room_id", "event_id"), room_id_event_id_tuples
             )
@@ -548,7 +543,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
             return txn.fetchall()
 
         # room_id -> receipts
-        room_to_receipts: Dict[str, List[ReceiptInRoom]] = {}
+        room_to_receipts: dict[str, list[ReceiptInRoom]] = {}
         for batch in batch_iter(room_and_event_ids, 1000):
             batch_results = await self.db_pool.runInteraction(
                 "get_linearized_receipts_for_events",
@@ -582,7 +577,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
     async def get_linearized_receipts_for_all_rooms(
         self,
         to_key: MultiWriterStreamToken,
-        from_key: Optional[MultiWriterStreamToken] = None,
+        from_key: MultiWriterStreamToken | None = None,
     ) -> Mapping[str, JsonMapping]:
         """Get receipts for all rooms between two stream_ids, up
         to a limit of the latest 100 read receipts.
@@ -596,7 +591,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
             A dictionary of roomids to a list of receipts.
         """
 
-        def f(txn: LoggingTransaction) -> List[Tuple[str, str, str, str, str]]:
+        def f(txn: LoggingTransaction) -> list[tuple[str, str, str, str, str]]:
             if from_key:
                 sql = """
                     SELECT stream_id, instance_name, room_id, receipt_type, user_id, event_id, data
@@ -659,7 +654,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         def get_linearized_receipts_for_user_in_rooms_txn(
             txn: LoggingTransaction,
             batch_room_ids: StrCollection,
-        ) -> List[Tuple[str, str, str, str, Optional[str], str]]:
+        ) -> list[tuple[str, str, str, str, str | None, str]]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "room_id", batch_room_ids
             )
@@ -687,7 +682,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
             ]
 
         # room_id -> receipts
-        room_to_receipts: Dict[str, List[ReceiptInRoom]] = {}
+        room_to_receipts: dict[str, list[ReceiptInRoom]] = {}
         for batch in batch_iter(room_ids, 1000):
             batch_results = await self.db_pool.runInteraction(
                 "get_linearized_receipts_for_events",
@@ -746,7 +741,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
 
             return [room_id for (room_id,) in txn]
 
-        results: List[str] = []
+        results: list[str] = []
         for batch in batch_iter(room_ids, 1000):
             batch_result = await self.db_pool.runInteraction(
                 "get_rooms_with_receipts_between", f, batch
@@ -757,7 +752,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
 
     async def get_users_sent_receipts_between(
         self, last_id: int, current_id: int
-    ) -> List[str]:
+    ) -> list[str]:
         """Get all users who sent receipts between `last_id` exclusive and
         `current_id` inclusive.
 
@@ -768,7 +763,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         if last_id == current_id:
             return []
 
-        def _get_users_sent_receipts_between_txn(txn: LoggingTransaction) -> List[str]:
+        def _get_users_sent_receipts_between_txn(txn: LoggingTransaction) -> list[str]:
             sql = """
                 SELECT DISTINCT user_id FROM receipts_linearized
                 WHERE ? < stream_id AND stream_id <= ?
@@ -783,8 +778,8 @@ class ReceiptsWorkerStore(SQLBaseStore):
 
     async def get_all_updated_receipts(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[
-        List[Tuple[int, Tuple[str, str, str, str, Optional[str], JsonDict]]], int, bool
+    ) -> tuple[
+        list[tuple[int, tuple[str, str, str, str, str | None, JsonDict]]], int, bool
     ]:
         """Get updates for receipts replication stream.
 
@@ -812,8 +807,8 @@ class ReceiptsWorkerStore(SQLBaseStore):
 
         def get_all_updated_receipts_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[
-            List[Tuple[int, Tuple[str, str, str, str, Optional[str], JsonDict]]],
+        ) -> tuple[
+            list[tuple[int, tuple[str, str, str, str, str | None, JsonDict]]],
             int,
             bool,
         ]:
@@ -828,7 +823,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
             txn.execute(sql, (last_id, current_id, instance_name, limit))
 
             updates = cast(
-                List[Tuple[int, Tuple[str, str, str, str, Optional[str], JsonDict]]],
+                list[tuple[int, tuple[str, str, str, str, str | None, JsonDict]]],
                 [(r[0], r[1:6] + (db_to_json(r[6]),)) for r in txn],
             )
 
@@ -888,10 +883,10 @@ class ReceiptsWorkerStore(SQLBaseStore):
         receipt_type: str,
         user_id: str,
         event_id: str,
-        thread_id: Optional[str],
+        thread_id: str | None,
         data: JsonDict,
         stream_id: int,
-    ) -> Optional[int]:
+    ) -> int | None:
         """Inserts a receipt into the database if it's newer than the current one.
 
         Returns:
@@ -917,7 +912,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         if stream_ordering is not None:
             if thread_id is None:
                 thread_clause = "r.thread_id IS NULL"
-                thread_args: Tuple[str, ...] = ()
+                thread_args: tuple[str, ...] = ()
             else:
                 thread_clause = "r.thread_id = ?"
                 thread_args = (thread_id,)
@@ -986,7 +981,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         return rx_ts
 
     def _graph_to_linear(
-        self, txn: LoggingTransaction, room_id: str, event_ids: List[str]
+        self, txn: LoggingTransaction, room_id: str, event_ids: list[str]
     ) -> str:
         """
         Generate a linearized event from a list of events (i.e. a list of forward
@@ -1026,10 +1021,10 @@ class ReceiptsWorkerStore(SQLBaseStore):
         room_id: str,
         receipt_type: str,
         user_id: str,
-        event_ids: List[str],
-        thread_id: Optional[str],
+        event_ids: list[str],
+        thread_id: str | None,
         data: dict,
-    ) -> Optional[PersistedPosition]:
+    ) -> PersistedPosition | None:
         """Insert a receipt, either from local client or remote server.
 
         Automatically does conversion between linearized and graph
@@ -1073,7 +1068,7 @@ class ReceiptsWorkerStore(SQLBaseStore):
         if event_ts is None:
             return None
 
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
         logger.debug(
             "Receipt %s for event %s in %s (%i ms old)",
             receipt_type,
@@ -1098,8 +1093,8 @@ class ReceiptsWorkerStore(SQLBaseStore):
         room_id: str,
         receipt_type: str,
         user_id: str,
-        event_ids: List[str],
-        thread_id: Optional[str],
+        event_ids: list[str],
+        thread_id: str | None,
         data: JsonDict,
     ) -> None:
         assert self._can_write_to_receipts
@@ -1237,7 +1232,7 @@ class ReceiptsBackgroundUpdateStore(SQLBaseStore):
                 HAVING COUNT(*) > 1
             """
             txn.execute(sql)
-            duplicate_keys = cast(List[Tuple[int, str, str, str]], list(txn))
+            duplicate_keys = cast(list[tuple[int, str, str, str]], list(txn))
 
             # Then remove duplicate receipts, keeping the one with the highest
             # `stream_id`. Since there might be duplicate rows with the same
@@ -1255,7 +1250,7 @@ class ReceiptsBackgroundUpdateStore(SQLBaseStore):
                 LIMIT 1
                 """
                 txn.execute(sql, (room_id, receipt_type, user_id, stream_id))
-                row_id = cast(Tuple[str], txn.fetchone())[0]
+                row_id = cast(tuple[str], txn.fetchone())[0]
 
                 sql = f"""
                     DELETE FROM receipts_linearized
@@ -1306,7 +1301,7 @@ class ReceiptsBackgroundUpdateStore(SQLBaseStore):
                 HAVING COUNT(*) > 1
             """
             txn.execute(sql)
-            duplicate_keys = cast(List[Tuple[str, str, str]], list(txn))
+            duplicate_keys = cast(list[tuple[str, str, str]], list(txn))
 
             # Then remove all duplicate receipts.
             # We could be clever and try to keep the latest receipt out of every set of
diff --git a/synapse/storage/databases/main/registration.py b/synapse/storage/databases/main/registration.py
index 117444e7b7..7b0de92435 100644
--- a/synapse/storage/databases/main/registration.py
+++ b/synapse/storage/databases/main/registration.py
@@ -22,7 +22,7 @@
 import logging
 import random
 import re
-from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union, cast
+from typing import TYPE_CHECKING, Any, cast
 
 import attr
 
@@ -49,13 +49,12 @@ from synapse.storage.util.id_generators import IdGenerator
 from synapse.storage.util.sequence import build_sequence_generator
 from synapse.types import JsonDict, StrCollection, UserID, UserInfo
 from synapse.util.caches.descriptors import cached
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
 
-THIRTY_MINUTES_IN_MS = 30 * 60 * 1000
-
 logger = logging.getLogger(__name__)
 
 
@@ -94,8 +93,8 @@ class TokenLookupResult:
     token_id: int
     is_guest: bool = False
     shadow_banned: bool = False
-    device_id: Optional[str] = None
-    valid_until_ms: Optional[int] = None
+    device_id: str | None = None
+    valid_until_ms: int | None = None
     token_owner: str = attr.ib()
     token_used: bool = False
 
@@ -118,7 +117,7 @@ class RefreshTokenLookupResult:
     token_id: int
     """The ID of this refresh token."""
 
-    next_token_id: Optional[int]
+    next_token_id: int | None
     """The ID of the refresh token which replaced this one."""
 
     has_next_refresh_token_been_refreshed: bool
@@ -127,11 +126,11 @@ class RefreshTokenLookupResult:
     has_next_access_token_been_used: bool
     """True if the next access token was already used at least once."""
 
-    expiry_ts: Optional[int]
+    expiry_ts: int | None
     """The time at which the refresh token expires and can not be used.
     If None, the refresh token doesn't expire."""
 
-    ultimate_session_expiry_ts: Optional[int]
+    ultimate_session_expiry_ts: int | None
     """The time at which the session comes to an end and can no longer be
     refreshed.
     If None, the session can be refreshed indefinitely."""
@@ -144,10 +143,10 @@ class LoginTokenLookupResult:
     user_id: str
     """The user this token belongs to."""
 
-    auth_provider_id: Optional[str]
+    auth_provider_id: str | None
     """The SSO Identity Provider that the user authenticated with, to get this token."""
 
-    auth_provider_session_id: Optional[str]
+    auth_provider_session_id: str | None
     """The session ID advertised by the SSO Identity Provider."""
 
 
@@ -171,7 +170,7 @@ class ThreepidValidationSession:
     """ID of the validation session"""
     last_send_attempt: int
     """a number serving to dedupe send attempts for this session"""
-    validated_at: Optional[int]
+    validated_at: int | None
     """timestamp of when this session was validated if so"""
 
 
@@ -212,8 +211,8 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             )
 
             if hs.config.worker.run_background_tasks:
-                self._clock.call_later(
-                    0.0,
+                self.clock.call_later(
+                    Duration(seconds=0),
                     self._set_expiration_date_when_missing,
                 )
 
@@ -226,20 +225,20 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
         # Create a background job for culling expired 3PID validity tokens
         if hs.config.worker.run_background_tasks:
-            self._clock.looping_call(
-                self.cull_expired_threepid_validation_tokens, THIRTY_MINUTES_IN_MS
+            self.clock.looping_call(
+                self.cull_expired_threepid_validation_tokens, Duration(minutes=30)
             )
 
     async def register_user(
         self,
         user_id: str,
-        password_hash: Optional[str] = None,
+        password_hash: str | None = None,
         was_guest: bool = False,
         make_guest: bool = False,
-        appservice_id: Optional[str] = None,
-        create_profile_with_displayname: Optional[str] = None,
+        appservice_id: str | None = None,
+        create_profile_with_displayname: str | None = None,
         admin: bool = False,
-        user_type: Optional[str] = None,
+        user_type: str | None = None,
         shadow_banned: bool = False,
         approved: bool = False,
     ) -> None:
@@ -286,19 +285,19 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         self,
         txn: LoggingTransaction,
         user_id: str,
-        password_hash: Optional[str],
+        password_hash: str | None,
         was_guest: bool,
         make_guest: bool,
-        appservice_id: Optional[str],
-        create_profile_with_displayname: Optional[str],
+        appservice_id: str | None,
+        create_profile_with_displayname: str | None,
         admin: bool,
-        user_type: Optional[str],
+        user_type: str | None,
         shadow_banned: bool,
         approved: bool,
     ) -> None:
         user_id_obj = UserID.from_string(user_id)
 
-        now = int(self._clock.time())
+        now = int(self.clock.time())
 
         user_approved = approved or not self._require_approval
 
@@ -379,10 +378,10 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         self._invalidate_cache_and_stream(txn, self.get_user_by_id, (user_id,))
 
     @cached()
-    async def get_user_by_id(self, user_id: str) -> Optional[UserInfo]:
+    async def get_user_by_id(self, user_id: str) -> UserInfo | None:
         """Returns info about the user account, if it exists."""
 
-        def get_user_by_id_txn(txn: LoggingTransaction) -> Optional[UserInfo]:
+        def get_user_by_id_txn(txn: LoggingTransaction) -> UserInfo | None:
             # We could technically use simple_select_one here, but it would not perform
             # the COALESCEs (unless hacked into the column names), which could yield
             # confusing results.
@@ -457,7 +456,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         if not info:
             return False
 
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
         days = self.config.server.mau_appservice_trial_days.get(
             info.appservice_id, self.config.server.mau_trial_days
         )
@@ -466,7 +465,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         return is_trial
 
     @cached()
-    async def get_user_by_access_token(self, token: str) -> Optional[TokenLookupResult]:
+    async def get_user_by_access_token(self, token: str) -> TokenLookupResult | None:
         """Get a user from the given access token.
 
         Args:
@@ -479,7 +478,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         )
 
     @cached()
-    async def get_expiration_ts_for_user(self, user_id: str) -> Optional[int]:
+    async def get_expiration_ts_for_user(self, user_id: str) -> int | None:
         """Get the expiration timestamp for the account bearing a given user ID.
 
         Args:
@@ -515,8 +514,8 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         user_id: str,
         expiration_ts: int,
         email_sent: bool,
-        renewal_token: Optional[str] = None,
-        token_used_ts: Optional[int] = None,
+        renewal_token: str | None = None,
+        token_used_ts: int | None = None,
     ) -> None:
         """Updates the account validity properties of the given account, with the
         given values.
@@ -576,7 +575,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
     async def get_user_from_renewal_token(
         self, renewal_token: str
-    ) -> Tuple[str, int, Optional[int]]:
+    ) -> tuple[str, int, int | None]:
         """Get a user ID and renewal status from a renewal token.
 
         Args:
@@ -592,7 +591,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
                     has not been renewed using the current token yet.
         """
         return cast(
-            Tuple[str, int, Optional[int]],
+            tuple[str, int, int | None],
             await self.db_pool.simple_select_one(
                 table="account_validity",
                 keyvalues={"renewal_token": renewal_token},
@@ -617,7 +616,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             desc="get_renewal_token_for_user",
         )
 
-    async def get_users_expiring_soon(self) -> List[Tuple[str, int]]:
+    async def get_users_expiring_soon(self) -> list[tuple[str, int]]:
         """Selects users whose account will expire in the [now, now + renew_at] time
         window (see configuration for account_validity for information on what renew_at
         refers to).
@@ -628,19 +627,19 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
         def select_users_txn(
             txn: LoggingTransaction, now_ms: int, renew_at: int
-        ) -> List[Tuple[str, int]]:
+        ) -> list[tuple[str, int]]:
             sql = (
                 "SELECT user_id, expiration_ts_ms FROM account_validity"
                 " WHERE email_sent = FALSE AND (expiration_ts_ms - ?) <= ?"
             )
             values = [now_ms, renew_at]
             txn.execute(sql, values)
-            return cast(List[Tuple[str, int]], txn.fetchall())
+            return cast(list[tuple[str, int]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_users_expiring_soon",
             select_users_txn,
-            self._clock.time_msec(),
+            self.clock.time_msec(),
             self.config.account_validity.account_validity_renew_at,
         )
 
@@ -745,7 +744,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         await self.db_pool.runInteraction("set_shadow_banned", set_shadow_banned_txn)
 
     async def set_user_type(
-        self, user: UserID, user_type: Optional[Union[UserTypes, str]]
+        self, user: UserID, user_type: UserTypes | str | None
     ) -> None:
         """Sets the user type.
 
@@ -766,7 +765,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
     def _query_for_auth(
         self, txn: LoggingTransaction, token: str
-    ) -> Optional[TokenLookupResult]:
+    ) -> TokenLookupResult | None:
         sql = """
             SELECT users.name as user_id,
                 users.is_guest,
@@ -858,17 +857,17 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         )
         return True if res == UserTypes.SUPPORT else False
 
-    async def get_users_by_id_case_insensitive(self, user_id: str) -> Dict[str, str]:
+    async def get_users_by_id_case_insensitive(self, user_id: str) -> dict[str, str]:
         """Gets users that match user_id case insensitively.
 
         Returns:
              A mapping of user_id -> password_hash.
         """
 
-        def f(txn: LoggingTransaction) -> Dict[str, str]:
+        def f(txn: LoggingTransaction) -> dict[str, str]:
             sql = "SELECT name, password_hash FROM users WHERE lower(name) = lower(?)"
             txn.execute(sql, (user_id,))
-            result = cast(List[Tuple[str, str]], txn.fetchall())
+            result = cast(list[tuple[str, str]], txn.fetchall())
             return dict(result)
 
         return await self.db_pool.runInteraction("get_users_by_id_case_insensitive", f)
@@ -978,7 +977,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
     async def replace_user_external_id(
         self,
-        record_external_ids: List[Tuple[str, str]],
+        record_external_ids: list[tuple[str, str]],
         user_id: str,
     ) -> None:
         """Replace mappings from external user ids to a mxid in a single transaction.
@@ -1027,7 +1026,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
     @cached()
     async def get_user_by_external_id(
         self, auth_provider: str, external_id: str
-    ) -> Optional[str]:
+    ) -> str | None:
         """Look up a user by their external auth id
 
         Args:
@@ -1045,7 +1044,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             desc="get_user_by_external_id",
         )
 
-    async def get_external_ids_by_user(self, mxid: str) -> List[Tuple[str, str]]:
+    async def get_external_ids_by_user(self, mxid: str) -> list[tuple[str, str]]:
         """Look up external ids for the given user
 
         Args:
@@ -1055,7 +1054,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             Tuples of (auth_provider, external_id)
         """
         return cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="user_external_ids",
                 keyvalues={"user_id": mxid},
@@ -1075,7 +1074,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
         return await self.db_pool.runInteraction("count_users", _count_users)
 
-    async def count_daily_user_type(self) -> Dict[str, int]:
+    async def count_daily_user_type(self) -> dict[str, int]:
         """
         Counts 1) native non guest users
                2) native guests users
@@ -1083,8 +1082,8 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         who registered on the homeserver in the past 24 hours
         """
 
-        def _count_daily_user_type(txn: LoggingTransaction) -> Dict[str, int]:
-            yesterday = int(self._clock.time()) - (60 * 60 * 24)
+        def _count_daily_user_type(txn: LoggingTransaction) -> dict[str, int]:
+            yesterday = int(self.clock.time()) - (60 * 60 * 24)
 
             sql = """
                 SELECT user_type, COUNT(*) AS count FROM (
@@ -1116,7 +1115,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
                 WHERE appservice_id IS NULL
             """
             )
-            (count,) = cast(Tuple[int], txn.fetchone())
+            (count,) = cast(tuple[int], txn.fetchone())
             return count
 
         return await self.db_pool.runInteraction("count_users", _count_users)
@@ -1145,7 +1144,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
         return str(next_id)
 
-    async def get_user_id_by_threepid(self, medium: str, address: str) -> Optional[str]:
+    async def get_user_id_by_threepid(self, medium: str, address: str) -> str | None:
         """Returns user id from threepid
 
         Args:
@@ -1163,7 +1162,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
     def get_user_id_by_threepid_txn(
         self, txn: LoggingTransaction, medium: str, address: str
-    ) -> Optional[str]:
+    ) -> str | None:
         """Returns user id from threepid
 
         Args:
@@ -1196,9 +1195,9 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             {"user_id": user_id, "validated_at": validated_at, "added_at": added_at},
         )
 
-    async def user_get_threepids(self, user_id: str) -> List[ThreepidResult]:
+    async def user_get_threepids(self, user_id: str) -> list[ThreepidResult]:
         results = cast(
-            List[Tuple[str, str, int, int]],
+            list[tuple[str, str, int, int]],
             await self.db_pool.simple_select_list(
                 "user_threepids",
                 keyvalues={"user_id": user_id},
@@ -1253,7 +1252,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             desc="add_user_bound_threepid",
         )
 
-    async def user_get_bound_threepids(self, user_id: str) -> List[Tuple[str, str]]:
+    async def user_get_bound_threepids(self, user_id: str) -> list[tuple[str, str]]:
         """Get the threepids that a user has bound to an identity server through the homeserver
         The homeserver remembers where binds to an identity server occurred. Using this
         method can retrieve those threepids.
@@ -1267,7 +1266,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
                 address: The address of the threepid (e.g "bob@example.com")
         """
         return cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="user_threepid_id_server",
                 keyvalues={"user_id": user_id},
@@ -1302,7 +1301,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
     async def get_id_servers_user_bound(
         self, user_id: str, medium: str, address: str
-    ) -> List[str]:
+    ) -> list[str]:
         """Get the list of identity servers that the server proxied bind
         requests to for given user and threepid
 
@@ -1386,12 +1385,12 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
     async def get_threepid_validation_session(
         self,
-        medium: Optional[str],
+        medium: str | None,
         client_secret: str,
-        address: Optional[str] = None,
-        sid: Optional[str] = None,
-        validated: Optional[bool] = True,
-    ) -> Optional[ThreepidValidationSession]:
+        address: str | None = None,
+        sid: str | None = None,
+        validated: bool | None = True,
+    ) -> ThreepidValidationSession | None:
         """Gets a session_id and last_send_attempt (if available) for a
         combination of validation metadata
 
@@ -1425,7 +1424,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
         def get_threepid_validation_session_txn(
             txn: LoggingTransaction,
-        ) -> Optional[ThreepidValidationSession]:
+        ) -> ThreepidValidationSession | None:
             sql = """
                 SELECT address, session_id, medium, client_secret,
                 last_send_attempt, validated_at
@@ -1496,7 +1495,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         await self.db_pool.runInteraction(
             "cull_expired_threepid_validation_tokens",
             cull_expired_threepid_validation_tokens_txn,
-            self._clock.time_msec(),
+            self.clock.time_msec(),
         )
 
     @wrap_as_background_process("account_validity_set_expiration_dates")
@@ -1537,7 +1536,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
                 random value in the [now + period - d ; now + period] range, d being a
                 delta equal to 10% of the validity period.
         """
-        now_ms = self._clock.time_msec()
+        now_ms = self.clock.time_msec()
         assert self._account_validity_period is not None
         expiration_ts = now_ms + self._account_validity_period
 
@@ -1555,7 +1554,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             values={"expiration_ts_ms": expiration_ts, "email_sent": False},
         )
 
-    async def get_user_pending_deactivation(self) -> Optional[str]:
+    async def get_user_pending_deactivation(self) -> str | None:
         """
         Gets one user from the table of users waiting to be parted from all the rooms
         they're in.
@@ -1608,7 +1607,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         Raises:
             StoreError if there was a problem updating this.
         """
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
 
         await self.db_pool.simple_update_one(
             "access_tokens",
@@ -1639,7 +1638,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         uses_allowed, pending, completed, expiry_time = res
 
         # Check if the token has expired
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
         if expiry_time and expiry_time < now:
             return False
 
@@ -1686,7 +1685,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         """
 
         def _use_registration_token_txn(txn: LoggingTransaction) -> None:
-            # Normally, res is Optional[Dict[str, Any]].
+            # Normally, res is dict[str, Any] | None.
             # Override type because the return type is only optional if
             # allow_none is True, and we don't want mypy throwing errors
             # about None not being indexable.
@@ -1715,8 +1714,8 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         )
 
     async def get_registration_tokens(
-        self, valid: Optional[bool] = None
-    ) -> List[Tuple[str, Optional[int], int, int, Optional[int]]]:
+        self, valid: bool | None = None
+    ) -> list[tuple[str, int | None, int, int, int | None]]:
         """List all registration tokens. Used by the admin API.
 
         Args:
@@ -1734,8 +1733,8 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         """
 
         def select_registration_tokens_txn(
-            txn: LoggingTransaction, now: int, valid: Optional[bool]
-        ) -> List[Tuple[str, Optional[int], int, int, Optional[int]]]:
+            txn: LoggingTransaction, now: int, valid: bool | None
+        ) -> list[tuple[str, int | None, int, int, int | None]]:
             if valid is None:
                 # Return all tokens regardless of validity
                 txn.execute(
@@ -1765,17 +1764,17 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
                 txn.execute(sql, [now])
 
             return cast(
-                List[Tuple[str, Optional[int], int, int, Optional[int]]], txn.fetchall()
+                list[tuple[str, int | None, int, int, int | None]], txn.fetchall()
             )
 
         return await self.db_pool.runInteraction(
             "select_registration_tokens",
             select_registration_tokens_txn,
-            self._clock.time_msec(),
+            self.clock.time_msec(),
             valid,
         )
 
-    async def get_one_registration_token(self, token: str) -> Optional[Dict[str, Any]]:
+    async def get_one_registration_token(self, token: str) -> dict[str, Any] | None:
         """Get info about the given registration token. Used by the admin API.
 
         Args:
@@ -1801,9 +1800,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             "expiry_time": row[4],
         }
 
-    async def generate_registration_token(
-        self, length: int, chars: str
-    ) -> Optional[str]:
+    async def generate_registration_token(self, length: int, chars: str) -> str | None:
         """Generate a random registration token. Used by the admin API.
 
         Args:
@@ -1843,7 +1840,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         )
 
     async def create_registration_token(
-        self, token: str, uses_allowed: Optional[int], expiry_time: Optional[int]
+        self, token: str, uses_allowed: int | None, expiry_time: int | None
     ) -> bool:
         """Create a new registration token. Used by the admin API.
 
@@ -1892,8 +1889,8 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         )
 
     async def update_registration_token(
-        self, token: str, updatevalues: Dict[str, Optional[int]]
-    ) -> Optional[Dict[str, Any]]:
+        self, token: str, updatevalues: dict[str, int | None]
+    ) -> dict[str, Any] | None:
         """Update a registration token. Used by the admin API.
 
         Args:
@@ -1909,7 +1906,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
         def _update_registration_token_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Dict[str, Any]]:
+        ) -> dict[str, Any] | None:
             try:
                 self.db_pool.simple_update_one_txn(
                     txn,
@@ -1996,14 +1993,12 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             desc="mark_access_token_as_used",
         )
 
-    async def lookup_refresh_token(
-        self, token: str
-    ) -> Optional[RefreshTokenLookupResult]:
+    async def lookup_refresh_token(self, token: str) -> RefreshTokenLookupResult | None:
         """Lookup a refresh token with hints about its validity."""
 
         def _lookup_refresh_token_txn(
             txn: LoggingTransaction,
-        ) -> Optional[RefreshTokenLookupResult]:
+        ) -> RefreshTokenLookupResult | None:
             txn.execute(
                 """
                 SELECT
@@ -2097,65 +2092,13 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             "replace_refresh_token", _replace_refresh_token_txn
         )
 
-    async def set_device_for_refresh_token(
-        self, user_id: str, old_device_id: str, device_id: str
-    ) -> None:
-        """Moves refresh tokens from old device to current device
-
-        Args:
-            user_id: The user of the devices.
-            old_device_id: The old device.
-            device_id: The new device ID.
-        Returns:
-            None
-        """
-
-        await self.db_pool.simple_update(
-            "refresh_tokens",
-            keyvalues={"user_id": user_id, "device_id": old_device_id},
-            updatevalues={"device_id": device_id},
-            desc="set_device_for_refresh_token",
-        )
-
-    def _set_device_for_access_token_txn(
-        self, txn: LoggingTransaction, token: str, device_id: str
-    ) -> str:
-        old_device_id = self.db_pool.simple_select_one_onecol_txn(
-            txn, "access_tokens", {"token": token}, "device_id"
-        )
-
-        self.db_pool.simple_update_txn(
-            txn, "access_tokens", {"token": token}, {"device_id": device_id}
-        )
-
-        self._invalidate_cache_and_stream(txn, self.get_user_by_access_token, (token,))
-
-        return old_device_id
-
-    async def set_device_for_access_token(self, token: str, device_id: str) -> str:
-        """Sets the device ID associated with an access token.
-
-        Args:
-            token: The access token to modify.
-            device_id: The new device ID.
-        Returns:
-            The old device ID associated with the access token.
-        """
-
-        return await self.db_pool.runInteraction(
-            "set_device_for_access_token",
-            self._set_device_for_access_token_txn,
-            token,
-            device_id,
-        )
-
     async def add_login_token_to_user(
         self,
         user_id: str,
         token: str,
         expiry_ts: int,
-        auth_provider_id: Optional[str],
-        auth_provider_session_id: Optional[str],
+        auth_provider_id: str | None,
+        auth_provider_session_id: str | None,
     ) -> None:
         """Adds a short-term login token for the given user.
 
@@ -2251,7 +2194,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             "consume_login_token",
             self._consume_login_token,
             token,
-            self._clock.time_msec(),
+            self.clock.time_msec(),
         )
 
     async def invalidate_login_tokens_by_session_id(
@@ -2271,7 +2214,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
                 "auth_provider_id": auth_provider_id,
                 "auth_provider_session_id": auth_provider_session_id,
             },
-            updatevalues={"used_ts": self._clock.time_msec()},
+            updatevalues={"used_ts": self.clock.time_msec()},
             desc="invalidate_login_tokens_by_session_id",
         )
 
@@ -2455,9 +2398,9 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
     async def user_delete_access_tokens(
         self,
         user_id: str,
-        except_token_id: Optional[int] = None,
-        device_id: Optional[str] = None,
-    ) -> List[Tuple[str, int, Optional[str]]]:
+        except_token_id: int | None = None,
+        device_id: str | None = None,
+    ) -> list[tuple[str, int, str | None]]:
         """
         Invalidate access and refresh tokens belonging to a user
 
@@ -2471,14 +2414,14 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             A tuple of (token, token id, device id) for each of the deleted tokens
         """
 
-        def f(txn: LoggingTransaction) -> List[Tuple[str, int, Optional[str]]]:
+        def f(txn: LoggingTransaction) -> list[tuple[str, int, str | None]]:
             keyvalues = {"user_id": user_id}
             if device_id is not None:
                 keyvalues["device_id"] = device_id
 
             items = keyvalues.items()
             where_clause = " AND ".join(k + " = ?" for k, _ in items)
-            values: List[Union[str, int]] = [v for _, v in items]
+            values: list[str | int] = [v for _, v in items]
             # Conveniently, refresh_tokens and access_tokens both use the user_id and device_id fields. Only caveat
             # is the `except_token_id` param that is tricky to get right, so for now we're just using the same where
             # clause and values before we handle that. This seems to be only used in the "set password" handler.
@@ -2517,7 +2460,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         self,
         user_id: str,
         device_ids: StrCollection,
-    ) -> List[Tuple[str, int, Optional[str]]]:
+    ) -> list[tuple[str, int, str | None]]:
         """
         Invalidate access and refresh tokens belonging to a user
 
@@ -2530,7 +2473,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
 
         def user_delete_access_tokens_for_devices_txn(
             txn: LoggingTransaction, batch_device_ids: StrCollection
-        ) -> List[Tuple[str, int, Optional[str]]]:
+        ) -> list[tuple[str, int, str | None]]:
             self.db_pool.simple_delete_many_txn(
                 txn,
                 table="refresh_tokens",
@@ -2544,31 +2487,13 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
             )
             args.append(user_id)
 
-            if self.database_engine.supports_returning:
-                sql = f"""
-                    DELETE FROM access_tokens
-                    WHERE {clause} AND user_id = ?
-                    RETURNING token, id, device_id
-                """
-                txn.execute(sql, args)
-                tokens_and_devices = txn.fetchall()
-            else:
-                tokens_and_devices = self.db_pool.simple_select_many_txn(
-                    txn,
-                    table="access_tokens",
-                    column="device_id",
-                    iterable=batch_device_ids,
-                    keyvalues={"user_id": user_id},
-                    retcols=("token", "id", "device_id"),
-                )
-
-                self.db_pool.simple_delete_many_txn(
-                    txn,
-                    table="access_tokens",
-                    keyvalues={"user_id": user_id},
-                    column="device_id",
-                    values=batch_device_ids,
-                )
+            sql = f"""
+                DELETE FROM access_tokens
+                WHERE {clause} AND user_id = ?
+                RETURNING token, id, device_id
+            """
+            txn.execute(sql, args)
+            tokens_and_devices = txn.fetchall()
 
             self._invalidate_cache_and_stream_bulk(
                 txn,
@@ -2601,7 +2526,7 @@ class RegistrationWorkerStore(StatsStore, CacheInvalidationWorkerStore):
         await self.db_pool.runInteraction("delete_access_token", f)
 
     async def user_set_password_hash(
-        self, user_id: str, password_hash: Optional[str]
+        self, user_id: str, password_hash: str | None
     ) -> None:
         """
         NB. This does *not* evict any cache because the one use for this
@@ -2640,7 +2565,6 @@ class RegistrationBackgroundUpdateStore(RegistrationWorkerStore):
     ):
         super().__init__(database, db_conn, hs)
 
-        self._clock = hs.get_clock()
         self.config = hs.config
 
         self.db_pool.updates.register_background_index_update(
@@ -2687,7 +2611,7 @@ class RegistrationBackgroundUpdateStore(RegistrationWorkerStore):
 
         def _background_update_set_deactivated_flag_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[bool, int]:
+        ) -> tuple[bool, int]:
             txn.execute(
                 """
                 SELECT
@@ -2761,18 +2685,18 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
 
         # Create a background job for removing expired login tokens
         if hs.config.worker.run_background_tasks:
-            self._clock.looping_call(
-                self._delete_expired_login_tokens, THIRTY_MINUTES_IN_MS
+            self.clock.looping_call(
+                self._delete_expired_login_tokens, Duration(minutes=30)
             )
 
     async def add_access_token_to_user(
         self,
         user_id: str,
         token: str,
-        device_id: Optional[str],
-        valid_until_ms: Optional[int],
-        puppets_user_id: Optional[str] = None,
-        refresh_token_id: Optional[int] = None,
+        device_id: str | None,
+        valid_until_ms: int | None,
+        puppets_user_id: str | None = None,
+        refresh_token_id: int | None = None,
     ) -> int:
         """Adds an access token for the given user.
 
@@ -2790,7 +2714,7 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
             The token ID
         """
         next_id = self._access_tokens_id_gen.get_next()
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
 
         await self.db_pool.simple_insert(
             "access_tokens",
@@ -2814,9 +2738,9 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
         self,
         user_id: str,
         token: str,
-        device_id: Optional[str],
-        expiry_ts: Optional[int],
-        ultimate_session_expiry_ts: Optional[int],
+        device_id: str | None,
+        expiry_ts: int | None,
+        ultimate_session_expiry_ts: int | None,
     ) -> int:
         """Adds a refresh token for the given user.
 
@@ -2874,7 +2798,7 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
                 keyvalues={"name": user_id},
                 updatevalues={
                     "consent_version": consent_version,
-                    "consent_ts": self._clock.time_msec(),
+                    "consent_ts": self.clock.time_msec(),
                 },
             )
             self._invalidate_cache_and_stream(txn, self.get_user_by_id, (user_id,))
@@ -2908,7 +2832,7 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
 
     async def validate_threepid_session(
         self, session_id: str, client_secret: str, token: str, current_ts: int
-    ) -> Optional[str]:
+    ) -> str | None:
         """Attempt to validate a threepid session using a token
 
         Args:
@@ -2928,7 +2852,7 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
         """
 
         # Insert everything into a transaction in order to run atomically
-        def validate_threepid_session_txn(txn: LoggingTransaction) -> Optional[str]:
+        def validate_threepid_session_txn(txn: LoggingTransaction) -> str | None:
             row = self.db_pool.simple_select_one_txn(
                 txn,
                 table="threepid_validation_session",
@@ -2986,7 +2910,7 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
                 txn,
                 table="threepid_validation_session",
                 keyvalues={"session_id": session_id},
-                updatevalues={"validated_at": self._clock.time_msec()},
+                updatevalues={"validated_at": self.clock.time_msec()},
             )
 
             return next_link
@@ -3003,7 +2927,7 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
         session_id: str,
         client_secret: str,
         send_attempt: int,
-        next_link: Optional[str],
+        next_link: str | None,
         token: str,
         token_expires: int,
     ) -> None:
@@ -3064,7 +2988,7 @@ class RegistrationStore(RegistrationBackgroundUpdateStore):
 
         # We keep the expired tokens for an extra 5 minutes so we can measure how many
         # times a token is being used after its expiry
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
         await self.db_pool.runInteraction(
             "delete_expired_login_tokens",
             _delete_expired_login_tokens_txn,
diff --git a/synapse/storage/databases/main/rejections.py b/synapse/storage/databases/main/rejections.py
index a603258644..c73c3d761d 100644
--- a/synapse/storage/databases/main/rejections.py
+++ b/synapse/storage/databases/main/rejections.py
@@ -20,7 +20,6 @@
 #
 
 import logging
-from typing import Optional
 
 from synapse.storage._base import SQLBaseStore
 
@@ -28,7 +27,7 @@ logger = logging.getLogger(__name__)
 
 
 class RejectionsStore(SQLBaseStore):
-    async def get_rejection_reason(self, event_id: str) -> Optional[str]:
+    async def get_rejection_reason(self, event_id: str) -> str | None:
         return await self.db_pool.simple_select_one_onecol(
             table="rejections",
             retcol="reason",
diff --git a/synapse/storage/databases/main/relations.py b/synapse/storage/databases/main/relations.py
index 5edac56ec3..9d9c37e2a4 100644
--- a/synapse/storage/databases/main/relations.py
+++ b/synapse/storage/databases/main/relations.py
@@ -22,16 +22,9 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Collection,
-    Dict,
-    FrozenSet,
     Iterable,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -53,7 +46,7 @@ from synapse.storage.databases.main.stream import (
     generate_pagination_where_clause,
 )
 from synapse.storage.engines import PostgresEngine
-from synapse.types import JsonDict, MultiWriterStreamToken, StreamKeyType, StreamToken
+from synapse.types import JsonDict, StreamKeyType, StreamToken
 from synapse.util.caches.descriptors import cached, cachedList
 
 if TYPE_CHECKING:
@@ -172,14 +165,14 @@ class RelationsWorkerStore(SQLBaseStore):
         room_id: str,
         event_id: str,
         event: EventBase,
-        relation_type: Optional[str] = None,
-        event_type: Optional[str] = None,
+        relation_type: str | None = None,
+        event_type: str | None = None,
         limit: int = 5,
         direction: Direction = Direction.BACKWARDS,
-        from_token: Optional[StreamToken] = None,
-        to_token: Optional[StreamToken] = None,
+        from_token: StreamToken | None = None,
+        to_token: StreamToken | None = None,
         recurse: bool = False,
-    ) -> Tuple[Sequence[_RelatedEvent], Optional[StreamToken]]:
+    ) -> tuple[Sequence[_RelatedEvent], StreamToken | None]:
         """Get a list of relations for an event, ordered by topological ordering.
 
         Args:
@@ -209,7 +202,7 @@ class RelationsWorkerStore(SQLBaseStore):
         assert limit >= 0
 
         where_clause = ["room_id = ?"]
-        where_args: List[Union[str, int]] = [room_id]
+        where_args: list[str | int] = [room_id]
         is_redacted = event.internal_metadata.is_redacted()
 
         if relation_type is not None:
@@ -281,14 +274,14 @@ class RelationsWorkerStore(SQLBaseStore):
 
         def _get_recent_references_for_event_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[_RelatedEvent], Optional[StreamToken]]:
+        ) -> tuple[list[_RelatedEvent], StreamToken | None]:
             txn.execute(sql, [event.event_id] + where_args + [limit + 1])
 
             events = []
-            topo_orderings: List[int] = []
-            stream_orderings: List[int] = []
+            topo_orderings: list[int] = []
+            stream_orderings: list[int] = []
             for event_id, relation_type, sender, topo_ordering, stream_ordering in cast(
-                List[Tuple[str, str, str, int, int]], txn
+                list[tuple[str, str, str, int, int]], txn
             ):
                 # Do not include edits for redacted events as they leak event
                 # content.
@@ -316,17 +309,8 @@ class RelationsWorkerStore(SQLBaseStore):
                         StreamKeyType.ROOM, next_key
                     )
                 else:
-                    next_token = StreamToken(
-                        room_key=next_key,
-                        presence_key=0,
-                        typing_key=0,
-                        receipt_key=MultiWriterStreamToken(stream=0),
-                        account_data_key=0,
-                        push_rules_key=0,
-                        to_device_key=0,
-                        device_list_key=MultiWriterStreamToken(stream=0),
-                        groups_key=0,
-                        un_partial_stated_rooms_key=0,
+                    next_token = StreamToken.START.copy_and_replace(
+                        StreamKeyType.ROOM, next_key
                     )
 
             return events[:limit], next_token
@@ -338,8 +322,8 @@ class RelationsWorkerStore(SQLBaseStore):
     async def get_all_relations_for_event_with_types(
         self,
         event_id: str,
-        relation_types: List[str],
-    ) -> List[str]:
+        relation_types: list[str],
+    ) -> list[str]:
         """Get the event IDs of all events that have a relation to the given event with
         one of the given relation types.
 
@@ -354,9 +338,9 @@ class RelationsWorkerStore(SQLBaseStore):
 
         def get_all_relation_ids_for_event_with_types_txn(
             txn: LoggingTransaction,
-        ) -> List[str]:
+        ) -> list[str]:
             rows = cast(
-                List[Tuple[str]],
+                list[tuple[str]],
                 self.db_pool.simple_select_many_txn(
                     txn=txn,
                     table="event_relations",
@@ -377,7 +361,7 @@ class RelationsWorkerStore(SQLBaseStore):
     async def get_all_relations_for_event(
         self,
         event_id: str,
-    ) -> List[str]:
+    ) -> list[str]:
         """Get the event IDs of all events that have a relation to the given event.
 
         Args:
@@ -389,9 +373,9 @@ class RelationsWorkerStore(SQLBaseStore):
 
         def get_all_relation_ids_for_event_txn(
             txn: LoggingTransaction,
-        ) -> List[str]:
+        ) -> list[str]:
             rows = cast(
-                List[Tuple[str]],
+                list[tuple[str]],
                 self.db_pool.simple_select_list_txn(
                     txn=txn,
                     table="event_relations",
@@ -471,13 +455,13 @@ class RelationsWorkerStore(SQLBaseStore):
         return result is not None
 
     @cached()  # type: ignore[synapse-@cached-mutable]
-    async def get_references_for_event(self, event_id: str) -> List[JsonDict]:
+    async def get_references_for_event(self, event_id: str) -> list[JsonDict]:
         raise NotImplementedError()
 
     @cachedList(cached_method_name="get_references_for_event", list_name="event_ids")
     async def get_references_for_events(
         self, event_ids: Collection[str]
-    ) -> Mapping[str, Optional[Sequence[_RelatedEvent]]]:
+    ) -> Mapping[str, Sequence[_RelatedEvent] | None]:
         """Get a list of references to the given events.
 
         Args:
@@ -507,12 +491,12 @@ class RelationsWorkerStore(SQLBaseStore):
 
         def _get_references_for_events_txn(
             txn: LoggingTransaction,
-        ) -> Mapping[str, List[_RelatedEvent]]:
+        ) -> Mapping[str, list[_RelatedEvent]]:
             txn.execute(sql, args)
 
-            result: Dict[str, List[_RelatedEvent]] = {}
+            result: dict[str, list[_RelatedEvent]] = {}
             for relates_to_id, event_id, sender in cast(
-                List[Tuple[str, str, str]], txn
+                list[tuple[str, str, str]], txn
             ):
                 result.setdefault(relates_to_id, []).append(
                     _RelatedEvent(event_id, sender)
@@ -525,14 +509,14 @@ class RelationsWorkerStore(SQLBaseStore):
         )
 
     @cached()  # type: ignore[synapse-@cached-mutable]
-    def get_applicable_edit(self, event_id: str) -> Optional[EventBase]:
+    def get_applicable_edit(self, event_id: str) -> EventBase | None:
         raise NotImplementedError()
 
     # TODO: This returns a mutable object, which is generally bad.
     @cachedList(cached_method_name="get_applicable_edit", list_name="event_ids")  # type: ignore[synapse-@cached-mutable]
     async def get_applicable_edits(
         self, event_ids: Collection[str]
-    ) -> Mapping[str, Optional[EventBase]]:
+    ) -> Mapping[str, EventBase | None]:
         """Get the most recent edit (if any) that has happened for the given
         events.
 
@@ -587,14 +571,14 @@ class RelationsWorkerStore(SQLBaseStore):
                 ORDER by edit.origin_server_ts, edit.event_id
             """
 
-        def _get_applicable_edits_txn(txn: LoggingTransaction) -> Dict[str, str]:
+        def _get_applicable_edits_txn(txn: LoggingTransaction) -> dict[str, str]:
             clause, args = make_in_list_sql_clause(
                 txn.database_engine, "relates_to_id", event_ids
             )
             args.append(RelationTypes.REPLACE)
 
             txn.execute(sql % (clause,), args)
-            return dict(cast(Iterable[Tuple[str, str]], txn.fetchall()))
+            return dict(cast(Iterable[tuple[str, str]], txn.fetchall()))
 
         edit_ids = await self.db_pool.runInteraction(
             "get_applicable_edits", _get_applicable_edits_txn
@@ -612,14 +596,14 @@ class RelationsWorkerStore(SQLBaseStore):
         }
 
     @cached()  # type: ignore[synapse-@cached-mutable]
-    def get_thread_summary(self, event_id: str) -> Optional[Tuple[int, EventBase]]:
+    def get_thread_summary(self, event_id: str) -> tuple[int, EventBase] | None:
         raise NotImplementedError()
 
     # TODO: This returns a mutable object, which is generally bad.
     @cachedList(cached_method_name="get_thread_summary", list_name="event_ids")  # type: ignore[synapse-@cached-mutable]
     async def get_thread_summaries(
         self, event_ids: Collection[str]
-    ) -> Mapping[str, Optional[Tuple[int, EventBase]]]:
+    ) -> Mapping[str, tuple[int, EventBase] | None]:
         """Get the number of threaded replies and the latest reply (if any) for the given events.
 
         Args:
@@ -636,7 +620,7 @@ class RelationsWorkerStore(SQLBaseStore):
 
         def _get_thread_summaries_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[Dict[str, int], Dict[str, str]]:
+        ) -> tuple[dict[str, int], dict[str, str]]:
             # Fetch the count of threaded events and the latest event ID.
             # TODO Should this only allow m.room.message events.
             if isinstance(self.database_engine, PostgresEngine):
@@ -707,7 +691,7 @@ class RelationsWorkerStore(SQLBaseStore):
             args.append(RelationTypes.THREAD)
 
             txn.execute(sql % (clause,), args)
-            counts = dict(cast(List[Tuple[str, int]], txn.fetchall()))
+            counts = dict(cast(list[tuple[str, int]], txn.fetchall()))
 
             return counts, latest_event_ids
 
@@ -735,8 +719,8 @@ class RelationsWorkerStore(SQLBaseStore):
     async def get_threaded_messages_per_user(
         self,
         event_ids: Collection[str],
-        users: FrozenSet[str] = frozenset(),
-    ) -> Dict[Tuple[str, str], int]:
+        users: frozenset[str] = frozenset(),
+    ) -> dict[tuple[str, str], int]:
         """Get the number of threaded replies for a set of users.
 
         This is used, in conjunction with get_thread_summaries, to calculate an
@@ -768,7 +752,7 @@ class RelationsWorkerStore(SQLBaseStore):
 
         def _get_threaded_messages_per_user_txn(
             txn: LoggingTransaction,
-        ) -> Dict[Tuple[str, str], int]:
+        ) -> dict[tuple[str, str], int]:
             users_sql, users_args = make_in_list_sql_clause(
                 self.database_engine, "child.sender", users
             )
@@ -808,7 +792,7 @@ class RelationsWorkerStore(SQLBaseStore):
             user participated in that event's thread, otherwise false.
         """
 
-        def _get_threads_participated_txn(txn: LoggingTransaction) -> Set[str]:
+        def _get_threads_participated_txn(txn: LoggingTransaction) -> set[str]:
             # Fetch whether the requester has participated or not.
             sql = """
                 SELECT DISTINCT relates_to_id
@@ -839,10 +823,10 @@ class RelationsWorkerStore(SQLBaseStore):
 
     async def events_have_relations(
         self,
-        parent_ids: List[str],
-        relation_senders: Optional[List[str]],
-        relation_types: Optional[List[str]],
-    ) -> List[str]:
+        parent_ids: list[str],
+        relation_senders: list[str] | None,
+        relation_types: list[str] | None,
+    ) -> list[str]:
         """Check which events have a relationship from the given senders of the
         given types.
 
@@ -865,8 +849,8 @@ class RelationsWorkerStore(SQLBaseStore):
                 %s;
         """
 
-        def _get_if_events_have_relations(txn: LoggingTransaction) -> List[str]:
-            clauses: List[str] = []
+        def _get_if_events_have_relations(txn: LoggingTransaction) -> list[str]:
+            clauses: list[str] = []
             clause, args = make_in_list_sql_clause(
                 txn.database_engine, "relates_to_id", parent_ids
             )
@@ -944,8 +928,8 @@ class RelationsWorkerStore(SQLBaseStore):
         self,
         room_id: str,
         limit: int = 5,
-        from_token: Optional[ThreadsNextBatch] = None,
-    ) -> Tuple[Sequence[str], Optional[ThreadsNextBatch]]:
+        from_token: ThreadsNextBatch | None = None,
+    ) -> tuple[Sequence[str], ThreadsNextBatch | None]:
         """Get a list of thread IDs, ordered by topological ordering of their
         latest reply.
 
@@ -985,10 +969,10 @@ class RelationsWorkerStore(SQLBaseStore):
 
         def _get_threads_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[str], Optional[ThreadsNextBatch]]:
+        ) -> tuple[list[str], ThreadsNextBatch | None]:
             txn.execute(sql, (room_id, *pagination_args, limit + 1))
 
-            rows = cast(List[Tuple[str, int, int]], txn.fetchall())
+            rows = cast(list[tuple[str, int, int]], txn.fetchall())
             thread_ids = [r[0] for r in rows]
 
             # If there are more events, generate the next pagination key from the
diff --git a/synapse/storage/databases/main/room.py b/synapse/storage/databases/main/room.py
index 6ffc3aed34..7ac88e4c2a 100644
--- a/synapse/storage/databases/main/room.py
+++ b/synapse/storage/databases/main/room.py
@@ -27,13 +27,7 @@ from typing import (
     AbstractSet,
     Any,
     Collection,
-    Dict,
-    List,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -65,8 +59,8 @@ from synapse.storage.databases.main.cache import CacheInvalidationWorkerStore
 from synapse.storage.types import Cursor
 from synapse.storage.util.id_generators import IdGenerator, MultiWriterIdGenerator
 from synapse.types import JsonDict, RetentionPolicy, StrCollection, ThirdPartyInstanceID
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached, cachedList
+from synapse.util.json import json_encoder
 from synapse.util.stringutils import MXC_REGEX
 
 if TYPE_CHECKING:
@@ -86,24 +80,24 @@ class RatelimitOverride:
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class LargestRoomStats:
     room_id: str
-    name: Optional[str]
-    canonical_alias: Optional[str]
+    name: str | None
+    canonical_alias: str | None
     joined_members: int
-    join_rules: Optional[str]
-    guest_access: Optional[str]
-    history_visibility: Optional[str]
+    join_rules: str | None
+    guest_access: str | None
+    history_visibility: str | None
     state_events: int
-    avatar: Optional[str]
-    topic: Optional[str]
-    room_type: Optional[str]
+    avatar: str | None
+    topic: str | None
+    room_type: str | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class RoomStats(LargestRoomStats):
     joined_local_members: int
-    version: Optional[str]
-    creator: Optional[str]
-    encryption: Optional[str]
+    version: str | None
+    creator: str | None
+    encryption: str | None
     federatable: bool
     public: bool
 
@@ -138,8 +132,8 @@ class RoomSortOrder(Enum):
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class PartialStateResyncInfo:
-    joined_via: Optional[str]
-    servers_in_room: Set[str] = attr.ib(factory=set)
+    joined_via: str | None
+    servers_in_room: set[str] = attr.ib(factory=set)
 
 
 class RoomWorkerStore(CacheInvalidationWorkerStore):
@@ -209,7 +203,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             logger.error("store_room with room_id=%s failed: %s", room_id, e)
             raise StoreError(500, "Problem creating room.")
 
-    async def get_room(self, room_id: str) -> Optional[Tuple[bool, bool]]:
+    async def get_room(self, room_id: str) -> tuple[bool, bool] | None:
         """Retrieve a room.
 
         Args:
@@ -222,7 +216,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             or None if the room is unknown.
         """
         row = cast(
-            Optional[Tuple[Optional[Union[int, bool]], Optional[Union[int, bool]]]],
+            tuple[int | bool | None, int | bool | None] | None,
             await self.db_pool.simple_select_one(
                 table="rooms",
                 keyvalues={"room_id": room_id},
@@ -235,7 +229,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             return row
         return bool(row[0]), bool(row[1])
 
-    async def get_room_with_stats(self, room_id: str) -> Optional[RoomStats]:
+    async def get_room_with_stats(self, room_id: str) -> RoomStats | None:
         """Retrieve room with statistics.
 
         Args:
@@ -246,7 +240,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def get_room_with_stats_txn(
             txn: LoggingTransaction, room_id: str
-        ) -> Optional[RoomStats]:
+        ) -> RoomStats | None:
             sql = """
                 SELECT room_id, state.name, state.canonical_alias, curr.joined_members,
                   curr.local_users_in_room AS joined_local_members, rooms.room_version AS version,
@@ -287,7 +281,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             "get_room_with_stats", get_room_with_stats_txn, room_id
         )
 
-    async def get_public_room_ids(self) -> List[str]:
+    async def get_public_room_ids(self) -> list[str]:
         return await self.db_pool.simple_select_onecol(
             table="rooms",
             keyvalues={"is_public": True},
@@ -296,8 +290,8 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         )
 
     def _construct_room_type_where_clause(
-        self, room_types: Union[List[Union[str, None]], None]
-    ) -> Tuple[Union[str, None], list]:
+        self, room_types: list[str | None] | None
+    ) -> tuple[str | None, list]:
         if not room_types:
             return None, []
 
@@ -324,9 +318,9 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
     async def count_public_rooms(
         self,
-        network_tuple: Optional[ThirdPartyInstanceID],
+        network_tuple: ThirdPartyInstanceID | None,
         ignore_non_federatable: bool,
-        search_filter: Optional[dict],
+        search_filter: dict | None,
     ) -> int:
         """Counts the number of public rooms as tracked in the room_stats_current
         and room_stats_state table.
@@ -387,7 +381,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             """
 
             txn.execute(sql, query_args)
-            return cast(Tuple[int], txn.fetchone())[0]
+            return cast(tuple[int], txn.fetchone())[0]
 
         return await self.db_pool.runInteraction(
             "count_public_rooms", _count_public_rooms_txn
@@ -399,20 +393,20 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         def f(txn: LoggingTransaction) -> int:
             sql = "SELECT count(*)  FROM rooms"
             txn.execute(sql)
-            row = cast(Tuple[int], txn.fetchone())
+            row = cast(tuple[int], txn.fetchone())
             return row[0]
 
         return await self.db_pool.runInteraction("get_rooms", f)
 
     async def get_largest_public_rooms(
         self,
-        network_tuple: Optional[ThirdPartyInstanceID],
-        search_filter: Optional[dict],
-        limit: Optional[int],
-        bounds: Optional[Tuple[int, str]],
+        network_tuple: ThirdPartyInstanceID | None,
+        search_filter: dict | None,
+        limit: int | None,
+        bounds: tuple[int, str] | None,
         forwards: bool,
         ignore_non_federatable: bool = False,
-    ) -> List[LargestRoomStats]:
+    ) -> list[LargestRoomStats]:
         """Gets the largest public rooms (where largest is in terms of joined
         members, as tracked in the statistics table).
 
@@ -433,7 +427,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         """
 
         where_clauses = []
-        query_args: List[Union[str, int]] = []
+        query_args: list[str | int] = []
 
         if network_tuple:
             if network_tuple.appservice_id:
@@ -549,7 +543,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def _get_largest_public_rooms_txn(
             txn: LoggingTransaction,
-        ) -> List[LargestRoomStats]:
+        ) -> list[LargestRoomStats]:
             txn.execute(sql, query_args)
 
             results = [
@@ -579,7 +573,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         )
 
     @cached(max_entries=10000)
-    async def is_room_blocked(self, room_id: str) -> Optional[bool]:
+    async def is_room_blocked(self, room_id: str) -> bool | None:
         return await self.db_pool.simple_select_one_onecol(
             table="blocked_rooms",
             keyvalues={"room_id": room_id},
@@ -588,7 +582,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             desc="is_room_blocked",
         )
 
-    async def room_is_blocked_by(self, room_id: str) -> Optional[str]:
+    async def room_is_blocked_by(self, room_id: str) -> str | None:
         """
         Function to retrieve user who has blocked the room.
         user_id is non-nullable
@@ -608,10 +602,10 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         limit: int,
         order_by: str,
         reverse_order: bool,
-        search_term: Optional[str],
-        public_rooms: Optional[bool],
-        empty_rooms: Optional[bool],
-    ) -> Tuple[List[Dict[str, Any]], int]:
+        search_term: str | None,
+        public_rooms: bool | None,
+        empty_rooms: bool | None,
+    ) -> tuple[list[dict[str, Any]], int]:
         """Function to retrieve a paginated list of rooms as json.
 
         Args:
@@ -760,7 +754,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def _get_rooms_paginate_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Dict[str, Any]], int]:
+        ) -> tuple[list[dict[str, Any]], int]:
             # Add the search term into the WHERE clause
             # and execute the data query
             txn.execute(info_sql, where_args + [limit, start])
@@ -795,7 +789,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             # Add the search term into the WHERE clause if present
             txn.execute(count_sql, where_args)
 
-            room_count = cast(Tuple[int], txn.fetchone())
+            room_count = cast(tuple[int], txn.fetchone())
             return rooms, room_count[0]
 
         return await self.db_pool.runInteraction(
@@ -804,7 +798,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         )
 
     @cached(max_entries=10000)
-    async def get_ratelimit_for_user(self, user_id: str) -> Optional[RatelimitOverride]:
+    async def get_ratelimit_for_user(self, user_id: str) -> RatelimitOverride | None:
         """Check if there are any overrides for ratelimiting for the given user
 
         Args:
@@ -909,7 +903,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def get_retention_policy_for_room_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Tuple[Optional[int], Optional[int]]]:
+        ) -> tuple[int | None, int | None] | None:
             txn.execute(
                 """
                 SELECT min_lifetime, max_lifetime FROM room_retention
@@ -919,7 +913,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
                 (room_id,),
             )
 
-            return cast(Optional[Tuple[Optional[int], Optional[int]]], txn.fetchone())
+            return cast(tuple[int | None, int | None] | None, txn.fetchone())
 
         ret = await self.db_pool.runInteraction(
             "get_retention_policy_for_room",
@@ -951,7 +945,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             max_lifetime=max_lifetime,
         )
 
-    async def get_media_mxcs_in_room(self, room_id: str) -> Tuple[List[str], List[str]]:
+    async def get_media_mxcs_in_room(self, room_id: str) -> tuple[list[str], list[str]]:
         """Retrieves all the local and remote media MXC URIs in a given room
 
         Args:
@@ -963,7 +957,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def _get_media_mxcs_in_room_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[str], List[str]]:
+        ) -> tuple[list[str], list[str]]:
             local_mxcs, remote_mxcs = self._get_media_mxcs_in_room_txn(txn, room_id)
             local_media_mxcs = []
             remote_media_mxcs = []
@@ -1001,7 +995,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
     def _get_media_mxcs_in_room_txn(
         self, txn: LoggingTransaction, room_id: str
-    ) -> Tuple[List[str], List[Tuple[str, str]]]:
+    ) -> tuple[list[str], list[tuple[str, str]]]:
         """Retrieves all the local and remote media MXC URIs in a given room
 
         Returns:
@@ -1062,7 +1056,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         self,
         server_name: str,
         media_id: str,
-        quarantined_by: Optional[str],
+        quarantined_by: str | None,
     ) -> int:
         """quarantines or unquarantines a single local or remote media id
 
@@ -1107,7 +1101,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
     def _get_media_ids_by_user_txn(
         self, txn: LoggingTransaction, user_id: str, filter_quarantined: bool = True
-    ) -> List[str]:
+    ) -> list[str]:
         """Retrieves local media IDs by a given user
 
         Args:
@@ -1137,9 +1131,9 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
     def _quarantine_local_media_txn(
         self,
         txn: LoggingTransaction,
-        hashes: Set[str],
-        media_ids: Set[str],
-        quarantined_by: Optional[str],
+        hashes: set[str],
+        media_ids: set[str],
+        quarantined_by: str | None,
     ) -> int:
         """Quarantine and unquarantine local media items.
 
@@ -1192,9 +1186,9 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
     def _quarantine_remote_media_txn(
         self,
         txn: LoggingTransaction,
-        hashes: Set[str],
-        media: Set[Tuple[str, str]],
-        quarantined_by: Optional[str],
+        hashes: set[str],
+        media: set[tuple[str, str]],
+        quarantined_by: str | None,
     ) -> int:
         """Quarantine and unquarantine remote items
 
@@ -1223,7 +1217,6 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             txn.execute(sql, [quarantined_by] + sql_args)
             total_media_quarantined += txn.rowcount if txn.rowcount > 0 else 0
 
-        total_media_quarantined = 0
         if hashes:
             sql_many_clause_sql, sql_many_clause_args = make_in_list_sql_clause(
                 txn.database_engine, "sha256", hashes
@@ -1240,9 +1233,9 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
     def _quarantine_media_txn(
         self,
         txn: LoggingTransaction,
-        local_mxcs: List[str],
-        remote_mxcs: List[Tuple[str, str]],
-        quarantined_by: Optional[str],
+        local_mxcs: list[str],
+        remote_mxcs: list[tuple[str, str]],
+        quarantined_by: str | None,
     ) -> int:
         """Quarantine and unquarantine local and remote media items
 
@@ -1345,8 +1338,8 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         )
 
     async def get_rooms_for_retention_period_in_range(
-        self, min_ms: Optional[int], max_ms: Optional[int], include_null: bool = False
-    ) -> Dict[str, RetentionPolicy]:
+        self, min_ms: int | None, max_ms: int | None, include_null: bool = False
+    ) -> dict[str, RetentionPolicy]:
         """Retrieves all of the rooms within the given retention range.
 
         Optionally includes the rooms which don't have a retention policy.
@@ -1368,7 +1361,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def get_rooms_for_retention_period_in_range_txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, RetentionPolicy]:
+        ) -> dict[str, RetentionPolicy]:
             range_conditions = []
             args = []
 
@@ -1425,7 +1418,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
     async def get_partial_state_servers_at_join(
         self, room_id: str
-    ) -> Optional[AbstractSet[str]]:
+    ) -> AbstractSet[str] | None:
         """Gets the set of servers in a partial state room at the time we joined it.
 
         Returns:
@@ -1464,10 +1457,10 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             A dictionary of rooms with partial state, with room IDs as keys and
             lists of servers in rooms as values.
         """
-        room_servers: Dict[str, PartialStateResyncInfo] = {}
+        room_servers: dict[str, PartialStateResyncInfo] = {}
 
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="partial_state_rooms",
                 keyvalues={},
@@ -1480,7 +1473,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             room_servers[room_id] = PartialStateResyncInfo(joined_via=joined_via)
 
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 "partial_state_rooms_servers",
                 keyvalues=None,
@@ -1533,7 +1526,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         """
 
         rows = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.db_pool.simple_select_many_batch(
                 table="partial_state_rooms",
                 column="room_id",
@@ -1571,7 +1564,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
     async def get_join_event_id_and_device_lists_stream_id_for_partial_state(
         self, room_id: str
-    ) -> Tuple[str, int]:
+    ) -> tuple[str, int]:
         """Get the event ID of the initial join that started the partial
         join, and the device list stream ID at the point we started the partial
         join.
@@ -1583,7 +1576,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         """
 
         return cast(
-            Tuple[str, int],
+            tuple[str, int],
             await self.db_pool.simple_select_one(
                 table="partial_state_rooms",
                 keyvalues={"room_id": room_id},
@@ -1602,7 +1595,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
     async def get_un_partial_stated_rooms_between(
         self, last_id: int, current_id: int, room_ids: Collection[str]
-    ) -> Set[str]:
+    ) -> set[str]:
         """Get all rooms that got un partial stated between `last_id` exclusive and
         `current_id` inclusive.
 
@@ -1615,7 +1608,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def _get_un_partial_stated_rooms_between_txn(
             txn: LoggingTransaction,
-        ) -> Set[str]:
+        ) -> set[str]:
             sql = """
                 SELECT DISTINCT room_id FROM un_partial_stated_room_stream
                 WHERE ? < stream_id AND stream_id <= ? AND
@@ -1636,7 +1629,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
     async def get_un_partial_stated_rooms_from_stream(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, Tuple[str]]], int, bool]:
+    ) -> tuple[list[tuple[int, tuple[str]]], int, bool]:
         """Get updates for un partial stated rooms replication stream.
 
         Args:
@@ -1663,7 +1656,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def get_un_partial_stated_rooms_from_stream_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[int, Tuple[str]]], int, bool]:
+        ) -> tuple[list[tuple[int, tuple[str]]], int, bool]:
             sql = """
                 SELECT stream_id, room_id
                 FROM un_partial_stated_room_stream
@@ -1686,7 +1679,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
             get_un_partial_stated_rooms_from_stream_txn,
         )
 
-    async def get_event_report(self, report_id: int) -> Optional[Dict[str, Any]]:
+    async def get_event_report(self, report_id: int) -> dict[str, Any] | None:
         """Retrieve an event report
 
         Args:
@@ -1698,7 +1691,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def _get_event_report_txn(
             txn: LoggingTransaction, report_id: int
-        ) -> Optional[Dict[str, Any]]:
+        ) -> dict[str, Any] | None:
             sql = """
                 SELECT
                     er.id,
@@ -1752,10 +1745,10 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
         start: int,
         limit: int,
         direction: Direction = Direction.BACKWARDS,
-        user_id: Optional[str] = None,
-        room_id: Optional[str] = None,
-        event_sender_user_id: Optional[str] = None,
-    ) -> Tuple[List[Dict[str, Any]], int]:
+        user_id: str | None = None,
+        room_id: str | None = None,
+        event_sender_user_id: str | None = None,
+    ) -> tuple[list[dict[str, Any]], int]:
         """Retrieve a paginated list of event reports
 
         Args:
@@ -1775,9 +1768,9 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
 
         def _get_event_reports_paginate_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Dict[str, Any]], int]:
+        ) -> tuple[list[dict[str, Any]], int]:
             filters = []
-            args: List[object] = []
+            args: list[object] = []
 
             if user_id:
                 filters.append("er.user_id LIKE ?")
@@ -1810,7 +1803,7 @@ class RoomWorkerStore(CacheInvalidationWorkerStore):
                 {}
                 """.format(where_clause)
             txn.execute(sql, args)
-            count = cast(Tuple[int], txn.fetchone())[0]
+            count = cast(tuple[int], txn.fetchone())[0]
 
             sql = """
                 SELECT
@@ -2214,7 +2207,7 @@ class RoomBackgroundUpdateStore(RoomWorkerStore):
 
         last_room = progress.get("room_id", "")
 
-        def _get_rooms(txn: LoggingTransaction) -> List[str]:
+        def _get_rooms(txn: LoggingTransaction) -> list[str]:
             txn.execute(
                 """
                 SELECT room_id
@@ -2460,7 +2453,7 @@ class RoomStore(RoomBackgroundUpdateStore, RoomWorkerStore):
         self._instance_name = hs.get_instance_name()
 
     async def upsert_room_on_join(
-        self, room_id: str, room_version: RoomVersion, state_events: List[EventBase]
+        self, room_id: str, room_version: RoomVersion, state_events: list[EventBase]
     ) -> None:
         """Ensure that the room is stored in the table
 
@@ -2606,7 +2599,7 @@ class RoomStore(RoomBackgroundUpdateStore, RoomWorkerStore):
         room_id: str,
         event_id: str,
         user_id: str,
-        reason: Optional[str],
+        reason: str | None,
         content: JsonDict,
         received_ts: int,
     ) -> int:
@@ -2700,7 +2693,7 @@ class RoomStore(RoomBackgroundUpdateStore, RoomWorkerStore):
         )
         return next_id
 
-    async def clear_partial_state_room(self, room_id: str) -> Optional[int]:
+    async def clear_partial_state_room(self, room_id: str) -> int | None:
         """Clears the partial state flag for a room.
 
         Args:
diff --git a/synapse/storage/databases/main/roommember.py b/synapse/storage/databases/main/roommember.py
index 67e7e99baa..736f3e4c78 100644
--- a/synapse/storage/databases/main/roommember.py
+++ b/synapse/storage/databases/main/roommember.py
@@ -24,16 +24,9 @@ from typing import (
     TYPE_CHECKING,
     AbstractSet,
     Collection,
-    Dict,
-    FrozenSet,
     Iterable,
-    List,
     Mapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -70,6 +63,7 @@ from synapse.types import (
     get_domain_from_id,
 )
 from synapse.util.caches.descriptors import _CacheContext, cached, cachedList
+from synapse.util.duration import Duration
 from synapse.util.iterutils import batch_iter
 from synapse.util.metrics import Measure
 
@@ -84,6 +78,13 @@ _CURRENT_STATE_MEMBERSHIP_UPDATE_NAME = "current_state_events_membership"
 _POPULATE_PARTICIPANT_BG_UPDATE_BATCH_SIZE = 1000
 
 
+federation_known_servers_gauge = LaterGauge(
+    name="synapse_federation_known_servers",
+    desc="",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
+
 @attr.s(frozen=True, slots=True, auto_attribs=True)
 class EventIdMembership:
     """Returned by `get_membership_from_event_ids`"""
@@ -110,17 +111,15 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
             self._known_servers_count = 1
             self.hs.get_clock().looping_call(
                 self._count_known_servers,
-                60 * 1000,
+                Duration(minutes=1),
             )
             self.hs.get_clock().call_later(
-                1,
+                Duration(seconds=1),
                 self._count_known_servers,
             )
-            LaterGauge(
-                name="synapse_federation_known_servers",
-                desc="",
-                labelnames=[SERVER_NAME_LABEL],
-                caller=lambda: {(self.server_name,): self._known_servers_count},
+            federation_known_servers_gauge.register_hook(
+                homeserver_instance_id=hs.get_instance_id(),
+                hook=lambda: {(self.server_name,): self._known_servers_count},
             )
 
     @wrap_as_background_process("_count_known_servers")
@@ -182,7 +181,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
             desc="get_users_in_room",
         )
 
-    def get_users_in_room_txn(self, txn: LoggingTransaction, room_id: str) -> List[str]:
+    def get_users_in_room_txn(self, txn: LoggingTransaction, room_id: str) -> list[str]:
         """Returns a list of users in the room."""
 
         return self.db_pool.simple_select_onecol_txn(
@@ -237,7 +236,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def _get_subset_users_in_room_with_profiles(
             txn: LoggingTransaction,
-        ) -> Dict[str, ProfileInfo]:
+        ) -> dict[str, ProfileInfo]:
             clause, ids = make_in_list_sql_clause(
                 self.database_engine, "c.state_key", user_ids
             )
@@ -282,7 +281,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def _get_users_in_room_with_profiles(
             txn: LoggingTransaction,
-        ) -> Dict[str, ProfileInfo]:
+        ) -> dict[str, ProfileInfo]:
             sql = """
                 SELECT state_key, display_name, avatar_url FROM room_memberships as m
                 INNER JOIN current_state_events as c
@@ -323,14 +322,14 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def _get_room_summary_txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, MemberSummary]:
+        ) -> dict[str, MemberSummary]:
             # first get counts.
             # We do this all in one transaction to keep the cache small.
             # FIXME: get rid of this when we have room_stats
 
             counts = self._get_member_counts_txn(txn, room_id)
 
-            res: Dict[str, MemberSummary] = {}
+            res: dict[str, MemberSummary] = {}
             for membership, count in counts.items():
                 res.setdefault(membership, MemberSummary([], count))
 
@@ -387,7 +386,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     def _get_member_counts_txn(
         self, txn: LoggingTransaction, room_id: str
-    ) -> Dict[str, int]:
+    ) -> dict[str, int]:
         """Get a mapping of number of users by membership"""
 
         # Note, rejected events will have a null membership field, so
@@ -446,7 +445,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_invite_for_local_user_in_room(
         self, user_id: str, room_id: str
-    ) -> Optional[RoomsForUser]:
+    ) -> RoomsForUser | None:
         """Gets the invite for the given *local* user and room.
 
         Args:
@@ -468,7 +467,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         user_id: str,
         membership_list: Collection[str],
         excluded_rooms: StrCollection = (),
-    ) -> List[RoomsForUser]:
+    ) -> list[RoomsForUser]:
         """Get all the rooms for this *local* user where the membership for this user
         matches one in the membership list.
 
@@ -531,8 +530,8 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         self,
         txn: LoggingTransaction,
         user_id: str,
-        membership_list: List[str],
-    ) -> List[RoomsForUser]:
+        membership_list: list[str],
+    ) -> list[RoomsForUser]:
         """Get all the rooms for this *local* user where the membership for this user
         matches one in the membership list.
 
@@ -598,12 +597,12 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_local_users_related_to_room(
         self, room_id: str
-    ) -> List[Tuple[str, str]]:
+    ) -> list[tuple[str, str]]:
         """
         Retrieves a list of the current roommembers who are local to the server and their membership status.
         """
         return cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="local_current_membership",
                 keyvalues={"room_id": room_id},
@@ -655,7 +654,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_local_current_membership_for_user_in_room(
         self, user_id: str, room_id: str
-    ) -> Tuple[Optional[str], Optional[str]]:
+    ) -> tuple[str | None, str | None]:
         """Retrieve the current local membership state and event ID for a user in a room.
 
         Args:
@@ -672,7 +671,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
             raise SynapseError(HTTPStatus.BAD_REQUEST, message, errcode=Codes.BAD_JSON)
 
         results = cast(
-            Optional[Tuple[str, str]],
+            tuple[str, str] | None,
             await self.db_pool.simple_select_one(
                 "local_current_membership",
                 {"room_id": room_id, "user_id": user_id},
@@ -688,7 +687,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_users_server_still_shares_room_with(
         self, user_ids: Collection[str]
-    ) -> Set[str]:
+    ) -> set[str]:
         """Given a list of users return the set that the server still share a
         room with.
         """
@@ -706,7 +705,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         self,
         txn: LoggingTransaction,
         user_ids: Collection[str],
-    ) -> Set[str]:
+    ) -> set[str]:
         if not user_ids:
             return set()
 
@@ -729,7 +728,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_rooms_user_currently_banned_from(
         self, user_id: str
-    ) -> FrozenSet[str]:
+    ) -> frozenset[str]:
         """Returns a set of room_ids the user is currently banned from.
 
         If a remote user only returns rooms this server is currently
@@ -748,8 +747,29 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         return frozenset(room_ids)
 
+    async def get_memberships_for_user(self, user_id: str) -> dict[str, str]:
+        """Returns a dict of room_id to membership state for a given user.
+
+        If a remote user only returns rooms this server is currently
+        participating in.
+        """
+
+        rows = cast(
+            list[tuple[str, str]],
+            await self.db_pool.simple_select_list(
+                "current_state_events",
+                keyvalues={
+                    "type": EventTypes.Member,
+                    "state_key": user_id,
+                },
+                retcols=["room_id", "membership"],
+                desc="get_memberships_for_user",
+            ),
+        )
+        return dict(rows)
+
     @cached(max_entries=500000, iterable=True)
-    async def get_rooms_for_user(self, user_id: str) -> FrozenSet[str]:
+    async def get_rooms_for_user(self, user_id: str) -> frozenset[str]:
         """Returns a set of room_ids the user is currently joined to.
 
         If a remote user only returns rooms this server is currently
@@ -775,7 +795,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
     )
     async def _get_rooms_for_users(
         self, user_ids: Collection[str]
-    ) -> Mapping[str, FrozenSet[str]]:
+    ) -> Mapping[str, frozenset[str]]:
         """A batched version of `get_rooms_for_user`.
 
         Returns:
@@ -783,7 +803,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         """
 
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_many_batch(
                 table="current_state_events",
                 column="state_key",
@@ -800,7 +820,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
             ),
         )
 
-        user_rooms: Dict[str, Set[str]] = {user_id: set() for user_id in user_ids}
+        user_rooms: dict[str, set[str]] = {user_id: set() for user_id in user_ids}
 
         for state_key, room_id in rows:
             user_rooms[state_key].add(room_id)
@@ -809,11 +829,11 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_rooms_for_users(
         self, user_ids: Collection[str]
-    ) -> Dict[str, FrozenSet[str]]:
+    ) -> dict[str, frozenset[str]]:
         """A batched wrapper around `_get_rooms_for_users`, to prevent locking
         other calls to `get_rooms_for_user` for large user lists.
         """
-        all_user_rooms: Dict[str, FrozenSet[str]] = {}
+        all_user_rooms: dict[str, frozenset[str]] = {}
 
         # 250 users is pretty arbitrary but the data can be quite large if users
         # are in many rooms.
@@ -833,7 +853,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
     )
     async def _do_users_share_a_room(
         self, user_id: str, other_user_ids: Collection[str]
-    ) -> Mapping[str, Optional[bool]]:
+    ) -> Mapping[str, bool | None]:
         """Return mapping from user ID to whether they share a room with the
         given user.
 
@@ -843,7 +863,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def do_users_share_a_room_txn(
             txn: LoggingTransaction, user_ids: Collection[str]
-        ) -> Dict[str, bool]:
+        ) -> dict[str, bool]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "state_key", user_ids
             )
@@ -877,7 +897,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def do_users_share_a_room(
         self, user_id: str, other_user_ids: Collection[str]
-    ) -> Set[str]:
+    ) -> set[str]:
         """Return the set of users who share a room with the first users"""
 
         user_dict = await self._do_users_share_a_room(user_id, other_user_ids)
@@ -896,7 +916,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
     )
     async def _do_users_share_a_room_joined_or_invited(
         self, user_id: str, other_user_ids: Collection[str]
-    ) -> Mapping[str, Optional[bool]]:
+    ) -> Mapping[str, bool | None]:
         """Return mapping from user ID to whether they share a room with the
         given user via being either joined or invited.
 
@@ -906,7 +926,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def do_users_share_a_room_joined_or_invited_txn(
             txn: LoggingTransaction, user_ids: Collection[str]
-        ) -> Dict[str, bool]:
+        ) -> dict[str, bool]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "state_key", user_ids
             )
@@ -942,7 +962,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def do_users_share_a_room_joined_or_invited(
         self, user_id: str, other_user_ids: Collection[str]
-    ) -> Set[str]:
+    ) -> set[str]:
         """Return the set of users who share a room with the first users via being either joined or invited"""
 
         user_dict = await self._do_users_share_a_room_joined_or_invited(
@@ -951,11 +971,11 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         return {u for u, share_room in user_dict.items() if share_room}
 
-    async def get_users_who_share_room_with_user(self, user_id: str) -> Set[str]:
+    async def get_users_who_share_room_with_user(self, user_id: str) -> set[str]:
         """Returns the set of users who share a room with `user_id`"""
         room_ids = await self.get_rooms_for_user(user_id)
 
-        user_who_share_room: Set[str] = set()
+        user_who_share_room: set[str] = set()
         for room_id in room_ids:
             user_ids = await self.get_users_in_room(room_id)
             user_who_share_room.update(user_ids)
@@ -964,8 +984,8 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     @cached(cache_context=True, iterable=True)
     async def get_mutual_rooms_between_users(
-        self, user_ids: FrozenSet[str], cache_context: _CacheContext
-    ) -> FrozenSet[str]:
+        self, user_ids: frozenset[str], cache_context: _CacheContext
+    ) -> frozenset[str]:
         """
         Returns the set of rooms that all users in `user_ids` share.
 
@@ -974,7 +994,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
               overlapping joined rooms for.
             cache_context
         """
-        shared_room_ids: Optional[FrozenSet[str]] = None
+        shared_room_ids: frozenset[str] | None = None
         for user_id in user_ids:
             room_ids = await self.get_rooms_for_user(
                 user_id, on_invalidate=cache_context.invalidate
@@ -988,7 +1008,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_joined_user_ids_from_state(
         self, room_id: str, state: StateMap[str]
-    ) -> Set[str]:
+    ) -> set[str]:
         """
         For a given set of state IDs, get a set of user IDs in the room.
 
@@ -997,7 +1017,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         """
 
         with Measure(
-            self._clock,
+            self.clock,
             name="get_joined_user_ids_from_state",
             server_name=self.server_name,
         ):
@@ -1012,7 +1032,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
             # We don't update the event cache hit ratio as it completely throws off
             # the hit ratio counts. After all, we don't populate the cache if we
             # miss it here
-            event_map = self._get_events_from_local_cache(
+            event_map = await self._get_events_from_local_cache(
                 member_event_ids, update_metrics=False
             )
 
@@ -1045,7 +1065,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
     )
     def _get_user_id_from_membership_event_id(
         self, event_id: str
-    ) -> Optional[Tuple[str, ProfileInfo]]:
+    ) -> tuple[str, ProfileInfo] | None:
         raise NotImplementedError()
 
     @cachedList(
@@ -1054,7 +1074,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
     )
     async def _get_user_ids_from_membership_event_ids(
         self, event_ids: Iterable[str]
-    ) -> Mapping[str, Optional[str]]:
+    ) -> Mapping[str, str | None]:
         """For given set of member event_ids check if they point to a join
         event.
 
@@ -1066,7 +1086,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         """
 
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_many_batch(
                 table="room_memberships",
                 column="event_id",
@@ -1143,7 +1163,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         # For PostgreSQL we can use a regex to pull out the domains from the
         # joined users in `current_state_events` via regex.
 
-        def get_current_hosts_in_room_txn(txn: LoggingTransaction) -> Set[str]:
+        def get_current_hosts_in_room_txn(txn: LoggingTransaction) -> set[str]:
             sql = """
                 SELECT DISTINCT substring(state_key FROM '@[^:]*:(.*)$')
                 FROM current_state_events
@@ -1160,7 +1180,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         )
 
     @cached(iterable=True, max_entries=10000)
-    async def get_current_hosts_in_room_ordered(self, room_id: str) -> Tuple[str, ...]:
+    async def get_current_hosts_in_room_ordered(self, room_id: str) -> tuple[str, ...]:
         """
         Get current hosts in room based on current state.
 
@@ -1196,7 +1216,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def get_current_hosts_in_room_ordered_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[str, ...]:
+        ) -> tuple[str, ...]:
             # Returns a list of servers currently joined in the room sorted by
             # longest in the room first (aka. with the lowest depth). The
             # heuristic of sorting by servers who have been in the room the
@@ -1229,7 +1249,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def _get_approximate_current_memberships_in_room(
         self, room_id: str
-    ) -> Mapping[str, Optional[str]]:
+    ) -> Mapping[str, str | None]:
         """Build a map from event id to membership, for all events in the current state.
 
         The event ids of non-memberships events (e.g. `m.room.power_levels`) are present
@@ -1240,7 +1260,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         """
 
         rows = cast(
-            List[Tuple[str, Optional[str]]],
+            list[tuple[str, str | None]],
             await self.db_pool.simple_select_list(
                 "current_state_events",
                 keyvalues={"room_id": room_id},
@@ -1292,7 +1312,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
             The forgotten rooms.
         """
 
-        def _get_forgotten_rooms_for_user_txn(txn: LoggingTransaction) -> Set[str]:
+        def _get_forgotten_rooms_for_user_txn(txn: LoggingTransaction) -> set[str]:
             # This is a slightly convoluted query that first looks up all rooms
             # that the user has forgotten in the past, then rechecks that list
             # to see if any have subsequently been updated. This is done so that
@@ -1343,7 +1363,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         # If any rows still exist it means someone has not forgotten this room yet
         return not rows[0][0]
 
-    async def get_rooms_user_has_been_in(self, user_id: str) -> Set[str]:
+    async def get_rooms_user_has_been_in(self, user_id: str) -> set[str]:
         """Get all rooms that the user has ever been in.
 
         Args:
@@ -1364,7 +1384,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_membership_event_ids_for_user(
         self, user_id: str, room_id: str
-    ) -> Set[str]:
+    ) -> set[str]:
         """Get all event_ids for the given user and room.
 
         Args:
@@ -1387,7 +1407,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
     @cached(max_entries=5000)
     async def _get_membership_from_event_id(
         self, member_event_id: str
-    ) -> Optional[EventIdMembership]:
+    ) -> EventIdMembership | None:
         raise NotImplementedError()
 
     @cachedList(
@@ -1395,7 +1415,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
     )
     async def get_membership_from_event_ids(
         self, member_event_ids: Iterable[str]
-    ) -> Mapping[str, Optional[EventIdMembership]]:
+    ) -> Mapping[str, EventIdMembership | None]:
         """Get user_id and membership of a set of event IDs.
 
         Returns:
@@ -1404,7 +1424,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         """
 
         rows = cast(
-            List[Tuple[str, str, str]],
+            list[tuple[str, str, str]],
             await self.db_pool.simple_select_many_batch(
                 table="room_memberships",
                 column="event_id",
@@ -1528,7 +1548,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def _txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, RoomsForUserSlidingSync]:
+        ) -> dict[str, RoomsForUserSlidingSync]:
             # XXX: If you use any new columns that can change (like from
             # `sliding_sync_joined_rooms` or `forgotten`), make sure to bust the
             # `get_sliding_sync_rooms_for_user_from_membership_snapshots` cache in the
@@ -1577,7 +1597,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
         self,
         user_id: str,
         to_token: StreamToken,
-    ) -> Dict[str, RoomsForUserSlidingSync]:
+    ) -> dict[str, RoomsForUserSlidingSync]:
         """
         Get all the self-leave rooms for a user after the `to_token` (outside the token
         range) that are potentially relevant[1] and needed to handle a sliding sync
@@ -1609,7 +1629,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def _txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, RoomsForUserSlidingSync]:
+        ) -> dict[str, RoomsForUserSlidingSync]:
             sql = """
                 SELECT m.room_id, m.sender, m.membership, m.membership_event_id,
                     r.room_version,
@@ -1636,7 +1656,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
             txn.execute(sql, (user_id, min_to_token_position))
 
             # Map from room_id to membership info
-            room_membership_for_user_map: Dict[str, RoomsForUserSlidingSync] = {}
+            room_membership_for_user_map: dict[str, RoomsForUserSlidingSync] = {}
             for row in txn:
                 room_for_user = RoomsForUserSlidingSync(
                     room_id=row[0],
@@ -1680,12 +1700,12 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_sliding_sync_room_for_user(
         self, user_id: str, room_id: str
-    ) -> Optional[RoomsForUserSlidingSync]:
+    ) -> RoomsForUserSlidingSync | None:
         """Get the sliding sync room entry for the given user and room."""
 
         def get_sliding_sync_room_for_user_txn(
             txn: LoggingTransaction,
-        ) -> Optional[RoomsForUserSlidingSync]:
+        ) -> RoomsForUserSlidingSync | None:
             sql = """
                 SELECT m.room_id, m.sender, m.membership, m.membership_event_id,
                     r.room_version,
@@ -1723,7 +1743,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_sliding_sync_room_for_user_batch(
         self, user_id: str, room_ids: StrCollection
-    ) -> Dict[str, RoomsForUserSlidingSync]:
+    ) -> dict[str, RoomsForUserSlidingSync]:
         """Get the sliding sync room entry for the given user and rooms."""
 
         if not room_ids:
@@ -1731,7 +1751,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
         def get_sliding_sync_room_for_user_batch_txn(
             txn: LoggingTransaction,
-        ) -> Dict[str, RoomsForUserSlidingSync]:
+        ) -> dict[str, RoomsForUserSlidingSync]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "m.room_id", room_ids
             )
@@ -1774,7 +1794,7 @@ class RoomMemberWorkerStore(EventsWorkerStore, CacheInvalidationWorkerStore):
 
     async def get_rooms_for_user_by_date(
         self, user_id: str, from_ts: int
-    ) -> FrozenSet[str]:
+    ) -> frozenset[str]:
         """
         Fetch a list of rooms that the user has joined at or after the given timestamp, including
         those they subsequently have left/been banned from.
@@ -1988,7 +2008,7 @@ class RoomMemberBackgroundUpdateStore(SQLBaseStore):
 
         def _background_current_state_membership_txn(
             txn: LoggingTransaction, last_processed_room: str
-        ) -> Tuple[int, bool]:
+        ) -> tuple[int, bool]:
             processed = 0
             while processed < batch_size:
                 txn.execute(
@@ -2058,7 +2078,7 @@ class RoomMemberStore(
 
 def extract_heroes_from_room_summary(
     details: Mapping[str, MemberSummary], me: str
-) -> List[str]:
+) -> list[str]:
     """Determine the users that represent a room, from the perspective of the `me` user.
 
     This function expects `MemberSummary.members` to already be sorted by
@@ -2100,13 +2120,13 @@ class _JoinedHostsCache:
     """The cached data used by the `_get_joined_hosts_cache`."""
 
     # Dict of host to the set of their users in the room at the state group.
-    hosts_to_joined_users: Dict[str, Set[str]] = attr.Factory(dict)
+    hosts_to_joined_users: dict[str, set[str]] = attr.Factory(dict)
 
     # The state group `hosts_to_joined_users` is derived from. Will be an object
     # if the instance is newly created or if the state is not based on a state
     # group. (An object is used as a sentinel value to ensure that it never is
     # equal to anything else).
-    state_group: Union[object, int] = attr.Factory(object)
+    state_group: object | int = attr.Factory(object)
 
     def __len__(self) -> int:
         return sum(len(v) for v in self.hosts_to_joined_users.values())
diff --git a/synapse/storage/databases/main/search.py b/synapse/storage/databases/main/search.py
index 47dfdf64e5..d6eace5efa 100644
--- a/synapse/storage/databases/main/search.py
+++ b/synapse/storage/databases/main/search.py
@@ -28,11 +28,6 @@ from typing import (
     Any,
     Collection,
     Iterable,
-    List,
-    Optional,
-    Set,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -63,7 +58,7 @@ class SearchEntry:
     value: str
     event_id: str
     room_id: str
-    stream_ordering: Optional[int]
+    stream_ordering: int | None
     origin_server_ts: int
 
 
@@ -362,7 +357,7 @@ class SearchBackgroundUpdateStore(SearchWorkerStore):
                 pg,
             )
 
-        def reindex_search_txn(txn: LoggingTransaction) -> Tuple[int, bool]:
+        def reindex_search_txn(txn: LoggingTransaction) -> tuple[int, bool]:
             sql = """
             UPDATE event_search AS es
             SET stream_ordering = e.stream_ordering, origin_server_ts = e.origin_server_ts
@@ -451,7 +446,7 @@ class SearchStore(SearchBackgroundUpdateStore):
         """
         clauses = []
 
-        args: List[Any] = []
+        args: list[Any] = []
 
         # Make sure we don't explode because the person is in too many rooms.
         # We filter the results below regardless.
@@ -471,7 +466,7 @@ class SearchStore(SearchBackgroundUpdateStore):
         count_args = args
         count_clauses = clauses
 
-        sqlite_highlights: List[str] = []
+        sqlite_highlights: list[str] = []
 
         if isinstance(self.database_engine, PostgresEngine):
             search_query = search_term
@@ -519,7 +514,7 @@ class SearchStore(SearchBackgroundUpdateStore):
 
         # List of tuples of (rank, room_id, event_id).
         results = cast(
-            List[Tuple[Union[int, float], str, str]],
+            list[tuple[int | float, str, str]],
             await self.db_pool.execute("search_msgs", sql, *args),
         )
 
@@ -544,7 +539,7 @@ class SearchStore(SearchBackgroundUpdateStore):
 
         # List of tuples of (room_id, count).
         count_results = cast(
-            List[Tuple[str, int]],
+            list[tuple[str, int]],
             await self.db_pool.execute("search_rooms_count", count_sql, *count_args),
         )
 
@@ -565,7 +560,7 @@ class SearchStore(SearchBackgroundUpdateStore):
         search_term: str,
         keys: Iterable[str],
         limit: int,
-        pagination_token: Optional[str] = None,
+        pagination_token: str | None = None,
     ) -> JsonDict:
         """Performs a full text search over events with given keys.
 
@@ -580,7 +575,7 @@ class SearchStore(SearchBackgroundUpdateStore):
             Each match as a dictionary.
         """
         clauses = []
-        args: List[Any] = []
+        args: list[Any] = []
 
         # Make sure we don't explode because the person is in too many rooms.
         # We filter the results below regardless.
@@ -602,7 +597,7 @@ class SearchStore(SearchBackgroundUpdateStore):
         count_args = list(args)
         count_clauses = list(clauses)
 
-        sqlite_highlights: List[str] = []
+        sqlite_highlights: list[str] = []
 
         if pagination_token:
             try:
@@ -686,7 +681,7 @@ class SearchStore(SearchBackgroundUpdateStore):
 
         # List of tuples of (rank, room_id, event_id, origin_server_ts, stream_ordering).
         results = cast(
-            List[Tuple[Union[int, float], str, str, int, int]],
+            list[tuple[int | float, str, str, int, int]],
             await self.db_pool.execute("search_rooms", sql, *args),
         )
 
@@ -711,7 +706,7 @@ class SearchStore(SearchBackgroundUpdateStore):
 
         # List of tuples of (room_id, count).
         count_results = cast(
-            List[Tuple[str, int]],
+            list[tuple[str, int]],
             await self.db_pool.execute("search_rooms_count", count_sql, *count_args),
         )
 
@@ -732,8 +727,8 @@ class SearchStore(SearchBackgroundUpdateStore):
         }
 
     async def _find_highlights_in_postgres(
-        self, search_query: str, events: List[EventBase]
-    ) -> Set[str]:
+        self, search_query: str, events: list[EventBase]
+    ) -> set[str]:
         """Given a list of events and a search term, return a list of words
         that match from the content of the event.
 
@@ -748,7 +743,7 @@ class SearchStore(SearchBackgroundUpdateStore):
             A set of strings.
         """
 
-        def f(txn: LoggingTransaction) -> Set[str]:
+        def f(txn: LoggingTransaction) -> set[str]:
             highlight_words = set()
             for event in events:
                 # As a hack we simply join values of all possible keys. This is
@@ -811,7 +806,7 @@ def _to_postgres_options(options_dict: JsonDict) -> str:
 
 @dataclass
 class Phrase:
-    phrase: List[str]
+    phrase: list[str]
 
 
 class SearchToken(enum.Enum):
@@ -820,8 +815,8 @@ class SearchToken(enum.Enum):
     And = enum.auto()
 
 
-Token = Union[str, Phrase, SearchToken]
-TokenList = List[Token]
+Token = str | Phrase | SearchToken
+TokenList = list[Token]
 
 
 def _is_stop_word(word: str) -> bool:
@@ -901,7 +896,7 @@ def _tokenize_query(query: str) -> TokenList:
     return tokens
 
 
-def _tokens_to_sqlite_match_query(tokens: TokenList) -> Tuple[str, List[str]]:
+def _tokens_to_sqlite_match_query(tokens: TokenList) -> tuple[str, list[str]]:
     """
     Convert the list of tokens to a string suitable for passing to sqlite's MATCH.
     Assume sqlite was compiled with enhanced query syntax.
@@ -934,7 +929,7 @@ def _tokens_to_sqlite_match_query(tokens: TokenList) -> Tuple[str, List[str]]:
     return "".join(match_query), highlights
 
 
-def _parse_query_for_sqlite(search_term: str) -> Tuple[str, List[str]]:
+def _parse_query_for_sqlite(search_term: str) -> tuple[str, list[str]]:
     """Takes a plain unicode string from the user and converts it into a form
     that can be passed to sqllite's matchinfo().
 
diff --git a/synapse/storage/databases/main/session.py b/synapse/storage/databases/main/session.py
index 8a1331d4c8..f088a8d88c 100644
--- a/synapse/storage/databases/main/session.py
+++ b/synapse/storage/databases/main/session.py
@@ -30,7 +30,8 @@ from synapse.storage.database import (
     LoggingTransaction,
 )
 from synapse.types import JsonDict
-from synapse.util import json_encoder
+from synapse.util.duration import Duration
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -55,7 +56,7 @@ class SessionStore(SQLBaseStore):
 
         # Create a background job for culling expired sessions.
         if hs.config.worker.run_background_tasks:
-            self._clock.looping_call(self._delete_expired_sessions, 30 * 60 * 1000)
+            self.clock.looping_call(self._delete_expired_sessions, Duration(minutes=30))
 
     async def create_session(
         self, session_type: str, value: JsonDict, expiry_ms: int
@@ -133,7 +134,7 @@ class SessionStore(SQLBaseStore):
             _get_session,
             session_type,
             session_id,
-            self._clock.time_msec(),
+            self.clock.time_msec(),
         )
 
     @wrap_as_background_process("delete_expired_sessions")
@@ -147,5 +148,5 @@ class SessionStore(SQLBaseStore):
         await self.db_pool.runInteraction(
             "delete_expired_sessions",
             _delete_expired_sessions_txn,
-            self._clock.time_msec(),
+            self.clock.time_msec(),
         )
diff --git a/synapse/storage/databases/main/signatures.py b/synapse/storage/databases/main/signatures.py
index ef86151e31..8072a8c741 100644
--- a/synapse/storage/databases/main/signatures.py
+++ b/synapse/storage/databases/main/signatures.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Collection, Dict, List, Mapping, Tuple
+from typing import Collection, Mapping
 
 from unpaddedbase64 import encode_base64
 
@@ -59,7 +59,7 @@ class SignatureWorkerStore(EventsWorkerStore):
             allow_rejected=True,
         )
 
-        hashes: Dict[str, Dict[str, bytes]] = {}
+        hashes: dict[str, dict[str, bytes]] = {}
         for event_id in event_ids:
             event = events.get(event_id)
             if event is None:
@@ -72,7 +72,7 @@ class SignatureWorkerStore(EventsWorkerStore):
 
     async def add_event_hashes(
         self, event_ids: Collection[str]
-    ) -> List[Tuple[str, Dict[str, str]]]:
+    ) -> list[tuple[str, dict[str, str]]]:
         """
 
         Args:
diff --git a/synapse/storage/databases/main/sliding_sync.py b/synapse/storage/databases/main/sliding_sync.py
index 6a62b11d1e..9a09c0f9b5 100644
--- a/synapse/storage/databases/main/sliding_sync.py
+++ b/synapse/storage/databases/main/sliding_sync.py
@@ -14,29 +14,34 @@
 
 
 import logging
-from typing import TYPE_CHECKING, Dict, List, Mapping, Optional, Set, cast
+from typing import TYPE_CHECKING, AbstractSet, Mapping, cast
 
 import attr
 
 from synapse.api.errors import SlidingSyncUnknownPosition
 from synapse.logging.opentracing import log_kv
+from synapse.metrics.background_process_metrics import wrap_as_background_process
 from synapse.storage._base import SQLBaseStore, db_to_json
 from synapse.storage.database import (
     DatabasePool,
     LoggingDatabaseConnection,
     LoggingTransaction,
+    make_in_list_sql_clause,
 )
+from synapse.storage.engines import PostgresEngine
 from synapse.types import MultiWriterStreamToken, RoomStreamToken
 from synapse.types.handlers.sliding_sync import (
     HaveSentRoom,
     HaveSentRoomFlag,
     MutablePerConnectionState,
     PerConnectionState,
+    RoomLazyMembershipChanges,
     RoomStatusMap,
     RoomSyncConfig,
 )
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached
+from synapse.util.duration import Duration
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -45,6 +50,21 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+# How often to update the `last_used_ts` column on
+# `sliding_sync_connection_positions` when the client uses a connection
+# position. We don't want to update it on every use to avoid excessive
+# writes, but we want it to be reasonably up-to-date to help with
+# cleaning up old connection positions.
+UPDATE_INTERVAL_LAST_USED_TS = Duration(minutes=5)
+
+# Time in milliseconds the connection hasn't been used before we consider it
+# expired and delete it.
+CONNECTION_EXPIRY = Duration(days=7)
+
+# How often we run the background process to delete old sliding sync connections.
+CONNECTION_EXPIRY_FREQUENCY = Duration(hours=1)
+
+
 class SlidingSyncStore(SQLBaseStore):
     def __init__(
         self,
@@ -76,10 +96,16 @@ class SlidingSyncStore(SQLBaseStore):
             replaces_index="sliding_sync_membership_snapshots_user_id",
         )
 
+        if self.hs.config.worker.run_background_tasks:
+            self.clock.looping_call(
+                self.delete_old_sliding_sync_connections,
+                CONNECTION_EXPIRY_FREQUENCY,
+            )
+
     async def get_latest_bump_stamp_for_room(
         self,
         room_id: str,
-    ) -> Optional[int]:
+    ) -> int | None:
         """
         Get the `bump_stamp` for the room.
 
@@ -99,7 +125,7 @@ class SlidingSyncStore(SQLBaseStore):
         """
 
         return cast(
-            Optional[int],
+            int | None,
             await self.db_pool.simple_select_one_onecol(
                 table="sliding_sync_joined_rooms",
                 keyvalues={"room_id": room_id},
@@ -121,7 +147,7 @@ class SlidingSyncStore(SQLBaseStore):
         user_id: str,
         device_id: str,
         conn_id: str,
-        previous_connection_position: Optional[int],
+        previous_connection_position: int | None,
         per_connection_state: "MutablePerConnectionState",
     ) -> int:
         """Persist updates to the per-connection state for a sliding sync
@@ -154,7 +180,7 @@ class SlidingSyncStore(SQLBaseStore):
         user_id: str,
         device_id: str,
         conn_id: str,
-        previous_connection_position: Optional[int],
+        previous_connection_position: int | None,
         per_connection_state: "PerConnectionStateDB",
     ) -> int:
         # First we fetch (or create) the connection key associated with the
@@ -201,7 +227,8 @@ class SlidingSyncStore(SQLBaseStore):
                     "user_id": user_id,
                     "effective_device_id": device_id,
                     "conn_id": conn_id,
-                    "created_ts": self._clock.time_msec(),
+                    "created_ts": self.clock.time_msec(),
+                    "last_used_ts": self.clock.time_msec(),
                 },
                 returning=("connection_key",),
             )
@@ -212,7 +239,7 @@ class SlidingSyncStore(SQLBaseStore):
             table="sliding_sync_connection_positions",
             values={
                 "connection_key": connection_key,
-                "created_ts": self._clock.time_msec(),
+                "created_ts": self.clock.time_msec(),
             },
             returning=("connection_position",),
         )
@@ -222,7 +249,7 @@ class SlidingSyncStore(SQLBaseStore):
         # with the updates to `required_state`
 
         # Dict from required state json -> required state ID
-        required_state_to_id: Dict[str, int] = {}
+        required_state_to_id: dict[str, int] = {}
         if previous_connection_position is not None:
             rows = self.db_pool.simple_select_list_txn(
                 txn,
@@ -233,8 +260,8 @@ class SlidingSyncStore(SQLBaseStore):
             for required_state_id, required_state in rows:
                 required_state_to_id[required_state] = required_state_id
 
-        room_to_state_ids: Dict[str, int] = {}
-        unique_required_state: Dict[str, List[str]] = {}
+        room_to_state_ids: dict[str, int] = {}
+        unique_required_state: dict[str, list[str]] = {}
         for room_id, room_state in per_connection_state.room_configs.items():
             serialized_state = json_encoder.encode(
                 # We store the required state as a sorted list of event type /
@@ -349,6 +376,13 @@ class SlidingSyncStore(SQLBaseStore):
             value_values=values,
         )
 
+        self._persist_sliding_sync_connection_lazy_members_txn(
+            txn,
+            connection_key,
+            connection_position,
+            per_connection_state.room_lazy_membership,
+        )
+
         return connection_position
 
     @cached(iterable=True, max_entries=100000)
@@ -384,7 +418,7 @@ class SlidingSyncStore(SQLBaseStore):
         # The `previous_connection_position` is a user-supplied value, so we
         # need to make sure that the one they supplied is actually theirs.
         sql = """
-            SELECT connection_key
+            SELECT connection_key, last_used_ts
             FROM sliding_sync_connection_positions
             INNER JOIN sliding_sync_connections USING (connection_key)
             WHERE
@@ -396,16 +430,52 @@ class SlidingSyncStore(SQLBaseStore):
         if row is None:
             raise SlidingSyncUnknownPosition()
 
-        (connection_key,) = row
+        (connection_key, last_used_ts) = row
+
+        # Update the `last_used_ts` if it's due to be updated. We don't update
+        # every time to avoid excessive writes.
+        now = self.clock.time_msec()
+        if (
+            last_used_ts is None
+            or now - last_used_ts > UPDATE_INTERVAL_LAST_USED_TS.as_millis()
+        ):
+            self.db_pool.simple_update_txn(
+                txn,
+                table="sliding_sync_connections",
+                keyvalues={
+                    "connection_key": connection_key,
+                },
+                updatevalues={"last_used_ts": now},
+            )
 
         # Now that we have seen the client has received and used the connection
         # position, we can delete all the other connection positions.
+        #
+        # Note: the rest of the code here assumes this is the only remaining
+        # connection position.
         sql = """
             DELETE FROM sliding_sync_connection_positions
             WHERE connection_key = ? AND connection_position != ?
         """
         txn.execute(sql, (connection_key, connection_position))
 
+        # Move any lazy membership entries for this connection position to have
+        # `NULL` connection position, indicating that it applies to all future
+        # positions on this connection. This is safe because we have deleted all
+        # other (potentially forked) connection positions, and so all future
+        # positions in this connection will be a continuation of the current
+        # position. Thus any lazy membership entries we have sent down will still
+        # be valid.
+        self.db_pool.simple_update_txn(
+            txn,
+            table="sliding_sync_connection_lazy_members",
+            keyvalues={
+                "connection_key": connection_key,
+                "connection_position": connection_position,
+            },
+            updatevalues={"connection_position": None},
+        )
+
         # Fetch and create a mapping from required state ID to the actual
         # required state for the connection.
         rows = self.db_pool.simple_select_list_txn(
@@ -418,9 +488,10 @@ class SlidingSyncStore(SQLBaseStore):
             ),
         )
 
-        required_state_map: Dict[int, Dict[str, Set[str]]] = {}
+        # Map from required_state_id -> event type -> set of state keys.
+        stored_required_state_id_maps: dict[int, dict[str, set[str]]] = {}
         for row in rows:
-            state = required_state_map[row[0]] = {}
+            state = stored_required_state_id_maps[row[0]] = {}
             for event_type, state_key in db_to_json(row[1]):
                 state.setdefault(event_type, set()).add(state_key)
 
@@ -437,7 +508,7 @@ class SlidingSyncStore(SQLBaseStore):
             ),
         )
 
-        room_configs: Dict[str, RoomSyncConfig] = {}
+        room_configs: dict[str, RoomSyncConfig] = {}
         for (
             room_id,
             timeline_limit,
@@ -445,13 +516,50 @@ class SlidingSyncStore(SQLBaseStore):
         ) in room_config_rows:
             room_configs[room_id] = RoomSyncConfig(
                 timeline_limit=timeline_limit,
-                required_state_map=required_state_map[required_state_id],
+                required_state_map=stored_required_state_id_maps[required_state_id],
+            )
+
+        # Clean up any `required_state_id`s that are no longer used by any
+        # connection position on this connection.
+        #
+        # We store the required state config per-connection per-room. Since this
+        # can be a lot of data, we deduplicate the required state JSON and store
+        # it separately, with multiple rooms referencing the same `required_state_id`.
+        # Over time as the required state configs change, some `required_state_id`s
+        # may no longer be referenced by any room config, so we need
+        # to clean them up.
+        #
+        # We do this by noting that we have pulled out *all* rows from
+        # `sliding_sync_connection_required_state` for this connection above. We
+        # have also pulled out all referenced `required_state_id`s for *this*
+        # connection position, which is the only connection position that
+        # remains (we deleted the others above).
+        #
+        # Thus we can compute the unused `required_state_id`s by looking for any
+        # `required_state_id`s that are not referenced by the remaining connection
+        # position.
+        used_required_state_ids = {
+            required_state_id for _, _, required_state_id in room_config_rows
+        }
+
+        unused_required_state_ids = (
+            stored_required_state_id_maps.keys() - used_required_state_ids
+        )
+        if unused_required_state_ids:
+            self.db_pool.simple_delete_many_batch_txn(
+                txn,
+                table="sliding_sync_connection_required_state",
+                keys=("connection_key", "required_state_id"),
+                values=[
+                    (connection_key, required_state_id)
+                    for required_state_id in unused_required_state_ids
+                ],
             )
 
         # Now look up the per-room stream data.
-        rooms: Dict[str, HaveSentRoom[str]] = {}
-        receipts: Dict[str, HaveSentRoom[str]] = {}
-        account_data: Dict[str, HaveSentRoom[str]] = {}
+        rooms: dict[str, HaveSentRoom[str]] = {}
+        receipts: dict[str, HaveSentRoom[str]] = {}
+        account_data: dict[str, HaveSentRoom[str]] = {}
 
         receipt_rows = self.db_pool.simple_select_list_txn(
             txn,
@@ -480,10 +588,173 @@ class SlidingSyncStore(SQLBaseStore):
                 logger.warning("Unrecognized sliding sync stream in DB %r", stream)
 
         return PerConnectionStateDB(
+            last_used_ts=last_used_ts,
             rooms=RoomStatusMap(rooms),
             receipts=RoomStatusMap(receipts),
             account_data=RoomStatusMap(account_data),
             room_configs=room_configs,
+            room_lazy_membership={},
+        )
+
+    async def get_sliding_sync_connection_lazy_members(
+        self,
+        connection_position: int,
+        room_id: str,
+        user_ids: AbstractSet[str],
+    ) -> Mapping[str, int]:
+        """Get which user IDs in the room we have previously sent lazy
+        membership for.
+
+        Args:
+            connection_position: The sliding sync connection position.
+            room_id: The room ID to get lazy members for.
+            user_ids: The user IDs to check whether we've previously sent
+                because of lazy membership.
+
+        Returns:
+            The mapping of user IDs to the last seen timestamp for those user
+            IDs. Only includes user IDs that we have previously sent lazy
+            membership for, and so may be a subset of the `user_ids` passed in.
+        """
+
+        def get_sliding_sync_connection_lazy_members_txn(
+            txn: LoggingTransaction,
+        ) -> Mapping[str, int]:
+            user_clause, user_args = make_in_list_sql_clause(
+                txn.database_engine, "user_id", user_ids
+            )
+
+            # Fetch all the lazy membership entries for the given connection,
+            # room and user IDs. We don't have the `connection_key` here, so we
+            # join against `sliding_sync_connection_positions` to get it.
+            #
+            # Beware that there are two `connection_position` columns in the
+            # query which are different, the one in
+            # `sliding_sync_connection_positions` is the one we match to get the
+            # connection_key, whereas the one in
+            # `sliding_sync_connection_lazy_members` is what we filter against
+            # (it may be null or the same as the one passed in).
+            #
+            # FIXME: We should pass in `connection_key` here to avoid the join.
+            # We don't do this currently as the caller doesn't have it handy.
+            sql = f"""
+                SELECT user_id, members.connection_position, last_seen_ts
+                FROM sliding_sync_connection_lazy_members AS members
+                INNER JOIN sliding_sync_connection_positions AS pos USING (connection_key)
+                WHERE pos.connection_position = ? AND room_id = ? AND {user_clause}
+            """
+
+            txn.execute(sql, (connection_position, room_id, *user_args))
+
+            # Filter out any cache entries that only apply to forked connection
+            # positions. Entries with `NULL` `connection_position` apply to all
+            # positions on the connection.
+            return {
+                user_id: last_seen_ts
+                for user_id, db_connection_position, last_seen_ts in txn
+                if db_connection_position == connection_position
+                or db_connection_position is None
+            }
+
+        return await self.db_pool.runInteraction(
+            "get_sliding_sync_connection_lazy_members",
+            get_sliding_sync_connection_lazy_members_txn,
+            db_autocommit=True,  # Avoid transaction for single read
+        )
+
+    def _persist_sliding_sync_connection_lazy_members_txn(
+        self,
+        txn: LoggingTransaction,
+        connection_key: int,
+        new_connection_position: int,
+        all_changes: dict[str, RoomLazyMembershipChanges],
+    ) -> None:
+        """Persist that we have sent lazy membership for the given user IDs."""
+
+        now = self.clock.time_msec()
+
+        # Figure out which cache entries to add or update.
+        #
+        # These are either a) new entries we've never sent before (i.e. with a
+        # None last_seen_ts), or b) where the `last_seen_ts` is old enough that
+        # we want to update it.
+        #
+        # We don't update the timestamp every time to avoid hammering the DB
+        # with writes, and we don't need the timestamp to be precise. It is used
+        # to evict old entries that haven't been used in a while.
+        to_update: list[tuple[str, str]] = []
+        for room_id, room_changes in all_changes.items():
+            user_ids_to_update = room_changes.get_returned_user_ids_to_update(
+                self.clock
+            )
+            to_update.extend((room_id, user_id) for user_id in user_ids_to_update)
+
+        if to_update:
+            # Upsert the new/updated entries.
+            #
+            # Ignore conflicts where the existing entry has a different
+            # connection position (i.e. from a forked connection position). This
+            # may mean that we lose some updates, but that's acceptable as this
+            # is a cache and its fine for it to *not* include rows. (Downstream
+            # this will cause us to maybe send a few extra lazy members down
+            # sync, but we're allowed to send extra members).
+            sql = """
+                INSERT INTO sliding_sync_connection_lazy_members
+                (connection_key, connection_position, room_id, user_id, last_seen_ts)
+                VALUES {value_placeholder}
+                ON CONFLICT (connection_key, room_id, user_id)
+                DO UPDATE SET last_seen_ts = EXCLUDED.last_seen_ts
+                WHERE sliding_sync_connection_lazy_members.connection_position IS NULL
+                    OR sliding_sync_connection_lazy_members.connection_position = EXCLUDED.connection_position
+            """
+
+            args = [
+                (connection_key, new_connection_position, room_id, user_id, now)
+                for room_id, user_id in to_update
+            ]
+
+            if isinstance(self.database_engine, PostgresEngine):
+                sql = sql.format(value_placeholder="?")
+                txn.execute_values(sql, args, fetch=False)
+            else:
+                sql = sql.format(value_placeholder="(?, ?, ?, ?, ?)")
+                txn.execute_batch(sql, args)
+
+        # Remove any invalidated entries.
+        to_remove: list[tuple[str, str]] = []
+        for room_id, room_changes in all_changes.items():
+            for user_id in room_changes.invalidated_user_ids:
+                to_remove.append((room_id, user_id))
+
+        if to_remove:
+            # We don't try and match on connection position here: it's fine to
+            # remove it from all forks. This is a cache so it's fine to expire
+            # arbitrary entries, the worst that happens is we send a few extra
+            # lazy members down sync.
+            self.db_pool.simple_delete_many_batch_txn(
+                txn,
+                table="sliding_sync_connection_lazy_members",
+                keys=("connection_key", "room_id", "user_id"),
+                values=[
+                    (connection_key, room_id, user_id) for room_id, user_id in to_remove
+                ],
+            )
+
+    @wrap_as_background_process("delete_old_sliding_sync_connections")
+    async def delete_old_sliding_sync_connections(self) -> None:
+        """Delete sliding sync connections that have not been used for a long time."""
+        cutoff_ts = self.clock.time_msec() - CONNECTION_EXPIRY.as_millis()
+
+        def delete_old_sliding_sync_connections_txn(txn: LoggingTransaction) -> None:
+            sql = """
+                DELETE FROM sliding_sync_connections
+                WHERE last_used_ts IS NOT NULL AND last_used_ts < ?
+            """
+            txn.execute(sql, (cutoff_ts,))
+
+        await self.db_pool.runInteraction(
+            "delete_old_sliding_sync_connections",
+            delete_old_sliding_sync_connections_txn,
         )
 
 
@@ -492,18 +763,24 @@ class PerConnectionStateDB:
     """An equivalent to `PerConnectionState` that holds data in a format stored
     in the DB.
 
-    The principle difference is that the tokens for the different streams are
+    The principal difference is that the tokens for the different streams are
     serialized to strings.
 
     When persisting this *only* contains updates to the state.
     """
 
+    last_used_ts: int | None
+
     rooms: "RoomStatusMap[str]"
     receipts: "RoomStatusMap[str]"
     account_data: "RoomStatusMap[str]"
 
     room_configs: Mapping[str, "RoomSyncConfig"]
 
+    room_lazy_membership: dict[str, RoomLazyMembershipChanges]
+    """Lazy membership changes to persist alongside this state. Only used
+    when persisting."""
+
     @staticmethod
     async def from_state(
         per_connection_state: "MutablePerConnectionState", store: "DataStore"
@@ -553,10 +830,12 @@ class PerConnectionStateDB:
         )
 
         return PerConnectionStateDB(
+            last_used_ts=per_connection_state.last_used_ts,
             rooms=RoomStatusMap(rooms),
             receipts=RoomStatusMap(receipts),
             account_data=RoomStatusMap(account_data),
             room_configs=per_connection_state.room_configs.maps[0],
+            room_lazy_membership=per_connection_state.room_lazy_membership,
         )
 
     async def to_state(self, store: "DataStore") -> "PerConnectionState":
@@ -596,6 +875,7 @@ class PerConnectionStateDB:
         }
 
         return PerConnectionState(
+            last_used_ts=self.last_used_ts,
             rooms=RoomStatusMap(rooms),
             receipts=RoomStatusMap(receipts),
             account_data=RoomStatusMap(account_data),
diff --git a/synapse/storage/databases/main/state.py b/synapse/storage/databases/main/state.py
index cfcc731f86..cfde107b48 100644
--- a/synapse/storage/databases/main/state.py
+++ b/synapse/storage/databases/main/state.py
@@ -25,17 +25,10 @@ from typing import (
     TYPE_CHECKING,
     Any,
     Collection,
-    Dict,
-    FrozenSet,
     Iterable,
-    List,
     Mapping,
     MutableMapping,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
     cast,
     overload,
 )
@@ -91,8 +84,8 @@ class EventMetadata:
 
     room_id: str
     event_type: str
-    state_key: Optional[str]
-    rejection_reason: Optional[str]
+    state_key: str | None
+    rejection_reason: str | None
 
 
 def _retrieve_and_check_room_version(room_id: str, room_version_id: str) -> RoomVersion:
@@ -199,7 +192,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
     @trace
     async def get_metadata_for_events(
         self, event_ids: Collection[str]
-    ) -> Dict[str, EventMetadata]:
+    ) -> dict[str, EventMetadata]:
         """Get some metadata (room_id, type, state_key) for the given events.
 
         This method is a faster alternative than fetching the full events from
@@ -212,7 +205,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
         def get_metadata_for_events_txn(
             txn: LoggingTransaction,
             batch_ids: Collection[str],
-        ) -> Dict[str, EventMetadata]:
+        ) -> dict[str, EventMetadata]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "e.event_id", batch_ids
             )
@@ -236,7 +229,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
                 for event_id, room_id, event_type, state_key, rejection_reason in txn
             }
 
-        result_map: Dict[str, EventMetadata] = {}
+        result_map: dict[str, EventMetadata] = {}
         for batch_ids in batch_iter(event_ids, 1000):
             result_map.update(
                 await self.db_pool.runInteraction(
@@ -248,7 +241,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
 
         return result_map
 
-    async def get_room_predecessor(self, room_id: str) -> Optional[JsonMapping]:
+    async def get_room_predecessor(self, room_id: str) -> JsonMapping | None:
         """Get the predecessor of an upgraded room if it exists.
         Otherwise return None.
 
@@ -308,7 +301,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
         return create_event
 
     @cached(max_entries=10000)
-    async def get_room_type(self, room_id: str) -> Union[Optional[str], Sentinel]:
+    async def get_room_type(self, room_id: str) -> str | None | Sentinel:
         """Fetch room type for given room.
 
         Since this function is cached, any missing values would be cached as
@@ -329,8 +322,8 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
 
     @cachedList(cached_method_name="get_room_type", list_name="room_ids")
     async def bulk_get_room_type(
-        self, room_ids: Set[str]
-    ) -> Mapping[str, Union[Optional[str], Sentinel]]:
+        self, room_ids: set[str]
+    ) -> Mapping[str, str | None | Sentinel]:
         """
         Bulk fetch room types for the given rooms (via current state).
 
@@ -347,7 +340,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
 
         def txn(
             txn: LoggingTransaction,
-        ) -> MutableMapping[str, Union[Optional[str], Sentinel]]:
+        ) -> MutableMapping[str, str | None | Sentinel]:
             clause, args = make_in_list_sql_clause(
                 txn.database_engine, "room_id", room_ids
             )
@@ -403,13 +396,13 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
         return results
 
     @cached(max_entries=10000)
-    async def get_room_encryption(self, room_id: str) -> Optional[str]:
+    async def get_room_encryption(self, room_id: str) -> str | None:
         raise NotImplementedError()
 
     @cachedList(cached_method_name="get_room_encryption", list_name="room_ids")
     async def bulk_get_room_encryption(
-        self, room_ids: Set[str]
-    ) -> Mapping[str, Union[Optional[str], Sentinel]]:
+        self, room_ids: set[str]
+    ) -> Mapping[str, str | None | Sentinel]:
         """
         Bulk fetch room encryption for the given rooms (via current state).
 
@@ -427,7 +420,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
 
         def txn(
             txn: LoggingTransaction,
-        ) -> MutableMapping[str, Union[Optional[str], Sentinel]]:
+        ) -> MutableMapping[str, str | None | Sentinel]:
             clause, args = make_in_list_sql_clause(
                 txn.database_engine, "room_id", room_ids
             )
@@ -469,7 +462,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
         # If we haven't updated `room_stats_state` with the room yet, query the state
         # directly. This should happen only rarely so we don't mind if we do this in a
         # loop.
-        encryption_event_ids: List[str] = []
+        encryption_event_ids: list[str] = []
         for room_id in room_ids - results.keys():
             state_map = await self.get_partial_filtered_current_state_ids(
                 room_id,
@@ -541,7 +534,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
 
     async def check_if_events_in_current_state(
         self, event_ids: StrCollection
-    ) -> FrozenSet[str]:
+    ) -> frozenset[str]:
         """Checks and returns which of the given events is part of the current state."""
         rows = await self.db_pool.simple_select_many_batch(
             table="current_state_events",
@@ -556,7 +549,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
     # FIXME: how should this be cached?
     @cancellable
     async def get_partial_filtered_current_state_ids(
-        self, room_id: str, state_filter: Optional[StateFilter] = None
+        self, room_id: str, state_filter: StateFilter | None = None
     ) -> StateMap[str]:
         """Get the current state event of a given type for a room based on the
         current_state_events table.  This may not be as up-to-date as the result
@@ -609,7 +602,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
         )
 
     @cached(max_entries=50000)
-    async def _get_state_group_for_event(self, event_id: str) -> Optional[int]:
+    async def _get_state_group_for_event(self, event_id: str) -> int | None:
         return await self.db_pool.simple_select_one_onecol(
             table="event_to_state_groups",
             keyvalues={"event_id": event_id},
@@ -632,7 +625,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
              RuntimeError if the state is unknown at any of the given events
         """
         rows = cast(
-            List[Tuple[str, int]],
+            list[tuple[str, int]],
             await self.db_pool.simple_select_many_batch(
                 table="event_to_state_groups",
                 column="event_id",
@@ -651,7 +644,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
 
     async def get_referenced_state_groups(
         self, state_groups: Iterable[int]
-    ) -> Set[int]:
+    ) -> set[int]:
         """Check if the state groups are referenced by events.
 
         Args:
@@ -662,7 +655,7 @@ class StateGroupWorkerStore(EventsWorkerStore, SQLBaseStore):
         """
 
         rows = cast(
-            List[Tuple[int]],
+            list[tuple[int]],
             await self.db_pool.simple_select_many_batch(
                 table="event_to_state_groups",
                 column="state_group",
@@ -803,7 +796,7 @@ class MainStateBackgroundUpdateStore(RoomMemberWorkerStore):
 
         def _background_remove_left_rooms_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[bool, Set[str]]:
+        ) -> tuple[bool, set[str]]:
             # get a batch of room ids to consider
             sql = """
                 SELECT DISTINCT room_id FROM current_state_events
@@ -884,7 +877,7 @@ class MainStateBackgroundUpdateStore(RoomMemberWorkerStore):
             # server didn't share a room with the remote user and therefore may
             # have missed any device updates.
             rows = cast(
-                List[Tuple[str]],
+                list[tuple[str]],
                 self.db_pool.simple_select_many_txn(
                     txn,
                     table="current_state_events",
@@ -975,7 +968,7 @@ class StateStore(StateGroupWorkerStore, MainStateBackgroundUpdateStore):
 
 
 @attr.s(auto_attribs=True, slots=True)
-class StateMapWrapper(Dict[StateKey, str]):
+class StateMapWrapper(dict[StateKey, str]):
     """A wrapper around a StateMap[str] to ensure that we only query for items
     that were not filtered out.
 
@@ -990,16 +983,14 @@ class StateMapWrapper(Dict[StateKey, str]):
             raise Exception("State map was filtered and doesn't include: %s", key)
         return super().__getitem__(key)
 
-    @overload  # type: ignore[override]
-    def get(self, key: StateKey, default: None = None, /) -> Optional[str]: ...
+    @overload
+    def get(self, key: StateKey, default: None = None, /) -> str | None: ...
     @overload
     def get(self, key: StateKey, default: str, /) -> str: ...
     @overload
-    def get(self, key: StateKey, default: _T, /) -> Union[str, _T]: ...
+    def get(self, key: StateKey, default: _T, /) -> str | _T: ...
 
-    def get(
-        self, key: StateKey, default: Union[str, _T, None] = None
-    ) -> Union[str, _T, None]:
+    def get(self, key: StateKey, default: str | _T | None = None) -> str | _T | None:
         if key not in self.state_filter:
             raise Exception("State map was filtered and doesn't include: %s", key)
         return super().get(key, default)
diff --git a/synapse/storage/databases/main/state_deltas.py b/synapse/storage/databases/main/state_deltas.py
index 00f87cc3a1..a5d5407327 100644
--- a/synapse/storage/databases/main/state_deltas.py
+++ b/synapse/storage/databases/main/state_deltas.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING
 
 import attr
 
@@ -50,10 +50,10 @@ class StateDelta:
     event_type: str
     state_key: str
 
-    event_id: Optional[str]
+    event_id: str | None
     """new event_id for this state key. None if the state has been deleted."""
 
-    prev_event_id: Optional[str]
+    prev_event_id: str | None
     """previous event_id for this state key. None if it's new state."""
 
 
@@ -78,16 +78,27 @@ class StateDeltasStore(SQLBaseStore):
         )
 
     async def get_partial_current_state_deltas(
-        self, prev_stream_id: int, max_stream_id: int
-    ) -> Tuple[int, List[StateDelta]]:
-        """Fetch a list of room state changes since the given stream id
+        self, prev_stream_id: int, max_stream_id: int, limit: int = 100
+    ) -> tuple[int, list[StateDelta]]:
+        """Fetch a list of room state changes since the given stream id.
 
         This may be the partial state if we're lazy joining the room.
 
+        This method takes care to handle state deltas that share the same
+        `stream_id`. That can happen when persisting state in a batch,
+        potentially as the result of state resolution (both adding new state and
+        undo'ing previous state).
+
+        State deltas are grouped by `stream_id`. When hitting the given `limit`
+        would return only part of a "group" of state deltas, that entire group
+        is omitted. Thus, this function may return *up to* `limit` state deltas,
+        or slightly more when a single group itself exceeds `limit`.
+
         Args:
             prev_stream_id: point to get changes since (exclusive)
             max_stream_id: the point that we know has been correctly persisted
                 - ie, an upper limit to return changes from.
+            limit: the maximum number of rows to return.
 
         Returns:
             A tuple consisting of:
@@ -97,6 +108,11 @@ class StateDeltasStore(SQLBaseStore):
         """
         prev_stream_id = int(prev_stream_id)
 
+        if limit <= 0:
+            raise ValueError(
+                "Invalid `limit` passed to `get_partial_current_state_deltas"
+            )
+
         # check we're not going backwards
         assert prev_stream_id <= max_stream_id, (
             f"New stream id {max_stream_id} is smaller than prev stream id {prev_stream_id}"
@@ -112,46 +128,63 @@ class StateDeltasStore(SQLBaseStore):
 
         def get_current_state_deltas_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[int, List[StateDelta]]:
-            # First we calculate the max stream id that will give us less than
-            # N results.
-            # We arbitrarily limit to 100 stream_id entries to ensure we don't
-            # select toooo many.
-            sql = """
-                SELECT stream_id, count(*)
+        ) -> tuple[int, list[StateDelta]]:
+            # First we group state deltas by `stream_id` and calculate which
+            # groups can be returned without exceeding the provided `limit`.
+            sql_grouped = """
+                SELECT stream_id, COUNT(*) AS c
                 FROM current_state_delta_stream
                 WHERE stream_id > ? AND stream_id <= ?
                 GROUP BY stream_id
-                ORDER BY stream_id ASC
-                LIMIT 100
+                ORDER BY stream_id
+                LIMIT ?
             """
-            txn.execute(sql, (prev_stream_id, max_stream_id))
+            group_limit = limit + 1
+            txn.execute(sql_grouped, (prev_stream_id, max_stream_id, group_limit))
+            grouped_rows = txn.fetchall()
 
-            total = 0
+            if not grouped_rows:
+                # Nothing to return in the range; we are up to date through max_stream_id.
+                return max_stream_id, []
 
-            for stream_id, count in txn:
-                total += count
-                if total > 100:
-                    # We arbitrarily limit to 100 entries to ensure we don't
-                    # select toooo many.
-                    logger.debug(
-                        "Clipping current_state_delta_stream rows to stream_id %i",
-                        stream_id,
-                    )
-                    clipped_stream_id = stream_id
+            # Always retrieve the first group, at the bare minimum. This ensures the
+            # caller always makes progress, even if a single group exceeds `limit`.
+            fetch_upto_stream_id, included_rows = grouped_rows[0]
+
+            # Determine which other groups we can retrieve at the same time,
+            # without blowing the budget.
+            included_all_groups = True
+            for stream_id, count in grouped_rows[1:]:
+                if included_rows + count > limit:
+                    included_all_groups = False
                     break
-            else:
-                # if there's no problem, we may as well go right up to the max_stream_id
-                clipped_stream_id = max_stream_id
+                included_rows += count
+                fetch_upto_stream_id = stream_id
 
-            # Now actually get the deltas
-            sql = """
+            # If we retrieved fewer groups than the limit *and* we didn't hit the
+            # `LIMIT ?` cap on the grouping query, we know we've caught up with
+            # the stream.
+            caught_up_with_stream = (
+                included_all_groups and len(grouped_rows) < group_limit
+            )
+
+            # At this point we should have advanced, or bailed out early above.
+            assert fetch_upto_stream_id != prev_stream_id
+
+            # 2) Fetch the actual rows for only the included stream_id groups.
+            sql_rows = """
                 SELECT stream_id, room_id, type, state_key, event_id, prev_event_id
                 FROM current_state_delta_stream
                 WHERE ? < stream_id AND stream_id <= ?
                 ORDER BY stream_id ASC
             """
-            txn.execute(sql, (prev_stream_id, clipped_stream_id))
+            txn.execute(sql_rows, (prev_stream_id, fetch_upto_stream_id))
+            rows = txn.fetchall()
+
+            clipped_stream_id = (
+                max_stream_id if caught_up_with_stream else fetch_upto_stream_id
+            )
+
             return clipped_stream_id, [
                 StateDelta(
                     stream_id=row[0],
@@ -161,7 +194,7 @@ class StateDeltasStore(SQLBaseStore):
                     event_id=row[4],
                     prev_event_id=row[5],
                 )
-                for row in txn.fetchall()
+                for row in rows
             ]
 
         return await self.db_pool.runInteraction(
@@ -189,9 +222,9 @@ class StateDeltasStore(SQLBaseStore):
         txn: LoggingTransaction,
         room_id: str,
         *,
-        from_token: Optional[RoomStreamToken],
-        to_token: Optional[RoomStreamToken],
-    ) -> List[StateDelta]:
+        from_token: RoomStreamToken | None,
+        to_token: RoomStreamToken | None,
+    ) -> list[StateDelta]:
         """
         Get the state deltas between two tokens.
 
@@ -235,9 +268,9 @@ class StateDeltasStore(SQLBaseStore):
         self,
         room_id: str,
         *,
-        from_token: Optional[RoomStreamToken],
-        to_token: Optional[RoomStreamToken],
-    ) -> List[StateDelta]:
+        from_token: RoomStreamToken | None,
+        to_token: RoomStreamToken | None,
+    ) -> list[StateDelta]:
         """
         Get the state deltas between two tokens.
 
@@ -273,7 +306,7 @@ class StateDeltasStore(SQLBaseStore):
         room_ids: StrCollection,
         from_token: RoomStreamToken,
         to_token: RoomStreamToken,
-    ) -> List[StateDelta]:
+    ) -> list[StateDelta]:
         """Get the state deltas between two tokens for the set of rooms."""
 
         room_ids = self._curr_state_delta_stream_cache.get_entities_changed(
@@ -285,7 +318,7 @@ class StateDeltasStore(SQLBaseStore):
         def get_current_state_deltas_for_rooms_txn(
             txn: LoggingTransaction,
             room_ids: StrCollection,
-        ) -> List[StateDelta]:
+        ) -> list[StateDelta]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "room_id", room_ids
             )
diff --git a/synapse/storage/databases/main/stats.py b/synapse/storage/databases/main/stats.py
index 74830b7129..687cabe69e 100644
--- a/synapse/storage/databases/main/stats.py
+++ b/synapse/storage/databases/main/stats.py
@@ -20,18 +20,13 @@
 #
 
 import logging
+from collections import Counter
 from enum import Enum
 from itertools import chain
 from typing import (
     TYPE_CHECKING,
     Any,
-    Counter,
-    Dict,
     Iterable,
-    List,
-    Optional,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -154,7 +149,7 @@ class StatsStore(StateDeltasStore):
 
         last_user_id = progress.get("last_user_id", "")
 
-        def _get_next_batch(txn: LoggingTransaction) -> List[str]:
+        def _get_next_batch(txn: LoggingTransaction) -> list[str]:
             sql = """
                     SELECT DISTINCT name FROM users
                     WHERE name > ?
@@ -200,7 +195,7 @@ class StatsStore(StateDeltasStore):
 
         last_room_id = progress.get("last_room_id", "")
 
-        def _get_next_batch(txn: LoggingTransaction) -> List[str]:
+        def _get_next_batch(txn: LoggingTransaction) -> list[str]:
             sql = """
                     SELECT DISTINCT room_id FROM current_state_events
                     WHERE room_id > ?
@@ -245,7 +240,7 @@ class StatsStore(StateDeltasStore):
             desc="stats_incremental_position",
         )
 
-    async def update_room_state(self, room_id: str, fields: Dict[str, Any]) -> None:
+    async def update_room_state(self, room_id: str, fields: dict[str, Any]) -> None:
         """Update the state of a room.
 
         fields can contain the following keys with string values:
@@ -299,7 +294,7 @@ class StatsStore(StateDeltasStore):
     @cached()
     async def get_earliest_token_for_stats(
         self, stats_type: str, id: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """
         Fetch the "earliest token". This is used by the room stats delta
         processor to ignore deltas that have been processed between the
@@ -320,7 +315,7 @@ class StatsStore(StateDeltasStore):
         )
 
     async def bulk_update_stats_delta(
-        self, ts: int, updates: Dict[str, Dict[str, Counter[str]]], stream_id: int
+        self, ts: int, updates: dict[str, dict[str, Counter[str]]], stream_id: int
     ) -> None:
         """Bulk update stats tables for a given stream_id and updates the stats
         incremental position.
@@ -363,9 +358,9 @@ class StatsStore(StateDeltasStore):
         ts: int,
         stats_type: str,
         stats_id: str,
-        fields: Dict[str, int],
+        fields: dict[str, int],
         complete_with_stream_id: int,
-        absolute_field_overrides: Optional[Dict[str, int]] = None,
+        absolute_field_overrides: dict[str, int] | None = None,
     ) -> None:
         """
         Updates the statistics for a subject, with a delta (difference/relative
@@ -401,9 +396,9 @@ class StatsStore(StateDeltasStore):
         ts: int,
         stats_type: str,
         stats_id: str,
-        fields: Dict[str, int],
+        fields: dict[str, int],
         complete_with_stream_id: int,
-        absolute_field_overrides: Optional[Dict[str, int]] = None,
+        absolute_field_overrides: dict[str, int] | None = None,
     ) -> None:
         if absolute_field_overrides is None:
             absolute_field_overrides = {}
@@ -450,9 +445,9 @@ class StatsStore(StateDeltasStore):
         self,
         txn: LoggingTransaction,
         table: str,
-        keyvalues: Dict[str, Any],
-        absolutes: Dict[str, Any],
-        additive_relatives: Dict[str, int],
+        keyvalues: dict[str, Any],
+        absolutes: dict[str, Any],
+        additive_relatives: dict[str, int],
     ) -> None:
         """Used to update values in the stats tables.
 
@@ -510,11 +505,11 @@ class StatsStore(StateDeltasStore):
 
         def _fetch_current_state_stats(
             txn: LoggingTransaction,
-        ) -> Tuple[List[str], Dict[str, int], int, List[str], int]:
+        ) -> tuple[list[str], dict[str, int], int, list[str], int]:
             pos = self.get_room_max_stream_ordering()  # type: ignore[attr-defined]
 
             rows = cast(
-                List[Tuple[str]],
+                list[tuple[str]],
                 self.db_pool.simple_select_many_txn(
                     txn,
                     table="current_state_events",
@@ -544,7 +539,7 @@ class StatsStore(StateDeltasStore):
                 """,
                 (room_id,),
             )
-            membership_counts = dict(cast(Iterable[Tuple[str, int]], txn))
+            membership_counts = dict(cast(Iterable[tuple[str, int]], txn))
 
             txn.execute(
                 """
@@ -554,7 +549,7 @@ class StatsStore(StateDeltasStore):
                 (room_id,),
             )
 
-            current_state_events_count = cast(Tuple[int], txn.fetchone())[0]
+            current_state_events_count = cast(tuple[int], txn.fetchone())[0]
 
             users_in_room = self.get_users_in_room_txn(txn, room_id)  # type: ignore[attr-defined]
 
@@ -588,7 +583,7 @@ class StatsStore(StateDeltasStore):
             )
             return
 
-        room_state: Dict[str, Union[None, bool, str]] = {
+        room_state: dict[str, None | bool | str] = {
             "join_rules": None,
             "history_visibility": None,
             "encryption": None,
@@ -651,7 +646,7 @@ class StatsStore(StateDeltasStore):
     async def _calculate_and_set_initial_state_for_user(self, user_id: str) -> None:
         def _calculate_and_set_initial_state_for_user_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[int, int]:
+        ) -> tuple[int, int]:
             pos = self._get_max_stream_id_in_current_state_deltas_txn(txn)
 
             txn.execute(
@@ -662,7 +657,7 @@ class StatsStore(StateDeltasStore):
                 """,
                 (user_id,),
             )
-            count = cast(Tuple[int], txn.fetchone())[0]
+            count = cast(tuple[int], txn.fetchone())[0]
             return count, pos
 
         joined_rooms, pos = await self.db_pool.runInteraction(
@@ -683,12 +678,12 @@ class StatsStore(StateDeltasStore):
         self,
         start: int,
         limit: int,
-        from_ts: Optional[int] = None,
-        until_ts: Optional[int] = None,
-        order_by: Optional[str] = UserSortOrder.USER_ID.value,
+        from_ts: int | None = None,
+        until_ts: int | None = None,
+        order_by: str | None = UserSortOrder.USER_ID.value,
         direction: Direction = Direction.FORWARDS,
-        search_term: Optional[str] = None,
-    ) -> Tuple[List[Tuple[str, Optional[str], int, int]], int]:
+        search_term: str | None = None,
+    ) -> tuple[list[tuple[str, str | None, int, int]], int]:
         """Function to retrieve a paginated list of users and their uploaded local media
         (size and number). This will return a json list of users and the
         total number of users matching the filter criteria.
@@ -713,7 +708,7 @@ class StatsStore(StateDeltasStore):
 
         def get_users_media_usage_paginate_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[str, Optional[str], int, int]], int]:
+        ) -> tuple[list[tuple[str, str | None, int, int]], int]:
             filters = []
             args: list = []
 
@@ -766,7 +761,7 @@ class StatsStore(StateDeltasStore):
                 sql_base=sql_base,
             )
             txn.execute(sql, args)
-            count = cast(Tuple[int], txn.fetchone())[0]
+            count = cast(tuple[int], txn.fetchone())[0]
 
             sql = """
                 SELECT
@@ -785,7 +780,7 @@ class StatsStore(StateDeltasStore):
 
             args += [limit, start]
             txn.execute(sql, args)
-            users = cast(List[Tuple[str, Optional[str], int, int]], txn.fetchall())
+            users = cast(list[tuple[str, str | None, int, int]], txn.fetchall())
 
             return users, count
 
diff --git a/synapse/storage/databases/main/sticky_events.py b/synapse/storage/databases/main/sticky_events.py
new file mode 100644
index 0000000000..38b84443df
--- /dev/null
+++ b/synapse/storage/databases/main/sticky_events.py
@@ -0,0 +1,413 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+import logging
+import random
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Collection, cast
+
+from twisted.internet.defer import Deferred
+
+from synapse.events import EventBase
+from synapse.replication.tcp.streams._base import StickyEventsStream
+from synapse.storage.database import (
+    DatabasePool,
+    LoggingDatabaseConnection,
+    LoggingTransaction,
+    make_in_list_sql_clause,
+)
+from synapse.storage.databases.main.cache import CacheInvalidationWorkerStore
+from synapse.storage.databases.main.state import StateGroupWorkerStore
+from synapse.storage.engines import PostgresEngine, Sqlite3Engine
+from synapse.storage.util.id_generators import MultiWriterIdGenerator
+from synapse.util.duration import Duration
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
+
+logger = logging.getLogger(__name__)
+
+DELETE_EXPIRED_STICKY_EVENTS_INTERVAL = Duration(hours=1)
+"""
+Remove entries from the sticky_events table at this frequency.
+Note: don't be misled, we still honour shorter expiration timeouts,
+because readers of the sticky_events table filter out expired sticky events
+themselves, even if they aren't deleted from the table yet.
+
+Currently just an arbitrary choice.
+Frequent enough to clean up expired sticky events promptly,
+especially given the short cap on the lifetime of sticky events.
+"""
+
+
+@dataclass(frozen=True)
+class StickyEventUpdate:
+    stream_id: int
+    room_id: str
+    event_id: str
+    soft_failed: bool
+
+
+class StickyEventsWorkerStore(StateGroupWorkerStore, CacheInvalidationWorkerStore):
+    def __init__(
+        self,
+        database: DatabasePool,
+        db_conn: LoggingDatabaseConnection,
+        hs: "HomeServer",
+    ):
+        super().__init__(database, db_conn, hs)
+
+        self._can_write_to_sticky_events = (
+            self._instance_name in hs.config.worker.writers.events
+        )
+
+        # Technically this means we will cleanup N times, once per event persister, maybe put on master?
+        if self._can_write_to_sticky_events:
+            # Start a looping call to clean up the `sticky_events` table
+            #
+            # Because this will run once per event persister (for now),
+            # randomly stagger the initial time so that they don't all
+            # coincide with each other if the workers are deployed at the
+            # same time. This allows each cleanup to be somewhat more effective
+            # than if they all started at the same time, as they would all be
+            # cleaning up the same thing whereas each worker gets to clean up a little
+            # throughout the hour when they're staggered.
+            #
+            # Concurrent execution of the same deletions could also lead to
+            # repeatable serialisation violations in the database transaction,
+            # meaning we'd have to retry the transaction several times.
+            #
+            # This staggering is not critical, it's just best-effort.
+            self.clock.call_later(
+                # random() is 0.0 to 1.0
+                DELETE_EXPIRED_STICKY_EVENTS_INTERVAL * random.random(),
+                self.clock.looping_call,
+                self._run_background_cleanup,
+                DELETE_EXPIRED_STICKY_EVENTS_INTERVAL,
+            )
+
+        self._sticky_events_id_gen: MultiWriterIdGenerator = MultiWriterIdGenerator(
+            db_conn=db_conn,
+            db=database,
+            notifier=hs.get_replication_notifier(),
+            stream_name="sticky_events",
+            server_name=self.server_name,
+            instance_name=self._instance_name,
+            tables=[
+                ("sticky_events", "instance_name", "stream_id"),
+            ],
+            sequence_name="sticky_events_sequence",
+            writers=hs.config.worker.writers.events,
+        )
+
+        if hs.config.experimental.msc4354_enabled and isinstance(
+            self.database_engine, Sqlite3Engine
+        ):
+            import sqlite3
+
+            if sqlite3.sqlite_version_info < (3, 40, 0):
+                raise RuntimeError(
+                    f"Experimental MSC4354 Sticky Events enabled but SQLite3 version is too old: {sqlite3.sqlite_version_info}, must be at least 3.40. Disable MSC4354 Sticky Events, switch to Postgres, or upgrade SQLite. See https://github.com/element-hq/synapse/issues/19428"
+                )
+
+    def process_replication_position(
+        self, stream_name: str, instance_name: str, token: int
+    ) -> None:
+        if stream_name == StickyEventsStream.NAME:
+            self._sticky_events_id_gen.advance(instance_name, token)
+        super().process_replication_position(stream_name, instance_name, token)
+
+    def get_max_sticky_events_stream_id(self) -> int:
+        """Get the current maximum stream_id for thread subscriptions.
+
+        Returns:
+            The maximum stream_id
+        """
+        return self._sticky_events_id_gen.get_current_token()
+
+    def get_sticky_events_stream_id_generator(self) -> MultiWriterIdGenerator:
+        return self._sticky_events_id_gen
+
+    async def get_sticky_events_in_rooms(
+        self,
+        room_ids: Collection[str],
+        *,
+        from_id: int,
+        to_id: int,
+        now: int,
+        limit: int | None,
+    ) -> tuple[int, dict[str, list[str]]]:
+        """
+        Fetch all the sticky events' IDs in the given rooms, with sticky stream IDs satisfying
+        from_id < sticky stream ID <= to_id.
+
+        The events are returned ordered by the sticky events stream.
+
+        Args:
+            room_ids: The room IDs to return sticky events in.
+            from_id: The sticky stream ID that sticky events should be returned from (exclusive).
+            to_id: The sticky stream ID that sticky events should end at (inclusive).
+            now: The current time in unix millis, used for skipping expired events.
+            limit: Max sticky events to return, or None to apply no limit.
+        Returns:
+            to_id, dict[room_id, list[event_ids]]
+        """
+        sticky_events_rows = await self.db_pool.runInteraction(
+            "get_sticky_events_in_rooms",
+            self._get_sticky_events_in_rooms_txn,
+            room_ids,
+            from_id=from_id,
+            to_id=to_id,
+            now=now,
+            limit=limit,
+        )
+
+        if not sticky_events_rows:
+            return to_id, {}
+
+        # Get stream_id of the last row, which is the highest
+        new_to_id, _, _ = sticky_events_rows[-1]
+
+        # room ID -> event IDs
+        room_id_to_event_ids: dict[str, list[str]] = {}
+        for _, room_id, event_id in sticky_events_rows:
+            events = room_id_to_event_ids.setdefault(room_id, [])
+            events.append(event_id)
+
+        return (new_to_id, room_id_to_event_ids)
+
+    def _get_sticky_events_in_rooms_txn(
+        self,
+        txn: LoggingTransaction,
+        room_ids: Collection[str],
+        *,
+        from_id: int,
+        to_id: int,
+        now: int,
+        limit: int | None,
+    ) -> list[tuple[int, str, str]]:
+        if len(room_ids) == 0:
+            return []
+        room_id_in_list_clause, room_id_in_list_values = make_in_list_sql_clause(
+            txn.database_engine, "se.room_id", room_ids
+        )
+        limit_clause = ""
+        limit_params: tuple[int, ...] = ()
+        if limit is not None:
+            limit_clause = "LIMIT ?"
+            limit_params = (limit,)
+
+        if isinstance(self.database_engine, PostgresEngine):
+            expr_soft_failed = "COALESCE(((ej.internal_metadata::jsonb)->>'soft_failed')::boolean, FALSE)"
+        else:
+            expr_soft_failed = "COALESCE(ej.internal_metadata->>'soft_failed', FALSE)"
+
+        txn.execute(
+            f"""
+            SELECT se.stream_id, se.room_id, event_id
+            FROM sticky_events se
+            INNER JOIN event_json ej USING (event_id)
+            WHERE
+                NOT {expr_soft_failed}
+                AND ? < expires_at
+                AND ? < stream_id
+                AND stream_id <= ?
+                AND {room_id_in_list_clause}
+            ORDER BY stream_id ASC
+            {limit_clause}
+            """,
+            (now, from_id, to_id, *room_id_in_list_values, *limit_params),
+        )
+        return cast(list[tuple[int, str, str]], txn.fetchall())
+
+    async def get_updated_sticky_events(
+        self, *, from_id: int, to_id: int, limit: int
+    ) -> list[StickyEventUpdate]:
+        """Get updates to sticky events between two stream IDs.
+
+        Bounds: from_id < ... <= to_id
+
+        Args:
+            from_id: The starting stream ID (exclusive)
+            to_id: The ending stream ID (inclusive)
+            limit: The maximum number of rows to return
+
+        Returns:
+            list of StickyEventUpdate update rows
+        """
+
+        if not self.hs.config.experimental.msc4354_enabled:
+            # We need to prevent `_get_updated_sticky_events_txn`
+            # from running when MSC4354 is turned off, because the query used
+            # for SQLite is not compatible with Ubuntu 22.04 (as used in our CI olddeps run).
+            # It's technically out of support.
+            # See: https://github.com/element-hq/synapse/issues/19428
+            return []
+
+        return await self.db_pool.runInteraction(
+            "get_updated_sticky_events",
+            self._get_updated_sticky_events_txn,
+            from_id,
+            to_id,
+            limit,
+        )
+
+    def _get_updated_sticky_events_txn(
+        self, txn: LoggingTransaction, from_id: int, to_id: int, limit: int
+    ) -> list[StickyEventUpdate]:
+        if isinstance(self.database_engine, PostgresEngine):
+            expr_soft_failed = "COALESCE(((ej.internal_metadata::jsonb)->>'soft_failed')::boolean, FALSE)"
+        else:
+            expr_soft_failed = "COALESCE(ej.internal_metadata->>'soft_failed', FALSE)"
+
+        txn.execute(
+            f"""
+            SELECT se.stream_id, se.room_id, se.event_id,
+            {expr_soft_failed} AS "soft_failed"
+            FROM sticky_events se
+            INNER JOIN event_json ej USING (event_id)
+            WHERE ? < stream_id AND stream_id <= ?
+            LIMIT ?
+            """,
+            (from_id, to_id, limit),
+        )
+
+        return [
+            StickyEventUpdate(
+                stream_id=stream_id,
+                room_id=room_id,
+                event_id=event_id,
+                soft_failed=bool(soft_failed),
+            )
+            for stream_id, room_id, event_id, soft_failed in txn
+        ]
+
+    def insert_sticky_events_txn(
+        self,
+        txn: LoggingTransaction,
+        events: list[EventBase],
+    ) -> None:
+        """
+        Insert events into the sticky_events table.
+
+        Skips inserting events:
+            - if they are considered spammy by the policy server;
+              (unsure if correct, track: https://github.com/matrix-org/matrix-spec-proposals/pull/4354#discussion_r2727593350)
+            - if they are rejected;
+            - if they are outliers (they should be reconsidered for insertion when de-outliered); or
+            - if they are not sticky (e.g. if the stickiness expired).
+
+        Skipping the insertion of these types of 'invalid' events is useful for performance reasons because
+        they would fill up the table yet we wouldn't show them to clients anyway.
+
+        Since syncing clients can't (easily?) 'skip over' sticky events (due to being in-order, reliably delivered),
+        tracking loads of invalid events in the table could make it expensive for servers to retrieve the sticky events that are actually valid.
+
+        For instance, someone spamming 1000s of rejected or 'policy_server_spammy' events could clog up this table in a way that means we either
+        have to deliver empty payloads to syncing clients, or consider substantially more than 100 events in order to gather a 100-sized batch to send down.
+        """
+
+        now_ms = self.clock.time_msec()
+        # event, expires_at
+        sticky_events: list[tuple[EventBase, int]] = []
+        for ev in events:
+            # MSC: Note: policy servers and other similar antispam techniques still apply to these events.
+            if ev.internal_metadata.policy_server_spammy:
+                continue
+            # We shouldn't be passed rejected events, but if we do, we filter them out too.
+            if ev.rejected_reason is not None:
+                continue
+            # We can't persist outlier sticky events as we don't know the room state at that event
+            if ev.internal_metadata.is_outlier():
+                continue
+            sticky_duration = ev.sticky_duration()
+            if sticky_duration is None:
+                continue
+            # Calculate the end time as start_time + effecitve sticky duration
+            expires_at = min(ev.origin_server_ts, now_ms) + sticky_duration.as_millis()
+            # Filter out already expired sticky events
+            if expires_at <= now_ms:
+                continue
+
+            sticky_events.append((ev, expires_at))
+
+        if len(sticky_events) == 0:
+            return
+
+        logger.info(
+            "inserting %d sticky events in room %s",
+            len(sticky_events),
+            sticky_events[0][0].room_id,
+        )
+
+        # Generate stream_ids in one go
+        sticky_events_with_ids = zip(
+            sticky_events,
+            self._sticky_events_id_gen.get_next_mult_txn(txn, len(sticky_events)),
+            strict=True,
+        )
+
+        self.db_pool.simple_insert_many_txn(
+            txn,
+            "sticky_events",
+            keys=(
+                "instance_name",
+                "stream_id",
+                "room_id",
+                "event_id",
+                "event_stream_ordering",
+                "sender",
+                "expires_at",
+            ),
+            values=[
+                (
+                    self._instance_name,
+                    stream_id,
+                    ev.room_id,
+                    ev.event_id,
+                    ev.internal_metadata.stream_ordering,
+                    ev.sender,
+                    expires_at,
+                )
+                for (ev, expires_at), stream_id in sticky_events_with_ids
+            ],
+        )
+
+    async def _delete_expired_sticky_events(self) -> None:
+        await self.db_pool.runInteraction(
+            "_delete_expired_sticky_events",
+            self._delete_expired_sticky_events_txn,
+            self.clock.time_msec(),
+        )
+
+    def _delete_expired_sticky_events_txn(
+        self, txn: LoggingTransaction, now: int
+    ) -> None:
+        """
+        From the `sticky_events` table, deletes all entries whose expiry is in the past
+        (older than `now`).
+
+        This is fine because we don't consider the events as sticky anymore when that's
+        happened.
+        """
+        txn.execute(
+            """
+            DELETE FROM sticky_events WHERE expires_at < ?
+            """,
+            (now,),
+        )
+
+    def _run_background_cleanup(self) -> Deferred:
+        return self.hs.run_as_background_process(
+            "delete_expired_sticky_events",
+            self._delete_expired_sticky_events,
+        )
diff --git a/synapse/storage/databases/main/stream.py b/synapse/storage/databases/main/stream.py
index 66280f2f9a..8fa1e2e5a9 100644
--- a/synapse/storage/databases/main/stream.py
+++ b/synapse/storage/databases/main/stream.py
@@ -47,15 +47,10 @@ from typing import (
     AbstractSet,
     Any,
     Collection,
-    Dict,
     Iterable,
-    List,
     Literal,
     Mapping,
-    Optional,
     Protocol,
-    Set,
-    Tuple,
     cast,
     overload,
 )
@@ -106,24 +101,24 @@ class PaginateFunction(Protocol):
         *,
         room_id: str,
         from_key: RoomStreamToken,
-        to_key: Optional[RoomStreamToken] = None,
+        to_key: RoomStreamToken | None = None,
         direction: Direction = Direction.BACKWARDS,
         limit: int = 0,
-    ) -> Tuple[List[EventBase], RoomStreamToken, bool]: ...
+    ) -> tuple[list[EventBase], RoomStreamToken, bool]: ...
 
 
 # Used as return values for pagination APIs
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class _EventDictReturn:
     event_id: str
-    topological_ordering: Optional[int]
+    topological_ordering: int | None
     stream_ordering: int
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class _EventsAround:
-    events_before: List[EventBase]
-    events_after: List[EventBase]
+    events_before: list[EventBase]
+    events_after: list[EventBase]
     start: RoomStreamToken
     end: RoomStreamToken
 
@@ -143,22 +138,22 @@ class CurrentStateDeltaMembership:
 
     room_id: str
     # Event
-    event_id: Optional[str]
+    event_id: str | None
     event_pos: PersistedEventPosition
     membership: str
-    sender: Optional[str]
+    sender: str | None
     # Prev event
-    prev_event_id: Optional[str]
-    prev_event_pos: Optional[PersistedEventPosition]
-    prev_membership: Optional[str]
-    prev_sender: Optional[str]
+    prev_event_id: str | None
+    prev_event_pos: PersistedEventPosition | None
+    prev_membership: str | None
+    prev_sender: str | None
 
 
 def generate_pagination_where_clause(
     direction: Direction,
-    column_names: Tuple[str, str],
-    from_token: Optional[Tuple[Optional[int], int]],
-    to_token: Optional[Tuple[Optional[int], int]],
+    column_names: tuple[str, str],
+    from_token: tuple[int | None, int] | None,
+    to_token: tuple[int | None, int] | None,
     engine: BaseDatabaseEngine,
 ) -> str:
     """Creates an SQL expression to bound the columns by the pagination
@@ -222,11 +217,9 @@ def generate_pagination_where_clause(
 
 def generate_pagination_bounds(
     direction: Direction,
-    from_token: Optional[RoomStreamToken],
-    to_token: Optional[RoomStreamToken],
-) -> Tuple[
-    str, Optional[Tuple[Optional[int], int]], Optional[Tuple[Optional[int], int]]
-]:
+    from_token: RoomStreamToken | None,
+    to_token: RoomStreamToken | None,
+) -> tuple[str, tuple[int | None, int] | None, tuple[int | None, int] | None]:
     """
     Generate a start and end point for this page of events.
 
@@ -261,7 +254,7 @@ def generate_pagination_bounds(
     # by fetching all events between the min stream token and the maximum
     # stream token (as returned by `RoomStreamToken.get_max_stream_pos`) and
     # then filtering the results.
-    from_bound: Optional[Tuple[Optional[int], int]] = None
+    from_bound: tuple[int | None, int] | None = None
     if from_token:
         if from_token.topological is not None:
             from_bound = from_token.as_historical_tuple()
@@ -276,7 +269,7 @@ def generate_pagination_bounds(
                 from_token.stream,
             )
 
-    to_bound: Optional[Tuple[Optional[int], int]] = None
+    to_bound: tuple[int | None, int] | None = None
     if to_token:
         if to_token.topological is not None:
             to_bound = to_token.as_historical_tuple()
@@ -295,7 +288,7 @@ def generate_pagination_bounds(
 
 
 def generate_next_token(
-    direction: Direction, last_topo_ordering: Optional[int], last_stream_ordering: int
+    direction: Direction, last_topo_ordering: int | None, last_stream_ordering: int
 ) -> RoomStreamToken:
     """
     Generate the next room stream token based on the currently returned data.
@@ -320,8 +313,8 @@ def generate_next_token(
 
 def _make_generic_sql_bound(
     bound: str,
-    column_names: Tuple[str, str],
-    values: Tuple[Optional[int], int],
+    column_names: tuple[str, str],
+    values: tuple[int | None, int],
     engine: BaseDatabaseEngine,
 ) -> str:
     """Create an SQL expression that bounds the given column names by the
@@ -385,9 +378,9 @@ def _make_generic_sql_bound(
 
 
 def _filter_results(
-    lower_token: Optional[RoomStreamToken],
-    upper_token: Optional[RoomStreamToken],
-    instance_name: Optional[str],
+    lower_token: RoomStreamToken | None,
+    upper_token: RoomStreamToken | None,
+    instance_name: str | None,
     topological_ordering: int,
     stream_ordering: int,
 ) -> bool:
@@ -440,9 +433,9 @@ def _filter_results(
 
 
 def _filter_results_by_stream(
-    lower_token: Optional[RoomStreamToken],
-    upper_token: Optional[RoomStreamToken],
-    instance_name: Optional[str],
+    lower_token: RoomStreamToken | None,
+    upper_token: RoomStreamToken | None,
+    instance_name: str | None,
     stream_ordering: int,
 ) -> bool:
     """
@@ -484,7 +477,7 @@ def _filter_results_by_stream(
     return True
 
 
-def filter_to_clause(event_filter: Optional[Filter]) -> Tuple[str, List[str]]:
+def filter_to_clause(event_filter: Filter | None) -> tuple[str, list[str]]:
     # NB: This may create SQL clauses that don't optimise well (and we don't
     # have indices on all possible clauses). E.g. it may create
     # "room_id == X AND room_id != X", which postgres doesn't optimise.
@@ -666,10 +659,10 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         *,
         room_ids: Collection[str],
         from_key: RoomStreamToken,
-        to_key: Optional[RoomStreamToken] = None,
+        to_key: RoomStreamToken | None = None,
         direction: Direction = Direction.BACKWARDS,
         limit: int = 0,
-    ) -> Dict[str, Tuple[List[EventBase], RoomStreamToken, bool]]:
+    ) -> dict[str, tuple[list[EventBase], RoomStreamToken, bool]]:
         """Get new room events in stream ordering since `from_key`.
 
         Args:
@@ -730,7 +723,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
     def get_rooms_that_changed(
         self, room_ids: Collection[str], from_key: RoomStreamToken
-    ) -> Set[str]:
+    ) -> set[str]:
         """Given a list of rooms and a token, return rooms where there may have
         been changes.
         """
@@ -747,7 +740,14 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         from_key: RoomStreamToken,
     ) -> StrCollection:
         """Return the rooms that probably have had updates since the given
-        token (changes that are > `from_key`)."""
+        token (changes that are > `from_key`).
+
+        May return false positives, but must not return false negatives.
+
+        If `have_finished_sliding_sync_background_jobs` is False, then we return
+        all the room IDs, as we can't be sure that the sliding sync table is
+        fully populated.
+        """
         # If the stream change cache is valid for the stream token, we can just
         # use the result of that.
         if from_key.stream >= self._events_stream_cache.get_earliest_known_position():
@@ -755,6 +755,11 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
                 room_ids, from_key.stream
             )
 
+        if not self.have_finished_sliding_sync_background_jobs():
+            # If the table hasn't been populated yet, we have to assume all rooms
+            # have updates.
+            return room_ids
+
         def get_rooms_that_have_updates_since_sliding_sync_table_txn(
             txn: LoggingTransaction,
         ) -> StrCollection:
@@ -765,7 +770,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
                     AND event_stream_ordering > ?
             """
 
-            results: Set[str] = set()
+            results: set[str] = set()
             for batch in batch_iter(room_ids, 1000):
                 clause, args = make_in_list_sql_clause(
                     self.database_engine, "room_id", batch
@@ -788,10 +793,10 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         *,
         room_id: str,
         from_key: RoomStreamToken,
-        to_key: Optional[RoomStreamToken] = None,
+        to_key: RoomStreamToken | None = None,
         direction: Direction = Direction.BACKWARDS,
         limit: int = 0,
-    ) -> Tuple[List[EventBase], RoomStreamToken, bool]:
+    ) -> tuple[list[EventBase], RoomStreamToken, bool]:
         """
         Paginate events by `stream_ordering` in the room from the `from_key` in the
         given `direction` to the `to_key` or `limit`.
@@ -876,7 +881,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             engine=self.database_engine,
         )
 
-        def f(txn: LoggingTransaction) -> Tuple[List[_EventDictReturn], bool]:
+        def f(txn: LoggingTransaction) -> tuple[list[_EventDictReturn], bool]:
             sql = f"""
                 SELECT event_id, instance_name, stream_ordering
                 FROM events
@@ -940,8 +945,8 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         user_id: str,
         from_key: RoomStreamToken,
         to_key: RoomStreamToken,
-        excluded_room_ids: Optional[List[str]] = None,
-    ) -> List[CurrentStateDeltaMembership]:
+        excluded_room_ids: list[str] | None = None,
+    ) -> list[CurrentStateDeltaMembership]:
         """
         Fetch membership events (and the previous event that was replaced by that one)
         for a given user.
@@ -995,13 +1000,13 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             if not has_changed:
                 return []
 
-        def f(txn: LoggingTransaction) -> List[CurrentStateDeltaMembership]:
+        def f(txn: LoggingTransaction) -> list[CurrentStateDeltaMembership]:
             # To handle tokens with a non-empty instance_map we fetch more
             # results than necessary and then filter down
             min_from_id = from_key.stream
             max_to_id = to_key.get_max_stream_pos()
 
-            args: List[Any] = [min_from_id, max_to_id, EventTypes.Member, user_id]
+            args: list[Any] = [min_from_id, max_to_id, EventTypes.Member, user_id]
 
             # TODO: It would be good to assert that the `from_token`/`to_token` is >=
             # the first row in `current_state_delta_stream` for the rooms we're
@@ -1044,7 +1049,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
             txn.execute(sql, args)
 
-            membership_changes: List[CurrentStateDeltaMembership] = []
+            membership_changes: list[CurrentStateDeltaMembership] = []
             for (
                 room_id,
                 event_id,
@@ -1135,8 +1140,8 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         user_id: str,
         from_key: RoomStreamToken,
         to_key: RoomStreamToken,
-        excluded_room_ids: Optional[AbstractSet[str]] = None,
-    ) -> Dict[str, RoomsForUserStateReset]:
+        excluded_room_ids: AbstractSet[str] | None = None,
+    ) -> dict[str, RoomsForUserStateReset]:
         """
         Fetch membership events that result in a meaningful membership change for a
         given user.
@@ -1185,7 +1190,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         if excluded_room_ids is not None:
             room_ids_to_exclude = excluded_room_ids
 
-        def f(txn: LoggingTransaction) -> Dict[str, RoomsForUserStateReset]:
+        def f(txn: LoggingTransaction) -> dict[str, RoomsForUserStateReset]:
             # To handle tokens with a non-empty instance_map we fetch more
             # results than necessary and then filter down
             min_from_id = from_key.stream
@@ -1248,7 +1253,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
                 (user_id, EventTypes.Member, user_id, min_from_id, max_to_id),
             )
 
-            membership_changes: Dict[str, RoomsForUserStateReset] = {}
+            membership_changes: dict[str, RoomsForUserStateReset] = {}
             for (
                 room_id,
                 membership_event_id,
@@ -1332,8 +1337,8 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         user_id: str,
         from_key: RoomStreamToken,
         to_key: RoomStreamToken,
-        excluded_rooms: Optional[List[str]] = None,
-    ) -> List[EventBase]:
+        excluded_rooms: list[str] | None = None,
+    ) -> list[EventBase]:
         """Fetch membership events for a given user.
 
         All such events whose stream ordering `s` lies in the range
@@ -1351,13 +1356,13 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             if not has_changed:
                 return []
 
-        def f(txn: LoggingTransaction) -> List[_EventDictReturn]:
+        def f(txn: LoggingTransaction) -> list[_EventDictReturn]:
             # To handle tokens with a non-empty instance_map we fetch more
             # results than necessary and then filter down
             min_from_id = from_key.stream
             max_to_id = to_key.get_max_stream_pos()
 
-            args: List[Any] = [user_id, min_from_id, max_to_id]
+            args: list[Any] = [user_id, min_from_id, max_to_id]
 
             ignore_room_clause = ""
             if excluded_rooms is not None and len(excluded_rooms) > 0:
@@ -1403,7 +1408,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
     async def get_recent_events_for_room(
         self, room_id: str, limit: int, end_token: RoomStreamToken
-    ) -> Tuple[List[EventBase], RoomStreamToken]:
+    ) -> tuple[list[EventBase], RoomStreamToken]:
         """Get the most recent events in the room in topological ordering.
 
         Args:
@@ -1428,7 +1433,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
     async def get_recent_event_ids_for_room(
         self, room_id: str, limit: int, end_token: RoomStreamToken
-    ) -> Tuple[List[_EventDictReturn], RoomStreamToken]:
+    ) -> tuple[list[_EventDictReturn], RoomStreamToken]:
         """Get the most recent events in the room in topological ordering.
 
         Args:
@@ -1459,7 +1464,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
     async def get_room_event_before_stream_ordering(
         self, room_id: str, stream_ordering: int
-    ) -> Optional[Tuple[int, int, str]]:
+    ) -> tuple[int, int, str] | None:
         """Gets details of the first event in a room at or before a stream ordering
 
         Args:
@@ -1470,7 +1475,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             A tuple of (stream ordering, topological ordering, event_id)
         """
 
-        def _f(txn: LoggingTransaction) -> Optional[Tuple[int, int, str]]:
+        def _f(txn: LoggingTransaction) -> tuple[int, int, str] | None:
             sql = """
                 SELECT stream_ordering, topological_ordering, event_id
                 FROM events
@@ -1483,7 +1488,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
                 LIMIT 1
             """
             txn.execute(sql, (room_id, stream_ordering))
-            return cast(Optional[Tuple[int, int, str]], txn.fetchone())
+            return cast(tuple[int, int, str] | None, txn.fetchone())
 
         return await self.db_pool.runInteraction(
             "get_room_event_before_stream_ordering", _f
@@ -1493,7 +1498,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         self,
         room_id: str,
         end_token: RoomStreamToken,
-    ) -> Optional[str]:
+    ) -> str | None:
         """Returns the ID of the last event in a room at or before a stream ordering
 
         Args:
@@ -1518,8 +1523,8 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
     async def get_last_event_pos_in_room(
         self,
         room_id: str,
-        event_types: Optional[StrCollection] = None,
-    ) -> Optional[Tuple[str, PersistedEventPosition]]:
+        event_types: StrCollection | None = None,
+    ) -> tuple[str, PersistedEventPosition] | None:
         """
         Returns the ID and event position of the last event in a room.
 
@@ -1536,9 +1541,9 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
         def _get_last_event_pos_in_room_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Tuple[str, PersistedEventPosition]]:
+        ) -> tuple[str, PersistedEventPosition] | None:
             event_type_clause = ""
-            event_type_args: List[str] = []
+            event_type_args: list[str] = []
             if event_types is not None and len(event_types) > 0:
                 event_type_clause, event_type_args = make_in_list_sql_clause(
                     txn.database_engine, "type", event_types
@@ -1562,7 +1567,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
                 [room_id] + event_type_args,
             )
 
-            row = cast(Optional[Tuple[str, int, str]], txn.fetchone())
+            row = cast(tuple[str, int, str] | None, txn.fetchone())
             if row is not None:
                 event_id, stream_ordering, instance_name = row
 
@@ -1584,8 +1589,8 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         self,
         room_id: str,
         end_token: RoomStreamToken,
-        event_types: Optional[StrCollection] = None,
-    ) -> Optional[Tuple[str, PersistedEventPosition]]:
+        event_types: StrCollection | None = None,
+    ) -> tuple[str, PersistedEventPosition] | None:
         """
         Returns the ID and event position of the last event in a room at or before a
         stream ordering.
@@ -1602,7 +1607,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
         def get_last_event_pos_in_room_before_stream_ordering_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Tuple[str, PersistedEventPosition]]:
+        ) -> tuple[str, PersistedEventPosition] | None:
             # We're looking for the closest event at or before the token. We need to
             # handle the fact that the stream token can be a vector clock (with an
             # `instance_map`) and events can be persisted on different instances
@@ -1616,7 +1621,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             max_stream = end_token.get_max_stream_pos()
 
             event_type_clause = ""
-            event_type_args: List[str] = []
+            event_type_args: list[str] = []
             if event_types is not None and len(event_types) > 0:
                 event_type_clause, event_type_args = make_in_list_sql_clause(
                     txn.database_engine, "type", event_types
@@ -1692,7 +1697,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         self,
         room_ids: StrCollection,
         end_token: RoomStreamToken,
-    ) -> Dict[str, int]:
+    ) -> dict[str, int]:
         """Bulk fetch the stream position of the latest events in the given
         rooms
         """
@@ -1705,8 +1710,8 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         # Check that the stream position for the rooms are from before the
         # minimum position of the token. If not then we need to fetch more
         # rows.
-        results: Dict[str, int] = {}
-        recheck_rooms: Set[str] = set()
+        results: dict[str, int] = {}
+        recheck_rooms: set[str] = set()
         min_token = end_token.stream
         for room_id, stream in uncapped_results.items():
             if stream is None:
@@ -1739,7 +1744,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
     @cachedList(cached_method_name="_get_max_event_pos", list_name="room_ids")
     async def _bulk_get_max_event_pos(
         self, room_ids: StrCollection
-    ) -> Mapping[str, Optional[int]]:
+    ) -> Mapping[str, int | None]:
         """Fetch the max position of a persisted event in the room."""
 
         # We need to be careful not to return positions ahead of the current
@@ -1747,11 +1752,11 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         now_token = self.get_room_max_token()
         max_pos = now_token.get_max_stream_pos()
 
-        results: Dict[str, int] = {}
+        results: dict[str, int] = {}
 
         # First, we check for the rooms in the stream change cache to see if we
         # can just use the latest position from it.
-        missing_room_ids: Set[str] = set()
+        missing_room_ids: set[str] = set()
         for room_id in room_ids:
             stream_pos = self._events_stream_cache.get_max_pos_of_last_change(room_id)
             if stream_pos is not None:
@@ -1770,7 +1775,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
         def bulk_get_max_event_pos_fallback_txn(
             txn: LoggingTransaction, batched_room_ids: StrCollection
-        ) -> Dict[str, int]:
+        ) -> dict[str, int]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "room_id", batched_room_ids
             )
@@ -1795,7 +1800,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         # the joins and sub-queries.
         def bulk_get_max_event_pos_from_sliding_sync_tables_txn(
             txn: LoggingTransaction, batched_room_ids: StrCollection
-        ) -> Dict[str, int]:
+        ) -> dict[str, int]:
             clause, args = make_in_list_sql_clause(
                 self.database_engine, "room_id", batched_room_ids
             )
@@ -1808,7 +1813,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             txn.execute(sql, args)
             return {row[0]: row[1] for row in txn}
 
-        recheck_rooms: Set[str] = set()
+        recheck_rooms: set[str] = set()
         for batched in batch_iter(room_ids, 1000):
             if await self.have_finished_sliding_sync_background_jobs():
                 batch_results = await self.db_pool.runInteraction(
@@ -1864,14 +1869,14 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         txn: LoggingTransaction,
         event_id: str,
         allow_none: bool = False,
-    ) -> Optional[int]: ...
+    ) -> int | None: ...
 
     def get_stream_id_for_event_txn(
         self,
         txn: LoggingTransaction,
         event_id: str,
         allow_none: bool = False,
-    ) -> Optional[int]:
+    ) -> int | None:
         # Type ignore: we pass keyvalues a Dict[str, str]; the function wants
         # Dict[str, Any]. I think mypy is unhappy because Dict is invariant?
         return self.db_pool.simple_select_one_onecol_txn(  # type: ignore[call-overload]
@@ -1974,7 +1979,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         event_id: str,
         before_limit: int,
         after_limit: int,
-        event_filter: Optional[Filter] = None,
+        event_filter: Filter | None = None,
     ) -> _EventsAround:
         """Retrieve events and pagination tokens around a given event in a
         room.
@@ -2012,7 +2017,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         event_id: str,
         before_limit: int,
         after_limit: int,
-        event_filter: Optional[Filter],
+        event_filter: Filter | None,
     ) -> dict:
         """Retrieves event_ids and pagination tokens around a given event in a
         room.
@@ -2077,7 +2082,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         from_id: int,
         current_id: int,
         limit: int,
-    ) -> Tuple[int, Dict[str, Optional[int]]]:
+    ) -> tuple[int, dict[str, int | None]]:
         """Get all new events
 
         Returns all event ids with from_id < stream_ordering <= current_id.
@@ -2098,7 +2103,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
 
         def get_all_new_event_ids_stream_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[int, Dict[str, Optional[int]]]:
+        ) -> tuple[int, dict[str, int | None]]:
             sql = (
                 "SELECT e.stream_ordering, e.event_id, e.received_ts"
                 " FROM events AS e"
@@ -2115,7 +2120,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             if len(rows) == limit:
                 upper_bound = rows[-1][0]
 
-            event_to_received_ts: Dict[str, Optional[int]] = {
+            event_to_received_ts: dict[str, int | None] = {
                 row[1]: row[2] for row in rows
             }
             return upper_bound, event_to_received_ts
@@ -2194,7 +2199,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         """
         txn.execute(sql)
         min_positions = dict(
-            cast(Iterable[Tuple[str, int]], txn)
+            cast(Iterable[tuple[str, int]], txn)
         )  # Map from type -> min position
 
         # Ensure we do actually have some values here
@@ -2225,11 +2230,11 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         txn: LoggingTransaction,
         room_id: str,
         from_token: RoomStreamToken,
-        to_token: Optional[RoomStreamToken] = None,
+        to_token: RoomStreamToken | None = None,
         direction: Direction = Direction.BACKWARDS,
         limit: int = 0,
-        event_filter: Optional[Filter] = None,
-    ) -> Tuple[List[_EventDictReturn], RoomStreamToken, bool]:
+        event_filter: Filter | None = None,
+    ) -> tuple[list[_EventDictReturn], RoomStreamToken, bool]:
         """Returns list of events before or after a given token.
 
         Args:
@@ -2269,7 +2274,7 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
             # Token selection matches what we do below if there are no rows
             return [], to_token if to_token else from_token, False
 
-        args: List[Any] = [room_id]
+        args: list[Any] = [room_id]
 
         order, from_bound, to_bound = generate_pagination_bounds(
             direction, from_token, to_token
@@ -2399,11 +2404,11 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
         *,
         room_id: str,
         from_key: RoomStreamToken,
-        to_key: Optional[RoomStreamToken] = None,
+        to_key: RoomStreamToken | None = None,
         direction: Direction = Direction.BACKWARDS,
         limit: int = 0,
-        event_filter: Optional[Filter] = None,
-    ) -> Tuple[List[EventBase], RoomStreamToken, bool]:
+        event_filter: Filter | None = None,
+    ) -> tuple[list[EventBase], RoomStreamToken, bool]:
         """
         Paginate events by `topological_ordering` (tie-break with `stream_ordering`) in
         the room from the `from_key` in the given `direction` to the `to_key` or
@@ -2529,9 +2534,9 @@ class StreamWorkerStore(EventsWorkerStore, SQLBaseStore):
     async def get_timeline_gaps(
         self,
         room_id: str,
-        from_token: Optional[RoomStreamToken],
+        from_token: RoomStreamToken | None,
         to_token: RoomStreamToken,
-    ) -> Optional[RoomStreamToken]:
+    ) -> RoomStreamToken | None:
         """Check if there is a gap, and return a token that marks the position
         of the gap in the stream.
         """
diff --git a/synapse/storage/databases/main/tags.py b/synapse/storage/databases/main/tags.py
index 97b190bccc..0768dd78c0 100644
--- a/synapse/storage/databases/main/tags.py
+++ b/synapse/storage/databases/main/tags.py
@@ -21,7 +21,7 @@
 #
 
 import logging
-from typing import Any, Dict, Iterable, List, Mapping, Tuple, cast
+from typing import Any, Iterable, Mapping, cast
 
 from synapse.api.constants import AccountDataTypes
 from synapse.replication.tcp.streams import AccountDataStream
@@ -30,8 +30,8 @@ from synapse.storage.database import LoggingTransaction
 from synapse.storage.databases.main.account_data import AccountDataWorkerStore
 from synapse.storage.util.id_generators import AbstractStreamIdGenerator
 from synapse.types import JsonDict, JsonMapping
-from synapse.util import json_encoder
 from synapse.util.caches.descriptors import cached
+from synapse.util.json import json_encoder
 
 logger = logging.getLogger(__name__)
 
@@ -52,13 +52,13 @@ class TagsWorkerStore(AccountDataWorkerStore):
         """
 
         rows = cast(
-            List[Tuple[str, str, str]],
+            list[tuple[str, str, str]],
             await self.db_pool.simple_select_list(
                 "room_tags", {"user_id": user_id}, ["room_id", "tag", "content"]
             ),
         )
 
-        tags_by_room: Dict[str, Dict[str, JsonDict]] = {}
+        tags_by_room: dict[str, dict[str, JsonDict]] = {}
         for room_id, tag, content in rows:
             room_tags = tags_by_room.setdefault(room_id, {})
             room_tags[tag] = db_to_json(content)
@@ -66,7 +66,7 @@ class TagsWorkerStore(AccountDataWorkerStore):
 
     async def get_all_updated_tags(
         self, instance_name: str, last_id: int, current_id: int, limit: int
-    ) -> Tuple[List[Tuple[int, str, str]], int, bool]:
+    ) -> tuple[list[tuple[int, str, str]], int, bool]:
         """Get updates for tags replication stream.
 
         Args:
@@ -93,7 +93,7 @@ class TagsWorkerStore(AccountDataWorkerStore):
 
         def get_all_updated_tags_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str]]:
+        ) -> list[tuple[int, str, str]]:
             sql = (
                 "SELECT stream_id, user_id, room_id"
                 " FROM room_tags_revisions as r"
@@ -102,7 +102,7 @@ class TagsWorkerStore(AccountDataWorkerStore):
             )
             txn.execute(sql, (last_id, current_id, limit))
             # mypy doesn't understand what the query is selecting.
-            return cast(List[Tuple[int, str, str]], txn.fetchall())
+            return cast(list[tuple[int, str, str]], txn.fetchall())
 
         tag_ids = await self.db_pool.runInteraction(
             "get_all_updated_tags", get_all_updated_tags_txn
@@ -131,7 +131,7 @@ class TagsWorkerStore(AccountDataWorkerStore):
             rooms that changed since the stream_id token.
         """
 
-        def get_updated_tags_txn(txn: LoggingTransaction) -> List[str]:
+        def get_updated_tags_txn(txn: LoggingTransaction) -> list[str]:
             sql = (
                 "SELECT room_id from room_tags_revisions"
                 " WHERE user_id = ? AND stream_id > ?"
@@ -218,7 +218,7 @@ class TagsWorkerStore(AccountDataWorkerStore):
             A mapping of tags to tag content.
         """
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="room_tags",
                 keyvalues={"user_id": user_id, "room_id": room_id},
@@ -338,8 +338,8 @@ class TagsWorkerStore(AccountDataWorkerStore):
         if stream_name == AccountDataStream.NAME:
             # Cast is safe because the `AccountDataStream` should only be giving us
             # `AccountDataStreamRow`
-            account_data_stream_rows: List[AccountDataStream.AccountDataStreamRow] = (
-                cast(List[AccountDataStream.AccountDataStreamRow], rows)
+            account_data_stream_rows: list[AccountDataStream.AccountDataStreamRow] = (
+                cast(list[AccountDataStream.AccountDataStreamRow], rows)
             )
 
             for row in account_data_stream_rows:
diff --git a/synapse/storage/databases/main/task_scheduler.py b/synapse/storage/databases/main/task_scheduler.py
index 4956870b1a..05ebb57cf3 100644
--- a/synapse/storage/databases/main/task_scheduler.py
+++ b/synapse/storage/databases/main/task_scheduler.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import TYPE_CHECKING, Any, List, Optional, Tuple, cast
+from typing import TYPE_CHECKING, Any, cast
 
 from synapse.storage._base import SQLBaseStore, db_to_json
 from synapse.storage.database import (
@@ -29,12 +29,12 @@ from synapse.storage.database import (
     make_in_list_sql_clause,
 )
 from synapse.types import JsonDict, JsonMapping, ScheduledTask, TaskStatus
-from synapse.util import json_encoder
+from synapse.util.json import json_encoder
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
 
-ScheduledTaskRow = Tuple[str, str, str, int, str, str, str, str]
+ScheduledTaskRow = tuple[str, str, str, int, str, str, str, str]
 
 
 class TaskSchedulerWorkerStore(SQLBaseStore):
@@ -63,12 +63,12 @@ class TaskSchedulerWorkerStore(SQLBaseStore):
     async def get_scheduled_tasks(
         self,
         *,
-        actions: Optional[List[str]] = None,
-        resource_id: Optional[str] = None,
-        statuses: Optional[List[TaskStatus]] = None,
-        max_timestamp: Optional[int] = None,
-        limit: Optional[int] = None,
-    ) -> List[ScheduledTask]:
+        actions: list[str] | None = None,
+        resource_id: str | None = None,
+        statuses: list[TaskStatus] | None = None,
+        max_timestamp: int | None = None,
+        limit: int | None = None,
+    ) -> list[ScheduledTask]:
         """Get a list of scheduled tasks from the DB.
 
         Args:
@@ -82,9 +82,9 @@ class TaskSchedulerWorkerStore(SQLBaseStore):
         Returns: a list of `ScheduledTask`, ordered by increasing timestamps
         """
 
-        def get_scheduled_tasks_txn(txn: LoggingTransaction) -> List[ScheduledTaskRow]:
-            clauses: List[str] = []
-            args: List[Any] = []
+        def get_scheduled_tasks_txn(txn: LoggingTransaction) -> list[ScheduledTaskRow]:
+            clauses: list[str] = []
+            args: list[Any] = []
             if resource_id:
                 clauses.append("resource_id = ?")
                 args.append(resource_id)
@@ -115,7 +115,7 @@ class TaskSchedulerWorkerStore(SQLBaseStore):
                 args.append(limit)
 
             txn.execute(sql, args)
-            return cast(List[ScheduledTaskRow], txn.fetchall())
+            return cast(list[ScheduledTaskRow], txn.fetchall())
 
         rows = await self.db_pool.runInteraction(
             "get_scheduled_tasks", get_scheduled_tasks_txn
@@ -152,9 +152,9 @@ class TaskSchedulerWorkerStore(SQLBaseStore):
         id: str,
         timestamp: int,
         *,
-        status: Optional[TaskStatus] = None,
-        result: Optional[JsonMapping] = None,
-        error: Optional[str] = None,
+        status: TaskStatus | None = None,
+        result: JsonMapping | None = None,
+        error: str | None = None,
     ) -> bool:
         """Update a scheduled task in the DB with some new value(s).
 
@@ -182,7 +182,7 @@ class TaskSchedulerWorkerStore(SQLBaseStore):
         )
         return nb_rows > 0
 
-    async def get_scheduled_task(self, id: str) -> Optional[ScheduledTask]:
+    async def get_scheduled_task(self, id: str) -> ScheduledTask | None:
         """Get a specific `ScheduledTask` from its id.
 
         Args:
@@ -191,7 +191,7 @@ class TaskSchedulerWorkerStore(SQLBaseStore):
         Returns: the task if available, `None` otherwise
         """
         row = cast(
-            Optional[ScheduledTaskRow],
+            ScheduledTaskRow | None,
             await self.db_pool.simple_select_one(
                 table="scheduled_tasks",
                 keyvalues={"id": id},
diff --git a/synapse/storage/databases/main/thread_subscriptions.py b/synapse/storage/databases/main/thread_subscriptions.py
index 24a99cf449..e177e67ab1 100644
--- a/synapse/storage/databases/main/thread_subscriptions.py
+++ b/synapse/storage/databases/main/thread_subscriptions.py
@@ -14,12 +14,7 @@ import logging
 from typing import (
     TYPE_CHECKING,
     Any,
-    FrozenSet,
     Iterable,
-    List,
-    Optional,
-    Tuple,
-    Union,
     cast,
 )
 
@@ -165,8 +160,8 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
         room_id: str,
         thread_root_event_id: str,
         *,
-        automatic_event_orderings: Optional[EventOrderings],
-    ) -> Optional[Union[int, AutomaticSubscriptionConflicted]]:
+        automatic_event_orderings: EventOrderings | None,
+    ) -> int | AutomaticSubscriptionConflicted | None:
         """Updates a user's subscription settings for a specific thread root.
 
         If no change would be made to the subscription, does not produce any database change.
@@ -208,7 +203,7 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
 
         def _subscribe_user_to_thread_txn(
             txn: LoggingTransaction,
-        ) -> Optional[Union[int, AutomaticSubscriptionConflicted]]:
+        ) -> int | AutomaticSubscriptionConflicted | None:
             requested_automatic = automatic_event_orderings is not None
 
             row = self.db_pool.simple_select_one_txn(
@@ -310,7 +305,7 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
 
     async def unsubscribe_user_from_thread(
         self, user_id: str, room_id: str, thread_root_event_id: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """Unsubscribes a user from a thread.
 
         If no change would be made to the subscription, does not produce any database change.
@@ -326,7 +321,7 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
 
         assert self._can_write_to_thread_subscriptions
 
-        def _unsubscribe_user_from_thread_txn(txn: LoggingTransaction) -> Optional[int]:
+        def _unsubscribe_user_from_thread_txn(txn: LoggingTransaction) -> int | None:
             already_subscribed = self.db_pool.simple_select_one_onecol_txn(
                 txn,
                 table="thread_subscriptions",
@@ -423,7 +418,7 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
     @cached(tree=True)
     async def get_subscription_for_thread(
         self, user_id: str, room_id: str, thread_root_event_id: str
-    ) -> Optional[ThreadSubscription]:
+    ) -> ThreadSubscription | None:
         """Get the thread subscription for a specific thread and user.
 
         Args:
@@ -479,7 +474,7 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
     @cached(max_entries=100)
     async def get_subscribers_to_thread(
         self, room_id: str, thread_root_event_id: str
-    ) -> FrozenSet[str]:
+    ) -> frozenset[str]:
         """
         Returns:
             the set of user_ids for local users who are subscribed to the given thread.
@@ -505,9 +500,12 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
         """
         return self._thread_subscriptions_id_gen.get_current_token()
 
+    def get_thread_subscriptions_stream_id_generator(self) -> MultiWriterIdGenerator:
+        return self._thread_subscriptions_id_gen
+
     async def get_updated_thread_subscriptions(
         self, *, from_id: int, to_id: int, limit: int
-    ) -> List[Tuple[int, str, str, str]]:
+    ) -> list[tuple[int, str, str, str]]:
         """Get updates to thread subscriptions between two stream IDs.
 
         Args:
@@ -521,7 +519,7 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
 
         def get_updated_thread_subscriptions_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str, str]]:
+        ) -> list[tuple[int, str, str, str]]:
             sql = """
                 SELECT stream_id, user_id, room_id, event_id
                 FROM thread_subscriptions
@@ -531,41 +529,59 @@ class ThreadSubscriptionsWorkerStore(CacheInvalidationWorkerStore):
             """
 
             txn.execute(sql, (from_id, to_id, limit))
-            return cast(List[Tuple[int, str, str, str]], txn.fetchall())
+            return cast(list[tuple[int, str, str, str]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_updated_thread_subscriptions",
             get_updated_thread_subscriptions_txn,
         )
 
-    async def get_updated_thread_subscriptions_for_user(
+    async def get_latest_updated_thread_subscriptions_for_user(
         self, user_id: str, *, from_id: int, to_id: int, limit: int
-    ) -> List[Tuple[int, str, str]]:
-        """Get updates to thread subscriptions for a specific user.
+    ) -> list[tuple[int, str, str, bool, bool | None]]:
+        """Get the latest updates to thread subscriptions for a specific user.
 
         Args:
             user_id: The ID of the user
             from_id: The starting stream ID (exclusive)
             to_id: The ending stream ID (inclusive)
             limit: The maximum number of rows to return
+                If there are too many rows to return, rows from the start (closer to `from_id`)
+                will be omitted.
 
         Returns:
-            A list of (stream_id, room_id, thread_root_event_id) tuples.
+            A list of (stream_id, room_id, thread_root_event_id, subscribed, automatic) tuples.
+            The row with lowest `stream_id` is the first row.
         """
 
         def get_updated_thread_subscriptions_for_user_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[int, str, str]]:
+        ) -> list[tuple[int, str, str, bool, bool | None]]:
             sql = """
-                SELECT stream_id, room_id, event_id
-                FROM thread_subscriptions
-                WHERE user_id = ? AND ? < stream_id AND stream_id <= ?
+                WITH the_updates AS (
+                    SELECT stream_id, room_id, event_id, subscribed, automatic
+                    FROM thread_subscriptions
+                    WHERE user_id = ? AND ? < stream_id AND stream_id <= ?
+                    ORDER BY stream_id DESC
+                    LIMIT ?
+                )
+                SELECT stream_id, room_id, event_id, subscribed, automatic
+                FROM the_updates
                 ORDER BY stream_id ASC
-                LIMIT ?
             """
 
             txn.execute(sql, (user_id, from_id, to_id, limit))
-            return [(row[0], row[1], row[2]) for row in txn]
+            return [
+                (
+                    stream_id,
+                    room_id,
+                    event_id,
+                    # SQLite integer to boolean conversions
+                    bool(subscribed),
+                    bool(automatic) if subscribed else None,
+                )
+                for (stream_id, room_id, event_id, subscribed, automatic) in txn
+            ]
 
         return await self.db_pool.runInteraction(
             "get_updated_thread_subscriptions_for_user",
diff --git a/synapse/storage/databases/main/transactions.py b/synapse/storage/databases/main/transactions.py
index bfc324b80d..a3d75002b9 100644
--- a/synapse/storage/databases/main/transactions.py
+++ b/synapse/storage/databases/main/transactions.py
@@ -21,7 +21,7 @@
 
 import logging
 from enum import Enum
-from typing import TYPE_CHECKING, Iterable, List, Mapping, Optional, Tuple, cast
+from typing import TYPE_CHECKING, Iterable, Mapping, cast
 
 import attr
 from canonicaljson import encode_canonical_json
@@ -37,6 +37,7 @@ from synapse.storage.database import (
 from synapse.storage.databases.main.cache import CacheInvalidationWorkerStore
 from synapse.types import JsonDict, StrCollection
 from synapse.util.caches.descriptors import cached, cachedList
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.server import HomeServer
@@ -81,11 +82,11 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
         super().__init__(database, db_conn, hs)
 
         if hs.config.worker.run_background_tasks:
-            self._clock.looping_call(self._cleanup_transactions, 30 * 60 * 1000)
+            self.clock.looping_call(self._cleanup_transactions, Duration(minutes=30))
 
     @wrap_as_background_process("cleanup_transactions")
     async def _cleanup_transactions(self) -> None:
-        now = self._clock.time_msec()
+        now = self.clock.time_msec()
         day_ago = now - 24 * 60 * 60 * 1000
 
         def _cleanup_transactions_txn(txn: LoggingTransaction) -> None:
@@ -97,7 +98,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
 
     async def get_received_txn_response(
         self, transaction_id: str, origin: str
-    ) -> Optional[Tuple[int, JsonDict]]:
+    ) -> tuple[int, JsonDict] | None:
         """For an incoming transaction from a given origin, check if we have
         already responded to it. If so, return the response code and response
         body (as a dict).
@@ -120,7 +121,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
 
     def _get_received_txn_response(
         self, txn: LoggingTransaction, transaction_id: str, origin: str
-    ) -> Optional[Tuple[int, JsonDict]]:
+    ) -> tuple[int, JsonDict] | None:
         result = self.db_pool.simple_select_one_txn(
             txn,
             table="received_transactions",
@@ -160,7 +161,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
             insertion_values={
                 "response_code": code,
                 "response_json": db_binary_type(encode_canonical_json(response_dict)),
-                "ts": self._clock.time_msec(),
+                "ts": self.clock.time_msec(),
             },
             desc="set_received_txn_response",
         )
@@ -169,7 +170,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
     async def get_destination_retry_timings(
         self,
         destination: str,
-    ) -> Optional[DestinationRetryTimings]:
+    ) -> DestinationRetryTimings | None:
         """Gets the current retry timings (if any) for a given destination.
 
         Args:
@@ -190,7 +191,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
 
     def _get_destination_retry_timings(
         self, txn: LoggingTransaction, destination: str
-    ) -> Optional[DestinationRetryTimings]:
+    ) -> DestinationRetryTimings | None:
         result = self.db_pool.simple_select_one_txn(
             txn,
             table="destinations",
@@ -213,9 +214,9 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
     )
     async def get_destination_retry_timings_batch(
         self, destinations: StrCollection
-    ) -> Mapping[str, Optional[DestinationRetryTimings]]:
+    ) -> Mapping[str, DestinationRetryTimings | None]:
         rows = cast(
-            List[Tuple[str, Optional[int], Optional[int], Optional[int]]],
+            list[tuple[str, int | None, int | None, int | None]],
             await self.db_pool.simple_select_many_batch(
                 table="destinations",
                 iterable=destinations,
@@ -241,7 +242,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
     async def set_destination_retry_timings(
         self,
         destination: str,
-        failure_ts: Optional[int],
+        failure_ts: int | None,
         retry_last_ts: int,
         retry_interval: int,
     ) -> None:
@@ -269,7 +270,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
         self,
         txn: LoggingTransaction,
         destination: str,
-        failure_ts: Optional[int],
+        failure_ts: int | None,
         retry_last_ts: int,
         retry_interval: int,
     ) -> None:
@@ -337,7 +338,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
 
     async def get_destination_last_successful_stream_ordering(
         self, destination: str
-    ) -> Optional[int]:
+    ) -> int | None:
         """
         Gets the stream ordering of the PDU most-recently successfully sent
         to the specified destination, or None if this information has not been
@@ -377,10 +378,10 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
         self,
         destination: str,
         last_successful_stream_ordering: int,
-    ) -> List[str]:
+    ) -> list[str]:
         """
         Returns at most 50 event IDs and their corresponding stream_orderings
-        that correspond to the oldest events that have not yet been sent to
+        that correspond to the newest events that have not yet been sent to
         the destination.
 
         Args:
@@ -403,7 +404,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
         txn: LoggingTransaction,
         destination: str,
         last_successful_stream_ordering: int,
-    ) -> List[str]:
+    ) -> list[str]:
         q = """
                 SELECT event_id FROM destination_rooms
                  JOIN events USING (stream_ordering)
@@ -420,8 +421,8 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
         return event_ids
 
     async def get_catch_up_outstanding_destinations(
-        self, after_destination: Optional[str]
-    ) -> List[str]:
+        self, after_destination: str | None
+    ) -> list[str]:
         """
         Get a list of destinations we should retry transaction sending to.
 
@@ -449,8 +450,8 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
 
     @staticmethod
     def _get_catch_up_outstanding_destinations_txn(
-        txn: LoggingTransaction, now_time_ms: int, after_destination: Optional[str]
-    ) -> List[str]:
+        txn: LoggingTransaction, now_time_ms: int, after_destination: str | None
+    ) -> list[str]:
         # We're looking for destinations which satisfy either of the following
         # conditions:
         #
@@ -537,11 +538,11 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
         self,
         start: int,
         limit: int,
-        destination: Optional[str] = None,
+        destination: str | None = None,
         order_by: str = DestinationSortOrder.DESTINATION.value,
         direction: Direction = Direction.FORWARDS,
-    ) -> Tuple[
-        List[Tuple[str, Optional[int], Optional[int], Optional[int], Optional[int]]],
+    ) -> tuple[
+        list[tuple[str, int | None, int | None, int | None, int | None]],
         int,
     ]:
         """Function to retrieve a paginated list of destinations.
@@ -566,10 +567,8 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
 
         def get_destinations_paginate_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[
-            List[
-                Tuple[str, Optional[int], Optional[int], Optional[int], Optional[int]]
-            ],
+        ) -> tuple[
+            list[tuple[str, int | None, int | None, int | None, int | None]],
             int,
         ]:
             order_by_column = DestinationSortOrder(order_by).value
@@ -579,7 +578,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
             else:
                 order = "ASC"
 
-            args: List[object] = []
+            args: list[object] = []
             where_statement = ""
             if destination:
                 args.extend(["%" + destination.lower() + "%"])
@@ -588,7 +587,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
             sql_base = f"FROM destinations {where_statement} "
             sql = f"SELECT COUNT(*) as total_destinations {sql_base}"
             txn.execute(sql, args)
-            count = cast(Tuple[int], txn.fetchone())[0]
+            count = cast(tuple[int], txn.fetchone())[0]
 
             sql = f"""
                 SELECT destination, retry_last_ts, retry_interval, failure_ts,
@@ -599,11 +598,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
             """
             txn.execute(sql, args + [limit, start])
             destinations = cast(
-                List[
-                    Tuple[
-                        str, Optional[int], Optional[int], Optional[int], Optional[int]
-                    ]
-                ],
+                list[tuple[str, int | None, int | None, int | None, int | None]],
                 txn.fetchall(),
             )
             return destinations, count
@@ -618,7 +613,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
         start: int,
         limit: int,
         direction: Direction = Direction.FORWARDS,
-    ) -> Tuple[List[Tuple[str, int]], int]:
+    ) -> tuple[list[tuple[str, int]], int]:
         """Function to retrieve a paginated list of destination's rooms.
         This will return a json list of rooms and the
         total number of rooms.
@@ -636,7 +631,7 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
 
         def get_destination_rooms_paginate_txn(
             txn: LoggingTransaction,
-        ) -> Tuple[List[Tuple[str, int]], int]:
+        ) -> tuple[list[tuple[str, int]], int]:
             if direction == Direction.BACKWARDS:
                 order = "DESC"
             else:
@@ -648,10 +643,10 @@ class TransactionWorkerStore(CacheInvalidationWorkerStore):
                 WHERE destination = ?
                 """
             txn.execute(sql, [destination])
-            count = cast(Tuple[int], txn.fetchone())[0]
+            count = cast(tuple[int], txn.fetchone())[0]
 
             rooms = cast(
-                List[Tuple[str, int]],
+                list[tuple[str, int]],
                 self.db_pool.simple_select_list_paginate_txn(
                     txn=txn,
                     table="destination_rooms",
diff --git a/synapse/storage/databases/main/ui_auth.py b/synapse/storage/databases/main/ui_auth.py
index 17bd0ac09a..e523f0238a 100644
--- a/synapse/storage/databases/main/ui_auth.py
+++ b/synapse/storage/databases/main/ui_auth.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict, List, Optional, Tuple, Union, cast
+from typing import Any, cast
 
 import attr
 
@@ -27,7 +27,8 @@ from synapse.api.errors import StoreError
 from synapse.storage._base import SQLBaseStore, db_to_json
 from synapse.storage.database import LoggingTransaction
 from synapse.types import JsonDict
-from synapse.util import json_encoder, stringutils
+from synapse.util import stringutils
+from synapse.util.json import json_encoder
 
 
 @attr.s(slots=True, auto_attribs=True)
@@ -141,7 +142,7 @@ class UIAuthWorkerStore(SQLBaseStore):
         self,
         session_id: str,
         stage_type: str,
-        result: Union[str, bool, JsonDict],
+        result: str | bool | JsonDict,
     ) -> None:
         """
         Mark a session stage as completed.
@@ -169,7 +170,7 @@ class UIAuthWorkerStore(SQLBaseStore):
 
     async def get_completed_ui_auth_stages(
         self, session_id: str
-    ) -> Dict[str, Union[str, bool, JsonDict]]:
+    ) -> dict[str, str | bool | JsonDict]:
         """
         Retrieve the completed stages of a UI authentication session.
 
@@ -181,7 +182,7 @@ class UIAuthWorkerStore(SQLBaseStore):
         """
         results = {}
         rows = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="ui_auth_sessions_credentials",
                 keyvalues={"session_id": session_id},
@@ -261,7 +262,7 @@ class UIAuthWorkerStore(SQLBaseStore):
         )
 
     async def get_ui_auth_session_data(
-        self, session_id: str, key: str, default: Optional[Any] = None
+        self, session_id: str, key: str, default: Any | None = None
     ) -> Any:
         """
         Retrieve data stored with set_session_data
@@ -301,14 +302,14 @@ class UIAuthWorkerStore(SQLBaseStore):
     async def get_user_agents_ips_to_ui_auth_session(
         self,
         session_id: str,
-    ) -> List[Tuple[str, str]]:
+    ) -> list[tuple[str, str]]:
         """Get the given user agents / IPs used during the ui auth process
 
         Returns:
             List of user_agent/ip pairs
         """
         return cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.db_pool.simple_select_list(
                 table="ui_auth_sessions_ips",
                 keyvalues={"session_id": session_id},
@@ -352,7 +353,7 @@ class UIAuthWorkerStore(SQLBaseStore):
         # If a registration token was used, decrement the pending counter
         # before deleting the session.
         rows = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             self.db_pool.simple_select_many_txn(
                 txn,
                 table="ui_auth_sessions_credentials",
@@ -364,7 +365,7 @@ class UIAuthWorkerStore(SQLBaseStore):
         )
 
         # Get the tokens used and how much pending needs to be decremented by.
-        token_counts: Dict[str, int] = {}
+        token_counts: dict[str, int] = {}
         for r in rows:
             # If registration was successfully completed, the result of the
             # registration token stage for that session will be True.
@@ -377,7 +378,7 @@ class UIAuthWorkerStore(SQLBaseStore):
         # Update the `pending` counters.
         if len(token_counts) > 0:
             token_rows = cast(
-                List[Tuple[str, int]],
+                list[tuple[str, int]],
                 self.db_pool.simple_select_many_txn(
                     txn,
                     table="registration_tokens",
diff --git a/synapse/storage/databases/main/user_directory.py b/synapse/storage/databases/main/user_directory.py
index 9deb9ab73c..6c5abc71ae 100644
--- a/synapse/storage/databases/main/user_directory.py
+++ b/synapse/storage/databases/main/user_directory.py
@@ -26,11 +26,7 @@ from typing import (
     TYPE_CHECKING,
     Collection,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
     TypedDict,
     cast,
 )
@@ -75,8 +71,8 @@ class _UserDirProfile:
     user_id: str
 
     # If the display name or avatar URL are unexpected types, replace with None
-    display_name: Optional[str] = attr.ib(default=None, converter=non_null_str_or_none)
-    avatar_url: Optional[str] = attr.ib(default=None, converter=non_null_str_or_none)
+    display_name: str | None = attr.ib(default=None, converter=non_null_str_or_none)
+    avatar_url: str | None = attr.ib(default=None, converter=non_null_str_or_none)
 
 
 class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
@@ -209,7 +205,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
         def _get_next_batch(
             txn: LoggingTransaction,
-        ) -> Optional[Sequence[Tuple[str, int]]]:
+        ) -> Sequence[tuple[str, int]] | None:
             # Only fetch 250 rooms, so we don't fetch too many at once, even
             # if those 250 rooms have less than batch_size state events.
             sql = """
@@ -218,7 +214,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
                 LIMIT 250
             """ % (TEMP_TABLE + "_rooms",)
             txn.execute(sql)
-            rooms_to_work_on = cast(List[Tuple[str, int]], txn.fetchall())
+            rooms_to_work_on = cast(list[tuple[str, int]], txn.fetchall())
 
             if not rooms_to_work_on:
                 return None
@@ -355,28 +351,20 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
         def _populate_user_directory_process_users_txn(
             txn: LoggingTransaction,
-        ) -> Optional[int]:
-            if self.database_engine.supports_returning:
-                # Note: we use an ORDER BY in the SELECT to force usage of an
-                # index. Otherwise, postgres does a sequential scan that is
-                # surprisingly slow (I think due to the fact it will read/skip
-                # over lots of already deleted rows).
-                sql = f"""
-                    DELETE FROM {TEMP_TABLE + "_users"}
-                    WHERE user_id IN (
-                        SELECT user_id FROM {TEMP_TABLE + "_users"} ORDER BY user_id LIMIT ?
-                    )
-                    RETURNING user_id
-                """
-                txn.execute(sql, (batch_size,))
-                user_result = cast(List[Tuple[str]], txn.fetchall())
-            else:
-                sql = "SELECT user_id FROM %s ORDER BY user_id LIMIT %s" % (
-                    TEMP_TABLE + "_users",
-                    str(batch_size),
+        ) -> int | None:
+            # Note: we use an ORDER BY in the SELECT to force usage of an
+            # index. Otherwise, postgres does a sequential scan that is
+            # surprisingly slow (I think due to the fact it will read/skip
+            # over lots of already deleted rows).
+            sql = f"""
+                DELETE FROM {TEMP_TABLE + "_users"}
+                WHERE user_id IN (
+                    SELECT user_id FROM {TEMP_TABLE + "_users"} ORDER BY user_id LIMIT ?
                 )
-                txn.execute(sql)
-                user_result = cast(List[Tuple[str]], txn.fetchall())
+                RETURNING user_id
+            """
+            txn.execute(sql, (batch_size,))
+            user_result = cast(list[tuple[str]], txn.fetchall())
 
             if not user_result:
                 return None
@@ -408,7 +396,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
             # Next fetch their profiles. Note that not all users have profiles.
             profile_rows = cast(
-                List[Tuple[str, Optional[str], Optional[str]]],
+                list[tuple[str, str | None, str | None]],
                 self.db_pool.simple_select_many_txn(
                     txn,
                     table="profiles",
@@ -435,17 +423,6 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
             # Actually insert the users with their profiles into the directory.
             self._update_profiles_in_user_dir_txn(txn, profiles_to_insert)
 
-            # We've finished processing the users. Delete it from the table, if
-            # we haven't already.
-            if not self.database_engine.supports_returning:
-                self.db_pool.simple_delete_many_txn(
-                    txn,
-                    table=TEMP_TABLE + "_users",
-                    column="user_id",
-                    values=users_to_work_on,
-                    keyvalues={},
-                )
-
             # Update the remaining counter.
             progress["remaining"] -= len(users_to_work_on)
             self.db_pool.updates._background_update_progress_txn(
@@ -514,7 +491,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
         ]
 
         rows = cast(
-            List[Tuple[str, Optional[str]]],
+            list[tuple[str, str | None]],
             self.db_pool.simple_select_many_txn(
                 txn,
                 table="users",
@@ -608,7 +585,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
     async def get_remote_servers_with_profiles_to_refresh(
         self, now_ts: int, limit: int
-    ) -> List[str]:
+    ) -> list[str]:
         """
         Get a list of up to `limit` server names which have users whose
         locally-cached profiles we believe to be stale
@@ -617,7 +594,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
         def _get_remote_servers_with_refreshable_profiles_txn(
             txn: LoggingTransaction,
-        ) -> List[str]:
+        ) -> list[str]:
             sql = """
                 SELECT user_server_name
                 FROM user_directory_stale_remote_users
@@ -636,7 +613,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
     async def get_remote_users_to_refresh_on_server(
         self, server_name: str, now_ts: int, limit: int
-    ) -> List[Tuple[str, int, int]]:
+    ) -> list[tuple[str, int, int]]:
         """
         Get a list of up to `limit` user IDs from the server `server_name`
         whose locally-cached profiles we believe to be stale
@@ -651,7 +628,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
         def _get_remote_users_to_refresh_on_server_txn(
             txn: LoggingTransaction,
-        ) -> List[Tuple[str, int, int]]:
+        ) -> list[tuple[str, int, int]]:
             sql = """
                 SELECT user_id, retry_counter, next_try_at_ts
                 FROM user_directory_stale_remote_users
@@ -660,7 +637,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
                 LIMIT ?
             """
             txn.execute(sql, (server_name, now_ts, limit))
-            return cast(List[Tuple[str, int, int]], txn.fetchall())
+            return cast(list[tuple[str, int, int]], txn.fetchall())
 
         return await self.db_pool.runInteraction(
             "get_remote_users_to_refresh_on_server",
@@ -668,7 +645,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
         )
 
     async def update_profile_in_user_dir(
-        self, user_id: str, display_name: Optional[str], avatar_url: Optional[str]
+        self, user_id: str, display_name: str | None, avatar_url: str | None
     ) -> None:
         """
         Update or add a user's profile in the user directory.
@@ -771,7 +748,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
             raise Exception("Unrecognized database engine")
 
     async def add_users_who_share_private_room(
-        self, room_id: str, user_id_tuples: Iterable[Tuple[str, str]]
+        self, room_id: str, user_id_tuples: Iterable[tuple[str, str]]
     ) -> None:
         """Insert entries into the users_who_share_private_rooms table. The first
         user should be a local user.
@@ -834,7 +811,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
     async def _get_user_in_directory(
         self, user_id: str
-    ) -> Optional[Tuple[Optional[str], Optional[str]]]:
+    ) -> tuple[str | None, str | None] | None:
         """
         Fetch the user information in the user directory.
 
@@ -843,7 +820,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
             avatar URL (both of which may be None).
         """
         return cast(
-            Optional[Tuple[Optional[str], Optional[str]]],
+            tuple[str | None, str | None] | None,
             await self.db_pool.simple_select_one(
                 table="user_directory",
                 keyvalues={"user_id": user_id},
@@ -853,7 +830,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
             ),
         )
 
-    async def update_user_directory_stream_pos(self, stream_id: Optional[int]) -> None:
+    async def update_user_directory_stream_pos(self, stream_id: int | None) -> None:
         await self.db_pool.simple_update_one(
             table="user_directory_stream_pos",
             keyvalues={},
@@ -864,7 +841,7 @@ class UserDirectoryBackgroundUpdateStore(StateDeltasStore):
 
 class SearchResult(TypedDict):
     limited: bool
-    results: List[UserProfile]
+    results: list[UserProfile]
 
 
 class UserDirectoryStore(UserDirectoryBackgroundUpdateStore):
@@ -911,7 +888,7 @@ class UserDirectoryStore(UserDirectoryBackgroundUpdateStore):
             "remove_from_user_dir", _remove_from_user_dir_txn
         )
 
-    async def get_users_in_dir_due_to_room(self, room_id: str) -> Set[str]:
+    async def get_users_in_dir_due_to_room(self, room_id: str) -> set[str]:
         """Get all user_ids that are in the room directory because they're
         in the given room_id
         """
@@ -965,7 +942,7 @@ class UserDirectoryStore(UserDirectoryBackgroundUpdateStore):
             "remove_user_who_share_room", _remove_user_who_share_room_txn
         )
 
-    async def get_user_dir_rooms_user_is_in(self, user_id: str) -> List[str]:
+    async def get_user_dir_rooms_user_is_in(self, user_id: str) -> list[str]:
         """
         Returns the rooms that a user is in.
 
@@ -993,7 +970,7 @@ class UserDirectoryStore(UserDirectoryBackgroundUpdateStore):
         users.update(rows)
         return list(users)
 
-    async def get_user_directory_stream_pos(self) -> Optional[int]:
+    async def get_user_directory_stream_pos(self) -> int | None:
         """
         Get the stream ID of the user directory stream.
 
@@ -1031,7 +1008,7 @@ class UserDirectoryStore(UserDirectoryBackgroundUpdateStore):
                 }
         """
 
-        join_args: Tuple[str, ...] = (user_id,)
+        join_args: tuple[str, ...] = (user_id,)
 
         if self.hs.config.userdirectory.user_directory_search_all_users:
             where_clause = "user_id != ?"
@@ -1060,7 +1037,7 @@ class UserDirectoryStore(UserDirectoryBackgroundUpdateStore):
         # We allow manipulating the ranking algorithm by injecting statements
         # based on config options.
         additional_ordering_statements = []
-        ordering_arguments: Tuple[str, ...] = ()
+        ordering_arguments: tuple[str, ...] = ()
 
         if isinstance(self.database_engine, PostgresEngine):
             full_query, exact_query, prefix_query = _parse_query_postgres(search_term)
@@ -1166,7 +1143,7 @@ class UserDirectoryStore(UserDirectoryBackgroundUpdateStore):
             raise Exception("Unrecognized database engine")
 
         results = cast(
-            List[Tuple[str, Optional[str], Optional[str]]],
+            list[tuple[str, str | None, str | None]],
             await self.db_pool.execute("search_user_dir", sql, *args),
         )
 
@@ -1232,7 +1209,7 @@ def _parse_query_sqlite(search_term: str) -> str:
     return " & ".join("(%s* OR %s)" % (result, result) for result in results)
 
 
-def _parse_query_postgres(search_term: str) -> Tuple[str, str, str]:
+def _parse_query_postgres(search_term: str) -> tuple[str, str, str]:
     """Takes a plain unicode string from the user and converts it into a form
     that can be passed to the database.
     We use this so that we can add prefix matching, which isn't something
@@ -1263,7 +1240,7 @@ def _parse_query_postgres(search_term: str) -> Tuple[str, str, str]:
     return both, exact, prefix
 
 
-def _parse_words(search_term: str) -> List[str]:
+def _parse_words(search_term: str) -> list[str]:
     """Split the provided search string into a list of its words using ICU.
 
     Args:
@@ -1275,7 +1252,7 @@ def _parse_words(search_term: str) -> List[str]:
     return _parse_words_with_icu(search_term)
 
 
-def _parse_words_with_icu(search_term: str) -> List[str]:
+def _parse_words_with_icu(search_term: str) -> list[str]:
     """Break down the provided search string into its individual words using ICU
     (International Components for Unicode).
 
@@ -1298,7 +1275,7 @@ def _parse_words_with_icu(search_term: str) -> List[str]:
     #
     # In particular, user-71 in postgres gets tokenised to "user, -71", and this
     # will not match a query for "user, 71".
-    new_results: List[str] = []
+    new_results: list[str] = []
     i = 0
     while i < len(results):
         curr = results[i]
diff --git a/synapse/storage/databases/main/user_erasure_store.py b/synapse/storage/databases/main/user_erasure_store.py
index cceed484c3..f89f11e149 100644
--- a/synapse/storage/databases/main/user_erasure_store.py
+++ b/synapse/storage/databases/main/user_erasure_store.py
@@ -18,7 +18,7 @@
 #
 #
 
-from typing import Iterable, List, Mapping, Tuple, cast
+from typing import Iterable, Mapping, cast
 
 from synapse.storage.database import LoggingTransaction
 from synapse.storage.databases.main import CacheInvalidationWorkerStore
@@ -57,7 +57,7 @@ class UserErasureWorkerStore(CacheInvalidationWorkerStore):
             for each user, whether the user has requested erasure.
         """
         rows = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.db_pool.simple_select_many_batch(
                 table="erased_users",
                 column="user_id",
diff --git a/synapse/storage/databases/state/bg_updates.py b/synapse/storage/databases/state/bg_updates.py
index ac38b2ab19..8c505041f0 100644
--- a/synapse/storage/databases/state/bg_updates.py
+++ b/synapse/storage/databases/state/bg_updates.py
@@ -22,12 +22,7 @@
 import logging
 from typing import (
     TYPE_CHECKING,
-    Dict,
-    List,
     Mapping,
-    Optional,
-    Tuple,
-    Union,
 )
 
 from synapse.logging.opentracing import tag_args, trace
@@ -85,7 +80,7 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
         else:
             # We don't use WITH RECURSIVE on sqlite3 as there are distributions
             # that ship with an sqlite3 version that doesn't support it (e.g. wheezy)
-            next_group: Optional[int] = state_group
+            next_group: int | None = state_group
             count = 0
 
             while next_group:
@@ -106,8 +101,8 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
     def _get_state_groups_from_groups_txn(
         self,
         txn: LoggingTransaction,
-        groups: List[int],
-        state_filter: Optional[StateFilter] = None,
+        groups: list[int],
+        state_filter: StateFilter | None = None,
     ) -> Mapping[int, StateMap[str]]:
         """
         Given a number of state groups, fetch the latest state for each group.
@@ -123,7 +118,7 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
         if state_filter is None:
             state_filter = StateFilter.all()
 
-        results: Dict[int, MutableStateMap[str]] = {group: {} for group in groups}
+        results: dict[int, MutableStateMap[str]] = {group: {} for group in groups}
 
         if isinstance(self.database_engine, PostgresEngine):
             # Temporarily disable sequential scans in this transaction. This is
@@ -147,7 +142,7 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
                 %s
             """
 
-            overall_select_query_args: List[Union[int, str]] = []
+            overall_select_query_args: list[int | str] = []
 
             # This is an optimization to create a select clause per-condition. This
             # makes the query planner a lot smarter on what rows should pull out in the
@@ -156,7 +151,7 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
             use_condition_optimization = (
                 not state_filter.include_others and not state_filter.is_full()
             )
-            state_filter_condition_combos: List[Tuple[str, Optional[str]]] = []
+            state_filter_condition_combos: list[tuple[str, str | None]] = []
             # We don't need to caclculate this list if we're not using the condition
             # optimization
             if use_condition_optimization:
@@ -173,7 +168,7 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
             # `filter_events_for_client` which just uses 2 conditions
             # (`EventTypes.RoomHistoryVisibility` and `EventTypes.Member`).
             if use_condition_optimization and len(state_filter_condition_combos) < 10:
-                select_clause_list: List[str] = []
+                select_clause_list: list[str] = []
                 for etype, skey in state_filter_condition_combos:
                     if skey is None:
                         where_clause = "(type = ?)"
@@ -216,7 +211,7 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
                 """
 
             for group in groups:
-                args: List[Union[int, str]] = [group]
+                args: list[int | str] = [group]
                 args.extend(overall_select_query_args)
 
                 txn.execute(sql % (overall_select_clause,), args)
@@ -238,7 +233,7 @@ class StateGroupBackgroundUpdateStore(SQLBaseStore):
             #
             # We just haven't put in the time to refactor this.
             for group in groups:
-                next_group: Optional[int] = group
+                next_group: int | None = group
 
                 while next_group:
                     # We did this before by getting the list of group ids, and
@@ -347,7 +342,7 @@ class StateBackgroundUpdateStore(StateGroupBackgroundUpdateStore):
             )
             max_group = rows[0][0]
 
-        def reindex_txn(txn: LoggingTransaction) -> Tuple[bool, int]:
+        def reindex_txn(txn: LoggingTransaction) -> tuple[bool, int]:
             new_last_state_group = last_state_group
             for count in range(batch_size):
                 txn.execute(
diff --git a/synapse/storage/databases/state/deletion.py b/synapse/storage/databases/state/deletion.py
index 9b62c1d814..23150e8626 100644
--- a/synapse/storage/databases/state/deletion.py
+++ b/synapse/storage/databases/state/deletion.py
@@ -20,9 +20,6 @@ from typing import (
     AsyncIterator,
     Collection,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
 )
 
 from synapse.events.snapshot import EventPersistencePair
@@ -233,7 +230,7 @@ class StateDeletionDataStore:
         any state groups referenced still exist and that they don't get deleted
         during this."""
 
-        referenced_state_groups: Set[int] = set()
+        referenced_state_groups: set[int] = set()
         for event, ctx in event_and_contexts:
             if ctx.rejected or event.internal_metadata.is_outlier():
                 continue
@@ -269,7 +266,7 @@ class StateDeletionDataStore:
             )
 
     def _mark_state_groups_as_persisting_txn(
-        self, txn: LoggingTransaction, state_groups: Set[int]
+        self, txn: LoggingTransaction, state_groups: set[int]
     ) -> None:
         """Marks the given state groups as being persisted."""
 
@@ -508,7 +505,7 @@ class StateDeletionDataStore:
 
     async def get_next_state_group_collection_to_delete(
         self,
-    ) -> Optional[Tuple[str, Mapping[int, int]]]:
+    ) -> tuple[str, Mapping[int, int]] | None:
         """Get the next set of state groups to try and delete
 
         Returns:
@@ -522,7 +519,7 @@ class StateDeletionDataStore:
     def _get_next_state_group_collection_to_delete_txn(
         self,
         txn: LoggingTransaction,
-    ) -> Optional[Tuple[str, Mapping[int, int]]]:
+    ) -> tuple[str, Mapping[int, int]] | None:
         """Implementation of `get_next_state_group_collection_to_delete`"""
 
         # We want to return chunks of state groups that were marked for deletion
diff --git a/synapse/storage/databases/state/store.py b/synapse/storage/databases/state/store.py
index 9b3b7e086f..d3ce7a8b55 100644
--- a/synapse/storage/databases/state/store.py
+++ b/synapse/storage/databases/state/store.py
@@ -22,13 +22,8 @@
 import logging
 from typing import (
     TYPE_CHECKING,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
     cast,
 )
 
@@ -73,8 +68,8 @@ class _GetStateGroupDelta:
     us use the iterable flag when caching
     """
 
-    prev_group: Optional[int]
-    delta_ids: Optional[StateMap[str]]
+    prev_group: int | None
+    delta_ids: StateMap[str] | None
 
     def __len__(self) -> int:
         return len(self.delta_ids) if self.delta_ids else 0
@@ -125,6 +120,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
 
         self._state_group_cache: DictionaryCache[int, StateKey, str] = DictionaryCache(
             name="*stateGroupCache*",
+            clock=hs.get_clock(),
             server_name=self.server_name,
             # TODO: this hasn't been tuned yet
             max_entries=50000,
@@ -132,6 +128,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         self._state_group_members_cache: DictionaryCache[int, StateKey, str] = (
             DictionaryCache(
                 name="*stateGroupMembersCache*",
+                clock=hs.get_clock(),
                 server_name=self.server_name,
                 max_entries=500000,
             )
@@ -172,7 +169,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
                 return _GetStateGroupDelta(None, None)
 
             delta_ids = cast(
-                List[Tuple[str, str, str]],
+                list[tuple[str, str, str]],
                 self.db_pool.simple_select_list_txn(
                     txn,
                     table="state_groups_state",
@@ -197,8 +194,8 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
     @tag_args
     @cancellable
     async def _get_state_groups_from_groups(
-        self, groups: List[int], state_filter: StateFilter
-    ) -> Dict[int, StateMap[str]]:
+        self, groups: list[int], state_filter: StateFilter
+    ) -> dict[int, StateMap[str]]:
         """Returns the state groups for a given set of groups from the
         database, filtering on types of state events.
 
@@ -209,7 +206,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         Returns:
             Dict of state group to state map.
         """
-        results: Dict[int, StateMap[str]] = {}
+        results: dict[int, StateMap[str]] = {}
 
         chunks = [groups[i : i + 100] for i in range(0, len(groups), 100)]
         for chunk in chunks:
@@ -230,7 +227,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         cache: DictionaryCache[int, StateKey, str],
         group: int,
         state_filter: StateFilter,
-    ) -> Tuple[MutableStateMap[str], bool]:
+    ) -> tuple[MutableStateMap[str], bool]:
         """Checks if group is in cache. See `get_state_for_groups`
 
         Args:
@@ -281,8 +278,8 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
     @tag_args
     @cancellable
     async def _get_state_for_groups(
-        self, groups: Iterable[int], state_filter: Optional[StateFilter] = None
-    ) -> Dict[int, MutableStateMap[str]]:
+        self, groups: Iterable[int], state_filter: StateFilter | None = None
+    ) -> dict[int, MutableStateMap[str]]:
         """Gets the state at each of a list of state groups, optionally
         filtering by type/state_key
 
@@ -353,7 +350,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         groups: Iterable[int],
         cache: DictionaryCache[int, StateKey, str],
         state_filter: StateFilter,
-    ) -> Tuple[Dict[int, MutableStateMap[str]], Set[int]]:
+    ) -> tuple[dict[int, MutableStateMap[str]], set[int]]:
         """Gets the state at each of a list of state groups, optionally
         filtering by type/state_key, querying from a specific cache.
 
@@ -385,7 +382,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
 
     def _insert_into_cache(
         self,
-        group_to_state_dict: Dict[int, StateMap[str]],
+        group_to_state_dict: dict[int, StateMap[str]],
         state_filter: StateFilter,
         cache_seq_num_members: int,
         cache_seq_num_non_members: int,
@@ -450,10 +447,10 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
     @tag_args
     async def store_state_deltas_for_batched(
         self,
-        events_and_context: List[Tuple[EventBase, UnpersistedEventContextBase]],
+        events_and_context: list[tuple[EventBase, UnpersistedEventContextBase]],
         room_id: str,
         prev_group: int,
-    ) -> List[Tuple[EventBase, UnpersistedEventContext]]:
+    ) -> list[tuple[EventBase, UnpersistedEventContext]]:
         """Generate and store state deltas for a group of events and contexts created to be
         batch persisted. Note that all the events must be in a linear chain (ie a <- b <- c).
 
@@ -467,9 +464,9 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
 
         def insert_deltas_group_txn(
             txn: LoggingTransaction,
-            events_and_context: List[Tuple[EventBase, UnpersistedEventContext]],
+            events_and_context: list[tuple[EventBase, UnpersistedEventContext]],
             prev_group: int,
-        ) -> List[Tuple[EventBase, UnpersistedEventContext]]:
+        ) -> list[tuple[EventBase, UnpersistedEventContext]]:
             """Generate and store state groups for the provided events and contexts.
 
             Requires that we have the state as a delta from the last persisted state group.
@@ -573,9 +570,9 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         self,
         event_id: str,
         room_id: str,
-        prev_group: Optional[int],
-        delta_ids: Optional[StateMap[str]],
-        current_state_ids: Optional[StateMap[str]],
+        prev_group: int | None,
+        delta_ids: StateMap[str] | None,
+        current_state_ids: StateMap[str] | None,
     ) -> int:
         """Store a new set of state, returning a newly assigned state group.
 
@@ -604,7 +601,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
 
         def insert_delta_group_txn(
             txn: LoggingTransaction, prev_group: int, delta_ids: StateMap[str]
-        ) -> Optional[int]:
+        ) -> int | None:
             """Try and persist the new group as a delta.
 
             Requires that we have the state as a delta from a previous state group.
@@ -780,7 +777,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         )
 
         rows = cast(
-            List[Tuple[int]],
+            list[tuple[int]],
             self.db_pool.simple_select_many_txn(
                 txn,
                 table="state_group_edges",
@@ -851,7 +848,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
     @tag_args
     async def get_previous_state_groups(
         self, state_groups: Iterable[int]
-    ) -> Dict[int, int]:
+    ) -> dict[int, int]:
         """Fetch the previous groups of the given state groups.
 
         Args:
@@ -862,7 +859,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         """
 
         rows = cast(
-            List[Tuple[int, int]],
+            list[tuple[int, int]],
             await self.db_pool.simple_select_many_batch(
                 table="state_group_edges",
                 column="state_group",
@@ -879,7 +876,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
     @tag_args
     async def get_next_state_groups(
         self, state_groups: Iterable[int]
-    ) -> Dict[int, int]:
+    ) -> dict[int, int]:
         """Fetch the groups that have the given state groups as their previous
         state groups.
 
@@ -891,7 +888,7 @@ class StateGroupDataStore(StateBackgroundUpdateStore, SQLBaseStore):
         """
 
         rows = cast(
-            List[Tuple[int, int]],
+            list[tuple[int, int]],
             await self.db_pool.simple_select_many_batch(
                 table="state_group_edges",
                 column="prev_state_group",
diff --git a/synapse/storage/engines/_base.py b/synapse/storage/engines/_base.py
index 9fec42c2e0..026b742aad 100644
--- a/synapse/storage/engines/_base.py
+++ b/synapse/storage/engines/_base.py
@@ -20,7 +20,7 @@
 #
 import abc
 from enum import IntEnum
-from typing import TYPE_CHECKING, Any, Generic, Mapping, Optional, TypeVar
+from typing import TYPE_CHECKING, Any, Generic, Mapping, TypeVar
 
 from synapse.storage.types import Connection, Cursor, DBAPI2Module
 
@@ -63,12 +63,6 @@ class BaseDatabaseEngine(Generic[ConnectionType, CursorType], metaclass=abc.ABCM
         """
         ...
 
-    @property
-    @abc.abstractmethod
-    def supports_returning(self) -> bool:
-        """Do we support the `RETURNING` clause in insert/update/delete?"""
-        ...
-
     @abc.abstractmethod
     def check_database(
         self, db_conn: ConnectionType, allow_outdated_version: bool = False
@@ -129,7 +123,7 @@ class BaseDatabaseEngine(Generic[ConnectionType, CursorType], metaclass=abc.ABCM
 
     @abc.abstractmethod
     def attempt_to_set_isolation_level(
-        self, conn: ConnectionType, isolation_level: Optional[int]
+        self, conn: ConnectionType, isolation_level: int | None
     ) -> None:
         """Attempt to set the connections isolation level.
 
diff --git a/synapse/storage/engines/postgres.py b/synapse/storage/engines/postgres.py
index e4cd359201..7cd50fb8f1 100644
--- a/synapse/storage/engines/postgres.py
+++ b/synapse/storage/engines/postgres.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Any, Mapping, NoReturn, Optional, Tuple, cast
+from typing import TYPE_CHECKING, Any, Mapping, NoReturn, cast
 
 import psycopg2.extensions
 
@@ -31,6 +31,7 @@ from synapse.storage.engines._base import (
     IsolationLevel,
 )
 from synapse.storage.types import Cursor
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.storage.database import LoggingDatabaseConnection
@@ -54,16 +55,17 @@ class PostgresEngine(
 
         psycopg2.extensions.register_adapter(bytes, _disable_bytes_adapter)
         self.synchronous_commit: bool = database_config.get("synchronous_commit", True)
-        # Set the statement timeout to 1 hour by default.
-        # Any query taking more than 1 hour should probably be considered a bug;
+        # Set the statement timeout to 10 minutes by default.
+        #
+        # Any query taking more than 10 minutes should probably be considered a bug;
         # most of the time this is a sign that work needs to be split up or that
         # some degenerate query plan has been created and the client has probably
         # timed out/walked off anyway.
         # This is in milliseconds.
-        self.statement_timeout: Optional[int] = database_config.get(
-            "statement_timeout", 60 * 60 * 1000
+        self.statement_timeout: int | None = database_config.get(
+            "statement_timeout", Duration(minutes=10).as_millis()
         )
-        self._version: Optional[int] = None  # unknown as yet
+        self._version: int | None = None  # unknown as yet
 
         self.isolation_level_map: Mapping[int, int] = {
             IsolationLevel.READ_COMMITTED: psycopg2.extensions.ISOLATION_LEVEL_READ_COMMITTED,
@@ -79,11 +81,11 @@ class PostgresEngine(
     def single_threaded(self) -> bool:
         return False
 
-    def get_db_locale(self, txn: Cursor) -> Tuple[str, str]:
+    def get_db_locale(self, txn: Cursor) -> tuple[str, str]:
         txn.execute(
             "SELECT datcollate, datctype FROM pg_database WHERE datname = current_database()"
         )
-        collation, ctype = cast(Tuple[str, str], txn.fetchone())
+        collation, ctype = cast(tuple[str, str], txn.fetchone())
         return collation, ctype
 
     def check_database(
@@ -99,8 +101,8 @@ class PostgresEngine(
         allow_unsafe_locale = self.config.get("allow_unsafe_locale", False)
 
         # Are we on a supported PostgreSQL version?
-        if not allow_outdated_version and self._version < 130000:
-            raise RuntimeError("Synapse requires PostgreSQL 13 or above.")
+        if not allow_outdated_version and self._version < 140000:
+            raise RuntimeError("Synapse requires PostgreSQL 14 or above.")
 
         with db_conn.cursor() as txn:
             txn.execute("SHOW SERVER_ENCODING")
@@ -193,11 +195,6 @@ class PostgresEngine(
         """Do we support using `a = ANY(?)` and passing a list"""
         return True
 
-    @property
-    def supports_returning(self) -> bool:
-        """Do we support the `RETURNING` clause in insert/update/delete?"""
-        return True
-
     def is_deadlock(self, error: Exception) -> bool:
         if isinstance(error, psycopg2.DatabaseError):
             # https://www.postgresql.org/docs/current/static/errcodes-appendix.html
@@ -239,7 +236,7 @@ class PostgresEngine(
         return conn.set_session(autocommit=autocommit)
 
     def attempt_to_set_isolation_level(
-        self, conn: psycopg2.extensions.connection, isolation_level: Optional[int]
+        self, conn: psycopg2.extensions.connection, isolation_level: int | None
     ) -> None:
         if isolation_level is None:
             isolation_level = self.default_isolation_level
diff --git a/synapse/storage/engines/sqlite.py b/synapse/storage/engines/sqlite.py
index 9d1795ebe5..3b1b19c00e 100644
--- a/synapse/storage/engines/sqlite.py
+++ b/synapse/storage/engines/sqlite.py
@@ -22,7 +22,7 @@ import platform
 import sqlite3
 import struct
 import threading
-from typing import TYPE_CHECKING, Any, List, Mapping, Optional
+from typing import TYPE_CHECKING, Any, Mapping
 
 from synapse.storage.engines import BaseDatabaseEngine
 from synapse.storage.engines._base import AUTO_INCREMENT_PRIMARY_KEYPLACEHOLDER
@@ -45,7 +45,7 @@ class Sqlite3Engine(BaseDatabaseEngine[sqlite3.Connection, sqlite3.Cursor]):
         # A connection to a database that has already been prepared, to use as a
         # base for an in-memory connection. This is used during unit tests to
         # speed up setting up the DB.
-        self._prepped_conn: Optional[sqlite3.Connection] = database_config.get(
+        self._prepped_conn: sqlite3.Connection | None = database_config.get(
             "_TEST_PREPPED_CONN"
         )
 
@@ -68,11 +68,6 @@ class Sqlite3Engine(BaseDatabaseEngine[sqlite3.Connection, sqlite3.Cursor]):
         """Do we support using `a = ANY(?)` and passing a list"""
         return False
 
-    @property
-    def supports_returning(self) -> bool:
-        """Do we support the `RETURNING` clause in insert/update/delete?"""
-        return sqlite3.sqlite_version_info >= (3, 35, 0)
-
     def check_database(
         self, db_conn: sqlite3.Connection, allow_outdated_version: bool = False
     ) -> None:
@@ -80,8 +75,8 @@ class Sqlite3Engine(BaseDatabaseEngine[sqlite3.Connection, sqlite3.Cursor]):
             # Synapse is untested against older SQLite versions, and we don't want
             # to let users upgrade to a version of Synapse with broken support for their
             # sqlite version, because it risks leaving them with a half-upgraded db.
-            if sqlite3.sqlite_version_info < (3, 27, 0):
-                raise RuntimeError("Synapse requires sqlite 3.27 or above.")
+            if sqlite3.sqlite_version_info < (3, 37, 2):
+                raise RuntimeError("Synapse requires sqlite 3.37.2 or above.")
 
     def check_new_database(self, txn: Cursor) -> None:
         """Gets called when setting up a brand new database. This allows us to
@@ -146,7 +141,7 @@ class Sqlite3Engine(BaseDatabaseEngine[sqlite3.Connection, sqlite3.Cursor]):
         pass
 
     def attempt_to_set_isolation_level(
-        self, conn: sqlite3.Connection, isolation_level: Optional[int]
+        self, conn: sqlite3.Connection, isolation_level: int | None
     ) -> None:
         # All transactions are SERIALIZABLE by default in sqlite
         pass
@@ -182,7 +177,7 @@ class Sqlite3Engine(BaseDatabaseEngine[sqlite3.Connection, sqlite3.Cursor]):
 # Following functions taken from: https://github.com/coleifer/peewee
 
 
-def _parse_match_info(buf: bytes) -> List[int]:
+def _parse_match_info(buf: bytes) -> list[int]:
     bufsize = len(buf)
     return [struct.unpack("@I", buf[i : i + 4])[0] for i in range(0, bufsize, 4)]
 
diff --git a/synapse/storage/invite_rule.py b/synapse/storage/invite_rule.py
index f63390871e..489533a9f4 100644
--- a/synapse/storage/invite_rule.py
+++ b/synapse/storage/invite_rule.py
@@ -1,7 +1,9 @@
 import logging
+from abc import abstractmethod
 from enum import Enum
-from typing import Optional, Pattern
+from typing import Pattern
 
+import attr
 from matrix_common.regex import glob_to_regex
 
 from synapse.types import JsonMapping, UserID
@@ -18,9 +20,29 @@ class InviteRule(Enum):
 
 
 class InviteRulesConfig:
-    """Class to determine if a given user permits an invite from another user, and the action to take."""
+    """An object encapsulating a given user's choices about whether to accept invites."""
 
-    def __init__(self, account_data: Optional[JsonMapping]):
+    @abstractmethod
+    def get_invite_rule(self, inviter_user_id: str) -> InviteRule:
+        """Get the invite rule that matches this user. Will return InviteRule.ALLOW if no rules match
+
+        Args:
+            inviter_user_id: The user ID of the inviting user.
+        """
+
+
+@attr.s(slots=True)
+class AllowAllInviteRulesConfig(InviteRulesConfig):
+    """An `InviteRulesConfig` implementation which will accept all invites."""
+
+    def get_invite_rule(self, inviter_user_id: str) -> InviteRule:
+        return InviteRule.ALLOW
+
+
+class MSC4155InviteRulesConfig(InviteRulesConfig):
+    """An object encapsulating [MSC4155](https://github.com/matrix-org/matrix-spec-proposals/pull/4155) invite rules."""
+
+    def __init__(self, account_data: JsonMapping):
         self.allowed_users: list[Pattern[str]] = []
         self.ignored_users: list[Pattern[str]] = []
         self.blocked_users: list[Pattern[str]] = []
@@ -30,7 +52,7 @@ class InviteRulesConfig:
         self.blocked_servers: list[Pattern[str]] = []
 
         def process_field(
-            values: Optional[list[str]],
+            values: list[str] | None,
             ruleset: list[Pattern[str]],
             rule: InviteRule,
         ) -> None:
@@ -110,3 +132,21 @@ class InviteRulesConfig:
                     return rule
 
         return InviteRule.ALLOW
+
+
+@attr.s(slots=True, auto_attribs=True)
+class MSC4380InviteRulesConfig(InviteRulesConfig):
+    default_invite_rule: InviteRule
+    """The invite rule to apply to all invites."""
+
+    @classmethod
+    def from_account_data(cls, data: JsonMapping) -> "MSC4380InviteRulesConfig":
+        default = data.get("default_action")
+
+        default_invite_rule = (
+            InviteRule.BLOCK if default == "block" else InviteRule.ALLOW
+        )
+        return cls(default_invite_rule=default_invite_rule)
+
+    def get_invite_rule(self, inviter_user_id: str) -> InviteRule:
+        return self.default_invite_rule
diff --git a/synapse/storage/prepare_database.py b/synapse/storage/prepare_database.py
index bf087702ea..2def1e130c 100644
--- a/synapse/storage/prepare_database.py
+++ b/synapse/storage/prepare_database.py
@@ -28,10 +28,7 @@ from typing import (
     Counter as CounterType,
     Generator,
     Iterable,
-    List,
-    Optional,
     TextIO,
-    Tuple,
 )
 
 import attr
@@ -77,7 +74,7 @@ class _SchemaState:
     current_version: int = attr.ib()
     """The current schema version of the database"""
 
-    compat_version: Optional[int] = attr.ib()
+    compat_version: int | None = attr.ib()
     """The SCHEMA_VERSION of the oldest version of Synapse for this database
 
     If this is None, we have an old version of the database without the necessary
@@ -97,7 +94,7 @@ class _SchemaState:
 def prepare_database(
     db_conn: LoggingDatabaseConnection,
     database_engine: BaseDatabaseEngine,
-    config: Optional[HomeServerConfig],
+    config: HomeServerConfig | None,
     databases: Collection[str] = ("main", "state"),
 ) -> None:
     """Prepares a physical database for usage. Will either create all necessary tables
@@ -270,7 +267,7 @@ def _setup_new_database(
         for database in databases
     )
 
-    directory_entries: List[_DirectoryListing] = []
+    directory_entries: list[_DirectoryListing] = []
     for directory in directories:
         directory_entries.extend(
             _DirectoryListing(file_name, os.path.join(directory, file_name))
@@ -309,7 +306,7 @@ def _upgrade_existing_database(
     cur: LoggingTransaction,
     current_schema_state: _SchemaState,
     database_engine: BaseDatabaseEngine,
-    config: Optional[HomeServerConfig],
+    config: HomeServerConfig | None,
     databases: Collection[str],
     is_empty: bool = False,
 ) -> None:
@@ -453,7 +450,7 @@ def _upgrade_existing_database(
         file_name_counter: CounterType[str] = Counter()
 
         # Now find which directories have anything of interest.
-        directory_entries: List[_DirectoryListing] = []
+        directory_entries: list[_DirectoryListing] = []
         for directory in directories:
             logger.debug("Looking for schema deltas in %s", directory)
             try:
@@ -593,7 +590,7 @@ def _apply_module_schema_files(
     cur: Cursor,
     database_engine: BaseDatabaseEngine,
     modname: str,
-    names_and_streams: Iterable[Tuple[str, TextIO]],
+    names_and_streams: Iterable[tuple[str, TextIO]],
 ) -> None:
     """Apply the module schemas for a single module
 
@@ -685,7 +682,7 @@ def execute_statements_from_stream(cur: Cursor, f: TextIO) -> None:
 
 def _get_or_create_schema_state(
     txn: Cursor, database_engine: BaseDatabaseEngine
-) -> Optional[_SchemaState]:
+) -> _SchemaState | None:
     # Bluntly try creating the schema_version tables.
     sql_path = os.path.join(schema_path, "common", "schema_version.sql")
     database_engine.execute_script_file(txn, sql_path)
@@ -700,7 +697,7 @@ def _get_or_create_schema_state(
     current_version = int(row[0])
     upgraded = bool(row[1])
 
-    compat_version: Optional[int] = None
+    compat_version: int | None = None
     txn.execute("SELECT compat_version FROM schema_compat_version")
     row = txn.fetchone()
     if row is not None:
diff --git a/synapse/storage/roommember.py b/synapse/storage/roommember.py
index 9dc6c395e8..4c1ace28e7 100644
--- a/synapse/storage/roommember.py
+++ b/synapse/storage/roommember.py
@@ -20,7 +20,6 @@
 #
 
 import logging
-from typing import List, Optional, Tuple
 
 import attr
 
@@ -42,14 +41,14 @@ class RoomsForUser:
 @attr.s(slots=True, frozen=True, weakref_slot=False, auto_attribs=True)
 class RoomsForUserSlidingSync:
     room_id: str
-    sender: Optional[str]
+    sender: str | None
     membership: str
-    event_id: Optional[str]
+    event_id: str | None
     event_pos: PersistedEventPosition
     room_version_id: str
 
     has_known_state: bool
-    room_type: Optional[str]
+    room_type: str | None
     is_encrypted: bool
 
 
@@ -60,9 +59,9 @@ class RoomsForUserStateReset:
     without a corresponding event so that information isn't always available."""
 
     room_id: str
-    sender: Optional[str]
+    sender: str | None
     membership: str
-    event_id: Optional[str]
+    event_id: str | None
     event_pos: PersistedEventPosition
     room_version_id: str
 
@@ -75,8 +74,8 @@ class GetRoomsForUserWithStreamOrdering:
 
 @attr.s(slots=True, frozen=True, weakref_slot=False, auto_attribs=True)
 class ProfileInfo:
-    avatar_url: Optional[str]
-    display_name: Optional[str]
+    avatar_url: str | None
+    display_name: str | None
 
 
 # TODO This is used as a cached value and is mutable.
@@ -84,6 +83,6 @@ class ProfileInfo:
 class MemberSummary:
     # A truncated list of (user_id, event_id) tuples for users of a given
     # membership type, suitable for use in calculating heroes for a room.
-    members: List[Tuple[str, str]]
+    members: list[tuple[str, str]]
     # The total number of users of a given membership type.
     count: int
diff --git a/synapse/storage/schema/__init__.py b/synapse/storage/schema/__init__.py
index 3c3b13437e..e3095a9d0d 100644
--- a/synapse/storage/schema/__init__.py
+++ b/synapse/storage/schema/__init__.py
@@ -19,7 +19,7 @@
 #
 #
 
-SCHEMA_VERSION = 92  # remember to update the list below when updating
+SCHEMA_VERSION = 94  # remember to update the list below when updating
 """Represents the expectations made by the codebase about the database schema
 
 This should be incremented whenever the codebase changes its requirements on the
@@ -168,11 +168,18 @@ Changes in SCHEMA_VERSION = 91
 
 Changes in SCHEMA_VERSION = 92
     - Cleaned up a trigger that was added in #18260 and then reverted.
+
+Changes in SCHEMA_VERSION = 93
+    - MSC4140: Set delayed events to be uniquely identifiable by their delay ID.
+
+Changes in SCHEMA_VERSION = 94
+    - Add `recheck` column (boolean, default true) to the `redactions` table.
 """
 
 
 SCHEMA_COMPAT_VERSION = (
     # Transitive links are no longer written to `event_auth_chain_links`
+    # TODO: On the next compat bump, update the primary key of `delayed_events`
     84
 )
 """Limit on how far the synapse codebase can be rolled back without breaking db compat
diff --git a/synapse/storage/schema/main/delta/30/as_users.py b/synapse/storage/schema/main/delta/30/as_users.py
index 060217575b..b7e9a11c2f 100644
--- a/synapse/storage/schema/main/delta/30/as_users.py
+++ b/synapse/storage/schema/main/delta/30/as_users.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import Dict, Iterable, List, Tuple, cast
+from typing import Iterable, cast
 
 from synapse.config.appservice import load_appservices
 from synapse.config.homeserver import HomeServerConfig
@@ -44,7 +44,7 @@ def run_upgrade(
     config: HomeServerConfig,
 ) -> None:
     cur.execute("SELECT name FROM users")
-    rows = cast(Iterable[Tuple[str]], cur.fetchall())
+    rows = cast(Iterable[tuple[str]], cur.fetchall())
 
     config_files = []
     try:
@@ -54,7 +54,7 @@ def run_upgrade(
 
     appservices = load_appservices(config.server.server_name, config_files)
 
-    owned: Dict[str, List[str]] = {}
+    owned: dict[str, list[str]] = {}
 
     for row in rows:
         user_id = row[0]
diff --git a/synapse/storage/schema/main/delta/92/08_thread_subscriptions_seq_fixup.sql.postgres b/synapse/storage/schema/main/delta/92/08_thread_subscriptions_seq_fixup.sql.postgres
new file mode 100644
index 0000000000..d327d1e165
--- /dev/null
+++ b/synapse/storage/schema/main/delta/92/08_thread_subscriptions_seq_fixup.sql.postgres
@@ -0,0 +1,19 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2025 New Vector, Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+-- Work around https://github.com/element-hq/synapse/issues/18712 by advancing the
+-- stream sequence.
+-- This makes last_value of the sequence point to a position that will not get later
+-- returned by nextval.
+-- (For blank thread subscription streams, this means last_value = 2, nextval() = 3 after this line.)
+SELECT nextval('thread_subscriptions_sequence');
diff --git a/synapse/storage/schema/main/delta/93/01_add_delayed_events.sql b/synapse/storage/schema/main/delta/93/01_add_delayed_events.sql
new file mode 100644
index 0000000000..c7f3c00612
--- /dev/null
+++ b/synapse/storage/schema/main/delta/93/01_add_delayed_events.sql
@@ -0,0 +1,15 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2025 Element Creations, Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+INSERT INTO background_updates (ordering, update_name, progress_json) VALUES
+  (9301, 'delayed_events_idx', '{}');
\ No newline at end of file
diff --git a/synapse/storage/schema/main/delta/93/01_sticky_events.sql b/synapse/storage/schema/main/delta/93/01_sticky_events.sql
new file mode 100644
index 0000000000..59fded5959
--- /dev/null
+++ b/synapse/storage/schema/main/delta/93/01_sticky_events.sql
@@ -0,0 +1,60 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2025 New Vector, Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+-- Tracks sticky events.
+-- Excludes 'policy_server_spammy' events, outliers, rejected events.
+--
+-- Skipping the insertion of these types of 'invalid' events is useful for performance reasons because
+-- they would fill up the table yet we wouldn't show them to clients anyway.
+--
+-- Since syncing clients can't (easily) 'skip over' sticky events (due to being in-order, reliably delivered),
+-- tracking loads of invalid events in the table could make it expensive for servers to retrieve the sticky events that are actually valid.
+--
+-- For instance, someone spamming 1000s of rejected or 'policy_server_spammy' events could clog up this table in a way that means we either
+-- have to deliver empty payloads to syncing clients, or consider substantially more than 100 events in order to gather a 100-sized batch to send down.
+--
+-- May contain sticky events that have expired since being inserted,
+-- although they will be periodically cleaned up in the background.
+CREATE TABLE sticky_events (
+  -- Position in the sticky events stream
+  stream_id INTEGER NOT NULL PRIMARY KEY,
+
+  -- Name of the worker sending this. (This makes the stream compatible with multiple writers.)
+  instance_name TEXT NOT NULL,
+
+  -- The event ID of the sticky event itself.
+  event_id TEXT NOT NULL,
+
+  -- The room ID that the sticky event is in.
+  -- Denormalised for performance. (Safe as it's an immutable property of the event.)
+  room_id TEXT NOT NULL,
+
+  -- The stream_ordering of the event.
+  -- Denormalised for performance since we will want to sort these by stream_ordering
+  -- when fetching them. (Safe as it's an immutable property of the event.)
+  event_stream_ordering INTEGER NOT NULL UNIQUE,
+
+  -- Sender of the sticky event.
+  -- Denormalised for performance so we can query only for sticky events originating
+  -- from our homeserver. (Safe as it's an immutable property of the event.)
+  sender TEXT NOT NULL,
+
+  -- When the sticky event expires, in milliseconds since the Unix epoch.
+  expires_at BIGINT NOT NULL
+);
+
+-- For pulling out sticky events by room at send time, obeying stream ordering range limits.
+CREATE INDEX sticky_events_room_idx ON sticky_events (room_id, event_stream_ordering);
+
+-- A optional integer for combining sticky events with delayed events. Used at send time.
+ALTER TABLE delayed_events ADD COLUMN sticky_duration_ms BIGINT;
diff --git a/synapse/storage/schema/main/delta/93/01_sticky_events_seq.sql.postgres b/synapse/storage/schema/main/delta/93/01_sticky_events_seq.sql.postgres
new file mode 100644
index 0000000000..9ba72856bc
--- /dev/null
+++ b/synapse/storage/schema/main/delta/93/01_sticky_events_seq.sql.postgres
@@ -0,0 +1,18 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2025 New Vector, Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+CREATE SEQUENCE sticky_events_sequence;
+-- Synapse streams start at 2, because the default position is 1
+-- so any item inserted at position 1 is ignored.
+-- We have to use nextval not START WITH 2, see https://github.com/element-hq/synapse/issues/18712
+SELECT nextval('sticky_events_sequence');
diff --git a/synapse/storage/schema/main/delta/93/02_sliding_sync_members.sql b/synapse/storage/schema/main/delta/93/02_sliding_sync_members.sql
new file mode 100644
index 0000000000..279458d710
--- /dev/null
+++ b/synapse/storage/schema/main/delta/93/02_sliding_sync_members.sql
@@ -0,0 +1,60 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2025 Element Creations Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+
+-- Tracks which member states have been sent to the client for lazy-loaded
+-- members in sliding sync. This is a *cache* as it doesn't matter if we send
+-- down members we've previously sent down, i.e. it's safe to delete any rows.
+--
+-- We could have tracked these as part of the
+-- `sliding_sync_connection_required_state` table, but that would bloat that
+-- table significantly as most rooms will have lazy-loaded members. We want to
+-- keep that table small as we always pull out all rows for the connection for
+-- every request, so storing lots of data there would be bad for performance. To
+-- keep that table small we also deduplicate the requested state across
+-- different rooms, which if we stored lazy members there would prevent.
+--
+-- We track a *rough* `last_seen_ts` for each user in each room which indicates
+-- when we last would've sent their member state to the client. `last_seen_ts`
+-- is used so that we can remove members which haven't been seen for a while to
+-- save space. This is a *rough* timestamp as we don't want to update the
+-- timestamp every time to avoid hammering the DB with writes, and we don't need
+-- the timestamp to be precise (as it is used to evict old entries that haven't
+-- been used in a while).
+--
+-- Care must be taken when handling "forked" positions, i.e. we have responded
+-- to a request with a position and then get another different request using the
+-- previous position as a base. We track this by including a
+-- `connection_position` for newly inserted rows. When we advance the position
+-- we set this to NULL for all rows which were present at that position, and
+-- delete all other rows. When reading rows we can then filter out any rows
+-- which have a non-NULL `connection_position` which is not the current
+-- position.
+--
+-- I.e. `connection_position` is NULL for rows which are valid for *all*
+-- positions on the connection, and is non-NULL for rows which are only valid
+-- for a specific position.
+--
+-- When invalidating rows, we can just delete them. Technically this could
+-- invalidate for a forked position, but this is acceptable as equivalent to a
+-- cache eviction.
+CREATE TABLE sliding_sync_connection_lazy_members (
+    connection_key BIGINT NOT NULL REFERENCES sliding_sync_connections(connection_key) ON DELETE CASCADE,
+    connection_position BIGINT REFERENCES sliding_sync_connection_positions(connection_position) ON DELETE CASCADE,
+    room_id TEXT NOT NULL,
+    user_id TEXT NOT NULL,
+    last_seen_ts BIGINT NOT NULL
+);
+
+CREATE UNIQUE INDEX sliding_sync_connection_lazy_members_idx ON sliding_sync_connection_lazy_members (connection_key, room_id, user_id);
+CREATE INDEX sliding_sync_connection_lazy_members_pos_idx ON sliding_sync_connection_lazy_members (connection_key, connection_position) WHERE connection_position IS NOT NULL;
diff --git a/synapse/storage/schema/main/delta/93/03_sss_pos_last_used.sql b/synapse/storage/schema/main/delta/93/03_sss_pos_last_used.sql
new file mode 100644
index 0000000000..747ba7a144
--- /dev/null
+++ b/synapse/storage/schema/main/delta/93/03_sss_pos_last_used.sql
@@ -0,0 +1,27 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2025 Element Creations, Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+-- Add a timestamp for when the sliding sync connection position was last used,
+-- only updated with a small granularity.
+--
+-- This should be NOT NULL, but we need to consider existing rows. In future we
+-- may want to either backfill this or delete all rows with a NULL value (and
+-- then make it NOT NULL).
+ALTER TABLE sliding_sync_connections ADD COLUMN last_used_ts BIGINT;
+
+-- Note: We don't add an index on this column to allow HOT updates on PostgreSQL
+-- to reduce the cost of the updates to the column. c.f.
+-- https://www.postgresql.org/docs/current/storage-hot.html
+--
+-- We do query this column directly to find expired connections, but we expect
+-- that to be an infrequent operation and a sequential scan should be fine.
diff --git a/synapse/storage/schema/main/delta/93/04_make_delayed_event_content_text.py b/synapse/storage/schema/main/delta/93/04_make_delayed_event_content_text.py
new file mode 100644
index 0000000000..0e48a40ff3
--- /dev/null
+++ b/synapse/storage/schema/main/delta/93/04_make_delayed_event_content_text.py
@@ -0,0 +1,62 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 Element Creations Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+
+import logging
+
+from synapse.storage.database import LoggingTransaction
+from synapse.storage.engines import BaseDatabaseEngine, PostgresEngine
+
+logger = logging.getLogger(__name__)
+
+
+def run_create(cur: LoggingTransaction, database_engine: BaseDatabaseEngine) -> None:
+    """
+    Change the type / affinity of the `delayed_events` table's `content` column from bytes to text.
+    This brings it in line with the `event_json` table's `json` column, and fixes the inability to
+    schedule a delayed event with non-ASCII characters in its content.
+    """
+
+    if isinstance(database_engine, PostgresEngine):
+        cur.execute(
+            "ALTER TABLE delayed_events "
+            "ALTER COLUMN content SET DATA TYPE TEXT "
+            "USING convert_from(content, 'utf8')"
+        )
+        return
+
+    # For sqlite3, change the type affinity by fiddling with the table schema directly.
+    # This strategy is also used by ../50/make_event_content_nullable.py.
+
+    cur.execute(
+        "SELECT sql FROM sqlite_master WHERE tbl_name='delayed_events' AND type='table'"
+    )
+    row = cur.fetchone()
+    assert row is not None
+    (oldsql,) = row
+
+    sql = oldsql.replace("content bytea", "content TEXT")
+    if sql == oldsql:
+        raise Exception("Couldn't find content bytes column in %s" % oldsql)
+
+    cur.execute("PRAGMA schema_version")
+    row = cur.fetchone()
+    assert row is not None
+    (oldver,) = row
+    cur.execute("PRAGMA writable_schema=ON")
+    cur.execute(
+        "UPDATE sqlite_master SET sql=? WHERE tbl_name='delayed_events' AND type='table'",
+        (sql,),
+    )
+    cur.execute("PRAGMA schema_version=%i" % (oldver + 1,))
+    cur.execute("PRAGMA writable_schema=OFF")
diff --git a/synapse/storage/schema/main/delta/94/01_redactions_recheck.sql b/synapse/storage/schema/main/delta/94/01_redactions_recheck.sql
new file mode 100644
index 0000000000..e99aa52f1f
--- /dev/null
+++ b/synapse/storage/schema/main/delta/94/01_redactions_recheck.sql
@@ -0,0 +1,15 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2026 Element Creations, Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+
+ALTER TABLE redactions ADD COLUMN recheck boolean NOT NULL DEFAULT true;
diff --git a/synapse/storage/schema/main/delta/94/02_redactions_recheck_bg_update.sql b/synapse/storage/schema/main/delta/94/02_redactions_recheck_bg_update.sql
new file mode 100644
index 0000000000..6367afd318
--- /dev/null
+++ b/synapse/storage/schema/main/delta/94/02_redactions_recheck_bg_update.sql
@@ -0,0 +1,15 @@
+--
+-- This file is licensed under the Affero General Public License (AGPL) version 3.
+--
+-- Copyright (C) 2026 Element Creations, Ltd
+--
+-- This program is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as
+-- published by the Free Software Foundation, either version 3 of the
+-- License, or (at your option) any later version.
+--
+-- See the GNU Affero General Public License for more details:
+-- <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+INSERT INTO background_updates (ordering, update_name, progress_json) VALUES
+  (9402, 'redactions_recheck', '{}');
diff --git a/synapse/storage/types.py b/synapse/storage/types.py
index 4329d88c9a..ad9e5391e3 100644
--- a/synapse/storage/types.py
+++ b/synapse/storage/types.py
@@ -23,21 +23,16 @@ from typing import (
     Any,
     Callable,
     Iterator,
-    List,
     Mapping,
-    Optional,
     Protocol,
     Sequence,
-    Tuple,
-    Type,
-    Union,
 )
 
 """
 Some very basic protocol definitions for the DB-API2 classes specified in PEP-249
 """
 
-SQLQueryParameters = Union[Sequence[Any], Mapping[str, Any]]
+SQLQueryParameters = Sequence[Any] | Mapping[str, Any]
 
 
 class Cursor(Protocol):
@@ -47,16 +42,16 @@ class Cursor(Protocol):
         self, sql: str, parameters: Sequence[SQLQueryParameters]
     ) -> Any: ...
 
-    def fetchone(self) -> Optional[Tuple]: ...
+    def fetchone(self) -> tuple | None: ...
 
-    def fetchmany(self, size: Optional[int] = ...) -> List[Tuple]: ...
+    def fetchmany(self, size: int | None = ...) -> list[tuple]: ...
 
-    def fetchall(self) -> List[Tuple]: ...
+    def fetchall(self) -> list[tuple]: ...
 
     @property
     def description(
         self,
-    ) -> Optional[Sequence[Any]]:
+    ) -> Sequence[Any] | None:
         # At the time of writing, Synapse only assumes that `column[0]: str` for each
         # `column in description`. Since this is hard to express in the type system, and
         # as this is rarely used in Synapse, we deem `column: Any` good enough.
@@ -66,7 +61,7 @@ class Cursor(Protocol):
     def rowcount(self) -> int:
         return 0
 
-    def __iter__(self) -> Iterator[Tuple]: ...
+    def __iter__(self) -> Iterator[tuple]: ...
 
     def close(self) -> None: ...
 
@@ -84,10 +79,10 @@ class Connection(Protocol):
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_value: Optional[BaseException],
-        traceback: Optional[TracebackType],
-    ) -> Optional[bool]: ...
+        exc_type: type[BaseException] | None,
+        exc_value: BaseException | None,
+        traceback: TracebackType | None,
+    ) -> bool | None: ...
 
 
 class DBAPI2Module(Protocol):
@@ -117,20 +112,20 @@ class DBAPI2Module(Protocol):
     # explain why this is necessary for safety. TL;DR: we shouldn't be able to write
     # to `x`, only read from it. See also https://github.com/python/mypy/issues/6002 .
     @property
-    def Warning(self) -> Type[Exception]: ...
+    def Warning(self) -> type[Exception]: ...
 
     @property
-    def Error(self) -> Type[Exception]: ...
+    def Error(self) -> type[Exception]: ...
 
     # Errors are divided into `InterfaceError`s (something went wrong in the database
     # driver) and `DatabaseError`s (something went wrong in the database). These are
     # both subclasses of `Error`, but we can't currently express this in type
     # annotations due to https://github.com/python/mypy/issues/8397
     @property
-    def InterfaceError(self) -> Type[Exception]: ...
+    def InterfaceError(self) -> type[Exception]: ...
 
     @property
-    def DatabaseError(self) -> Type[Exception]: ...
+    def DatabaseError(self) -> type[Exception]: ...
 
     # Everything below is a subclass of `DatabaseError`.
 
@@ -139,7 +134,7 @@ class DBAPI2Module(Protocol):
     # - An invalid date time was provided.
     # - A string contained a null code point.
     @property
-    def DataError(self) -> Type[Exception]: ...
+    def DataError(self) -> type[Exception]: ...
 
     # Roughly: something went wrong in the database, but it's not within the application
     # programmer's control. Examples:
@@ -150,18 +145,18 @@ class DBAPI2Module(Protocol):
     # - The database ran out of resources, such as storage, memory, connections, etc.
     # - The database encountered an error from the operating system.
     @property
-    def OperationalError(self) -> Type[Exception]: ...
+    def OperationalError(self) -> type[Exception]: ...
 
     # Roughly: we've given the database data which breaks a rule we asked it to enforce.
     # Examples:
     # - Stop, criminal scum! You violated the foreign key constraint
     # - Also check constraints, non-null constraints, etc.
     @property
-    def IntegrityError(self) -> Type[Exception]: ...
+    def IntegrityError(self) -> type[Exception]: ...
 
     # Roughly: something went wrong within the database server itself.
     @property
-    def InternalError(self) -> Type[Exception]: ...
+    def InternalError(self) -> type[Exception]: ...
 
     # Roughly: the application did something silly that needs to be fixed. Examples:
     # - We don't have permissions to do something.
@@ -169,11 +164,11 @@ class DBAPI2Module(Protocol):
     # - We tried to use a reserved name.
     # - We referred to a column that doesn't exist.
     @property
-    def ProgrammingError(self) -> Type[Exception]: ...
+    def ProgrammingError(self) -> type[Exception]: ...
 
     # Roughly: we've tried to do something that this database doesn't support.
     @property
-    def NotSupportedError(self) -> Type[Exception]: ...
+    def NotSupportedError(self) -> type[Exception]: ...
 
     # We originally wrote
     # def connect(self, *args, **kwargs) -> Connection: ...
diff --git a/synapse/storage/util/id_generators.py b/synapse/storage/util/id_generators.py
index a15a161ce8..a1afe6d2ae 100644
--- a/synapse/storage/util/id_generators.py
+++ b/synapse/storage/util/id_generators.py
@@ -28,17 +28,10 @@ from typing import (
     TYPE_CHECKING,
     AsyncContextManager,
     ContextManager,
-    Dict,
     Generic,
     Iterable,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     cast,
 )
 
@@ -182,13 +175,18 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
     Uses a Postgres sequence to coordinate ID assignment, but positions of other
     writers will only get updated when `advance` is called (by replication).
 
-    Note: Only works with Postgres.
+    On SQLite, falls back to a single-writer implementation, which is fine because
+    Synapse only supports monolith mode when SQLite is the database driver.
 
     Warning: Streams using this generator start at ID 2, because ID 1 is always assumed
         to have been 'seen as persisted'.
         Unclear if this extant behaviour is desirable for some reason.
-        When creating a new sequence for a new stream,
-        it will be necessary to use `START WITH 2`.
+        When creating a new sequence for a new stream, it will be necessary to advance it
+        so that position 1 is consumed.
+        DO NOT USE `START WITH 2` FOR THIS PURPOSE:
+            see https://github.com/element-hq/synapse/issues/18712
+        Instead, use `SELECT nextval('sequence_name');` immediately after the
+        `CREATE SEQUENCE` statement.
 
     Args:
         db_conn
@@ -219,9 +217,9 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
         stream_name: str,
         server_name: str,
         instance_name: str,
-        tables: List[Tuple[str, str, str]],
+        tables: list[tuple[str, str, str]],
         sequence_name: str,
-        writers: List[str],
+        writers: list[str],
         positive: bool = True,
     ) -> None:
         self._db = db
@@ -239,7 +237,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
         # Note: If we are a negative stream then we still store all the IDs as
         # positive to make life easier for us, and simply negate the IDs when we
         # return them.
-        self._current_positions: Dict[str, int] = {}
+        self._current_positions: dict[str, int] = {}
 
         # Set of local IDs that we're still processing. The current position
         # should be less than the minimum of this set (if not empty).
@@ -256,7 +254,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
 
         # Set of local IDs that we've processed that are larger than the current
         # position, due to there being smaller unpersisted IDs.
-        self._finished_ids: Set[int] = set()
+        self._finished_ids: set[int] = set()
 
         # We track the max position where we know everything before has been
         # persisted. This is done by a) looking at the min across all instances
@@ -277,7 +275,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
         self._persisted_upto_position = (
             min(self._current_positions.values()) if self._current_positions else 1
         )
-        self._known_persisted_positions: List[int] = []
+        self._known_persisted_positions: list[int] = []
 
         # The maximum stream ID that we have seen been allocated across any writer.
         # Since this defaults to 1, this means that ID 1 is assumed to have already
@@ -344,7 +342,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
     def _load_current_ids(
         self,
         db_conn: LoggingDatabaseConnection,
-        tables: List[Tuple[str, str, str]],
+        tables: list[tuple[str, str, str]],
         sequence_name: str,
     ) -> None:
         cur = db_conn.cursor(txn_name="_load_current_ids")
@@ -435,7 +433,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
 
             self._persisted_upto_position = min_stream_id
 
-            rows: List[Tuple[str, int]] = []
+            rows: list[tuple[str, int]] = []
             for table, instance_column, id_column in tables:
                 sql = """
                     SELECT %(instance)s, %(id)s FROM %(table)s
@@ -449,13 +447,13 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
                 cur.execute(sql, (min_stream_id * self._return_factor,))
 
                 # Cast safety: this corresponds to the types returned by the query above.
-                rows.extend(cast(Iterable[Tuple[str, int]], cur))
+                rows.extend(cast(Iterable[tuple[str, int]], cur))
 
             # Sort by stream_id (ascending, lowest -> highest) so that we handle
             # rows in order for each instance because we don't want to overwrite
             # the current_position of an instance to a lower stream ID than
             # we're actually at.
-            def sort_by_stream_id_key_func(row: Tuple[str, int]) -> int:
+            def sort_by_stream_id_key_func(row: tuple[str, int]) -> int:
                 (instance, stream_id) = row
                 # If `stream_id` is ever `None`, we will see a `TypeError: '<'
                 # not supported between instances of 'NoneType' and 'X'` error.
@@ -488,7 +486,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
         stream_ids = self._load_next_mult_id_txn(txn, 1)
         return stream_ids[0]
 
-    def _load_next_mult_id_txn(self, txn: Cursor, n: int) -> List[int]:
+    def _load_next_mult_id_txn(self, txn: Cursor, n: int) -> list[int]:
         # We need to track that we've requested some more stream IDs, and what
         # the current max allocated stream ID is. This is to prevent a race
         # where we've been allocated stream IDs but they have not yet been added
@@ -525,7 +523,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
             AsyncContextManager[int], _MultiWriterCtxManager(self, self._notifier)
         )
 
-    def get_next_mult(self, n: int) -> AsyncContextManager[List[int]]:
+    def get_next_mult(self, n: int) -> AsyncContextManager[list[int]]:
         # If we have a list of instances that are allowed to write to this
         # stream, make sure we're in it.
         if self._writers and self._instance_name not in self._writers:
@@ -533,12 +531,22 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
 
         # Cast safety: see get_next.
         return cast(
-            AsyncContextManager[List[int]],
+            AsyncContextManager[list[int]],
             _MultiWriterCtxManager(self, self._notifier, n),
         )
 
     def get_next_txn(self, txn: LoggingTransaction) -> int:
         """
+        Generate an ID for immediate use within a database transaction.
+
+        The ID will automatically be marked as finished at the end of the
+        database transaction, therefore the stream rows MUST be persisted
+        within the active transaction (MUST NOT be persisted in a later
+        transaction).
+
+        The replication notifier will automatically be notified when the
+        transaction ends successfully.
+
         Usage:
 
             stream_id = stream_id_gen.get_next_txn(txn)
@@ -574,8 +582,18 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
 
         return self._return_factor * next_id
 
-    def get_next_mult_txn(self, txn: LoggingTransaction, n: int) -> List[int]:
+    def get_next_mult_txn(self, txn: LoggingTransaction, n: int) -> list[int]:
         """
+        Generate multiple IDs for immediate use within a database transaction.
+
+        The IDs will automatically be marked as finished at the end of the
+        database transaction, therefore the stream rows MUST be persisted
+        within the active transaction (MUST NOT be persisted in a later
+        transaction).
+
+        The replication notifier will automatically be notified when the
+        transaction ends successfully.
+
         Usage:
 
             stream_id = stream_id_gen.get_next_txn(txn)
@@ -611,7 +629,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
 
         return [self._return_factor * next_id for next_id in next_ids]
 
-    def _mark_ids_as_finished(self, next_ids: List[int]) -> None:
+    def _mark_ids_as_finished(self, next_ids: list[int]) -> None:
         """These IDs have finished being processed so we should advance the
         current position if possible.
         """
@@ -620,7 +638,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
             self._unfinished_ids.difference_update(next_ids)
             self._finished_ids.update(next_ids)
 
-            new_cur: Optional[int] = None
+            new_cur: int | None = None
 
             if self._unfinished_ids or self._in_flight_fetches:
                 # If there are unfinished IDs then the new position will be the
@@ -703,7 +721,7 @@ class MultiWriterIdGenerator(AbstractStreamIdGenerator):
                 self._instance_name, self._persisted_upto_position
             )
 
-    def get_positions(self) -> Dict[str, int]:
+    def get_positions(self) -> dict[str, int]:
         """Get a copy of the current positon map.
 
         Note that this won't necessarily include all configured writers if some
@@ -845,10 +863,10 @@ class _AsyncCtxManagerWrapper(Generic[T]):
 
     async def __aexit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc: Optional[BaseException],
-        tb: Optional[TracebackType],
-    ) -> Optional[bool]:
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        tb: TracebackType | None,
+    ) -> bool | None:
         return self.inner.__exit__(exc_type, exc, tb)
 
 
@@ -858,10 +876,10 @@ class _MultiWriterCtxManager:
 
     id_gen: MultiWriterIdGenerator
     notifier: "ReplicationNotifier"
-    multiple_ids: Optional[int] = None
-    stream_ids: List[int] = attr.Factory(list)
+    multiple_ids: int | None = None
+    stream_ids: list[int] = attr.Factory(list)
 
-    async def __aenter__(self) -> Union[int, List[int]]:
+    async def __aenter__(self) -> int | list[int]:
         # It's safe to run this in autocommit mode as fetching values from a
         # sequence ignores transaction semantics anyway.
         self.stream_ids = await self.id_gen._db.runInteraction(
@@ -878,9 +896,9 @@ class _MultiWriterCtxManager:
 
     async def __aexit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc: Optional[BaseException],
-        tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        tb: TracebackType | None,
     ) -> bool:
         self.id_gen._mark_ids_as_finished(self.stream_ids)
 
diff --git a/synapse/storage/util/partial_state_events_tracker.py b/synapse/storage/util/partial_state_events_tracker.py
index f8addf38f6..5078f6367b 100644
--- a/synapse/storage/util/partial_state_events_tracker.py
+++ b/synapse/storage/util/partial_state_events_tracker.py
@@ -21,7 +21,7 @@
 
 import logging
 from collections import defaultdict
-from typing import Collection, Dict, Set
+from typing import Collection
 
 from twisted.internet import defer
 from twisted.internet.defer import Deferred
@@ -43,7 +43,7 @@ class PartialStateEventsTracker:
         self._store = store
         # a map from event id to a set of Deferreds which are waiting for that event to be
         # un-partial-stated.
-        self._observers: Dict[str, Set[Deferred[None]]] = defaultdict(set)
+        self._observers: dict[str, set[Deferred[None]]] = defaultdict(set)
 
     def notify_un_partial_stated(self, event_id: str) -> None:
         """Notify that we now have full state for a given event
@@ -93,7 +93,7 @@ class PartialStateEventsTracker:
         )
 
         # create an observer for each lazy-joined event
-        observers: Dict[str, Deferred[None]] = {
+        observers: dict[str, Deferred[None]] = {
             event_id: Deferred() for event_id in partial_state_event_ids
         }
         for event_id, observer in observers.items():
@@ -140,7 +140,7 @@ class PartialCurrentStateTracker:
 
         # a map from room id to a set of Deferreds which are waiting for that room to be
         # un-partial-stated.
-        self._observers: Dict[str, Set[Deferred[None]]] = defaultdict(set)
+        self._observers: dict[str, set[Deferred[None]]] = defaultdict(set)
 
     def notify_un_partial_stated(self, room_id: str) -> None:
         """Notify that we now have full current state for a given room
diff --git a/synapse/storage/util/sequence.py b/synapse/storage/util/sequence.py
index cac3eba1a5..5bee3cf34f 100644
--- a/synapse/storage/util/sequence.py
+++ b/synapse/storage/util/sequence.py
@@ -21,7 +21,7 @@
 import abc
 import logging
 import threading
-from typing import TYPE_CHECKING, Callable, List, Optional
+from typing import TYPE_CHECKING, Callable
 
 from synapse.storage.engines import (
     BaseDatabaseEngine,
@@ -61,7 +61,7 @@ class SequenceGenerator(metaclass=abc.ABCMeta):
         ...
 
     @abc.abstractmethod
-    def get_next_mult_txn(self, txn: Cursor, n: int) -> List[int]:
+    def get_next_mult_txn(self, txn: Cursor, n: int) -> list[int]:
         """Get the next `n` IDs in the sequence"""
         ...
 
@@ -71,7 +71,7 @@ class SequenceGenerator(metaclass=abc.ABCMeta):
         db_conn: "LoggingDatabaseConnection",
         table: str,
         id_column: str,
-        stream_name: Optional[str] = None,
+        stream_name: str | None = None,
         positive: bool = True,
     ) -> None:
         """Should be called during start up to test that the current value of
@@ -105,7 +105,7 @@ class PostgresSequenceGenerator(SequenceGenerator):
         assert fetch_res is not None
         return fetch_res[0]
 
-    def get_next_mult_txn(self, txn: Cursor, n: int) -> List[int]:
+    def get_next_mult_txn(self, txn: Cursor, n: int) -> list[int]:
         txn.execute(
             "SELECT nextval(?) FROM generate_series(1, ?)", (self._sequence_name, n)
         )
@@ -116,7 +116,7 @@ class PostgresSequenceGenerator(SequenceGenerator):
         db_conn: "LoggingDatabaseConnection",
         table: str,
         id_column: str,
-        stream_name: Optional[str] = None,
+        stream_name: str | None = None,
         positive: bool = True,
     ) -> None:
         """See SequenceGenerator.check_consistency for docstring."""
@@ -223,10 +223,10 @@ class LocalSequenceGenerator(SequenceGenerator):
                  get_next_id_txn; should return the current maximum id
         """
         # the callback. this is cleared after it is called, so that it can be GCed.
-        self._callback: Optional[GetFirstCallbackType] = get_first_callback
+        self._callback: GetFirstCallbackType | None = get_first_callback
 
         # The current max value, or None if we haven't looked in the DB yet.
-        self._current_max_id: Optional[int] = None
+        self._current_max_id: int | None = None
         self._lock = threading.Lock()
 
     def get_next_id_txn(self, txn: Cursor) -> int:
@@ -241,7 +241,7 @@ class LocalSequenceGenerator(SequenceGenerator):
             self._current_max_id += 1
             return self._current_max_id
 
-    def get_next_mult_txn(self, txn: Cursor, n: int) -> List[int]:
+    def get_next_mult_txn(self, txn: Cursor, n: int) -> list[int]:
         with self._lock:
             if self._current_max_id is None:
                 assert self._callback is not None
@@ -257,7 +257,7 @@ class LocalSequenceGenerator(SequenceGenerator):
         db_conn: Connection,
         table: str,
         id_column: str,
-        stream_name: Optional[str] = None,
+        stream_name: str | None = None,
         positive: bool = True,
     ) -> None:
         # There is nothing to do for in memory sequences
@@ -278,9 +278,9 @@ def build_sequence_generator(
     database_engine: BaseDatabaseEngine,
     get_first_callback: GetFirstCallbackType,
     sequence_name: str,
-    table: Optional[str],
-    id_column: Optional[str],
-    stream_name: Optional[str] = None,
+    table: str | None,
+    id_column: str | None,
+    stream_name: str | None = None,
     positive: bool = True,
 ) -> SequenceGenerator:
     """Get the best impl of SequenceGenerator available
diff --git a/synapse/streams/__init__.py b/synapse/streams/__init__.py
index 67635d7ebe..0d386e538e 100644
--- a/synapse/streams/__init__.py
+++ b/synapse/streams/__init__.py
@@ -19,7 +19,7 @@
 #
 #
 from abc import ABC, abstractmethod
-from typing import Generic, List, Optional, Tuple, TypeVar
+from typing import Generic, TypeVar
 
 from synapse.types import StrCollection, UserID
 
@@ -38,6 +38,6 @@ class EventSource(ABC, Generic[K, R]):
         limit: int,
         room_ids: StrCollection,
         is_guest: bool,
-        explicit_room_id: Optional[str] = None,
-    ) -> Tuple[List[R], K]:
+        explicit_room_id: str | None = None,
+    ) -> tuple[list[R], K]:
         raise NotImplementedError()
diff --git a/synapse/streams/config.py b/synapse/streams/config.py
index 9fee5bfb92..52688a8b6b 100644
--- a/synapse/streams/config.py
+++ b/synapse/streams/config.py
@@ -19,7 +19,6 @@
 #
 #
 import logging
-from typing import Optional
 
 import attr
 
@@ -40,8 +39,8 @@ MAX_LIMIT = 1000
 class PaginationConfig:
     """A configuration object which stores pagination parameters."""
 
-    from_token: Optional[StreamToken]
-    to_token: Optional[StreamToken]
+    from_token: StreamToken | None
+    to_token: StreamToken | None
     direction: Direction
     limit: int
 
diff --git a/synapse/streams/events.py b/synapse/streams/events.py
index 4534068e7c..d2720fb959 100644
--- a/synapse/streams/events.py
+++ b/synapse/streams/events.py
@@ -20,7 +20,7 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Sequence, Tuple
+from typing import TYPE_CHECKING, Sequence
 
 import attr
 
@@ -33,7 +33,6 @@ from synapse.logging.opentracing import trace
 from synapse.streams import EventSource
 from synapse.types import (
     AbstractMultiWriterStreamToken,
-    MultiWriterStreamToken,
     StreamKeyType,
     StreamToken,
 )
@@ -53,7 +52,7 @@ class _EventSourcesInner:
     receipt: ReceiptEventSource
     account_data: AccountDataEventSource
 
-    def get_sources(self) -> Sequence[Tuple[StreamKeyType, EventSource]]:
+    def get_sources(self) -> Sequence[tuple[StreamKeyType, EventSource]]:
         return [
             (StreamKeyType.ROOM, self.room),
             (StreamKeyType.PRESENCE, self.presence),
@@ -84,6 +83,8 @@ class EventSources:
         un_partial_stated_rooms_key = self.store.get_un_partial_stated_rooms_token(
             self._instance_name
         )
+        thread_subscriptions_key = self.store.get_max_thread_subscriptions_stream_id()
+        sticky_events_key = self.store.get_max_sticky_events_stream_id()
 
         token = StreamToken(
             room_key=self.sources.room.get_current_key(),
@@ -97,6 +98,8 @@ class EventSources:
             # Groups key is unused.
             groups_key=0,
             un_partial_stated_rooms_key=un_partial_stated_rooms_key,
+            thread_subscriptions_key=thread_subscriptions_key,
+            sticky_events_key=sticky_events_key,
         )
         return token
 
@@ -123,6 +126,8 @@ class EventSources:
             StreamKeyType.TO_DEVICE: self.store.get_to_device_id_generator(),
             StreamKeyType.DEVICE_LIST: self.store.get_device_stream_id_generator(),
             StreamKeyType.UN_PARTIAL_STATED_ROOMS: self.store.get_un_partial_stated_rooms_id_generator(),
+            StreamKeyType.THREAD_SUBSCRIPTIONS: self.store.get_thread_subscriptions_stream_id_generator(),
+            StreamKeyType.STICKY_EVENTS: self.store.get_sticky_events_stream_id_generator(),
         }
 
         for _, key in StreamKeyType.__members__.items():
@@ -195,16 +200,7 @@ class EventSources:
         Returns:
             The current token for pagination.
         """
-        token = StreamToken(
-            room_key=await self.sources.room.get_current_key_for_room(room_id),
-            presence_key=0,
-            typing_key=0,
-            receipt_key=MultiWriterStreamToken(stream=0),
-            account_data_key=0,
-            push_rules_key=0,
-            to_device_key=0,
-            device_list_key=MultiWriterStreamToken(stream=0),
-            groups_key=0,
-            un_partial_stated_rooms_key=0,
+        return StreamToken.START.copy_and_replace(
+            StreamKeyType.ROOM,
+            await self.sources.room.get_current_key_for_room(room_id),
         )
-        return token
diff --git a/synapse/synapse_rust/__init__.pyi b/synapse/synapse_rust/__init__.pyi
index d25c609106..cb3eb7df07 100644
--- a/synapse/synapse_rust/__init__.pyi
+++ b/synapse/synapse_rust/__init__.pyi
@@ -1,3 +1,4 @@
 def sum_as_string(a: int, b: int) -> str: ...
 def get_rust_file_digest() -> str: ...
 def reset_logging_config() -> None: ...
+def get_rustc_version() -> str: ...
diff --git a/synapse/synapse_rust/acl.pyi b/synapse/synapse_rust/acl.pyi
index 985994d313..934d0de80a 100644
--- a/synapse/synapse_rust/acl.pyi
+++ b/synapse/synapse_rust/acl.pyi
@@ -13,10 +13,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import List
-
 class ServerAclEvaluator:
     def __init__(
-        self, allow_ip_literals: bool, allow: List[str], deny: List[str]
+        self, allow_ip_literals: bool, allow: list[str], deny: list[str]
     ) -> None: ...
     def server_matches_acl_event(self, server_name: str) -> bool: ...
diff --git a/synapse/synapse_rust/events.pyi b/synapse/synapse_rust/events.pyi
index a82211283b..e6753bbbad 100644
--- a/synapse/synapse_rust/events.pyi
+++ b/synapse/synapse_rust/events.pyi
@@ -10,17 +10,19 @@
 # See the GNU Affero General Public License for more details:
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 
-from typing import List, Mapping, Optional, Tuple
+from typing import Mapping
 
 from synapse.types import JsonDict
 
 class EventInternalMetadata:
     def __init__(self, internal_metadata_dict: JsonDict): ...
 
-    stream_ordering: Optional[int]
+    stream_ordering: int | None
     """the stream ordering of this event. None, until it has been persisted."""
-    instance_name: Optional[str]
+    instance_name: str | None
     """the instance name of the server that persisted this event. None, until it has been persisted."""
+    redacted_by: str | None
+    """the event ID of the redaction event, if this event has been redacted. Set dynamically at load time, not persisted."""
 
     outlier: bool
     """whether this event is an outlier (ie, whether we have the state at that
@@ -38,6 +40,8 @@ class EventInternalMetadata:
 
     txn_id: str
     """The transaction ID, if it was set when the event was created."""
+    delay_id: str
+    """The delay ID, set only if the event was a delayed event."""
     token_id: int
     """The access token ID of the user who sent this event, if any."""
     device_id: str
@@ -62,7 +66,7 @@ class EventInternalMetadata:
         (Added in synapse 0.99.0, so may be unreliable for events received before that)
         """
 
-    def get_send_on_behalf_of(self) -> Optional[str]:
+    def get_send_on_behalf_of(self) -> str | None:
         """Whether this server should send the event on behalf of another server.
         This is used by the federation "send_join" API to forward the initial join
         event for a server in the room.
@@ -115,7 +119,7 @@ def event_visible_to_server(
     history_visibility: str,
     erased_senders: Mapping[str, bool],
     partial_state_invisible: bool,
-    memberships: List[Tuple[str, str]],
+    memberships: list[tuple[str, str]],
 ) -> bool:
     """Determine whether the server is allowed to see the unredacted event.
 
diff --git a/synapse/synapse_rust/http_client.pyi b/synapse/synapse_rust/http_client.pyi
index 9fb7831e6b..1814daec73 100644
--- a/synapse/synapse_rust/http_client.pyi
+++ b/synapse/synapse_rust/http_client.pyi
@@ -17,7 +17,29 @@ from twisted.internet.defer import Deferred
 from synapse.types import ISynapseReactor
 
 class HttpClient:
-    def __init__(self, reactor: ISynapseReactor, user_agent: str) -> None: ...
+    """
+    The returned deferreds follow Synapse logcontext rules.
+    """
+
+    def __init__(
+        self,
+        reactor: ISynapseReactor,
+        user_agent: str,
+        http2_only: bool = False,
+    ) -> None:
+        """
+        Create a new HTTP client backed by reqwest.
+
+        Args:
+            reactor: The Twisted reactor to coordinate with
+            user_agent: The user agent to use for requests
+            http2_only: Whether to use HTTP/2 only, even on unencrypted connections. By
+                default, it will always use HTTP/1.1 over unencrypted connections, and
+                rely on TLS ALPN to negotiate HTTP/2.
+
+                Ensure the upstream server supports HTTP/2 before enabling this.
+        """
+
     def get(self, url: str, response_limit: int) -> Deferred[bytes]: ...
     def post(
         self,
diff --git a/synapse/synapse_rust/msc4388_rendezvous.pyi b/synapse/synapse_rust/msc4388_rendezvous.pyi
new file mode 100644
index 0000000000..f8e064ef64
--- /dev/null
+++ b/synapse/synapse_rust/msc4388_rendezvous.pyi
@@ -0,0 +1,33 @@
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 Element Creations Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+from typing import Any
+
+from twisted.web.iweb import IRequest
+
+from synapse.server import HomeServer
+
+class MSC4388RendezvousHandler:
+    def __init__(
+        self,
+        homeserver: HomeServer,
+        /,
+        soft_limit: int = 100,  # On each background eviction run sessions will be removed until we're under this limit
+        hard_limit: int = 200,  # If this limit is reached an immediate eviction will be triggered
+        max_content_length: int = 4 * 1024,  # MSC4388 specifies maximum of 4KB
+        eviction_interval: int = 60 * 1000,
+        ttl: int = 2 * 60 * 1000,  # MSC4388 specifies minimum of 120 seconds
+    ) -> None: ...
+    def handle_post(self, request: IRequest) -> tuple[int, Any]: ...
+    def handle_get(self, session_id: str, request: IRequest) -> tuple[int, Any]: ...
+    def handle_put(self, session_id: str, request: IRequest) -> tuple[int, Any]: ...
+    def handle_delete(self, session_id: str) -> tuple[int, Any]: ...
diff --git a/synapse/synapse_rust/push.pyi b/synapse/synapse_rust/push.pyi
index a3e12ad648..ef0d5f94f4 100644
--- a/synapse/synapse_rust/push.pyi
+++ b/synapse/synapse_rust/push.pyi
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import Any, Collection, Dict, Mapping, Optional, Sequence, Tuple, Union
+from typing import Any, Collection, Mapping, Sequence
 
 from synapse.types import JsonDict, JsonValue
 
@@ -25,7 +25,7 @@ class PushRule:
     @property
     def conditions(self) -> Sequence[Mapping[str, str]]: ...
     @property
-    def actions(self) -> Sequence[Union[Mapping[str, Any], str]]: ...
+    def actions(self) -> Sequence[Mapping[str, Any] | str]: ...
     @property
     def default(self) -> bool: ...
     @property
@@ -43,7 +43,7 @@ class FilteredPushRules:
     def __init__(
         self,
         push_rules: PushRules,
-        enabled_map: Dict[str, bool],
+        enabled_map: dict[str, bool],
         msc1767_enabled: bool,
         msc3381_polls_enabled: bool,
         msc3664_enabled: bool,
@@ -51,7 +51,7 @@ class FilteredPushRules:
         msc4210_enabled: bool,
         msc4306_enabled: bool,
     ): ...
-    def rules(self) -> Collection[Tuple[PushRule, bool]]: ...
+    def rules(self) -> Collection[tuple[PushRule, bool]]: ...
 
 def get_base_rule_ids() -> Collection[str]: ...
 
@@ -61,11 +61,11 @@ class PushRuleEvaluator:
         flattened_keys: Mapping[str, JsonValue],
         has_mentions: bool,
         room_member_count: int,
-        sender_power_level: Optional[int],
+        sender_power_level: int | None,
         notification_power_levels: Mapping[str, int],
         related_events_flattened: Mapping[str, Mapping[str, JsonValue]],
         related_event_match_enabled: bool,
-        room_version_feature_flags: Tuple[str, ...],
+        room_version_feature_flags: list[str],
         msc3931_enabled: bool,
         msc4210_enabled: bool,
         msc4306_enabled: bool,
@@ -73,14 +73,14 @@ class PushRuleEvaluator:
     def run(
         self,
         push_rules: FilteredPushRules,
-        user_id: Optional[str],
-        display_name: Optional[str],
-        msc4306_thread_subscription_state: Optional[bool],
-    ) -> Collection[Union[Mapping, str]]: ...
+        user_id: str | None,
+        display_name: str | None,
+        msc4306_thread_subscription_state: bool | None,
+    ) -> Collection[Mapping | str]: ...
     def matches(
         self,
         condition: JsonDict,
-        user_id: Optional[str],
-        display_name: Optional[str],
-        msc4306_thread_subscription_state: Optional[bool] = None,
+        user_id: str | None,
+        display_name: str | None,
+        msc4306_thread_subscription_state: bool | None = None,
     ) -> bool: ...
diff --git a/synapse/synapse_rust/room_versions.pyi b/synapse/synapse_rust/room_versions.pyi
new file mode 100644
index 0000000000..909e3a1c26
--- /dev/null
+++ b/synapse/synapse_rust/room_versions.pyi
@@ -0,0 +1,142 @@
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 Element Creations Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+from collections.abc import Mapping
+from typing import Iterator
+
+class EventFormatVersions:
+    """Internal enum for tracking the version of the event format,
+    independently of the room version.
+
+    To reduce confusion, the event format versions are named after the room
+    versions that they were used or introduced in.
+    The concept of an 'event format version' is specific to Synapse (the
+    specification does not mention this term.)
+    """
+
+    ROOM_V1_V2: int
+    """:server event id format: used for room v1 and v2"""
+    ROOM_V3: int
+    """MSC1659-style  event id format: used for room v3"""
+    ROOM_V4_PLUS: int
+    """MSC1884-style  format: introduced for room v4"""
+    ROOM_V11_HYDRA_PLUS: int
+    """MSC4291 room IDs as hashes: introduced for room HydraV11"""
+
+KNOWN_EVENT_FORMAT_VERSIONS: frozenset[int]
+
+class StateResolutionVersions:
+    """Enum to identify the state resolution algorithms."""
+
+    V1: int
+    """Room v1 state res"""
+    V2: int
+    """MSC1442 state res: room v2 and later"""
+    V2_1: int
+    """MSC4297 state res"""
+
+class RoomDisposition:
+    """Room disposition constants."""
+
+    STABLE: str
+    UNSTABLE: str
+
+class PushRuleRoomFlag:
+    """Enum for listing possible MSC3931 room version feature flags, for push rules."""
+
+    EXTENSIBLE_EVENTS: str
+    """MSC3932: Room version supports MSC1767 Extensible Events."""
+
+class RoomVersion:
+    """An object which describes the unique attributes of a room version."""
+
+    identifier: str
+    """The identifier for this version."""
+    disposition: str
+    """One of the RoomDisposition constants."""
+    event_format: int
+    """One of the EventFormatVersions constants."""
+    state_res: int
+    """One of the StateResolutionVersions constants."""
+    enforce_key_validity: bool
+    special_case_aliases_auth: bool
+    """Before MSC2432, m.room.aliases had special auth rules and redaction rules."""
+    strict_canonicaljson: bool
+    """Strictly enforce canonicaljson, do not allow:
+    * Integers outside the range of [-2^53 + 1, 2^53 - 1]
+    * Floats
+    * NaN, Infinity, -Infinity
+    """
+    limit_notifications_power_levels: bool
+    """MSC2209: Check 'notifications' key while verifying
+    m.room.power_levels auth rules."""
+    implicit_room_creator: bool
+    """MSC3820: No longer include the creator in m.room.create events (room version 11)."""
+    updated_redaction_rules: bool
+    """MSC3820: Apply updated redaction rules algorithm from room version 11."""
+    restricted_join_rule: bool
+    """Support the 'restricted' join rule."""
+    restricted_join_rule_fix: bool
+    """Support for the proper redaction rules for the restricted join rule.
+    This requires restricted_join_rule to be enabled."""
+    knock_join_rule: bool
+    """Support the 'knock' join rule."""
+    msc3389_relation_redactions: bool
+    """MSC3389: Protect relation information from redaction."""
+    knock_restricted_join_rule: bool
+    """Support the 'knock_restricted' join rule."""
+    enforce_int_power_levels: bool
+    """Enforce integer power levels."""
+    msc3931_push_features: list[str]
+    """MSC3931: Adds a push rule condition for "room version feature flags", making
+    some push rules room version dependent. Note that adding a flag to this list
+    is not enough to mark it "supported": the push rule evaluator also needs to
+    support the flag. Unknown flags are ignored by the evaluator, making conditions
+    fail if used. Values from PushRuleRoomFlag."""
+    msc3757_enabled: bool
+    """MSC3757: Restricting who can overwrite a state event."""
+    msc4289_creator_power_enabled: bool
+    """MSC4289: Creator power enabled."""
+    msc4291_room_ids_as_hashes: bool
+    """MSC4291: Room IDs as hashes of the create event."""
+    strict_event_byte_limits_room_versions: bool
+    """Whether this room version strictly enforces event key size limits in bytes,
+    rather than in codepoints.
+
+    If true, this room version uses stricter event size validation."""
+
+class RoomVersions:
+    V1: RoomVersion
+    V2: RoomVersion
+    V3: RoomVersion
+    V4: RoomVersion
+    V5: RoomVersion
+    V6: RoomVersion
+    V7: RoomVersion
+    V8: RoomVersion
+    V9: RoomVersion
+    V10: RoomVersion
+    MSC1767v10: RoomVersion
+    MSC3389v10: RoomVersion
+    MSC3757v10: RoomVersion
+    V11: RoomVersion
+    MSC3757v11: RoomVersion
+    HydraV11: RoomVersion
+    V12: RoomVersion
+
+class KnownRoomVersionsMapping(Mapping[str, RoomVersion]):
+    def add_room_version(self, room_version: RoomVersion) -> None: ...
+    def __getitem__(self, key: str) -> RoomVersion: ...
+    def __len__(self) -> int: ...
+    def __iter__(self) -> Iterator[str]: ...
+
+KNOWN_ROOM_VERSIONS: KnownRoomVersionsMapping
diff --git a/synapse/synapse_rust/segmenter.pyi b/synapse/synapse_rust/segmenter.pyi
index 5f36765947..19a0a4d83c 100644
--- a/synapse/synapse_rust/segmenter.pyi
+++ b/synapse/synapse_rust/segmenter.pyi
@@ -1,3 +1 @@
-from typing import List
-
-def parse_words(text: str) -> List[str]: ...
+def parse_words(text: str) -> list[str]: ...
diff --git a/synapse/types/__init__.py b/synapse/types/__init__.py
index 943f211b11..02889795bb 100644
--- a/synapse/types/__init__.py
+++ b/synapse/types/__init__.py
@@ -29,17 +29,12 @@ from typing import (
     AbstractSet,
     Any,
     ClassVar,
-    Dict,
-    List,
     Literal,
     Mapping,
     Match,
     MutableMapping,
     NoReturn,
     Optional,
-    Set,
-    Tuple,
-    Type,
     TypedDict,
     TypeVar,
     Union,
@@ -84,16 +79,16 @@ logger = logging.getLogger(__name__)
 # Define a state map type from type/state_key to T (usually an event ID or
 # event)
 T = TypeVar("T")
-StateKey = Tuple[str, str]
+StateKey = tuple[str, str]
 StateMap = Mapping[StateKey, T]
 MutableStateMap = MutableMapping[StateKey, T]
 
 # JSON types. These could be made stronger, but will do for now.
 # A "simple" (canonical) JSON value.
-SimpleJsonValue = Optional[Union[str, int, bool]]
-JsonValue = Union[List[SimpleJsonValue], Tuple[SimpleJsonValue, ...], SimpleJsonValue]
+SimpleJsonValue = str | int | bool | None
+JsonValue = list[SimpleJsonValue] | tuple[SimpleJsonValue, ...] | SimpleJsonValue
 # A JSON-serialisable dict.
-JsonDict = Dict[str, Any]
+JsonDict = dict[str, Any]
 # A JSON-serialisable mapping; roughly speaking an immutable JSONDict.
 # Useful when you have a TypedDict which isn't going to be mutated and you don't want
 # to cast to JsonDict everywhere.
@@ -106,23 +101,37 @@ JsonSerializable = object
 #
 # StrCollection is an unordered collection of strings. If ordering is important,
 # StrSequence can be used instead.
-StrCollection = Union[Tuple[str, ...], List[str], AbstractSet[str]]
+StrCollection = tuple[str, ...] | list[str] | AbstractSet[str]
 # Sequence[str] that does not include str itself; str being a Sequence[str]
 # is very misleading and results in bugs.
 #
 # Unlike StrCollection, StrSequence is an ordered collection of strings.
-StrSequence = Union[Tuple[str, ...], List[str]]
+StrSequence = tuple[str, ...] | list[str]
 
 
 # Note that this seems to require inheriting *directly* from Interface in order
 # for mypy-zope to realize it is an interface.
-class ISynapseReactor(
+class ISynapseThreadlessReactor(
     IReactorTCP,
     IReactorSSL,
     IReactorUNIX,
     IReactorPluggableNameResolver,
     IReactorTime,
     IReactorCore,
+    Interface,
+):
+    """
+    The interfaces necessary for Synapse to function (without threads).
+
+    Helpful because we use `twisted.internet.testing.MemoryReactorClock` in tests which
+    doesn't implement `IReactorThreads`.
+    """
+
+
+# Note that this seems to require inheriting *directly* from Interface in order
+# for mypy-zope to realize it is an interface.
+class ISynapseReactor(
+    ISynapseThreadlessReactor,
     IReactorThreads,
     Interface,
 ):
@@ -149,15 +158,15 @@ class Requester:
     """
 
     user: "UserID"
-    access_token_id: Optional[int]
+    access_token_id: int | None
     is_guest: bool
-    scope: Set[str]
+    scope: set[str]
     shadow_banned: bool
-    device_id: Optional[str]
+    device_id: str | None
     app_service: Optional["ApplicationService"]
     authenticated_entity: str
 
-    def serialize(self) -> Dict[str, Any]:
+    def serialize(self) -> dict[str, Any]:
         """Converts self to a type that can be serialized as JSON, and then
         deserialized by `deserialize`
 
@@ -177,7 +186,7 @@ class Requester:
 
     @staticmethod
     def deserialize(
-        store: "ApplicationServiceWorkerStore", input: Dict[str, Any]
+        store: "ApplicationServiceWorkerStore", input: dict[str, Any]
     ) -> "Requester":
         """Converts a dict that was produced by `serialize` back into a
         Requester.
@@ -207,13 +216,13 @@ class Requester:
 
 def create_requester(
     user_id: Union[str, "UserID"],
-    access_token_id: Optional[int] = None,
+    access_token_id: int | None = None,
     is_guest: bool = False,
     scope: StrCollection = (),
     shadow_banned: bool = False,
-    device_id: Optional[str] = None,
+    device_id: str | None = None,
     app_service: Optional["ApplicationService"] = None,
-    authenticated_entity: Optional[str] = None,
+    authenticated_entity: str | None = None,
 ) -> Requester:
     """
     Create a new ``Requester`` object
@@ -291,11 +300,11 @@ class DomainSpecificString(metaclass=abc.ABCMeta):
     def __copy__(self: DS) -> DS:
         return self
 
-    def __deepcopy__(self: DS, memo: Dict[str, object]) -> DS:
+    def __deepcopy__(self: DS, memo: dict[str, object]) -> DS:
         return self
 
     @classmethod
-    def from_string(cls: Type[DS], s: str) -> DS:
+    def from_string(cls: type[DS], s: str) -> DS:
         """Parse the string given by 's' into a structure object."""
         if len(s) < 1 or s[0:1] != cls.SIGIL:
             raise SynapseError(
@@ -323,7 +332,7 @@ class DomainSpecificString(metaclass=abc.ABCMeta):
         return "%s%s:%s" % (self.SIGIL, self.localpart, self.domain)
 
     @classmethod
-    def is_valid(cls: Type[DS], s: str) -> bool:
+    def is_valid(cls: type[DS], s: str) -> bool:
         """Parses the input string and attempts to ensure it is valid."""
         # TODO: this does not reject an empty localpart or an overly-long string.
         # See https://spec.matrix.org/v1.2/appendices/#identifier-grammar
@@ -334,7 +343,7 @@ class DomainSpecificString(metaclass=abc.ABCMeta):
             # possible for invalid data to exist in room-state, etc.
             parse_and_validate_server_name(obj.domain)
             return True
-        except Exception:
+        except (SynapseError, ValueError):
             return False
 
     __repr__ = to_string
@@ -346,6 +355,29 @@ class UserID(DomainSpecificString):
 
     SIGIL = "@"
 
+    @classmethod
+    def is_valid_strict(cls, s: str) -> bool:
+        """
+        Parses the input string and attempts to ensure it is a valid and compliant user
+        ID according to https://spec.matrix.org/v1.17/appendices/#historical-user-ids.
+
+        This should be used with care: there are existing non-compliant user IDs in the
+        wild with empty or non-ASCII localparts, which will be rejected by this method.
+        """
+        if len(s.encode("utf-8")) > 255:
+            return False
+        try:
+            obj = cls.from_string(s)
+            if not is_compliant_user_id_localpart(obj.localpart):
+                return False
+            # Apply additional validation to the domain. This is only done
+            # during  is_valid (and not part of from_string) since it is
+            # possible for invalid data to exist in room-state, etc.
+            parse_and_validate_server_name(obj.domain)
+            return True
+        except (SynapseError, ValueError):
+            return False
+
 
 @attr.s(slots=True, frozen=True, repr=False)
 class RoomAlias(DomainSpecificString):
@@ -376,10 +408,10 @@ class RoomID:
 
     SIGIL = "!"
     id: str
-    room_id_with_domain: Optional[RoomIdWithDomain]
+    room_id_with_domain: RoomIdWithDomain | None
 
     @classmethod
-    def is_valid(cls: Type["RoomID"], s: str) -> bool:
+    def is_valid(cls: type["RoomID"], s: str) -> bool:
         if ":" in s:
             return RoomIdWithDomain.is_valid(s)
         try:
@@ -388,7 +420,7 @@ class RoomID:
         except Exception:
             return False
 
-    def get_domain(self) -> Optional[str]:
+    def get_domain(self) -> str | None:
         if not self.room_id_with_domain:
             return None
         return self.room_id_with_domain.domain
@@ -401,7 +433,7 @@ class RoomID:
     __repr__ = to_string
 
     @classmethod
-    def from_string(cls: Type["RoomID"], s: str) -> "RoomID":
+    def from_string(cls: type["RoomID"], s: str) -> "RoomID":
         # sigil check
         if len(s) < 1 or s[0] != cls.SIGIL:
             raise SynapseError(
@@ -410,7 +442,7 @@ class RoomID:
                 Codes.INVALID_PARAM,
             )
 
-        room_id_with_domain: Optional[RoomIdWithDomain] = None
+        room_id_with_domain: RoomIdWithDomain | None = None
         if ":" in s:
             room_id_with_domain = RoomIdWithDomain.from_string(s)
         else:
@@ -444,12 +476,17 @@ GUEST_USER_ID_PATTERN = re.compile(r"^\d+$")
 
 
 def contains_invalid_mxid_characters(localpart: str) -> bool:
-    """Check for characters not allowed in an mxid or groupid localpart
+    """
+    Check for characters not allowed in a modern user ID localpart.
+
+    This is primarily used for new registrations and MUST NOT be used to validate
+    existing user IDs, as there are real users whose user IDs don't follow this
+    character set.
+
+    See https://spec.matrix.org/v1.17/appendices/#user-identifiers
 
     Args:
         localpart: the localpart to be checked
-        use_extended_character_set: True to use the extended allowed characters
-            from MSC4009.
 
     Returns:
         True if there are any naughty characters
@@ -457,6 +494,28 @@ def contains_invalid_mxid_characters(localpart: str) -> bool:
     return any(c not in MXID_LOCALPART_ALLOWED_CHARACTERS for c in localpart)
 
 
+def is_compliant_user_id_localpart(localpart: str) -> bool:
+    """
+    Validates that the given user ID localpart is within the "compliant" range,
+    i.e. not empty and all characters are between U+0021 and U+007E inclusive.
+    See https://spec.matrix.org/v1.17/appendices/#historical-user-ids
+
+    To check if a localpart is non-historical, use contains_invalid_mxid_characters instead.
+
+    This should be used with care: there are existing non-compliant user IDs in the
+    wild with empty or non-ASCII localparts, which will be rejected by this method.
+
+    Args:
+        localpart: the localpart to be checked
+
+    Returns:
+        True if the localpart is compliant, False otherwise
+    """
+    if not localpart:
+        return False
+    return all(0x21 <= ord(c) <= 0x7E for c in localpart)
+
+
 UPPER_CASE_PATTERN = re.compile(b"[A-Z_]")
 
 # the following is a pattern which matches '=', and bytes which are not allowed in a mxid
@@ -478,7 +537,7 @@ NON_MXID_CHARACTER_PATTERN = re.compile(
 
 
 def map_username_to_mxid_localpart(
-    username: Union[str, bytes], case_sensitive: bool = False
+    username: str | bytes, case_sensitive: bool = False
 ) -> str:
     """Map a username onto a string suitable for a MXID
 
@@ -735,7 +794,7 @@ class RoomStreamToken(AbstractMultiWriterStreamToken):
     attributes, must be hashable.
     """
 
-    topological: Optional[int] = attr.ib(
+    topological: int | None = attr.ib(
         validator=attr.validators.optional(attr.validators.instance_of(int)),
         kw_only=True,
         default=None,
@@ -815,7 +874,7 @@ class RoomStreamToken(AbstractMultiWriterStreamToken):
 
         return super().copy_and_advance(other)
 
-    def as_historical_tuple(self) -> Tuple[int, int]:
+    def as_historical_tuple(self) -> tuple[int, int]:
         """Returns a tuple of `(topological, stream)` for historical tokens.
 
         Raises if not an historical token (i.e. doesn't have a topological part).
@@ -945,7 +1004,7 @@ class MultiWriterStreamToken(AbstractMultiWriterStreamToken):
     def is_stream_position_in_range(
         low: Optional["AbstractMultiWriterStreamToken"],
         high: Optional["AbstractMultiWriterStreamToken"],
-        instance_name: Optional[str],
+        instance_name: str | None,
         pos: int,
     ) -> bool:
         """Checks if a given persisted position is between the two given tokens.
@@ -996,6 +1055,8 @@ class StreamKeyType(Enum):
     TO_DEVICE = "to_device_key"
     DEVICE_LIST = "device_list_key"
     UN_PARTIAL_STATED_ROOMS = "un_partial_stated_rooms_key"
+    THREAD_SUBSCRIPTIONS = "thread_subscriptions_key"
+    STICKY_EVENTS = "sticky_events_key"
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -1003,7 +1064,7 @@ class StreamToken:
     """A collection of keys joined together by underscores in the following
     order and which represent the position in their respective streams.
 
-    ex. `s2633508_17_338_6732159_1082514_541479_274711_265584_1_379`
+    ex. `s2633508_17_338_6732159_1082514_541479_274711_265584_1_379_4242`
         1. `room_key`: `s2633508` which is a `RoomStreamToken`
            - `RoomStreamToken`'s can also look like `t426-2633508` or `m56~2.58~3.59`
            - See the docstring for `RoomStreamToken` for more details.
@@ -1016,6 +1077,8 @@ class StreamToken:
         8. `device_list_key`: `265584`
         9. `groups_key`: `1` (note that this key is now unused)
         10. `un_partial_stated_rooms_key`: `379`
+        11. `thread_subscriptions_key`: 4242
+        12. `sticky_events_key`: 4141
 
     You can see how many of these keys correspond to the various
     fields in a "/sync" response:
@@ -1074,6 +1137,8 @@ class StreamToken:
     # Note that the groups key is no longer used and may have bogus values.
     groups_key: int
     un_partial_stated_rooms_key: int
+    thread_subscriptions_key: int
+    sticky_events_key: int
 
     _SEPARATOR = "_"
     START: ClassVar["StreamToken"]
@@ -1101,6 +1166,8 @@ class StreamToken:
                 device_list_key,
                 groups_key,
                 un_partial_stated_rooms_key,
+                thread_subscriptions_key,
+                sticky_events_key,
             ) = keys
 
             return cls(
@@ -1116,6 +1183,8 @@ class StreamToken:
                 ),
                 groups_key=int(groups_key),
                 un_partial_stated_rooms_key=int(un_partial_stated_rooms_key),
+                thread_subscriptions_key=int(thread_subscriptions_key),
+                sticky_events_key=int(sticky_events_key),
             )
         except CancelledError:
             raise
@@ -1138,6 +1207,8 @@ class StreamToken:
                 # if additional tokens are added.
                 str(self.groups_key),
                 str(self.un_partial_stated_rooms_key),
+                str(self.thread_subscriptions_key),
+                str(self.sticky_events_key),
             ]
         )
 
@@ -1202,17 +1273,19 @@ class StreamToken:
             StreamKeyType.TO_DEVICE,
             StreamKeyType.TYPING,
             StreamKeyType.UN_PARTIAL_STATED_ROOMS,
+            StreamKeyType.THREAD_SUBSCRIPTIONS,
+            StreamKeyType.STICKY_EVENTS,
         ],
     ) -> int: ...
 
     @overload
     def get_field(
         self, key: StreamKeyType
-    ) -> Union[int, RoomStreamToken, MultiWriterStreamToken]: ...
+    ) -> int | RoomStreamToken | MultiWriterStreamToken: ...
 
     def get_field(
         self, key: StreamKeyType
-    ) -> Union[int, RoomStreamToken, MultiWriterStreamToken]:
+    ) -> int | RoomStreamToken | MultiWriterStreamToken:
         """Returns the stream ID for the given key."""
         return getattr(self, key.value)
 
@@ -1257,7 +1330,8 @@ class StreamToken:
             f"typing: {self.typing_key}, receipt: {self.receipt_key}, "
             f"account_data: {self.account_data_key}, push_rules: {self.push_rules_key}, "
             f"to_device: {self.to_device_key}, device_list: {self.device_list_key}, "
-            f"groups: {self.groups_key}, un_partial_stated_rooms: {self.un_partial_stated_rooms_key})"
+            f"groups: {self.groups_key}, un_partial_stated_rooms: {self.un_partial_stated_rooms_key},"
+            f"thread_subscriptions: {self.thread_subscriptions_key}, sticky_events: {self.sticky_events_key})"
         )
 
 
@@ -1272,6 +1346,8 @@ StreamToken.START = StreamToken(
     device_list_key=MultiWriterStreamToken(stream=0),
     groups_key=0,
     un_partial_stated_rooms_key=0,
+    thread_subscriptions_key=0,
+    sticky_events_key=0,
 )
 
 
@@ -1318,6 +1394,27 @@ class SlidingSyncStreamToken:
         return f"{self.connection_position}/{stream_token_str}"
 
 
+@attr.s(slots=True, frozen=True, auto_attribs=True)
+class ThreadSubscriptionsToken:
+    """
+    Token for a position in the thread subscriptions stream.
+
+    Format: `ts<stream_id>`
+    """
+
+    stream_id: int
+
+    @staticmethod
+    def from_string(s: str) -> "ThreadSubscriptionsToken":
+        if not s.startswith("ts"):
+            raise ValueError("thread subscription token must start with `ts`")
+
+        return ThreadSubscriptionsToken(stream_id=int(s[2:]))
+
+    def to_string(self) -> str:
+        return f"ts{self.stream_id}"
+
+
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class PersistedPosition:
     """Position of a newly persisted row with instance that persisted it."""
@@ -1355,8 +1452,8 @@ class PersistedEventPosition(PersistedPosition):
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class ThirdPartyInstanceID:
-    appservice_id: Optional[str]
-    network_id: Optional[str]
+    appservice_id: str | None
+    network_id: str | None
 
     # Deny iteration because it will bite you if you try to create a singleton
     # set by:
@@ -1368,7 +1465,7 @@ class ThirdPartyInstanceID:
     def __copy__(self) -> "ThirdPartyInstanceID":
         return self
 
-    def __deepcopy__(self, memo: Dict[str, object]) -> "ThirdPartyInstanceID":
+    def __deepcopy__(self, memo: dict[str, object]) -> "ThirdPartyInstanceID":
         return self
 
     @classmethod
@@ -1392,8 +1489,8 @@ class ReadReceipt:
     room_id: str
     receipt_type: str
     user_id: str
-    event_ids: List[str]
-    thread_id: Optional[str]
+    event_ids: list[str]
+    thread_id: str | None
     data: JsonDict
 
 
@@ -1415,8 +1512,8 @@ class DeviceListUpdates:
     # The latter happening only once, thus always giving you the same sets
     # across multiple DeviceListUpdates instances.
     # Also see: don't define mutable default arguments.
-    changed: Set[str] = attr.ib(factory=set)
-    left: Set[str] = attr.ib(factory=set)
+    changed: set[str] = attr.ib(factory=set)
+    left: set[str] = attr.ib(factory=set)
 
     def __bool__(self) -> bool:
         return bool(self.changed or self.left)
@@ -1424,7 +1521,7 @@ class DeviceListUpdates:
 
 def get_verify_key_from_cross_signing_key(
     key_info: Mapping[str, Any],
-) -> Tuple[str, VerifyKey]:
+) -> tuple[str, VerifyKey]:
     """Get the key ID and signedjson verify key from a cross-signing key dict
 
     Args:
@@ -1468,11 +1565,11 @@ class UserInfo:
     """
 
     user_id: UserID
-    appservice_id: Optional[int]
-    consent_server_notice_sent: Optional[str]
-    consent_version: Optional[str]
-    consent_ts: Optional[int]
-    user_type: Optional[str]
+    appservice_id: int | None
+    consent_server_notice_sent: str | None
+    consent_version: str | None
+    consent_ts: int | None
+    user_type: str | None
     creation_ts: int
     is_admin: bool
     is_deactivated: bool
@@ -1485,14 +1582,14 @@ class UserInfo:
 
 class UserProfile(TypedDict):
     user_id: str
-    display_name: Optional[str]
-    avatar_url: Optional[str]
+    display_name: str | None
+    avatar_url: str | None
 
 
 @attr.s(auto_attribs=True, frozen=True, slots=True)
 class RetentionPolicy:
-    min_lifetime: Optional[int] = None
-    max_lifetime: Optional[int] = None
+    min_lifetime: int | None = None
+    max_lifetime: int | None = None
 
 
 class TaskStatus(str, Enum):
@@ -1507,6 +1604,8 @@ class TaskStatus(str, Enum):
     COMPLETE = "complete"
     # Task is over and either returned a failed status, or had an exception
     FAILED = "failed"
+    # Task has been cancelled
+    CANCELLED = "cancelled"
 
 
 @attr.s(auto_attribs=True, frozen=True, slots=True)
@@ -1524,13 +1623,13 @@ class ScheduledTask:
     # In milliseconds since epoch in system time timezone, usually UTC.
     timestamp: int
     # Optionally bind a task to some resource id for easy retrieval
-    resource_id: Optional[str]
+    resource_id: str | None
     # Optional parameters that will be passed to the function ran by the task
-    params: Optional[JsonMapping]
+    params: JsonMapping | None
     # Optional result that can be updated by the running task
-    result: Optional[JsonMapping]
+    result: JsonMapping | None
     # Optional error that should be assigned a value when the status is FAILED
-    error: Optional[str]
+    error: str | None
 
 
 @attr.s(auto_attribs=True, frozen=True, slots=True)
diff --git a/synapse/types/handlers/__init__.py b/synapse/types/handlers/__init__.py
index f2fbc1dddf..b9d1b41a75 100644
--- a/synapse/types/handlers/__init__.py
+++ b/synapse/types/handlers/__init__.py
@@ -19,7 +19,7 @@
 #
 
 
-from typing import List, Optional, TypedDict
+from typing import TypedDict
 
 from synapse.api.constants import EventTypes
 
@@ -66,10 +66,10 @@ class ShutdownRoomParams(TypedDict):
             even if there are still users joined to the room.
     """
 
-    requester_user_id: Optional[str]
-    new_room_user_id: Optional[str]
-    new_room_name: Optional[str]
-    message: Optional[str]
+    requester_user_id: str | None
+    new_room_user_id: str | None
+    new_room_name: str | None
+    message: str | None
     block: bool
     purge: bool
     force_purge: bool
@@ -87,7 +87,7 @@ class ShutdownRoomResponse(TypedDict):
         new_room_id: A string representing the room ID of the new room.
     """
 
-    kicked_users: List[str]
-    failed_to_kick_users: List[str]
-    local_aliases: List[str]
-    new_room_id: Optional[str]
+    kicked_users: list[str]
+    failed_to_kick_users: list[str]
+    local_aliases: list[str]
+    new_room_id: str | None
diff --git a/synapse/types/handlers/sliding_sync.py b/synapse/types/handlers/sliding_sync.py
index 3ebd334a6d..694b3e1645 100644
--- a/synapse/types/handlers/sliding_sync.py
+++ b/synapse/types/handlers/sliding_sync.py
@@ -13,7 +13,6 @@
 #
 
 import logging
-import typing
 from collections import ChainMap
 from enum import Enum
 from typing import (
@@ -21,23 +20,18 @@ from typing import (
     AbstractSet,
     Any,
     Callable,
-    Dict,
     Final,
     Generic,
-    List,
     Mapping,
     MutableMapping,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
     TypeVar,
     cast,
 )
 
 import attr
+from pydantic import ConfigDict
 
-from synapse._pydantic_compat import Extra
 from synapse.api.constants import EventTypes
 from synapse.events import EventBase
 from synapse.types import (
@@ -50,15 +44,25 @@ from synapse.types import (
     SlidingSyncStreamToken,
     StrCollection,
     StreamToken,
+    ThreadSubscriptionsToken,
     UserID,
 )
 from synapse.types.rest.client import SlidingSyncBody
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 if TYPE_CHECKING:
     from synapse.handlers.relations import BundledAggregations
 
 logger = logging.getLogger(__name__)
 
+# How often to update the last seen timestamp for lazy members.
+#
+# We don't update the timestamp every time to avoid hammering the DB with
+# writes, and we don't need the timestamp to be precise (as it is used to evict
+# old entries that haven't been used in a while).
+LAZY_MEMBERS_UPDATE_INTERVAL = Duration(hours=1)
+
 
 class SlidingSyncConfig(SlidingSyncBody):
     """
@@ -68,15 +72,12 @@ class SlidingSyncConfig(SlidingSyncBody):
 
     user: UserID
     requester: Requester
-
-    # Pydantic config
-    class Config:
-        # By default, ignore fields that we don't recognise.
-        extra = Extra.ignore
-        # By default, don't allow fields to be reassigned after parsing.
-        allow_mutation = False
-        # Allow custom types like `UserID` to be used in the model
-        arbitrary_types_allowed = True
+    model_config = ConfigDict(
+        extra="ignore",
+        frozen=True,
+        # Allow custom types like `UserID` to be used in the model.
+        arbitrary_types_allowed=True,
+    )
 
 
 class OperationType(Enum):
@@ -172,31 +173,31 @@ class SlidingSyncResult:
         @attr.s(slots=True, frozen=True, auto_attribs=True)
         class StrippedHero:
             user_id: str
-            display_name: Optional[str]
-            avatar_url: Optional[str]
+            display_name: str | None
+            avatar_url: str | None
 
-        name: Optional[str]
-        avatar: Optional[str]
-        heroes: Optional[List[StrippedHero]]
+        name: str | None
+        avatar: str | None
+        heroes: list[StrippedHero] | None
         is_dm: bool
         initial: bool
         unstable_expanded_timeline: bool
         # Should be empty for invite/knock rooms with `stripped_state`
-        required_state: List[EventBase]
+        required_state: list[EventBase]
         # Should be empty for invite/knock rooms with `stripped_state`
-        timeline_events: List[EventBase]
-        bundled_aggregations: Optional[Dict[str, "BundledAggregations"]]
+        timeline_events: list[EventBase]
+        bundled_aggregations: dict[str, "BundledAggregations"] | None
         # Optional because it's only relevant to invite/knock rooms
-        stripped_state: List[JsonDict]
+        stripped_state: list[JsonDict]
         # Only optional because it won't be included for invite/knock rooms with `stripped_state`
-        prev_batch: Optional[StreamToken]
+        prev_batch: StreamToken | None
         # Only optional because it won't be included for invite/knock rooms with `stripped_state`
-        limited: Optional[bool]
+        limited: bool | None
         # Only optional because it won't be included for invite/knock rooms with `stripped_state`
-        num_live: Optional[int]
-        bump_stamp: Optional[int]
-        joined_count: Optional[int]
-        invited_count: Optional[int]
+        num_live: int | None
+        bump_stamp: int | None
+        joined_count: int | None
+        invited_count: int | None
         notification_count: int
         highlight_count: int
 
@@ -239,11 +240,11 @@ class SlidingSyncResult:
             """
 
             op: OperationType
-            range: Tuple[int, int]
-            room_ids: List[str]
+            range: tuple[int, int]
+            room_ids: list[str]
 
         count: int
-        ops: List[Operation]
+        ops: list[Operation]
 
     @attr.s(slots=True, frozen=True, auto_attribs=True)
     class Extensions:
@@ -287,7 +288,7 @@ class SlidingSyncResult:
             """
 
             # Only present on incremental syncs
-            device_list_updates: Optional[DeviceListUpdates]
+            device_list_updates: DeviceListUpdates | None
             device_one_time_keys_count: Mapping[str, int]
             device_unused_fallback_key_types: Sequence[str]
 
@@ -357,11 +358,50 @@ class SlidingSyncResult:
             def __bool__(self) -> bool:
                 return bool(self.room_id_to_typing_map)
 
-        to_device: Optional[ToDeviceExtension] = None
-        e2ee: Optional[E2eeExtension] = None
-        account_data: Optional[AccountDataExtension] = None
-        receipts: Optional[ReceiptsExtension] = None
-        typing: Optional[TypingExtension] = None
+        @attr.s(slots=True, frozen=True, auto_attribs=True)
+        class ThreadSubscriptionsExtension:
+            """The Thread Subscriptions extension (MSC4308)
+
+            Attributes:
+                subscribed: map (room_id -> thread_root_id -> info) of new or changed subscriptions
+                unsubscribed: map (room_id -> thread_root_id -> info) of new unsubscriptions
+                prev_batch: if present, there is a gap and the client can use this token to backpaginate
+            """
+
+            @attr.s(slots=True, frozen=True, auto_attribs=True)
+            class ThreadSubscription:
+                # always present when `subscribed`
+                automatic: bool | None
+
+                # the same as our stream_id; useful for clients to resolve
+                # race conditions locally
+                bump_stamp: int
+
+            @attr.s(slots=True, frozen=True, auto_attribs=True)
+            class ThreadUnsubscription:
+                # the same as our stream_id; useful for clients to resolve
+                # race conditions locally
+                bump_stamp: int
+
+            # room_id -> event_id (of thread root) -> the subscription change
+            subscribed: Mapping[str, Mapping[str, ThreadSubscription]] | None
+            # room_id -> event_id (of thread root) -> the unsubscription
+            unsubscribed: Mapping[str, Mapping[str, ThreadUnsubscription]] | None
+            prev_batch: ThreadSubscriptionsToken | None
+
+            def __bool__(self) -> bool:
+                return (
+                    bool(self.subscribed)
+                    or bool(self.unsubscribed)
+                    or bool(self.prev_batch)
+                )
+
+        to_device: ToDeviceExtension | None = None
+        e2ee: E2eeExtension | None = None
+        account_data: AccountDataExtension | None = None
+        receipts: ReceiptsExtension | None = None
+        typing: TypingExtension | None = None
+        thread_subscriptions: ThreadSubscriptionsExtension | None = None
 
         def __bool__(self) -> bool:
             return bool(
@@ -370,11 +410,12 @@ class SlidingSyncResult:
                 or self.account_data
                 or self.receipts
                 or self.typing
+                or self.thread_subscriptions
             )
 
     next_pos: SlidingSyncStreamToken
     lists: Mapping[str, SlidingWindowList]
-    rooms: Dict[str, RoomResult]
+    rooms: dict[str, RoomResult]
     extensions: Extensions
 
     def __bool__(self) -> bool:
@@ -444,7 +485,7 @@ class RoomSyncConfig:
         Args:
             room_params: `SlidingSyncConfig.SlidingSyncList` or `SlidingSyncConfig.RoomSubscription`
         """
-        required_state_map: Dict[str, Set[str]] = {}
+        required_state_map: dict[str, set[str]] = {}
         for (
             state_type,
             state_key,
@@ -696,7 +737,7 @@ class HaveSentRoom(Generic[T]):
     """
 
     status: HaveSentRoomFlag
-    last_token: Optional[T]
+    last_token: T | None
 
     @staticmethod
     def live() -> "HaveSentRoom[T]":
@@ -751,7 +792,7 @@ class MutableRoomStatusMap(RoomStatusMap[T]):
     # We use a ChainMap here so that we can easily track what has been updated
     # and what hasn't. Note that when we persist the per connection state this
     # will get flattened to a normal dict (via calling `.copy()`)
-    _statuses: typing.ChainMap[str, HaveSentRoom[T]]
+    _statuses: ChainMap[str, HaveSentRoom[T]]
 
     def __init__(
         self,
@@ -817,12 +858,16 @@ class PerConnectionState:
     since the last time you made a sync request.
 
     Attributes:
+        last_used_ts: The time this connection was last used, in milliseconds.
+            This is only accurate to `UPDATE_CONNECTION_STATE_EVERY_MS`.
         rooms: The status of each room for the events stream.
         receipts: The status of each room for the receipts stream.
         room_configs: Map from room_id to the `RoomSyncConfig` of all
             rooms that we have previously sent down.
     """
 
+    last_used_ts: int | None = None
+
     rooms: RoomStatusMap[RoomStreamToken] = attr.Factory(RoomStatusMap)
     receipts: RoomStatusMap[MultiWriterStreamToken] = attr.Factory(RoomStatusMap)
     account_data: RoomStatusMap[int] = attr.Factory(RoomStatusMap)
@@ -834,6 +879,7 @@ class PerConnectionState:
         room_configs = cast(MutableMapping[str, RoomSyncConfig], self.room_configs)
 
         return MutablePerConnectionState(
+            last_used_ts=self.last_used_ts,
             rooms=self.rooms.get_mutable(),
             receipts=self.receipts.get_mutable(),
             account_data=self.account_data.get_mutable(),
@@ -842,6 +888,7 @@ class PerConnectionState:
 
     def copy(self) -> "PerConnectionState":
         return PerConnectionState(
+            last_used_ts=self.last_used_ts,
             rooms=self.rooms.copy(),
             receipts=self.receipts.copy(),
             account_data=self.account_data.copy(),
@@ -852,22 +899,103 @@ class PerConnectionState:
         return len(self.rooms) + len(self.receipts) + len(self.room_configs)
 
 
+@attr.s(auto_attribs=True)
+class RoomLazyMembershipChanges:
+    """Changes to lazily-loaded room memberships for a given room."""
+
+    returned_user_id_to_last_seen_ts_map: Mapping[str, int | None] = attr.Factory(dict)
+    """Map from user ID to timestamp for users whose membership we have lazily
+    loaded in this room an request. The timestamp indicates the time we
+    previously needed the membership, or None if we sent it down for the first
+    time in this request.
+
+    We track a *rough* `last_seen_ts` for each user in each room which indicates
+    when we last would've sent their member state to the client. This is used so
+    that we can remove members which haven't been seen for a while to save
+    space.
+
+    Note: this will include users whose membership we would have sent down but
+    didn't due to us having previously sent them.
+    """
+
+    invalidated_user_ids: AbstractSet[str] = attr.Factory(set)
+    """Set of user IDs whose latest membership we have *not* sent down"""
+
+    def get_returned_user_ids_to_update(self, clock: Clock) -> StrCollection:
+        """Get the user IDs whose last seen timestamp we need to update in the
+        database.
+
+        This is a subset of user IDs in `returned_user_id_to_last_seen_ts_map`,
+        whose timestamp is either None (first time we've sent them) or older
+        than `LAZY_MEMBERS_UPDATE_INTERVAL`.
+
+        We only update the timestamp in the database every so often to avoid
+        hammering the DB with writes. We don't need the timestamp to be precise,
+        as the timestamp is used to evict old entries that haven't been used in
+        a while.
+        """
+
+        now_ms = clock.time_msec()
+        return [
+            user_id
+            for user_id, last_seen_ts in self.returned_user_id_to_last_seen_ts_map.items()
+            if last_seen_ts is None
+            or now_ms - last_seen_ts >= LAZY_MEMBERS_UPDATE_INTERVAL.as_millis()
+        ]
+
+    def has_updates(self, clock: Clock) -> bool:
+        """Check if there are any updates to the lazy membership changes.
+
+        Called to check if we need to persist changes to the lazy membership
+        state for the room. We want to avoid persisting the state if there are
+        no changes, to avoid unnecessary writes (and cache misses due to new
+        connection position).
+        """
+
+        # We consider there to be updates if there are any invalidated user
+        # IDs...
+        if self.invalidated_user_ids:
+            return True
+
+        # ...or if any of the returned user IDs need their last seen timestamp
+        # updating in the database.
+        return bool(self.get_returned_user_ids_to_update(clock))
+
+
 @attr.s(auto_attribs=True)
 class MutablePerConnectionState(PerConnectionState):
     """A mutable version of `PerConnectionState`"""
 
+    last_used_ts: int | None
+
     rooms: MutableRoomStatusMap[RoomStreamToken]
     receipts: MutableRoomStatusMap[MultiWriterStreamToken]
     account_data: MutableRoomStatusMap[int]
 
-    room_configs: typing.ChainMap[str, RoomSyncConfig]
+    room_configs: ChainMap[str, RoomSyncConfig]
 
-    def has_updates(self) -> bool:
+    # A map from room ID to the lazily-loaded memberships needed for the
+    # request in that room.
+    room_lazy_membership: dict[str, RoomLazyMembershipChanges] = attr.Factory(dict)
+
+    def has_updates(self, clock: Clock) -> bool:
+        """Check if there are any updates to the per-connection state that need
+        persisting.
+
+        It is important that we don't spuriously do persistence, as that will
+        always generate a new connection position which will invalidate some of
+        the caches. It doesn't need to be perfect, but we should avoid always
+        generating new connection positions when doing lazy loading
+        """
         return (
             bool(self.rooms.get_updates())
             or bool(self.receipts.get_updates())
             or bool(self.account_data.get_updates())
             or bool(self.get_room_config_updates())
+            or any(
+                change.has_updates(clock)
+                for change in self.room_lazy_membership.values()
+            )
         )
 
     def get_room_config_updates(self) -> Mapping[str, RoomSyncConfig]:
diff --git a/synapse/types/rest/client/__init__.py b/synapse/types/rest/client/__init__.py
index c739bd16b0..49782b5234 100644
--- a/synapse/types/rest/client/__init__.py
+++ b/synapse/types/rest/client/__init__.py
@@ -18,17 +18,19 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import TYPE_CHECKING, Dict, List, Optional, Tuple, Union
-
-from synapse._pydantic_compat import (
-    Extra,
+from pydantic import (
+    ConfigDict,
+    Field,
     StrictBool,
     StrictInt,
     StrictStr,
-    conint,
-    constr,
-    validator,
+    StringConstraints,
+    field_validator,
+    model_validator,
 )
+from pydantic_core import PydanticCustomError
+from typing_extensions import Annotated, Self
+
 from synapse.types.rest import RequestBodyModel
 from synapse.util.threepids import validate_email
 
@@ -43,39 +45,36 @@ class AuthenticationData(RequestBodyModel):
     `.dict(exclude_unset=True)` to access them.
     """
 
-    class Config:
-        extra = Extra.allow
+    model_config = ConfigDict(extra="allow")
 
-    session: Optional[StrictStr] = None
-    type: Optional[StrictStr] = None
+    session: StrictStr | None = None
+    type: StrictStr | None = None
 
 
-if TYPE_CHECKING:
-    ClientSecretStr = StrictStr
-else:
-    # See also assert_valid_client_secret()
-    ClientSecretStr = constr(
-        regex="[0-9a-zA-Z.=_-]",  # noqa: F722
+# See also assert_valid_client_secret()
+ClientSecretStr = Annotated[
+    str,
+    StringConstraints(
+        pattern="[0-9a-zA-Z.=_-]",
         min_length=1,
         max_length=255,
         strict=True,
-    )
+    ),
+]
 
 
 class ThreepidRequestTokenBody(RequestBodyModel):
     client_secret: ClientSecretStr
-    id_server: Optional[StrictStr]
-    id_access_token: Optional[StrictStr]
-    next_link: Optional[StrictStr]
+    id_server: StrictStr | None = None
+    id_access_token: StrictStr | None = None
+    next_link: StrictStr | None = None
     send_attempt: StrictInt
 
-    @validator("id_access_token", always=True)
-    def token_required_for_identity_server(
-        cls, token: Optional[str], values: Dict[str, object]
-    ) -> Optional[str]:
-        if values.get("id_server") is not None and token is None:
+    @model_validator(mode="after")
+    def token_required_for_identity_server(self) -> Self:
+        if self.id_server is not None and self.id_access_token is None:
             raise ValueError("id_access_token is required if an id_server is supplied.")
-        return token
+        return self
 
 
 class EmailRequestTokenBody(ThreepidRequestTokenBody):
@@ -86,14 +85,21 @@ class EmailRequestTokenBody(ThreepidRequestTokenBody):
     # know the exact spelling (eg. upper and lower case) of address in the database.
     # Without this, an email stored in the database as "foo@bar.com" would cause
     # user requests for "FOO@bar.com" to raise a Not Found error.
-    _email_validator = validator("email", allow_reuse=True)(validate_email)
+    @field_validator("email")
+    @classmethod
+    def _email_validator(cls, email: StrictStr) -> StrictStr:
+        try:
+            return validate_email(email)
+        except ValueError as e:
+            # To ensure backward compatibility of HTTP error codes, we return a
+            # Pydantic error with the custom, unrecognized error type
+            # "email_custom_err_type" instead of the default error type
+            # "value_error". This results in the more generic BAD_JSON HTTP
+            # error instead of the more specific INVALID_PARAM one.
+            raise PydanticCustomError("email_custom_err_type", str(e), None) from e
 
 
-if TYPE_CHECKING:
-    ISO3116_1_Alpha_2 = StrictStr
-else:
-    # Per spec: two-letter uppercase ISO-3166-1-alpha-2
-    ISO3116_1_Alpha_2 = constr(regex="[A-Z]{2}", strict=True)
+ISO3116_1_Alpha_2 = Annotated[str, StringConstraints(pattern="[A-Z]{2}", strict=True)]
 
 
 class MsisdnRequestTokenBody(ThreepidRequestTokenBody):
@@ -143,12 +149,10 @@ class SlidingSyncBody(RequestBodyModel):
                 (Max 1000 messages)
         """
 
-        required_state: List[Tuple[StrictStr, StrictStr]]
-        # mypy workaround via https://github.com/pydantic/pydantic/issues/156#issuecomment-1130883884
-        if TYPE_CHECKING:
-            timeline_limit: int
-        else:
-            timeline_limit: conint(le=1000, strict=True)  # type: ignore[valid-type]
+        required_state: list[
+            Annotated[tuple[StrictStr, StrictStr], Field(strict=False)]
+        ]
+        timeline_limit: Annotated[int, Field(le=1000, strict=True)]
 
     class SlidingSyncList(CommonRoomParameters):
         """
@@ -240,25 +244,30 @@ class SlidingSyncBody(RequestBodyModel):
                     list of favourite rooms again.
             """
 
-            is_dm: Optional[StrictBool] = None
-            spaces: Optional[List[StrictStr]] = None
-            is_encrypted: Optional[StrictBool] = None
-            is_invite: Optional[StrictBool] = None
-            room_types: Optional[List[Union[StrictStr, None]]] = None
-            not_room_types: Optional[List[Union[StrictStr, None]]] = None
-            room_name_like: Optional[StrictStr] = None
-            tags: Optional[List[StrictStr]] = None
-            not_tags: Optional[List[StrictStr]] = None
+            is_dm: StrictBool | None = None
+            spaces: list[StrictStr] | None = None
+            is_encrypted: StrictBool | None = None
+            is_invite: StrictBool | None = None
+            room_types: list[StrictStr | None] | None = None
+            not_room_types: list[StrictStr | None] | None = None
+            room_name_like: StrictStr | None = None
+            tags: list[StrictStr] | None = None
+            not_tags: list[StrictStr] | None = None
 
-        # mypy workaround via https://github.com/pydantic/pydantic/issues/156#issuecomment-1130883884
-        if TYPE_CHECKING:
-            ranges: Optional[List[Tuple[int, int]]] = None
-        else:
-            ranges: Optional[
-                List[Tuple[conint(ge=0, strict=True), conint(ge=0, strict=True)]]
-            ] = None  # type: ignore[valid-type]
-        slow_get_all_rooms: Optional[StrictBool] = False
-        filters: Optional[Filters] = None
+        ranges: (
+            list[
+                Annotated[
+                    tuple[
+                        Annotated[int, Field(ge=0, strict=True)],
+                        Annotated[int, Field(ge=0, strict=True)],
+                    ],
+                    Field(strict=False),
+                ]
+            ]
+            | None
+        ) = None
+        slow_get_all_rooms: StrictBool | None = False
+        filters: Filters | None = None
 
     class RoomSubscription(CommonRoomParameters):
         pass
@@ -281,14 +290,13 @@ class SlidingSyncBody(RequestBodyModel):
                 since: The `next_batch` from the previous sync response
             """
 
-            enabled: Optional[StrictBool] = False
+            enabled: StrictBool | None = False
             limit: StrictInt = 100
-            since: Optional[StrictStr] = None
+            since: StrictStr | None = None
 
-            @validator("since")
-            def since_token_check(
-                cls, value: Optional[StrictStr]
-            ) -> Optional[StrictStr]:
+            @field_validator("since")
+            @classmethod
+            def since_token_check(cls, value: StrictStr | None) -> StrictStr | None:
                 # `since` comes in as an opaque string token but we know that it's just
                 # an integer representing the position in the device inbox stream. We
                 # want to pre-validate it to make sure it works fine in downstream code.
@@ -311,7 +319,7 @@ class SlidingSyncBody(RequestBodyModel):
                 enabled
             """
 
-            enabled: Optional[StrictBool] = False
+            enabled: StrictBool | None = False
 
         class AccountDataExtension(RequestBodyModel):
             """The Account Data extension (MSC3959)
@@ -324,11 +332,11 @@ class SlidingSyncBody(RequestBodyModel):
                     extension to.
             """
 
-            enabled: Optional[StrictBool] = False
+            enabled: StrictBool | None = False
             # Process all lists defined in the Sliding Window API. (This is the default.)
-            lists: Optional[List[StrictStr]] = ["*"]
+            lists: list[StrictStr] | None = ["*"]
             # Process all room subscriptions defined in the Room Subscription API. (This is the default.)
-            rooms: Optional[List[StrictStr]] = ["*"]
+            rooms: list[StrictStr] | None = ["*"]
 
         class ReceiptsExtension(RequestBodyModel):
             """The Receipts extension (MSC3960)
@@ -341,11 +349,11 @@ class SlidingSyncBody(RequestBodyModel):
                     extension to.
             """
 
-            enabled: Optional[StrictBool] = False
+            enabled: StrictBool | None = False
             # Process all lists defined in the Sliding Window API. (This is the default.)
-            lists: Optional[List[StrictStr]] = ["*"]
+            lists: list[StrictStr] | None = ["*"]
             # Process all room subscriptions defined in the Room Subscription API. (This is the default.)
-            rooms: Optional[List[StrictStr]] = ["*"]
+            rooms: list[StrictStr] | None = ["*"]
 
         class TypingExtension(RequestBodyModel):
             """The Typing Notification extension (MSC3961)
@@ -358,34 +366,48 @@ class SlidingSyncBody(RequestBodyModel):
                     extension to.
             """
 
-            enabled: Optional[StrictBool] = False
+            enabled: StrictBool | None = False
             # Process all lists defined in the Sliding Window API. (This is the default.)
-            lists: Optional[List[StrictStr]] = ["*"]
+            lists: list[StrictStr] | None = ["*"]
             # Process all room subscriptions defined in the Room Subscription API. (This is the default.)
-            rooms: Optional[List[StrictStr]] = ["*"]
+            rooms: list[StrictStr] | None = ["*"]
 
-        to_device: Optional[ToDeviceExtension] = None
-        e2ee: Optional[E2eeExtension] = None
-        account_data: Optional[AccountDataExtension] = None
-        receipts: Optional[ReceiptsExtension] = None
-        typing: Optional[TypingExtension] = None
+        class ThreadSubscriptionsExtension(RequestBodyModel):
+            """The Thread Subscriptions extension (MSC4308)
 
-    conn_id: Optional[StrictStr]
+            Attributes:
+                enabled
+                limit: maximum number of subscription changes to return (default 100)
+            """
 
-    # mypy workaround via https://github.com/pydantic/pydantic/issues/156#issuecomment-1130883884
-    if TYPE_CHECKING:
-        lists: Optional[Dict[str, SlidingSyncList]] = None
-    else:
-        lists: Optional[Dict[constr(max_length=64, strict=True), SlidingSyncList]] = (
-            None  # type: ignore[valid-type]
+            enabled: StrictBool | None = False
+            limit: StrictInt = 100
+
+        to_device: ToDeviceExtension | None = None
+        e2ee: E2eeExtension | None = None
+        account_data: AccountDataExtension | None = None
+        receipts: ReceiptsExtension | None = None
+        typing: TypingExtension | None = None
+        thread_subscriptions: ThreadSubscriptionsExtension | None = Field(
+            None, alias="io.element.msc4308.thread_subscriptions"
         )
-    room_subscriptions: Optional[Dict[StrictStr, RoomSubscription]] = None
-    extensions: Optional[Extensions] = None
 
-    @validator("lists")
+    conn_id: StrictStr | None = None
+    lists: (
+        dict[
+            Annotated[str, StringConstraints(max_length=64, strict=True)],
+            SlidingSyncList,
+        ]
+        | None
+    ) = None
+    room_subscriptions: dict[StrictStr, RoomSubscription] | None = None
+    extensions: Extensions | None = None
+
+    @field_validator("lists")
+    @classmethod
     def lists_length_check(
-        cls, value: Optional[Dict[str, SlidingSyncList]]
-    ) -> Optional[Dict[str, SlidingSyncList]]:
+        cls, value: dict[str, SlidingSyncList] | None
+    ) -> dict[str, SlidingSyncList] | None:
         if value is not None:
             assert len(value) <= 100, f"Max lists: 100 but saw {len(value)}"
         return value
diff --git a/synapse/types/state.py b/synapse/types/state.py
index 6420e050a5..ab619a7fb8 100644
--- a/synapse/types/state.py
+++ b/synapse/types/state.py
@@ -25,13 +25,8 @@ from typing import (
     Any,
     Callable,
     Collection,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
 )
 
@@ -42,7 +37,7 @@ from synapse.api.constants import EventTypes
 from synapse.types import MutableStateMap, StateKey, StateMap
 
 if TYPE_CHECKING:
-    from typing import FrozenSet  # noqa: used within quoted type hint; flake8 sad
+    pass  # noqa: used within quoted type hint; flake8 sad
 
 
 logger = logging.getLogger(__name__)
@@ -64,7 +59,7 @@ class StateFilter:
             appear in `types`.
     """
 
-    types: "immutabledict[str, Optional[FrozenSet[str]]]"
+    types: "immutabledict[str, frozenset[str] | None]"
     include_others: bool = False
 
     def __attrs_post_init__(self) -> None:
@@ -105,7 +100,7 @@ class StateFilter:
         return _NONE_STATE_FILTER
 
     @staticmethod
-    def from_types(types: Iterable[Tuple[str, Optional[str]]]) -> "StateFilter":
+    def from_types(types: Iterable[tuple[str, str | None]]) -> "StateFilter":
         """Creates a filter that only fetches the given types
 
         Args:
@@ -115,7 +110,7 @@ class StateFilter:
         Returns:
             The new state filter.
         """
-        type_dict: Dict[str, Optional[Set[str]]] = {}
+        type_dict: dict[str, set[str] | None] = {}
         for typ, s in types:
             if typ in type_dict:
                 if type_dict[typ] is None:
@@ -134,7 +129,7 @@ class StateFilter:
             )
         )
 
-    def to_types(self) -> Iterable[Tuple[str, Optional[str]]]:
+    def to_types(self) -> Iterable[tuple[str, str | None]]:
         """The inverse to `from_types`."""
         for event_type, state_keys in self.types.items():
             if state_keys is None:
@@ -161,13 +156,13 @@ class StateFilter:
 
     @staticmethod
     def freeze(
-        types: Mapping[str, Optional[Collection[str]]], include_others: bool
+        types: Mapping[str, Collection[str] | None], include_others: bool
     ) -> "StateFilter":
         """
         Returns a (frozen) StateFilter with the same contents as the parameters
         specified here, which can be made of mutable types.
         """
-        types_with_frozen_values: Dict[str, Optional[FrozenSet[str]]] = {}
+        types_with_frozen_values: dict[str, frozenset[str] | None] = {}
         for state_types, state_keys in types.items():
             if state_keys is not None:
                 types_with_frozen_values[state_types] = frozenset(state_keys)
@@ -240,7 +235,7 @@ class StateFilter:
             # We want to return all non-members
             return _ALL_NON_MEMBER_STATE_FILTER
 
-    def make_sql_filter_clause(self) -> Tuple[str, List[str]]:
+    def make_sql_filter_clause(self) -> tuple[str, list[str]]:
         """Converts the filter to an SQL clause.
 
         For example:
@@ -257,7 +252,7 @@ class StateFilter:
         """
 
         where_clause = ""
-        where_args: List[str] = []
+        where_args: list[str] = []
 
         if self.is_full():
             return where_clause, where_args
@@ -293,7 +288,7 @@ class StateFilter:
 
         return where_clause, where_args
 
-    def max_entries_returned(self) -> Optional[int]:
+    def max_entries_returned(self) -> int | None:
         """Returns the maximum number of entries this filter will return if
         known, otherwise returns None.
 
@@ -353,7 +348,7 @@ class StateFilter:
             state_keys is None for state_keys in self.types.values()
         )
 
-    def concrete_types(self) -> List[Tuple[str, str]]:
+    def concrete_types(self) -> list[tuple[str, str]]:
         """Returns a list of concrete type/state_keys (i.e. not None) that
         will be fetched. This will be a complete list if `has_wildcards`
         returns False, but otherwise will be a subset (or even empty).
@@ -368,7 +363,7 @@ class StateFilter:
             for s in state_keys
         ]
 
-    def wildcard_types(self) -> List[str]:
+    def wildcard_types(self) -> list[str]:
         """Returns a list of event types which require us to fetch all state keys.
         This will be empty unless `has_wildcards` returns True.
 
@@ -377,7 +372,7 @@ class StateFilter:
         """
         return [t for t, state_keys in self.types.items() if state_keys is None]
 
-    def get_member_split(self) -> Tuple["StateFilter", "StateFilter"]:
+    def get_member_split(self) -> tuple["StateFilter", "StateFilter"]:
         """Return the filter split into two: one which assumes it's exclusively
         matching against member state, and one which assumes it's matching
         against non member state.
@@ -416,7 +411,7 @@ class StateFilter:
 
     def _decompose_into_four_parts(
         self,
-    ) -> Tuple[Tuple[bool, Set[str]], Tuple[Set[str], Set[StateKey]]]:
+    ) -> tuple[tuple[bool, set[str]], tuple[set[str], set[StateKey]]]:
         """
         Decomposes this state filter into 4 constituent parts, which can be
         thought of as this:
@@ -432,18 +427,18 @@ class StateFilter:
         correspondence.
         """
         is_all = self.include_others
-        excluded_types: Set[str] = {t for t in self.types if is_all}
-        wildcard_types: Set[str] = {t for t, s in self.types.items() if s is None}
-        concrete_keys: Set[StateKey] = set(self.concrete_types())
+        excluded_types: set[str] = {t for t in self.types if is_all}
+        wildcard_types: set[str] = {t for t, s in self.types.items() if s is None}
+        concrete_keys: set[StateKey] = set(self.concrete_types())
 
         return (is_all, excluded_types), (wildcard_types, concrete_keys)
 
     @staticmethod
     def _recompose_from_four_parts(
         all_part: bool,
-        minus_wildcards: Set[str],
-        plus_wildcards: Set[str],
-        plus_state_keys: Set[StateKey],
+        minus_wildcards: set[str],
+        plus_wildcards: set[str],
+        plus_state_keys: set[StateKey],
     ) -> "StateFilter":
         """
         Recomposes a state filter from 4 parts.
@@ -454,7 +449,7 @@ class StateFilter:
 
         # {state type -> set of state keys OR None for wildcard}
         # (The same structure as that of a StateFilter.)
-        new_types: Dict[str, Optional[Set[str]]] = {}
+        new_types: dict[str, set[str] | None] = {}
 
         # if we start with all, insert the excluded statetypes as empty sets
         # to prevent them from being included
diff --git a/synapse/types/storage/__init__.py b/synapse/types/storage/__init__.py
index b01653246a..992c36caba 100644
--- a/synapse/types/storage/__init__.py
+++ b/synapse/types/storage/__init__.py
@@ -64,3 +64,5 @@ class _BackgroundUpdates:
     )
 
     FIXUP_MAX_DEPTH_CAP = "fixup_max_depth_cap"
+
+    REDACTIONS_RECHECK_BG_UPDATE = "redactions_recheck"
diff --git a/synapse/util/__init__.py b/synapse/util/__init__.py
index 36129c3a67..f2898de0b8 100644
--- a/synapse/util/__init__.py
+++ b/synapse/util/__init__.py
@@ -20,83 +20,28 @@
 #
 
 import collections.abc
-import json
 import logging
+import os
 import typing
 from typing import (
-    Any,
-    Callable,
-    Dict,
     Iterator,
     Mapping,
-    Optional,
     Sequence,
-    Set,
     TypeVar,
 )
 
 import attr
-from immutabledict import immutabledict
 from matrix_common.versionstring import get_distribution_version_string
-from typing_extensions import ParamSpec
 
-from twisted.internet import defer, task
-from twisted.internet.interfaces import IDelayedCall, IReactorTime
-from twisted.internet.task import LoopingCall
+from twisted.internet import defer
 from twisted.python.failure import Failure
 
-from synapse.logging import context
-
 if typing.TYPE_CHECKING:
     pass
 
 logger = logging.getLogger(__name__)
 
 
-class Duration:
-    """Helper class that holds constants for common time durations in
-    milliseconds."""
-
-    MINUTE_MS = 60 * 1000
-    HOUR_MS = 60 * MINUTE_MS
-    DAY_MS = 24 * HOUR_MS
-
-
-def _reject_invalid_json(val: Any) -> None:
-    """Do not allow Infinity, -Infinity, or NaN values in JSON."""
-    raise ValueError("Invalid JSON value: '%s'" % val)
-
-
-def _handle_immutabledict(obj: Any) -> Dict[Any, Any]:
-    """Helper for json_encoder. Makes immutabledicts serializable by returning
-    the underlying dict
-    """
-    if type(obj) is immutabledict:
-        # fishing the protected dict out of the object is a bit nasty,
-        # but we don't really want the overhead of copying the dict.
-        try:
-            # Safety: we catch the AttributeError immediately below.
-            return obj._dict
-        except AttributeError:
-            # If all else fails, resort to making a copy of the immutabledict
-            return dict(obj)
-    raise TypeError(
-        "Object of type %s is not JSON serializable" % obj.__class__.__name__
-    )
-
-
-# A custom JSON encoder which:
-#   * handles immutabledicts
-#   * produces valid JSON (no NaNs etc)
-#   * reduces redundant whitespace
-json_encoder = json.JSONEncoder(
-    allow_nan=False, separators=(",", ":"), default=_handle_immutabledict
-)
-
-# Create a custom decoder to reject Python extensions to JSON.
-json_decoder = json.JSONDecoder(parse_constant=_reject_invalid_json)
-
-
 def unwrapFirstError(failure: Failure) -> Failure:
     # Deprecated: you probably just want to catch defer.FirstError and reraise
     # the subFailure's value, which will do a better job of preserving stacktraces.
@@ -105,132 +50,9 @@ def unwrapFirstError(failure: Failure) -> Failure:
     return failure.value.subFailure
 
 
-P = ParamSpec("P")
-
-
-@attr.s(slots=True)
-class Clock:
-    """
-    A Clock wraps a Twisted reactor and provides utilities on top of it.
-
-    Args:
-        reactor: The Twisted reactor to use.
-    """
-
-    _reactor: IReactorTime = attr.ib()
-
-    async def sleep(self, seconds: float) -> None:
-        d: defer.Deferred[float] = defer.Deferred()
-        with context.PreserveLoggingContext():
-            self._reactor.callLater(seconds, d.callback, seconds)
-            await d
-
-    def time(self) -> float:
-        """Returns the current system time in seconds since epoch."""
-        return self._reactor.seconds()
-
-    def time_msec(self) -> int:
-        """Returns the current system time in milliseconds since epoch."""
-        return int(self.time() * 1000)
-
-    def looping_call(
-        self,
-        f: Callable[P, object],
-        msec: float,
-        *args: P.args,
-        **kwargs: P.kwargs,
-    ) -> LoopingCall:
-        """Call a function repeatedly.
-
-        Waits `msec` initially before calling `f` for the first time.
-
-        If the function given to `looping_call` returns an awaitable/deferred, the next
-        call isn't scheduled until after the returned awaitable has finished. We get
-        this functionality thanks to this function being a thin wrapper around
-        `twisted.internet.task.LoopingCall`.
-
-        Note that the function will be called with no logcontext, so if it is anything
-        other than trivial, you probably want to wrap it in run_as_background_process.
-
-        Args:
-            f: The function to call repeatedly.
-            msec: How long to wait between calls in milliseconds.
-            *args: Positional arguments to pass to function.
-            **kwargs: Key arguments to pass to function.
-        """
-        return self._looping_call_common(f, msec, False, *args, **kwargs)
-
-    def looping_call_now(
-        self,
-        f: Callable[P, object],
-        msec: float,
-        *args: P.args,
-        **kwargs: P.kwargs,
-    ) -> LoopingCall:
-        """Call a function immediately, and then repeatedly thereafter.
-
-        As with `looping_call`: subsequent calls are not scheduled until after the
-        the Awaitable returned by a previous call has finished.
-
-        Also as with `looping_call`: the function is called with no logcontext and
-        you probably want to wrap it in `run_as_background_process`.
-
-        Args:
-            f: The function to call repeatedly.
-            msec: How long to wait between calls in milliseconds.
-            *args: Positional arguments to pass to function.
-            **kwargs: Key arguments to pass to function.
-        """
-        return self._looping_call_common(f, msec, True, *args, **kwargs)
-
-    def _looping_call_common(
-        self,
-        f: Callable[P, object],
-        msec: float,
-        now: bool,
-        *args: P.args,
-        **kwargs: P.kwargs,
-    ) -> LoopingCall:
-        """Common functionality for `looping_call` and `looping_call_now`"""
-        call = task.LoopingCall(f, *args, **kwargs)
-        call.clock = self._reactor
-        d = call.start(msec / 1000.0, now=now)
-        d.addErrback(log_failure, "Looping call died", consumeErrors=False)
-        return call
-
-    def call_later(
-        self, delay: float, callback: Callable, *args: Any, **kwargs: Any
-    ) -> IDelayedCall:
-        """Call something later
-
-        Note that the function will be called with no logcontext, so if it is anything
-        other than trivial, you probably want to wrap it in run_as_background_process.
-
-        Args:
-            delay: How long to wait in seconds.
-            callback: Function to call
-            *args: Postional arguments to pass to function.
-            **kwargs: Key arguments to pass to function.
-        """
-
-        def wrapped_callback(*args: Any, **kwargs: Any) -> None:
-            with context.PreserveLoggingContext():
-                callback(*args, **kwargs)
-
-        with context.PreserveLoggingContext():
-            return self._reactor.callLater(delay, wrapped_callback, *args, **kwargs)
-
-    def cancel_call_later(self, timer: IDelayedCall, ignore_errs: bool = False) -> None:
-        try:
-            timer.cancel()
-        except Exception:
-            if not ignore_errs:
-                raise
-
-
 def log_failure(
     failure: Failure, msg: str, consumeErrors: bool = True
-) -> Optional[Failure]:
+) -> Failure | None:
     """Creates a function suitable for passing to `Deferred.addErrback` that
     logs any failures that occur.
 
@@ -253,9 +75,15 @@ def log_failure(
     return None
 
 
-# Version string with git info. Computed here once so that we don't invoke git multiple
-# times.
-SYNAPSE_VERSION = get_distribution_version_string("matrix-synapse", __file__)
+SYNAPSE_VERSION = os.getenv(
+    "SYNAPSE_VERSION_STRING"
+) or get_distribution_version_string("matrix-synapse", __file__)
+"""
+Version string with git info.
+
+This can be overridden via the `SYNAPSE_VERSION_STRING` environment variable or is
+computed here once so that we don't invoke git multiple times.
+"""
 
 
 class ExceptionBundle(Exception):
@@ -286,8 +114,8 @@ class MutableOverlayMapping(collections.abc.MutableMapping[K, V]):
     """
 
     _underlying_map: Mapping[K, V]
-    _mutable_map: Dict[K, V] = attr.ib(factory=dict)
-    _deletions: Set[K] = attr.ib(factory=set)
+    _mutable_map: dict[K, V] = attr.ib(factory=dict)
+    _deletions: set[K] = attr.ib(factory=set)
 
     def __getitem__(self, key: K) -> V:
         if key in self._deletions:
diff --git a/synapse/util/async_helpers.py b/synapse/util/async_helpers.py
index e596e1ed20..1c3cd48a9c 100644
--- a/synapse/util/async_helpers.py
+++ b/synapse/util/async_helpers.py
@@ -25,7 +25,7 @@ import collections
 import inspect
 import itertools
 import logging
-import typing
+from collections import OrderedDict
 from contextlib import asynccontextmanager
 from typing import (
     Any,
@@ -35,19 +35,12 @@ from typing import (
     Callable,
     Collection,
     Coroutine,
-    Dict,
     Generator,
     Generic,
     Hashable,
     Iterable,
-    List,
     Literal,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
-    cast,
     overload,
 )
 
@@ -56,7 +49,6 @@ from typing_extensions import Concatenate, ParamSpec, Unpack
 
 from twisted.internet import defer
 from twisted.internet.defer import CancelledError
-from twisted.internet.interfaces import IReactorTime
 from twisted.python.failure import Failure
 
 from synapse.logging.context import (
@@ -65,7 +57,9 @@ from synapse.logging.context import (
     run_coroutine_in_background,
     run_in_background,
 )
-from synapse.util import Clock
+from synapse.util.cancellation import cancellable
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 logger = logging.getLogger(__name__)
 
@@ -90,6 +84,13 @@ class AbstractObservableDeferred(Generic[_T], metaclass=abc.ABCMeta):
         """
         ...
 
+    @abc.abstractmethod
+    def has_observers(self) -> bool:
+        """Returns True if there are any observers currently observing this
+        ObservableDeferred.
+        """
+        ...
+
 
 class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
     """Wraps a deferred object so that we can add observer deferreds. These
@@ -110,8 +111,8 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
     __slots__ = ["_deferred", "_observers", "_result"]
 
     _deferred: "defer.Deferred[_T]"
-    _observers: Union[List["defer.Deferred[_T]"], Tuple[()]]
-    _result: Union[None, Tuple[Literal[True], _T], Tuple[Literal[False], Failure]]
+    _observers: list["defer.Deferred[_T]"] | tuple[()]
+    _result: None | tuple[Literal[True], _T] | tuple[Literal[False], Failure]
 
     def __init__(self, deferred: "defer.Deferred[_T]", consumeErrors: bool = False):
         object.__setattr__(self, "_deferred", deferred)
@@ -129,6 +130,11 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
             for observer in observers:
                 try:
                     observer.callback(r)
+                except defer.CancelledError:
+                    # We do not want to propagate cancellations to the original
+                    # deferred, or to other observers, so we can just ignore
+                    # this.
+                    pass
                 except Exception as e:
                     logger.exception(
                         "%r threw an exception on .callback(%r), ignoring...",
@@ -138,7 +144,7 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
                     )
             return r
 
-        def errback(f: Failure) -> Optional[Failure]:
+        def errback(f: Failure) -> Failure | None:
             object.__setattr__(self, "_result", (False, f))
 
             # once we have set _result, no more entries will be added to _observers,
@@ -152,6 +158,11 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
                 f.value.__failure__ = f
                 try:
                     observer.errback(f)
+                except defer.CancelledError:
+                    # We do not want to propagate cancellations to the original
+                    # deferred, or to other observers, so we can just ignore
+                    # this.
+                    pass
                 except Exception as e:
                     logger.exception(
                         "%r threw an exception on .errback(%r), ignoring...",
@@ -167,6 +178,7 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
 
         deferred.addCallbacks(callback, errback)
 
+    @cancellable
     def observe(self) -> "defer.Deferred[_T]":
         """Observe the underlying deferred.
 
@@ -176,7 +188,7 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
         """
         if not self._result:
             assert isinstance(self._observers, list)
-            d: "defer.Deferred[_T]" = defer.Deferred()
+            d: "defer.Deferred[_T]" = defer.Deferred(canceller=self._remove_observer)
             self._observers.append(d)
             return d
         elif self._result[0]:
@@ -187,13 +199,19 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
     def observers(self) -> "Collection[defer.Deferred[_T]]":
         return self._observers
 
+    def has_observers(self) -> bool:
+        """Returns True if there are any observers currently observing this
+        ObservableDeferred.
+        """
+        return bool(self._observers)
+
     def has_called(self) -> bool:
         return self._result is not None
 
     def has_succeeded(self) -> bool:
         return self._result is not None and self._result[0] is True
 
-    def get_result(self) -> Union[_T, Failure]:
+    def get_result(self) -> _T | Failure:
         if self._result is None:
             raise ValueError(f"{self!r} has no result yet")
         return self._result[1]
@@ -211,6 +229,28 @@ class ObservableDeferred(Generic[_T], AbstractObservableDeferred[_T]):
             self._deferred,
         )
 
+    def _remove_observer(self, observer: "defer.Deferred[_T]") -> None:
+        """Removes an observer from the list of observers.
+
+        Used as a canceller for the observer deferreds, so that if an observer
+        is cancelled it is removed from the list of observers.
+        """
+        if self._result is not None:
+            # The underlying deferred has already resolved, so the observer has
+            # already been resolved. Nothing to do.
+            return
+
+        assert isinstance(self._observers, list)
+        try:
+            self._observers.remove(observer)
+        except ValueError:
+            # The observer was not in the list. This can happen if the underlying
+            # deferred resolves at around the same time as we try to remove the
+            # observer. In this case, it's possible that we tried to remove the
+            # observer just after it was added to the list, but before it was
+            # resolved and removed from the list by the callback/errback above.
+            pass
+
 
 T = TypeVar("T")
 
@@ -270,7 +310,7 @@ async def yieldable_gather_results(
     iter: Iterable[T],
     *args: P.args,
     **kwargs: P.kwargs,
-) -> List[R]:
+) -> list[R]:
     """Executes the function with each argument concurrently.
 
     Args:
@@ -312,7 +352,7 @@ async def yieldable_gather_results_delaying_cancellation(
     iter: Iterable[T],
     *args: P.args,
     **kwargs: P.kwargs,
-) -> List[R]:
+) -> list[R]:
     """Executes the function with each argument concurrently.
     Cancellation is delayed until after all the results have been gathered.
 
@@ -347,53 +387,54 @@ T2 = TypeVar("T2")
 T3 = TypeVar("T3")
 T4 = TypeVar("T4")
 T5 = TypeVar("T5")
+T6 = TypeVar("T6")
 
 
 @overload
 def gather_results(
-    deferredList: Tuple[()], consumeErrors: bool = ...
-) -> "defer.Deferred[Tuple[()]]": ...
+    deferredList: tuple[()], consumeErrors: bool = ...
+) -> "defer.Deferred[tuple[()]]": ...
 
 
 @overload
 def gather_results(
-    deferredList: Tuple["defer.Deferred[T1]"],
+    deferredList: tuple["defer.Deferred[T1]"],
     consumeErrors: bool = ...,
-) -> "defer.Deferred[Tuple[T1]]": ...
+) -> "defer.Deferred[tuple[T1]]": ...
 
 
 @overload
 def gather_results(
-    deferredList: Tuple["defer.Deferred[T1]", "defer.Deferred[T2]"],
+    deferredList: tuple["defer.Deferred[T1]", "defer.Deferred[T2]"],
     consumeErrors: bool = ...,
-) -> "defer.Deferred[Tuple[T1, T2]]": ...
+) -> "defer.Deferred[tuple[T1, T2]]": ...
 
 
 @overload
 def gather_results(
-    deferredList: Tuple[
+    deferredList: tuple[
         "defer.Deferred[T1]", "defer.Deferred[T2]", "defer.Deferred[T3]"
     ],
     consumeErrors: bool = ...,
-) -> "defer.Deferred[Tuple[T1, T2, T3]]": ...
+) -> "defer.Deferred[tuple[T1, T2, T3]]": ...
 
 
 @overload
 def gather_results(
-    deferredList: Tuple[
+    deferredList: tuple[
         "defer.Deferred[T1]",
         "defer.Deferred[T2]",
         "defer.Deferred[T3]",
         "defer.Deferred[T4]",
     ],
     consumeErrors: bool = ...,
-) -> "defer.Deferred[Tuple[T1, T2, T3, T4]]": ...
+) -> "defer.Deferred[tuple[T1, T2, T3, T4]]": ...
 
 
 def gather_results(  # type: ignore[misc]
-    deferredList: Tuple["defer.Deferred[T1]", ...],
+    deferredList: tuple["defer.Deferred[T1]", ...],
     consumeErrors: bool = False,
-) -> "defer.Deferred[Tuple[T1, ...]]":
+) -> "defer.Deferred[tuple[T1, ...]]":
     """Combines a tuple of `Deferred`s into a single `Deferred`.
 
     Wraps `defer.gatherResults` to provide type annotations that support heterogenous
@@ -407,63 +448,78 @@ def gather_results(  # type: ignore[misc]
 
 @overload
 async def gather_optional_coroutines(
-    *coroutines: Unpack[Tuple[Optional[Coroutine[Any, Any, T1]]]],
-) -> Tuple[Optional[T1]]: ...
+    *coroutines: Unpack[tuple[Coroutine[Any, Any, T1] | None]],
+) -> tuple[T1 | None]: ...
 
 
 @overload
 async def gather_optional_coroutines(
     *coroutines: Unpack[
-        Tuple[
-            Optional[Coroutine[Any, Any, T1]],
-            Optional[Coroutine[Any, Any, T2]],
+        tuple[
+            Coroutine[Any, Any, T1] | None,
+            Coroutine[Any, Any, T2] | None,
         ]
     ],
-) -> Tuple[Optional[T1], Optional[T2]]: ...
+) -> tuple[T1 | None, T2 | None]: ...
 
 
 @overload
 async def gather_optional_coroutines(
     *coroutines: Unpack[
-        Tuple[
-            Optional[Coroutine[Any, Any, T1]],
-            Optional[Coroutine[Any, Any, T2]],
-            Optional[Coroutine[Any, Any, T3]],
+        tuple[
+            Coroutine[Any, Any, T1] | None,
+            Coroutine[Any, Any, T2] | None,
+            Coroutine[Any, Any, T3] | None,
         ]
     ],
-) -> Tuple[Optional[T1], Optional[T2], Optional[T3]]: ...
+) -> tuple[T1 | None, T2 | None, T3 | None]: ...
 
 
 @overload
 async def gather_optional_coroutines(
     *coroutines: Unpack[
-        Tuple[
-            Optional[Coroutine[Any, Any, T1]],
-            Optional[Coroutine[Any, Any, T2]],
-            Optional[Coroutine[Any, Any, T3]],
-            Optional[Coroutine[Any, Any, T4]],
+        tuple[
+            Coroutine[Any, Any, T1] | None,
+            Coroutine[Any, Any, T2] | None,
+            Coroutine[Any, Any, T3] | None,
+            Coroutine[Any, Any, T4] | None,
         ]
     ],
-) -> Tuple[Optional[T1], Optional[T2], Optional[T3], Optional[T4]]: ...
+) -> tuple[T1 | None, T2 | None, T3 | None, T4 | None]: ...
 
 
 @overload
 async def gather_optional_coroutines(
     *coroutines: Unpack[
-        Tuple[
-            Optional[Coroutine[Any, Any, T1]],
-            Optional[Coroutine[Any, Any, T2]],
-            Optional[Coroutine[Any, Any, T3]],
-            Optional[Coroutine[Any, Any, T4]],
-            Optional[Coroutine[Any, Any, T5]],
+        tuple[
+            Coroutine[Any, Any, T1] | None,
+            Coroutine[Any, Any, T2] | None,
+            Coroutine[Any, Any, T3] | None,
+            Coroutine[Any, Any, T4] | None,
+            Coroutine[Any, Any, T5] | None,
         ]
     ],
-) -> Tuple[Optional[T1], Optional[T2], Optional[T3], Optional[T4], Optional[T5]]: ...
+) -> tuple[T1 | None, T2 | None, T3 | None, T4 | None, T5 | None]: ...
+
+
+@overload
+async def gather_optional_coroutines(
+    *coroutines: Unpack[
+        tuple[
+            Coroutine[Any, Any, T1] | None,
+            Coroutine[Any, Any, T2] | None,
+            Coroutine[Any, Any, T3] | None,
+            Coroutine[Any, Any, T4] | None,
+            Coroutine[Any, Any, T5] | None,
+            Coroutine[Any, Any, T6] | None,
+        ]
+    ],
+) -> tuple[T1 | None, T2 | None, T3 | None, T4 | None, T5 | None, T6 | None]: ...
 
 
 async def gather_optional_coroutines(
-    *coroutines: Unpack[Tuple[Optional[Coroutine[Any, Any, T1]], ...]],
-) -> Tuple[Optional[T1], ...]:
+    *coroutines: Unpack[tuple[Coroutine[Any, Any, T1] | None, ...]],
+) -> tuple[T1 | None, ...]:
     """Helper function that allows waiting on multiple coroutines at once.
 
     The return value is a tuple of the return values of the coroutines in order.
@@ -516,7 +572,7 @@ class _LinearizerEntry:
     # The number of things executing.
     count: int
     # Deferreds for the things blocked from executing.
-    deferreds: typing.OrderedDict["defer.Deferred[None]", Literal[1]]
+    deferreds: OrderedDict["defer.Deferred[None]", Literal[1]]
 
 
 class Linearizer:
@@ -532,28 +588,22 @@ class Linearizer:
 
     def __init__(
         self,
-        name: Optional[str] = None,
+        name: str,
+        clock: Clock,
         max_count: int = 1,
-        clock: Optional[Clock] = None,
     ):
         """
         Args:
+            name: TODO
             max_count: The maximum number of concurrent accesses
+            clock: (ideally, the homeserver clock `hs.get_clock()`)
         """
-        if name is None:
-            self.name: Union[str, int] = id(self)
-        else:
-            self.name = name
-
-        if not clock:
-            from twisted.internet import reactor
-
-            clock = Clock(cast(IReactorTime, reactor))
-        self._clock = clock
+        self.name = name
         self.max_count = max_count
+        self._clock = clock
 
         # key_to_defer is a map from the key to a _LinearizerEntry.
-        self.key_to_defer: Dict[Hashable, _LinearizerEntry] = {}
+        self.key_to_defer: dict[Hashable, _LinearizerEntry] = {}
 
     def is_queued(self, key: Hashable) -> bool:
         """Checks whether there is a process queued up waiting"""
@@ -638,7 +688,7 @@ class Linearizer:
         # This needs to happen while we hold the lock. We could put it on the
         # exit path, but that would slow down the uncontended case.
         try:
-            await self._clock.sleep(0)
+            await self._clock.sleep(Duration(seconds=0))
         except CancelledError:
             self._release_lock(key, entry)
             raise
@@ -688,10 +738,10 @@ class ReadWriteLock:
 
     def __init__(self) -> None:
         # Latest readers queued
-        self.key_to_current_readers: Dict[str, Set[defer.Deferred]] = {}
+        self.key_to_current_readers: dict[str, set[defer.Deferred]] = {}
 
         # Latest writer queued
-        self.key_to_current_writer: Dict[str, defer.Deferred] = {}
+        self.key_to_current_writer: dict[str, defer.Deferred] = {}
 
     def read(self, key: str) -> AsyncContextManager:
         @asynccontextmanager
@@ -760,7 +810,11 @@ class ReadWriteLock:
 
 
 def timeout_deferred(
-    deferred: "defer.Deferred[_T]", timeout: float, reactor: IReactorTime
+    *,
+    deferred: "defer.Deferred[_T]",
+    timeout: float,
+    cancel_on_shutdown: bool = True,
+    clock: Clock,
 ) -> "defer.Deferred[_T]":
     """The in built twisted `Deferred.addTimeout` fails to time out deferreds
     that have a canceller that throws exceptions. This method creates a new
@@ -778,7 +832,13 @@ def timeout_deferred(
     Args:
         deferred: The Deferred to potentially timeout.
         timeout: Timeout in seconds
-        reactor: The twisted reactor to use
+        cancel_on_shutdown: Whether this call should be tracked for cleanup during
+            shutdown. In general, all calls should be tracked. There may be a use case
+            not to track calls with a `timeout` of 0 (or similarly short) since tracking
+            them may result in rapid insertions and removals of tracked calls
+            unnecessarily. But unless a specific instance of tracking proves to be an
+            issue, we can just track all delayed calls.
+        clock: The `Clock` instance used to track delayed calls.
 
 
     Returns:
@@ -792,7 +852,8 @@ def timeout_deferred(
         timed_out[0] = True
 
         try:
-            deferred.cancel()
+            with PreserveLoggingContext():
+                deferred.cancel()
         except Exception:  # if we throw any exception it'll break time outs
             logger.exception("Canceller failed during timeout")
 
@@ -800,9 +861,15 @@ def timeout_deferred(
         # will have errbacked new_d, but in case it hasn't, errback it now.
 
         if not new_d.called:
-            new_d.errback(defer.TimeoutError("Timed out after %gs" % (timeout,)))
+            with PreserveLoggingContext():
+                new_d.errback(defer.TimeoutError("Timed out after %gs" % (timeout,)))
 
-    delayed_call = reactor.callLater(timeout, time_it_out)
+    # We don't track these calls since they are short.
+    delayed_call = clock.call_later(
+        Duration(seconds=timeout),
+        time_it_out,
+        call_later_cancel_on_shutdown=cancel_on_shutdown,
+    )
 
     def convert_cancelled(value: Failure) -> Failure:
         # if the original deferred was cancelled, and our timeout has fired, then
@@ -824,11 +891,13 @@ def timeout_deferred(
 
     def success_cb(val: _T) -> None:
         if not new_d.called:
-            new_d.callback(val)
+            with PreserveLoggingContext():
+                new_d.callback(val)
 
     def failure_cb(val: Failure) -> None:
         if not new_d.called:
-            new_d.errback(val)
+            with PreserveLoggingContext():
+                new_d.errback(val)
 
     deferred.addCallbacks(success_cb, failure_cb)
 
@@ -846,7 +915,7 @@ class DoneAwaitable(Awaitable[R]):
         return self.value
 
 
-def maybe_awaitable(value: Union[Awaitable[R], R]) -> Awaitable[R]:
+def maybe_awaitable(value: Awaitable[R] | R) -> Awaitable[R]:
     """Convert a value to an awaitable if not already an awaitable."""
     if inspect.isawaitable(value):
         return value
@@ -930,7 +999,8 @@ def delay_cancellation(awaitable: Awaitable[T]) -> Awaitable[T]:
         # propagating. we then `unpause` it once the wrapped deferred completes, to
         # propagate the exception.
         new_deferred.pause()
-        new_deferred.errback(Failure(CancelledError()))
+        with PreserveLoggingContext():
+            new_deferred.errback(Failure(CancelledError()))
 
         deferred.addBoth(lambda _: new_deferred.unpause())
 
@@ -939,14 +1009,35 @@ def delay_cancellation(awaitable: Awaitable[T]) -> Awaitable[T]:
     return new_deferred
 
 
+def observe_deferred(d: "defer.Deferred[T]") -> "defer.Deferred[T]":
+    """Returns a new `Deferred` that observes the given `Deferred`.
+
+    The returned `Deferred` will resolve with the same result as the given
+    `Deferred`, but will not "chain" on the deferred so that using the returned
+    deferred does not affect the given `Deferred` in any way.
+    """
+    new_deferred: "defer.Deferred[T]" = defer.Deferred()
+
+    def callback(r: T) -> T:
+        new_deferred.callback(r)
+        return r
+
+    def errback(f: Failure) -> Failure:
+        new_deferred.errback(f)
+        return f
+
+    d.addCallbacks(callback, errback)
+    return new_deferred
+
+
 class AwakenableSleeper:
     """Allows explicitly waking up deferreds related to an entity that are
     currently sleeping.
     """
 
-    def __init__(self, reactor: IReactorTime) -> None:
-        self._streams: Dict[str, Set[defer.Deferred[None]]] = {}
-        self._reactor = reactor
+    def __init__(self, clock: Clock) -> None:
+        self._streams: dict[str, set[defer.Deferred[None]]] = {}
+        self._clock = clock
 
     def wake(self, name: str) -> None:
         """Wake everything related to `name` that is currently sleeping."""
@@ -962,11 +1053,6 @@ class AwakenableSleeper:
         """Sleep for the given number of milliseconds, or return if the given
         `name` is explicitly woken up.
         """
-
-        # Create a deferred that gets called in N seconds
-        sleep_deferred: "defer.Deferred[None]" = defer.Deferred()
-        call = self._reactor.callLater(delay_ms / 1000, sleep_deferred.callback, None)
-
         # Create a deferred that will get called if `wake` is called with
         # the same `name`.
         stream_set = self._streams.setdefault(name, set())
@@ -976,13 +1062,14 @@ class AwakenableSleeper:
         try:
             # Wait for either the delay or for `wake` to be called.
             await make_deferred_yieldable(
-                defer.DeferredList(
-                    [sleep_deferred, notify_deferred],
-                    fireOnOneCallback=True,
-                    fireOnOneErrback=True,
-                    consumeErrors=True,
+                timeout_deferred(
+                    deferred=stop_cancellation(notify_deferred),
+                    timeout=delay_ms / 1000,
+                    clock=self._clock,
                 )
             )
+        except defer.TimeoutError:
+            pass
         finally:
             # Clean up the state
             curr_stream_set = self._streams.get(name)
@@ -991,21 +1078,18 @@ class AwakenableSleeper:
                 if len(curr_stream_set) == 0:
                     self._streams.pop(name)
 
-            # Cancel the sleep if we were woken up
-            if call.active():
-                call.cancel()
-
 
 class DeferredEvent:
     """Like threading.Event but for async code"""
 
-    def __init__(self, reactor: IReactorTime) -> None:
-        self._reactor = reactor
+    def __init__(self, clock: Clock) -> None:
+        self._clock = clock
         self._deferred: "defer.Deferred[None]" = defer.Deferred()
 
     def set(self) -> None:
         if not self._deferred.called:
-            self._deferred.callback(None)
+            with PreserveLoggingContext():
+                self._deferred.callback(None)
 
     def clear(self) -> None:
         if self._deferred.called:
@@ -1018,22 +1102,15 @@ class DeferredEvent:
         if self.is_set():
             return True
 
-        # Create a deferred that gets called in N seconds
-        sleep_deferred: "defer.Deferred[None]" = defer.Deferred()
-        call = self._reactor.callLater(timeout_seconds, sleep_deferred.callback, None)
-
         try:
             await make_deferred_yieldable(
-                defer.DeferredList(
-                    [sleep_deferred, self._deferred],
-                    fireOnOneCallback=True,
-                    fireOnOneErrback=True,
-                    consumeErrors=True,
+                timeout_deferred(
+                    deferred=stop_cancellation(self._deferred),
+                    timeout=timeout_seconds,
+                    clock=self._clock,
                 )
             )
-        finally:
-            # Cancel the sleep if we were woken up
-            if call.active():
-                call.cancel()
+        except defer.TimeoutError:
+            pass
 
         return self.is_set()
diff --git a/synapse/util/background_queue.py b/synapse/util/background_queue.py
new file mode 100644
index 0000000000..a86b0d0730
--- /dev/null
+++ b/synapse/util/background_queue.py
@@ -0,0 +1,155 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 Element Creations Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+#
+#
+
+import collections
+import logging
+from typing import (
+    TYPE_CHECKING,
+    Awaitable,
+    Callable,
+    Generic,
+    TypeVar,
+)
+
+from twisted.internet import defer
+
+from synapse.util.async_helpers import DeferredEvent
+from synapse.util.duration import Duration
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
+
+logger = logging.getLogger(__name__)
+
+T = TypeVar("T")
+
+
+# Number of iterations in a loop before we yield to the reactor to allow other
+# things to be processed, otherwise we can end up tight looping.
+ITERATIONS_BEFORE_YIELDING = 500
+
+
+class BackgroundQueue(Generic[T]):
+    """A single-producer single-consumer async queue processing items in the
+    background.
+
+    This is optimised for the case where we receive many items, but processing
+    each one takes a short amount of time. In this case we don't want to pay the
+    overhead of a new background process each time. Instead, we spawn a
+    background process that will wait for new items to arrive.
+
+    If the background process has been idle for a while, it will exit, and a new
+    background process will be spawned when new items arrive.
+
+    Args:
+        hs: The homeserver.
+        name: The name of the background process.
+        callback: The async callback to process each item.
+        timeout_ms: The time in milliseconds to wait for new items before
+            exiting the background process.
+    """
+
+    def __init__(
+        self,
+        hs: "HomeServer",
+        name: str,
+        callback: Callable[[T], Awaitable[None]],
+        timeout_ms: int = 1000,
+    ) -> None:
+        self._hs = hs
+        self._clock = hs.get_clock()
+        self._name = name
+        self._callback = callback
+        self._timeout_ms = Duration(milliseconds=timeout_ms)
+
+        # The queue of items to process.
+        self._queue: collections.deque[T] = collections.deque()
+
+        # Indicates if a background process is running, and if so whether there
+        # is new data in the queue. Used to signal to an existing background
+        # process that there is new data added to the queue.
+        self._wakeup_event: DeferredEvent | None = None
+
+    def add(self, item: T) -> None:
+        """Add an item into the queue."""
+
+        self._queue.append(item)
+        if self._wakeup_event is None:
+            self._hs.run_as_background_process(self._name, self._process_queue)
+        else:
+            self._wakeup_event.set()
+
+    async def _process_queue(self) -> None:
+        """Process items in the queue until it is empty."""
+
+        # Make sure we're the only background process.
+        if self._wakeup_event is not None:
+            # If there is already a background process then we signal it to wake
+            # up and exit. We do not want multiple background processes running
+            # at a time.
+            self._wakeup_event.set()
+            return
+
+        self._wakeup_event = DeferredEvent(self._hs.get_clock())
+
+        try:
+            while True:
+                # Clear the event before checking the queue. If we cleared after
+                # we run the risk of the wakeup signal racing with us checking
+                # the queue. (This can't really happen in Python due to the
+                # single threaded nature, but let's be a bit defensive anyway.)
+                self._wakeup_event.clear()
+
+                iterations = 0
+                while self._queue:
+                    iterations += 1
+                    if iterations % ITERATIONS_BEFORE_YIELDING == 0:
+                        # Yield to the reactor to allow other things to be processed,
+                        # otherwise we can end up tight looping.
+                        await self._clock.sleep(Duration(seconds=0))
+
+                    item = self._queue.popleft()
+                    try:
+                        await self._callback(item)
+                    except defer.CancelledError:
+                        raise
+                    except Exception:
+                        logger.exception("Error processing background queue item")
+
+                # Wait for new data to arrive, timing out after a while to avoid
+                # keeping the background process alive forever.
+                #
+                # New data may have arrived and been processed while we were
+                # pulling from the queue, so this may return that there is new
+                # data immediately even though there isn't. That's fine, we'll
+                # just loop round, clear the event, recheck the queue, and then
+                # wait here again.
+                new_data = await self._wakeup_event.wait(
+                    timeout_seconds=self._timeout_ms.as_secs()
+                )
+                if not new_data:
+                    # Timed out waiting for new data, so exit the loop
+                    break
+        finally:
+            # This background process is exiting, so clear the wakeup event to
+            # indicate that a new one should be started when new data arrives.
+            self._wakeup_event = None
+
+            # The queue must be empty here.
+            assert not self._queue
+
+    def __len__(self) -> int:
+        return len(self._queue)
diff --git a/synapse/util/batching_queue.py b/synapse/util/batching_queue.py
index 4c0f129423..43eefcb7f1 100644
--- a/synapse/util/batching_queue.py
+++ b/synapse/util/batching_queue.py
@@ -21,14 +21,11 @@
 
 import logging
 from typing import (
+    TYPE_CHECKING,
     Awaitable,
     Callable,
-    Dict,
     Generic,
     Hashable,
-    List,
-    Set,
-    Tuple,
     TypeVar,
 )
 
@@ -38,8 +35,11 @@ from twisted.internet import defer
 
 from synapse.logging.context import PreserveLoggingContext, make_deferred_yieldable
 from synapse.metrics import SERVER_NAME_LABEL
-from synapse.metrics.background_process_metrics import run_as_background_process
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
 
 logger = logging.getLogger(__name__)
 
@@ -97,20 +97,21 @@ class BatchingQueue(Generic[V, R]):
         self,
         *,
         name: str,
-        server_name: str,
+        hs: "HomeServer",
         clock: Clock,
-        process_batch_callback: Callable[[List[V]], Awaitable[R]],
+        process_batch_callback: Callable[[list[V]], Awaitable[R]],
     ):
         self._name = name
-        self.server_name = server_name
+        self.hs = hs
+        self.server_name = hs.hostname
         self._clock = clock
 
         # The set of keys currently being processed.
-        self._processing_keys: Set[Hashable] = set()
+        self._processing_keys: set[Hashable] = set()
 
         # The currently pending batch of values by key, with a Deferred to call
         # with the result of the corresponding `_process_batch_callback` call.
-        self._next_values: Dict[Hashable, List[Tuple[V, defer.Deferred]]] = {}
+        self._next_values: dict[Hashable, list[tuple[V, defer.Deferred]]] = {}
 
         # The function to call with batches of values.
         self._process_batch_callback = process_batch_callback
@@ -127,6 +128,14 @@ class BatchingQueue(Generic[V, R]):
             name=self._name, **{SERVER_NAME_LABEL: self.server_name}
         )
 
+    def shutdown(self) -> None:
+        """
+        Prepares the object for garbage collection by removing any handed out
+        references.
+        """
+        number_queued.remove(self._name, self.server_name)
+        number_of_keys.remove(self._name, self.server_name)
+
     async def add_to_queue(self, value: V, key: Hashable = ()) -> R:
         """Adds the value to the queue with the given key, returning the result
         of the processing function for the batch that included the given value.
@@ -145,9 +154,7 @@ class BatchingQueue(Generic[V, R]):
         # If we're not currently processing the key fire off a background
         # process to start processing.
         if key not in self._processing_keys:
-            run_as_background_process(
-                self._name, self.server_name, self._process_queue, key
-            )
+            self.hs.run_as_background_process(self._name, self._process_queue, key)
 
         with self._number_in_flight_metric.track_inprogress():
             return await make_deferred_yieldable(d)
@@ -169,7 +176,7 @@ class BatchingQueue(Generic[V, R]):
                 # pattern is to call `add_to_queue` multiple times at once, and
                 # deferring to the next reactor tick allows us to batch all of
                 # those up.
-                await self._clock.sleep(0)
+                await self._clock.sleep(Duration(seconds=0))
 
                 next_values = self._next_values.pop(key, [])
                 if not next_values:
diff --git a/synapse/util/caches/__init__.py b/synapse/util/caches/__init__.py
index 710a29e3f0..bd52c0c0ed 100644
--- a/synapse/util/caches/__init__.py
+++ b/synapse/util/caches/__init__.py
@@ -21,10 +21,10 @@
 #
 import collections
 import logging
-import typing
+from collections import Counter
 from enum import Enum, auto
 from sys import intern
-from typing import Any, Callable, Dict, List, Optional, Sized, TypeVar
+from typing import Any, Callable, Sized, TypeVar
 
 import attr
 from prometheus_client import REGISTRY
@@ -129,15 +129,15 @@ class CacheMetric:
     _cache: Sized
     _cache_type: str
     _cache_name: str
-    _collect_callback: Optional[Callable]
+    _collect_callback: Callable | None
     _server_name: str
 
     hits: int = 0
     misses: int = 0
-    eviction_size_by_reason: typing.Counter[EvictionReason] = attr.ib(
+    eviction_size_by_reason: Counter[EvictionReason] = attr.ib(
         factory=collections.Counter
     )
-    memory_usage: Optional[int] = None
+    memory_usage: int | None = None
 
     def inc_hits(self) -> None:
         self.hits += 1
@@ -162,7 +162,7 @@ class CacheMetric:
         if self.memory_usage is not None:
             self.memory_usage = 0
 
-    def describe(self) -> List[str]:
+    def describe(self) -> list[str]:
         return []
 
     def collect(self) -> None:
@@ -208,9 +208,9 @@ def register_cache(
     cache_name: str,
     cache: Sized,
     server_name: str,
-    collect_callback: Optional[Callable] = None,
+    collect_callback: Callable | None = None,
     resizable: bool = True,
-    resize_callback: Optional[Callable] = None,
+    resize_callback: Callable | None = None,
 ) -> CacheMetric:
     """Register a cache object for metric collection and resizing.
 
@@ -244,7 +244,7 @@ def register_cache(
         collect_callback=collect_callback,
     )
     metric_name = "cache_%s_%s_%s" % (cache_type, cache_name, server_name)
-    CACHE_METRIC_REGISTRY.register_hook(metric_name, metric.collect)
+    CACHE_METRIC_REGISTRY.register_hook(server_name, metric_name, metric.collect)
     return metric
 
 
@@ -269,7 +269,7 @@ KNOWN_KEYS = {
     )
 }
 
-T = TypeVar("T", Optional[str], str)
+T = TypeVar("T", str | None, str)
 
 
 def intern_string(string: T) -> T:
@@ -283,7 +283,7 @@ def intern_string(string: T) -> T:
         return string
 
 
-def intern_dict(dictionary: Dict[str, Any]) -> Dict[str, Any]:
+def intern_dict(dictionary: dict[str, Any]) -> dict[str, Any]:
     """Takes a dictionary and interns well known keys and their values"""
     return {
         KNOWN_KEYS.get(key, key): _intern_known_values(key, value)
diff --git a/synapse/util/caches/cached_call.py b/synapse/util/caches/cached_call.py
index 9b86017cd9..491e7e52a1 100644
--- a/synapse/util/caches/cached_call.py
+++ b/synapse/util/caches/cached_call.py
@@ -19,7 +19,7 @@
 #
 #
 import enum
-from typing import Awaitable, Callable, Generic, Optional, TypeVar, Union
+from typing import Awaitable, Callable, Generic, TypeVar
 
 from twisted.internet.defer import Deferred
 from twisted.python.failure import Failure
@@ -74,9 +74,9 @@ class CachedCall(Generic[TV]):
             f: The underlying function. Only one call to this function will be alive
                 at once (per instance of CachedCall)
         """
-        self._callable: Optional[Callable[[], Awaitable[TV]]] = f
-        self._deferred: Optional[Deferred] = None
-        self._result: Union[_Sentinel, TV, Failure] = _Sentinel.sentinel
+        self._callable: Callable[[], Awaitable[TV]] | None = f
+        self._deferred: Deferred | None = None
+        self._result: _Sentinel | TV | Failure = _Sentinel.sentinel
 
     async def get(self) -> TV:
         """Kick off the call if necessary, and return the result"""
@@ -93,7 +93,7 @@ class CachedCall(Generic[TV]):
             # result in the deferred, since `awaiting` a deferred destroys its result.
             # (Also, if it's a Failure, GCing the deferred would log a critical error
             # about unhandled Failures)
-            def got_result(r: Union[TV, Failure]) -> None:
+            def got_result(r: TV | Failure) -> None:
                 self._result = r
 
             self._deferred.addBoth(got_result)
diff --git a/synapse/util/caches/deferred_cache.py b/synapse/util/caches/deferred_cache.py
index 92d446ce2a..e7e21d0de9 100644
--- a/synapse/util/caches/deferred_cache.py
+++ b/synapse/util/caches/deferred_cache.py
@@ -26,15 +26,11 @@ import threading
 from typing import (
     Callable,
     Collection,
-    Dict,
     Generic,
     MutableMapping,
     Optional,
-    Set,
     Sized,
-    Tuple,
     TypeVar,
-    Union,
     cast,
 )
 
@@ -43,10 +39,12 @@ from prometheus_client import Gauge
 from twisted.internet import defer
 from twisted.python.failure import Failure
 
+from synapse.logging.context import PreserveLoggingContext
 from synapse.metrics import SERVER_NAME_LABEL
 from synapse.util.async_helpers import ObservableDeferred
 from synapse.util.caches.lrucache import LruCache
 from synapse.util.caches.treecache import TreeCache, iterate_tree_cache_entry
+from synapse.util.clock import Clock
 
 cache_pending_metric = Gauge(
     "synapse_util_caches_cache_pending",
@@ -82,6 +80,7 @@ class DeferredCache(Generic[KT, VT]):
         self,
         *,
         name: str,
+        clock: Clock,
         server_name: str,
         max_entries: int = 1000,
         tree: bool = False,
@@ -103,13 +102,14 @@ class DeferredCache(Generic[KT, VT]):
             prune_unread_entries: If True, cache entries that haven't been read recently
                 will be evicted from the cache in the background. Set to False to
                 opt-out of this behaviour.
+            clock: The homeserver `Clock` instance
         """
         cache_type = TreeCache if tree else dict
 
         # _pending_deferred_cache maps from the key value to a `CacheEntry` object.
-        self._pending_deferred_cache: Union[
-            TreeCache, "MutableMapping[KT, CacheEntry[KT, VT]]"
-        ] = cache_type()
+        self._pending_deferred_cache: (
+            TreeCache | "MutableMapping[KT, CacheEntry[KT, VT]]"
+        ) = cache_type()
 
         def metrics_cb() -> None:
             cache_pending_metric.labels(
@@ -120,6 +120,7 @@ class DeferredCache(Generic[KT, VT]):
         # a Deferred.
         self.cache: LruCache[KT, VT] = LruCache(
             max_size=max_entries,
+            clock=clock,
             server_name=server_name,
             cache_name=name,
             cache_type=cache_type,
@@ -135,7 +136,7 @@ class DeferredCache(Generic[KT, VT]):
             prune_unread_entries=prune_unread_entries,
         )
 
-        self.thread: Optional[threading.Thread] = None
+        self.thread: threading.Thread | None = None
 
     @property
     def max_entries(self) -> int:
@@ -154,7 +155,7 @@ class DeferredCache(Generic[KT, VT]):
     def get(
         self,
         key: KT,
-        callback: Optional[Callable[[], None]] = None,
+        callback: Callable[[], None] | None = None,
         update_metrics: bool = True,
     ) -> defer.Deferred:
         """Looks the key up in the caches.
@@ -198,8 +199,8 @@ class DeferredCache(Generic[KT, VT]):
     def get_bulk(
         self,
         keys: Collection[KT],
-        callback: Optional[Callable[[], None]] = None,
-    ) -> Tuple[Dict[KT, VT], Optional["defer.Deferred[Dict[KT, VT]]"], Collection[KT]]:
+        callback: Callable[[], None] | None = None,
+    ) -> tuple[dict[KT, VT], Optional["defer.Deferred[dict[KT, VT]]"], Collection[KT]]:
         """Bulk lookup of items in the cache.
 
         Returns:
@@ -262,9 +263,7 @@ class DeferredCache(Generic[KT, VT]):
 
         return (cached, pending_deferred, missing)
 
-    def get_immediate(
-        self, key: KT, default: T, update_metrics: bool = True
-    ) -> Union[VT, T]:
+    def get_immediate(self, key: KT, default: T, update_metrics: bool = True) -> VT | T:
         """If we have a *completed* cached value, return it."""
         return self.cache.get(key, default, update_metrics=update_metrics)
 
@@ -272,7 +271,7 @@ class DeferredCache(Generic[KT, VT]):
         self,
         key: KT,
         value: "defer.Deferred[VT]",
-        callback: Optional[Callable[[], None]] = None,
+        callback: Callable[[], None] | None = None,
     ) -> defer.Deferred:
         """Adds a new entry to the cache (or updates an existing one).
 
@@ -327,7 +326,7 @@ class DeferredCache(Generic[KT, VT]):
     def start_bulk_input(
         self,
         keys: Collection[KT],
-        callback: Optional[Callable[[], None]] = None,
+        callback: Callable[[], None] | None = None,
     ) -> "CacheMultipleEntries[KT, VT]":
         """Bulk set API for use when fetching multiple keys at once from the DB.
 
@@ -381,7 +380,7 @@ class DeferredCache(Generic[KT, VT]):
         return failure
 
     def prefill(
-        self, key: KT, value: VT, callback: Optional[Callable[[], None]] = None
+        self, key: KT, value: VT, callback: Callable[[], None] | None = None
     ) -> None:
         callbacks = (callback,) if callback else ()
         self.cache.set(key, value, callbacks=callbacks)
@@ -434,7 +433,7 @@ class CacheEntry(Generic[KT, VT], metaclass=abc.ABCMeta):
 
     @abc.abstractmethod
     def add_invalidation_callback(
-        self, key: KT, callback: Optional[Callable[[], None]]
+        self, key: KT, callback: Callable[[], None] | None
     ) -> None:
         """Add an invalidation callback"""
         ...
@@ -454,13 +453,13 @@ class CacheEntrySingle(CacheEntry[KT, VT]):
 
     def __init__(self, deferred: "defer.Deferred[VT]") -> None:
         self._deferred = ObservableDeferred(deferred, consumeErrors=True)
-        self._callbacks: Set[Callable[[], None]] = set()
+        self._callbacks: set[Callable[[], None]] = set()
 
     def deferred(self, key: KT) -> "defer.Deferred[VT]":
         return self._deferred.observe()
 
     def add_invalidation_callback(
-        self, key: KT, callback: Optional[Callable[[], None]]
+        self, key: KT, callback: Callable[[], None] | None
     ) -> None:
         if callback is None:
             return
@@ -477,9 +476,9 @@ class CacheMultipleEntries(CacheEntry[KT, VT]):
     __slots__ = ["_deferred", "_callbacks", "_global_callbacks"]
 
     def __init__(self) -> None:
-        self._deferred: Optional[ObservableDeferred[Dict[KT, VT]]] = None
-        self._callbacks: Dict[KT, Set[Callable[[], None]]] = {}
-        self._global_callbacks: Set[Callable[[], None]] = set()
+        self._deferred: ObservableDeferred[dict[KT, VT]] | None = None
+        self._callbacks: dict[KT, set[Callable[[], None]]] = {}
+        self._global_callbacks: set[Callable[[], None]] = set()
 
     def deferred(self, key: KT) -> "defer.Deferred[VT]":
         if not self._deferred:
@@ -487,7 +486,7 @@ class CacheMultipleEntries(CacheEntry[KT, VT]):
         return self._deferred.observe().addCallback(lambda res: res[key])
 
     def add_invalidation_callback(
-        self, key: KT, callback: Optional[Callable[[], None]]
+        self, key: KT, callback: Callable[[], None] | None
     ) -> None:
         if callback is None:
             return
@@ -498,7 +497,7 @@ class CacheMultipleEntries(CacheEntry[KT, VT]):
         return self._callbacks.get(key, set()) | self._global_callbacks
 
     def add_global_invalidation_callback(
-        self, callback: Optional[Callable[[], None]]
+        self, callback: Callable[[], None] | None
     ) -> None:
         """Add a callback for when any keys get invalidated."""
         if callback is None:
@@ -509,14 +508,15 @@ class CacheMultipleEntries(CacheEntry[KT, VT]):
     def complete_bulk(
         self,
         cache: DeferredCache[KT, VT],
-        result: Dict[KT, VT],
+        result: dict[KT, VT],
     ) -> None:
         """Called when there is a result"""
         for key, value in result.items():
             cache._completed_callback(value, self, key)
 
         if self._deferred:
-            self._deferred.callback(result)
+            with PreserveLoggingContext():
+                self._deferred.callback(result)
 
     def error_bulk(
         self, cache: DeferredCache[KT, VT], keys: Collection[KT], failure: Failure
@@ -526,4 +526,5 @@ class CacheMultipleEntries(CacheEntry[KT, VT]):
             cache._error_callback(failure, self, key)
 
         if self._deferred:
-            self._deferred.errback(failure)
+            with PreserveLoggingContext():
+                self._deferred.errback(failure)
diff --git a/synapse/util/caches/descriptors.py b/synapse/util/caches/descriptors.py
index 9630cd6d26..fd931cac89 100644
--- a/synapse/util/caches/descriptors.py
+++ b/synapse/util/caches/descriptors.py
@@ -26,19 +26,13 @@ from typing import (
     Awaitable,
     Callable,
     Collection,
-    Dict,
     Generic,
     Hashable,
     Iterable,
-    List,
     Mapping,
-    Optional,
     Protocol,
     Sequence,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     cast,
 )
 from weakref import WeakValueDictionary
@@ -53,18 +47,19 @@ from synapse.util import unwrapFirstError
 from synapse.util.async_helpers import delay_cancellation
 from synapse.util.caches.deferred_cache import DeferredCache
 from synapse.util.caches.lrucache import LruCache
+from synapse.util.clock import Clock
 
 logger = logging.getLogger(__name__)
 
-CacheKey = Union[Tuple, Any]
+CacheKey = tuple | Any
 
 F = TypeVar("F", bound=Callable[..., Any])
 
 
 class CachedFunction(Generic[F]):
-    invalidate: Callable[[Tuple[Any, ...]], None]
+    invalidate: Callable[[tuple[Any, ...]], None]
     invalidate_all: Callable[[], None]
-    prefill: Callable[[Tuple[Any, ...], Any], None]
+    prefill: Callable[[tuple[Any, ...], Any], None]
     cache: Any = None
     num_args: Any = None
 
@@ -79,10 +74,10 @@ class _CacheDescriptorBase:
     def __init__(
         self,
         orig: Callable[..., Any],
-        num_args: Optional[int],
-        uncached_args: Optional[Collection[str]] = None,
+        num_args: int | None,
+        uncached_args: Collection[str] | None = None,
         cache_context: bool = False,
-        name: Optional[str] = None,
+        name: str | None = None,
     ):
         self.orig = orig
         self.name = name or orig.__name__
@@ -154,13 +149,20 @@ class _CacheDescriptorBase:
         )
 
 
-class HasServerName(Protocol):
+class HasServerNameAndClock(Protocol):
     server_name: str
     """
     The homeserver name that this cache is associated with (used to label the metric)
     (`hs.hostname`).
     """
 
+    clock: Clock
+    """
+    The homeserver clock instance used to track delayed and looping calls. Important to
+    be able to fully cleanup the homeserver instance on server shutdown.
+    (`hs.get_clock()`).
+    """
+
 
 class DeferredCacheDescriptor(_CacheDescriptorBase):
     """A method decorator that applies a memoizing cache around the function.
@@ -212,13 +214,13 @@ class DeferredCacheDescriptor(_CacheDescriptorBase):
         *,
         orig: Callable[..., Any],
         max_entries: int = 1000,
-        num_args: Optional[int] = None,
-        uncached_args: Optional[Collection[str]] = None,
+        num_args: int | None = None,
+        uncached_args: Collection[str] | None = None,
         tree: bool = False,
         cache_context: bool = False,
         iterable: bool = False,
         prune_unread_entries: bool = True,
-        name: Optional[str] = None,
+        name: str | None = None,
     ):
         super().__init__(
             orig,
@@ -239,7 +241,7 @@ class DeferredCacheDescriptor(_CacheDescriptorBase):
         self.prune_unread_entries = prune_unread_entries
 
     def __get__(
-        self, obj: Optional[HasServerName], owner: Optional[Type]
+        self, obj: HasServerNameAndClock | None, owner: type | None
     ) -> Callable[..., "defer.Deferred[Any]"]:
         # We need access to instance-level `obj.server_name` attribute
         assert obj is not None, (
@@ -249,9 +251,13 @@ class DeferredCacheDescriptor(_CacheDescriptorBase):
         assert obj.server_name is not None, (
             "The `server_name` attribute must be set on the object where `@cached` decorator is used."
         )
+        assert obj.clock is not None, (
+            "The `clock` attribute must be set on the object where `@cached` decorator is used."
+        )
 
         cache: DeferredCache[CacheKey, Any] = DeferredCache(
             name=self.name,
+            clock=obj.clock,
             server_name=obj.server_name,
             max_entries=self.max_entries,
             tree=self.tree,
@@ -320,11 +326,11 @@ class DeferredCacheListDescriptor(_CacheDescriptorBase):
 
     def __init__(
         self,
-        orig: Callable[..., Awaitable[Dict]],
+        orig: Callable[..., Awaitable[dict]],
         cached_method_name: str,
         list_name: str,
-        num_args: Optional[int] = None,
-        name: Optional[str] = None,
+        num_args: int | None = None,
+        name: str | None = None,
     ):
         """
         Args:
@@ -351,8 +357,8 @@ class DeferredCacheListDescriptor(_CacheDescriptorBase):
             )
 
     def __get__(
-        self, obj: Optional[Any], objtype: Optional[Type] = None
-    ) -> Callable[..., "defer.Deferred[Dict[Hashable, Any]]"]:
+        self, obj: Any | None, objtype: type | None = None
+    ) -> Callable[..., "defer.Deferred[dict[Hashable, Any]]"]:
         cached_method = getattr(obj, self.cached_method_name)
         cache: DeferredCache[CacheKey, Any] = cached_method.cache
         num_args = cached_method.num_args
@@ -364,7 +370,7 @@ class DeferredCacheListDescriptor(_CacheDescriptorBase):
             )
 
         @functools.wraps(self.orig)
-        def wrapped(*args: Any, **kwargs: Any) -> "defer.Deferred[Dict]":
+        def wrapped(*args: Any, **kwargs: Any) -> "defer.Deferred[dict]":
             # If we're passed a cache_context then we'll want to call its
             # invalidate() whenever we are invalidated
             invalidate_callback = kwargs.pop("on_invalidate", None)
@@ -400,10 +406,10 @@ class DeferredCacheListDescriptor(_CacheDescriptorBase):
 
             results = {cache_key_to_arg(key): v for key, v in immediate_results.items()}
 
-            cached_defers: List["defer.Deferred[Any]"] = []
+            cached_defers: list["defer.Deferred[Any]"] = []
             if pending_deferred:
 
-                def update_results(r: Dict) -> None:
+                def update_results(r: dict) -> None:
                     for k, v in r.items():
                         results[cache_key_to_arg(k)] = v
 
@@ -413,7 +419,7 @@ class DeferredCacheListDescriptor(_CacheDescriptorBase):
             if missing:
                 cache_entry = cache.start_bulk_input(missing, invalidate_callback)
 
-                def complete_all(res: Dict[Hashable, Any]) -> None:
+                def complete_all(res: dict[Hashable, Any]) -> None:
                     missing_results = {}
                     for key in missing:
                         arg = cache_key_to_arg(key)
@@ -463,10 +469,10 @@ class _CacheContext:
     on a lower level.
     """
 
-    Cache = Union[DeferredCache, LruCache]
+    Cache = DeferredCache | LruCache
 
     _cache_context_objects: """WeakValueDictionary[
-        Tuple["_CacheContext.Cache", CacheKey], "_CacheContext"
+        tuple["_CacheContext.Cache", CacheKey], "_CacheContext"
     ]""" = WeakValueDictionary()
 
     def __init__(self, cache: "_CacheContext.Cache", cache_key: CacheKey) -> None:
@@ -500,13 +506,13 @@ class _CachedFunctionDescriptor:
     plugin."""
 
     max_entries: int
-    num_args: Optional[int]
-    uncached_args: Optional[Collection[str]]
+    num_args: int | None
+    uncached_args: Collection[str] | None
     tree: bool
     cache_context: bool
     iterable: bool
     prune_unread_entries: bool
-    name: Optional[str]
+    name: str | None
 
     def __call__(self, orig: F) -> CachedFunction[F]:
         d = DeferredCacheDescriptor(
@@ -526,13 +532,13 @@ class _CachedFunctionDescriptor:
 def cached(
     *,
     max_entries: int = 1000,
-    num_args: Optional[int] = None,
-    uncached_args: Optional[Collection[str]] = None,
+    num_args: int | None = None,
+    uncached_args: Collection[str] | None = None,
     tree: bool = False,
     cache_context: bool = False,
     iterable: bool = False,
     prune_unread_entries: bool = True,
-    name: Optional[str] = None,
+    name: str | None = None,
 ) -> _CachedFunctionDescriptor:
     return _CachedFunctionDescriptor(
         max_entries=max_entries,
@@ -553,8 +559,8 @@ class _CachedListFunctionDescriptor:
 
     cached_method_name: str
     list_name: str
-    num_args: Optional[int] = None
-    name: Optional[str] = None
+    num_args: int | None = None
+    name: str | None = None
 
     def __call__(self, orig: F) -> CachedFunction[F]:
         d = DeferredCacheListDescriptor(
@@ -571,17 +577,20 @@ def cachedList(
     *,
     cached_method_name: str,
     list_name: str,
-    num_args: Optional[int] = None,
-    name: Optional[str] = None,
+    num_args: int | None = None,
+    name: str | None = None,
 ) -> _CachedListFunctionDescriptor:
     """Creates a descriptor that wraps a function in a `DeferredCacheListDescriptor`.
 
     Used to do batch lookups for an already created cache. One of the arguments
     is specified as a list that is iterated through to lookup keys in the
     original cache. A new tuple consisting of the (deduplicated) keys that weren't in
-    the cache gets passed to the original function, which is expected to results
+    the cache gets passed to the original function, which is expected to result
     in a map of key to value for each passed value. The new results are stored in the
-    original cache. Note that any missing values are cached as None.
+    original cache.
+
+    Note that any values in the input that end up being missing from both the
+    cache and the returned dictionary will be cached as `None`.
 
     Args:
         cached_method_name: The name of the single-item lookup method.
diff --git a/synapse/util/caches/dictionary_cache.py b/synapse/util/caches/dictionary_cache.py
index 168ddc51cd..4289e327af 100644
--- a/synapse/util/caches/dictionary_cache.py
+++ b/synapse/util/caches/dictionary_cache.py
@@ -22,21 +22,17 @@ import enum
 import logging
 import threading
 from typing import (
-    Dict,
     Generic,
     Iterable,
     Literal,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
 )
 
 import attr
 
 from synapse.util.caches.lrucache import LruCache
 from synapse.util.caches.treecache import TreeCache
+from synapse.util.clock import Clock
 
 logger = logging.getLogger(__name__)
 
@@ -64,8 +60,8 @@ class DictionaryEntry(Generic[DKT, DV]):
     """
 
     full: bool
-    known_absent: Set[DKT]
-    value: Dict[DKT, DV]
+    known_absent: set[DKT]
+    value: dict[DKT, DV]
 
     def __len__(self) -> int:
         return len(self.value)
@@ -90,7 +86,7 @@ class _PerKeyValue(Generic[DV]):
 
     __slots__ = ["value"]
 
-    def __init__(self, value: Union[DV, Literal[_Sentinel.sentinel]]) -> None:
+    def __init__(self, value: DV | Literal[_Sentinel.sentinel]) -> None:
         self.value = value
 
     def __len__(self) -> int:
@@ -127,10 +123,13 @@ class DictionaryCache(Generic[KT, DKT, DV]):
     for the '2' dict key.
     """
 
-    def __init__(self, *, name: str, server_name: str, max_entries: int = 1000):
+    def __init__(
+        self, *, name: str, clock: Clock, server_name: str, max_entries: int = 1000
+    ):
         """
         Args:
             name
+            clock: The homeserver `Clock` instance
             server_name: The homeserver name that this cache is associated with
                 (used to label the metric) (`hs.hostname`).
             max_entries
@@ -156,10 +155,11 @@ class DictionaryCache(Generic[KT, DKT, DV]):
         #     * A key of `(KT, DKT)` has a value of `_PerKeyValue`
         #     * A key of `(KT, _FullCacheKey.KEY)` has a value of `Dict[DKT, DV]`
         self.cache: LruCache[
-            Tuple[KT, Union[DKT, Literal[_FullCacheKey.KEY]]],
-            Union[_PerKeyValue, Dict[DKT, DV]],
+            tuple[KT, DKT | Literal[_FullCacheKey.KEY]],
+            _PerKeyValue | dict[DKT, DV],
         ] = LruCache(
             max_size=max_entries,
+            clock=clock,
             server_name=server_name,
             cache_name=name,
             cache_type=TreeCache,
@@ -168,7 +168,7 @@ class DictionaryCache(Generic[KT, DKT, DV]):
 
         self.name = name
         self.sequence = 0
-        self.thread: Optional[threading.Thread] = None
+        self.thread: threading.Thread | None = None
 
     def check_thread(self) -> None:
         expected_thread = self.thread
@@ -180,9 +180,7 @@ class DictionaryCache(Generic[KT, DKT, DV]):
                     "Cache objects can only be accessed from the main thread"
                 )
 
-    def get(
-        self, key: KT, dict_keys: Optional[Iterable[DKT]] = None
-    ) -> DictionaryEntry:
+    def get(self, key: KT, dict_keys: Iterable[DKT] | None = None) -> DictionaryEntry:
         """Fetch an entry out of the cache
 
         Args:
@@ -292,8 +290,8 @@ class DictionaryCache(Generic[KT, DKT, DV]):
         self,
         sequence: int,
         key: KT,
-        value: Dict[DKT, DV],
-        fetched_keys: Optional[Iterable[DKT]] = None,
+        value: dict[DKT, DV],
+        fetched_keys: Iterable[DKT] | None = None,
     ) -> None:
         """Updates the entry in the cache.
 
@@ -327,7 +325,7 @@ class DictionaryCache(Generic[KT, DKT, DV]):
                 self._update_subset(key, value, fetched_keys)
 
     def _update_subset(
-        self, key: KT, value: Dict[DKT, DV], fetched_keys: Iterable[DKT]
+        self, key: KT, value: dict[DKT, DV], fetched_keys: Iterable[DKT]
     ) -> None:
         """Add the given dictionary values as explicit keys in the cache.
 
diff --git a/synapse/util/caches/expiringcache.py b/synapse/util/caches/expiringcache.py
index 1962a3fdfa..87870f4223 100644
--- a/synapse/util/caches/expiringcache.py
+++ b/synapse/util/caches/expiringcache.py
@@ -21,16 +21,27 @@
 
 import logging
 from collections import OrderedDict
-from typing import Any, Generic, Iterable, Literal, Optional, TypeVar, Union, overload
+from typing import (
+    TYPE_CHECKING,
+    Any,
+    Generic,
+    Iterable,
+    Literal,
+    TypeVar,
+    overload,
+)
 
 import attr
 
 from twisted.internet import defer
 
 from synapse.config import cache as cache_config
-from synapse.metrics.background_process_metrics import run_as_background_process
-from synapse.util import Clock
 from synapse.util.caches import EvictionReason, register_cache
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
 
 logger = logging.getLogger(__name__)
 
@@ -49,6 +60,7 @@ class ExpiringCache(Generic[KT, VT]):
         *,
         cache_name: str,
         server_name: str,
+        hs: "HomeServer",
         clock: Clock,
         max_len: int = 0,
         expiry_ms: int = 0,
@@ -99,11 +111,9 @@ class ExpiringCache(Generic[KT, VT]):
             return
 
         def f() -> "defer.Deferred[None]":
-            return run_as_background_process(
-                "prune_cache", server_name, self._prune_cache
-            )
+            return hs.run_as_background_process("prune_cache", self._prune_cache)
 
-        self._clock.looping_call(f, self._expiry_ms / 2)
+        self._clock.looping_call(f, Duration(milliseconds=self._expiry_ms / 2))
 
     def __setitem__(self, key: KT, value: VT) -> None:
         now = self._clock.time_msec()
@@ -135,7 +145,7 @@ class ExpiringCache(Generic[KT, VT]):
 
         return entry.value
 
-    def pop(self, key: KT, default: T = SENTINEL) -> Union[VT, T]:
+    def pop(self, key: KT, default: T = SENTINEL) -> VT | T:
         """Removes and returns the value with the given key from the cache.
 
         If the key isn't in the cache then `default` will be returned if
@@ -162,12 +172,12 @@ class ExpiringCache(Generic[KT, VT]):
         return key in self._cache
 
     @overload
-    def get(self, key: KT, default: Literal[None] = None) -> Optional[VT]: ...
+    def get(self, key: KT, default: Literal[None] = None) -> VT | None: ...
 
     @overload
-    def get(self, key: KT, default: T) -> Union[VT, T]: ...
+    def get(self, key: KT, default: T) -> VT | T: ...
 
-    def get(self, key: KT, default: Optional[T] = None) -> Union[VT, Optional[T]]:
+    def get(self, key: KT, default: T | None = None) -> VT | T | None:
         try:
             return self[key]
         except KeyError:
diff --git a/synapse/util/caches/lrucache.py b/synapse/util/caches/lrucache.py
index 927162700a..a3e7bd4d03 100644
--- a/synapse/util/caches/lrucache.py
+++ b/synapse/util/caches/lrucache.py
@@ -30,36 +30,27 @@ from typing import (
     Any,
     Callable,
     Collection,
-    Dict,
     Generic,
     Iterable,
-    List,
     Literal,
-    Optional,
-    Set,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     cast,
     overload,
 )
 
-from twisted.internet import defer, reactor
-from twisted.internet.interfaces import IReactorTime
+from twisted.internet import defer
 
 from synapse.config import cache as cache_config
-from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
-)
 from synapse.metrics.jemalloc import get_jemalloc_stats
-from synapse.util import Clock, caches
+from synapse.util import caches
 from synapse.util.caches import CacheMetric, EvictionReason, register_cache
 from synapse.util.caches.treecache import (
     TreeCache,
     iterate_tree_cache_entry,
     iterate_tree_cache_items,
 )
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.linked_list import ListNode
 
 if TYPE_CHECKING:
@@ -122,16 +113,17 @@ GLOBAL_ROOT = ListNode["_Node"].create_root_node()
 
 def _expire_old_entries(
     server_name: str,
+    hs: "HomeServer",
     clock: Clock,
     expiry_seconds: float,
-    autotune_config: Optional[dict],
+    autotune_config: dict | None,
 ) -> "defer.Deferred[None]":
     """Walks the global cache list to find cache entries that haven't been
     accessed in the given number of seconds, or if a given memory threshold has been breached.
     """
 
     async def _internal_expire_old_entries(
-        clock: Clock, expiry_seconds: float, autotune_config: Optional[dict]
+        clock: Clock, expiry_seconds: float, autotune_config: dict | None
     ) -> None:
         if autotune_config:
             max_cache_memory_usage = autotune_config["max_cache_memory_usage"]
@@ -211,9 +203,9 @@ def _expire_old_entries(
             if (i + 1) % 10000 == 0:
                 logger.debug("Waiting during drop")
                 if node.last_access_ts_secs > now - expiry_seconds:
-                    await clock.sleep(0.5)
+                    await clock.sleep(Duration(milliseconds=500))
                 else:
-                    await clock.sleep(0)
+                    await clock.sleep(Duration(seconds=0))
                 logger.debug("Waking during drop")
 
             node = next_node
@@ -227,9 +219,8 @@ def _expire_old_entries(
 
         logger.info("Dropped %d items from caches", i)
 
-    return run_as_background_process(
+    return hs.run_as_background_process(
         "LruCache._expire_old_entries",
-        server_name,
         _internal_expire_old_entries,
         clock,
         expiry_seconds,
@@ -258,8 +249,9 @@ def setup_expire_lru_cache_entries(hs: "HomeServer") -> None:
     clock = hs.get_clock()
     clock.looping_call(
         _expire_old_entries,
-        30 * 1000,
+        Duration(seconds=30),
         server_name,
+        hs,
         clock,
         expiry_time,
         hs.config.caches.cache_autotuning,
@@ -288,7 +280,7 @@ class _Node(Generic[KT, VT]):
         prune_unread_entries: bool = True,
     ):
         self._list_node = ListNode.insert_after(self, root)
-        self._global_list_node: Optional[_TimedListNode] = None
+        self._global_list_node: _TimedListNode | None = None
         if USE_GLOBAL_LIST and prune_unread_entries:
             self._global_list_node = _TimedListNode.insert_after(self, GLOBAL_ROOT)
             self._global_list_node.update_last_access(clock)
@@ -310,7 +302,7 @@ class _Node(Generic[KT, VT]):
         # footprint down. Storing `None` is free as its a singleton, while empty
         # lists are 56 bytes (and empty sets are 216 bytes, if we did the naive
         # thing and used sets).
-        self.callbacks: Optional[List[Callable[[], None]]] = None
+        self.callbacks: list[Callable[[], None]] | None = None
 
         self.add_callbacks(callbacks)
 
@@ -403,15 +395,15 @@ class LruCache(Generic[KT, VT]):
         self,
         *,
         max_size: int,
+        clock: Clock,
         server_name: str,
         cache_name: str,
-        cache_type: Type[Union[dict, TreeCache]] = dict,
-        size_callback: Optional[Callable[[VT], int]] = None,
-        metrics_collection_callback: Optional[Callable[[], None]] = None,
+        cache_type: type[dict | TreeCache] = dict,
+        size_callback: Callable[[VT], int] | None = None,
+        metrics_collection_callback: Callable[[], None] | None = None,
         apply_cache_factor_from_config: bool = True,
-        clock: Optional[Clock] = None,
         prune_unread_entries: bool = True,
-        extra_index_cb: Optional[Callable[[KT, VT], KT]] = None,
+        extra_index_cb: Callable[[KT, VT], KT] | None = None,
     ): ...
 
     @overload
@@ -419,42 +411,40 @@ class LruCache(Generic[KT, VT]):
         self,
         *,
         max_size: int,
-        server_name: Literal[None] = None,
+        clock: Clock,
+        server_name: str,
         cache_name: Literal[None] = None,
-        cache_type: Type[Union[dict, TreeCache]] = dict,
-        size_callback: Optional[Callable[[VT], int]] = None,
-        metrics_collection_callback: Optional[Callable[[], None]] = None,
+        cache_type: type[dict | TreeCache] = dict,
+        size_callback: Callable[[VT], int] | None = None,
+        metrics_collection_callback: Callable[[], None] | None = None,
         apply_cache_factor_from_config: bool = True,
-        clock: Optional[Clock] = None,
         prune_unread_entries: bool = True,
-        extra_index_cb: Optional[Callable[[KT, VT], KT]] = None,
+        extra_index_cb: Callable[[KT, VT], KT] | None = None,
     ): ...
 
     def __init__(
         self,
         *,
         max_size: int,
-        server_name: Optional[str] = None,
-        cache_name: Optional[str] = None,
-        cache_type: Type[Union[dict, TreeCache]] = dict,
-        size_callback: Optional[Callable[[VT], int]] = None,
-        metrics_collection_callback: Optional[Callable[[], None]] = None,
+        clock: Clock,
+        server_name: str,
+        cache_name: str | None = None,
+        cache_type: type[dict | TreeCache] = dict,
+        size_callback: Callable[[VT], int] | None = None,
+        metrics_collection_callback: Callable[[], None] | None = None,
         apply_cache_factor_from_config: bool = True,
-        clock: Optional[Clock] = None,
         prune_unread_entries: bool = True,
-        extra_index_cb: Optional[Callable[[KT, VT], KT]] = None,
+        extra_index_cb: Callable[[KT, VT], KT] | None = None,
     ):
         """
         Args:
             max_size: The maximum amount of entries the cache can hold
 
             server_name: The homeserver name that this cache is associated with
-                (used to label the metric) (`hs.hostname`). Must be set if `cache_name` is
-                set. If unset, no metrics will be reported on this cache.
+                (used to label the metric) (`hs.hostname`).
 
-            cache_name: The name of this cache, for the prometheus metrics. Must be set
-                if `server_name` is set. If unset, no metrics will be reported on this
-                cache.
+            cache_name: The name of this cache, for the prometheus metrics. If unset, no
+                metrics will be reported on this cache.
 
             cache_type:
                 type of underlying cache to be used. Typically one of dict
@@ -493,14 +483,7 @@ class LruCache(Generic[KT, VT]):
 
                 Note: The new key does not have to be unique.
         """
-        # Default `clock` to something sensible. Note that we rename it to
-        # `real_clock` so that mypy doesn't think its still `Optional`.
-        if clock is None:
-            real_clock = Clock(cast(IReactorTime, reactor))
-        else:
-            real_clock = clock
-
-        cache: Union[Dict[KT, _Node[KT, VT]], TreeCache] = cache_type()
+        cache: dict[KT, _Node[KT, VT]] | TreeCache = cache_type()
         self.cache = cache  # Used for introspection.
         self.apply_cache_factor_from_config = apply_cache_factor_from_config
 
@@ -516,10 +499,10 @@ class LruCache(Generic[KT, VT]):
 
         # register_cache might call our "set_cache_factor" callback; there's nothing to
         # do yet when we get resized.
-        self._on_resize: Optional[Callable[[], None]] = None
+        self._on_resize: Callable[[], None] | None = None
 
         if cache_name is not None and server_name is not None:
-            metrics: Optional[CacheMetric] = register_cache(
+            metrics: CacheMetric | None = register_cache(
                 cache_type="lru_cache",
                 cache_name=cache_name,
                 cache=self,
@@ -540,7 +523,7 @@ class LruCache(Generic[KT, VT]):
 
         lock = threading.Lock()
 
-        extra_index: Dict[KT, Set[KT]] = {}
+        extra_index: dict[KT, set[KT]] = {}
 
         def evict() -> None:
             while cache_len() > self.max_size:
@@ -591,7 +574,7 @@ class LruCache(Generic[KT, VT]):
                 key,
                 value,
                 weak_ref_to_self,
-                real_clock,
+                clock,
                 callbacks,
                 prune_unread_entries,
             )
@@ -609,7 +592,7 @@ class LruCache(Generic[KT, VT]):
                 metrics.inc_memory_usage(node.memory)
 
         def move_node_to_front(node: _Node[KT, VT]) -> None:
-            node.move_to_front(real_clock, list_root)
+            node.move_to_front(clock, list_root)
 
         def delete_node(node: _Node[KT, VT]) -> int:
             node.drop_from_lists()
@@ -641,7 +624,7 @@ class LruCache(Generic[KT, VT]):
             callbacks: Collection[Callable[[], None]] = ...,
             update_metrics: bool = ...,
             update_last_access: bool = ...,
-        ) -> Optional[VT]: ...
+        ) -> VT | None: ...
 
         @overload
         def cache_get(
@@ -650,16 +633,16 @@ class LruCache(Generic[KT, VT]):
             callbacks: Collection[Callable[[], None]] = ...,
             update_metrics: bool = ...,
             update_last_access: bool = ...,
-        ) -> Union[T, VT]: ...
+        ) -> T | VT: ...
 
         @synchronized
         def cache_get(
             key: KT,
-            default: Optional[T] = None,
+            default: T | None = None,
             callbacks: Collection[Callable[[], None]] = (),
             update_metrics: bool = True,
             update_last_access: bool = True,
-        ) -> Union[None, T, VT]:
+        ) -> None | T | VT:
             """Look up a key in the cache
 
             Args:
@@ -693,21 +676,21 @@ class LruCache(Generic[KT, VT]):
             key: tuple,
             default: Literal[None] = None,
             update_metrics: bool = True,
-        ) -> Union[None, Iterable[Tuple[KT, VT]]]: ...
+        ) -> None | Iterable[tuple[KT, VT]]: ...
 
         @overload
         def cache_get_multi(
             key: tuple,
             default: T,
             update_metrics: bool = True,
-        ) -> Union[T, Iterable[Tuple[KT, VT]]]: ...
+        ) -> T | Iterable[tuple[KT, VT]]: ...
 
         @synchronized
         def cache_get_multi(
             key: tuple,
-            default: Optional[T] = None,
+            default: T | None = None,
             update_metrics: bool = True,
-        ) -> Union[None, T, Iterable[Tuple[KT, VT]]]:
+        ) -> None | T | Iterable[tuple[KT, VT]]:
             """Returns a generator yielding all entries under the given key.
 
             Can only be used if backed by a tree cache.
@@ -785,13 +768,13 @@ class LruCache(Generic[KT, VT]):
                 return value
 
         @overload
-        def cache_pop(key: KT, default: Literal[None] = None) -> Optional[VT]: ...
+        def cache_pop(key: KT, default: Literal[None] = None) -> VT | None: ...
 
         @overload
-        def cache_pop(key: KT, default: T) -> Union[T, VT]: ...
+        def cache_pop(key: KT, default: T) -> T | VT: ...
 
         @synchronized
-        def cache_pop(key: KT, default: Optional[T] = None) -> Union[None, T, VT]:
+        def cache_pop(key: KT, default: T | None = None) -> None | T | VT:
             node = cache.get(key, None)
             if node:
                 evicted_len = delete_node(node)
@@ -941,22 +924,22 @@ class AsyncLruCache(Generic[KT, VT]):
         self._lru_cache: LruCache[KT, VT] = LruCache(*args, **kwargs)
 
     async def get(
-        self, key: KT, default: Optional[T] = None, update_metrics: bool = True
-    ) -> Optional[VT]:
+        self, key: KT, default: T | None = None, update_metrics: bool = True
+    ) -> VT | None:
         return self._lru_cache.get(key, update_metrics=update_metrics)
 
     async def get_external(
         self,
         key: KT,
-        default: Optional[T] = None,
+        default: T | None = None,
         update_metrics: bool = True,
-    ) -> Optional[VT]:
+    ) -> VT | None:
         # This method should fetch from any configured external cache, in this case noop.
         return None
 
     def get_local(
-        self, key: KT, default: Optional[T] = None, update_metrics: bool = True
-    ) -> Optional[VT]:
+        self, key: KT, default: T | None = None, update_metrics: bool = True
+    ) -> VT | None:
         return self._lru_cache.get(key, update_metrics=update_metrics)
 
     async def set(self, key: KT, value: VT) -> None:
diff --git a/synapse/util/caches/response_cache.py b/synapse/util/caches/response_cache.py
index 49a9151916..70cea9b77c 100644
--- a/synapse/util/caches/response_cache.py
+++ b/synapse/util/caches/response_cache.py
@@ -24,10 +24,8 @@ from typing import (
     Any,
     Awaitable,
     Callable,
-    Dict,
     Generic,
     Iterable,
-    Optional,
     TypeVar,
 )
 
@@ -41,9 +39,15 @@ from synapse.logging.opentracing import (
     start_active_span,
     start_active_span_follows_from,
 )
-from synapse.util import Clock
-from synapse.util.async_helpers import AbstractObservableDeferred, ObservableDeferred
+from synapse.util.async_helpers import (
+    ObservableDeferred,
+    delay_cancellation,
+)
 from synapse.util.caches import EvictionReason, register_cache
+from synapse.util.cancellation import cancellable, is_function_cancellable
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+from synapse.util.wheel_timer import WheelTimer
 
 logger = logging.getLogger(__name__)
 
@@ -80,8 +84,8 @@ class ResponseCacheContext(Generic[KV]):
 
 
 @attr.s(auto_attribs=True)
-class ResponseCacheEntry:
-    result: AbstractObservableDeferred
+class ResponseCacheEntry(Generic[KV]):
+    result: ObservableDeferred[KV]
     """The (possibly incomplete) result of the operation.
 
     Note that we continue to store an ObservableDeferred even after the operation
@@ -89,9 +93,18 @@ class ResponseCacheEntry:
     easier to cache Failure results.
     """
 
-    opentracing_span_context: "Optional[opentracing.SpanContext]"
+    opentracing_span_context: "opentracing.SpanContext | None"
     """The opentracing span which generated/is generating the result"""
 
+    cancellable: bool
+    """Whether the deferred is safe to be cancelled."""
+
+    last_observer_removed_time_ms: int | None = None
+    """The last time that an observer was removed from this entry.
+
+    Used to determine when to evict the entry if it has no observers.
+    """
+
 
 class ResponseCache(Generic[KV]):
     """
@@ -99,6 +112,22 @@ class ResponseCache(Generic[KV]):
     returned from the cache. This means that if the client retries the request
     while the response is still being computed, that original response will be
     used rather than trying to compute a new response.
+
+    If a timeout is not specified then the cache entry will be kept while the
+    wrapped function is still running, and will be removed immediately once it
+    completes.
+
+    If a timeout is specified then the cache entry will be kept for the duration
+    of the timeout after the wrapped function completes. If the wrapped function
+    is cancellable and during processing nothing waits on the result for longer
+    than the timeout then the wrapped function will be cancelled and the cache
+    entry will be removed.
+
+    This behaviour is useful for caching responses to requests which are
+    expensive to compute, but which may be retried by clients if they time out.
+    For example, /sync requests which may take a long time to compute, and which
+    clients will retry. However, if the client stops retrying for a while then
+    we want to stop processing the request and free up the resources.
     """
 
     def __init__(
@@ -107,7 +136,7 @@ class ResponseCache(Generic[KV]):
         clock: Clock,
         name: str,
         server_name: str,
-        timeout_ms: float = 0,
+        timeout: Duration | None = None,
         enable_logging: bool = True,
     ):
         """
@@ -119,10 +148,10 @@ class ResponseCache(Generic[KV]):
             timeout_ms
             enable_logging
         """
-        self._result_cache: Dict[KV, ResponseCacheEntry] = {}
+        self._result_cache: dict[KV, ResponseCacheEntry] = {}
 
         self.clock = clock
-        self.timeout_sec = timeout_ms / 1000.0
+        self.timeout = timeout
 
         self._name = name
         self._metrics = register_cache(
@@ -134,6 +163,13 @@ class ResponseCache(Generic[KV]):
         )
         self._enable_logging = enable_logging
 
+        self._prune_timer: WheelTimer[KV] | None = None
+        if self.timeout:
+            # Set up the timers for pruning inflight entries. The times here are
+            # how often we check for entries to prune.
+            self._prune_timer = WheelTimer(bucket_size=self.timeout / 10)
+            self.clock.looping_call(self._prune_inflight_entries, self.timeout / 10)
+
     def size(self) -> int:
         return len(self._result_cache)
 
@@ -151,7 +187,7 @@ class ResponseCache(Generic[KV]):
         """
         return self._result_cache.keys()
 
-    def _get(self, key: KV) -> Optional[ResponseCacheEntry]:
+    def _get(self, key: KV) -> ResponseCacheEntry | None:
         """Look up the given key.
 
         Args:
@@ -172,7 +208,8 @@ class ResponseCache(Generic[KV]):
         self,
         context: ResponseCacheContext[KV],
         deferred: "defer.Deferred[RV]",
-        opentracing_span_context: "Optional[opentracing.SpanContext]",
+        opentracing_span_context: "opentracing.SpanContext | None",
+        cancellable: bool,
     ) -> ResponseCacheEntry:
         """Set the entry for the given key to the given deferred.
 
@@ -184,21 +221,34 @@ class ResponseCache(Generic[KV]):
             context: Information about the cache miss
             deferred: The deferred which resolves to the result.
             opentracing_span_context: An opentracing span wrapping the calculation
+            cancellable: Whether the deferred is safe to be cancelled
 
         Returns:
             The cache entry object.
         """
         result = ObservableDeferred(deferred, consumeErrors=True)
         key = context.cache_key
-        entry = ResponseCacheEntry(result, opentracing_span_context)
+        entry = ResponseCacheEntry(
+            result, opentracing_span_context, cancellable=cancellable
+        )
         self._result_cache[key] = entry
 
         def on_complete(r: RV) -> RV:
             # if this cache has a non-zero timeout, and the callback has not cleared
             # the should_cache bit, we leave it in the cache for now and schedule
             # its removal later.
-            if self.timeout_sec and context.should_cache:
-                self.clock.call_later(self.timeout_sec, self._entry_timeout, key)
+            if self.timeout and context.should_cache:
+                self.clock.call_later(
+                    self.timeout,
+                    self._entry_timeout,
+                    key,
+                    # We don't need to track these calls since they don't hold any strong
+                    # references which would keep the `HomeServer` in memory after shutdown.
+                    # We don't want to track these because they can get cancelled really
+                    # quickly and thrash the tracking mechanism, ie. during repeated calls
+                    # to /sync.
+                    call_later_cancel_on_shutdown=False,
+                )
             else:
                 # otherwise, remove the result immediately.
                 self.unset(key)
@@ -224,6 +274,7 @@ class ResponseCache(Generic[KV]):
         self._metrics.inc_evictions(EvictionReason.time)
         self._result_cache.pop(key, None)
 
+    @cancellable
     async def wrap(
         self,
         key: KV,
@@ -280,7 +331,7 @@ class ResponseCache(Generic[KV]):
             if cache_context:
                 kwargs["cache_context"] = context
 
-            span_context: Optional[opentracing.SpanContext] = None
+            span_context: opentracing.SpanContext | None = None
 
             async def cb() -> RV:
                 # NB it is important that we do not `await` before setting span_context!
@@ -292,8 +343,44 @@ class ResponseCache(Generic[KV]):
                     return await callback(*args, **kwargs)
 
             d = run_in_background(cb)
-            entry = self._set(context, d, span_context)
-            return await make_deferred_yieldable(entry.result.observe())
+            entry = self._set(
+                context, d, span_context, cancellable=is_function_cancellable(callback)
+            )
+            try:
+                return await make_deferred_yieldable(entry.result.observe())
+            except defer.CancelledError:
+                pass
+
+            # We've been cancelled.
+            #
+            # Since we've kicked off the background operation, we can't just
+            # give up and return here and need to wait for the background
+            # operation to stop. We don't want to stop the background process
+            # immediately to give a chance for retries to come in and wait for
+            # the result.
+            #
+            # Instead, we temporarily swallow the cancellation and mark the
+            # cache key as one to potentially timeout.
+
+            # Update the `last_observer_removed_time_ms` so that the pruning
+            # mechanism can kick in if needed.
+            now = self.clock.time_msec()
+            entry.last_observer_removed_time_ms = now
+            if self._prune_timer is not None and self.timeout:
+                self._prune_timer.insert(now, key, now + self.timeout.as_millis())
+
+            # Wait on the original deferred, which will continue to run in the
+            # background until it completes. We don't want to add an observer as
+            # this would prevent the entry from being pruned.
+            #
+            # Note that this deferred has been consumed by the
+            # ObservableDeferred, so we don't know what it will return. That
+            # doesn't matter as we just want to throw a CancelledError once it completes anyway.
+            try:
+                await make_deferred_yieldable(delay_cancellation(d))
+            except Exception:
+                pass
+            raise defer.CancelledError()
 
         result = entry.result.observe()
         if self._enable_logging:
@@ -311,4 +398,60 @@ class ResponseCache(Generic[KV]):
             f"ResponseCache[{self._name}].wait",
             contexts=(span_context,) if span_context else (),
         ):
-            return await make_deferred_yieldable(result)
+            try:
+                return await make_deferred_yieldable(result)
+            except defer.CancelledError:
+                # If we're cancelled then we update the
+                # `last_observer_removed_time_ms` so that the pruning mechanism
+                # can kick in if needed.
+                now = self.clock.time_msec()
+                entry.last_observer_removed_time_ms = now
+                if self._prune_timer is not None and self.timeout:
+                    self._prune_timer.insert(now, key, now + self.timeout.as_millis())
+                raise
+
+    def _prune_inflight_entries(self) -> None:
+        """Prune entries which have been in the cache for too long without
+        observers"""
+        assert self._prune_timer is not None
+        assert self.timeout is not None
+
+        now = self.clock.time_msec()
+        keys_to_check = self._prune_timer.fetch(now)
+
+        # Loop through the keys and check if they should be evicted. We evict
+        # entries which have no active observers, and which have been in the
+        # cache for longer than the timeout since the last observer was removed.
+        for key in keys_to_check:
+            entry = self._result_cache.get(key)
+            if not entry:
+                continue
+
+            if not entry.cancellable:
+                # this entry is not cancellable, so we should keep it in the cache until it completes.
+                continue
+
+            if entry.result.has_called():
+                # this entry has already completed, so we should have scheduled it for
+                # removal at the right time. We can just skip it here and wait for the
+                # scheduled call to remove it.
+                continue
+
+            if entry.result.has_observers():
+                # this entry has observers, so we should keep it in the cache for now.
+                continue
+
+            if entry.last_observer_removed_time_ms is None:
+                # this should never happen, but just in case, we should keep the entry
+                # in the cache until we have a valid last_observer_removed_time_ms to
+                # compare against.
+                continue
+
+            if now - entry.last_observer_removed_time_ms > self.timeout.as_millis():
+                self._metrics.inc_evictions(EvictionReason.time)
+                self._result_cache.pop(key, None)
+                try:
+                    entry.result.cancel()
+                except Exception:
+                    # we ignore exceptions from cancel, as it is best effort anyway.
+                    pass
diff --git a/synapse/util/caches/stream_change_cache.py b/synapse/util/caches/stream_change_cache.py
index 2cffd352d8..7c6c9bc572 100644
--- a/synapse/util/caches/stream_change_cache.py
+++ b/synapse/util/caches/stream_change_cache.py
@@ -21,7 +21,7 @@
 
 import logging
 import math
-from typing import Collection, Dict, FrozenSet, List, Mapping, Optional, Set, Union
+from typing import Collection, Mapping
 
 import attr
 from sortedcontainers import SortedDict
@@ -45,14 +45,14 @@ class AllEntitiesChangedResult:
     that callers do the correct checks.
     """
 
-    _entities: Optional[List[EntityType]]
+    _entities: list[EntityType] | None
 
     @property
     def hit(self) -> bool:
         return self._entities is not None
 
     @property
-    def entities(self) -> List[EntityType]:
+    def entities(self) -> list[EntityType]:
         assert self._entities is not None
         return self._entities
 
@@ -78,7 +78,7 @@ class StreamChangeCache:
         server_name: str,
         current_stream_pos: int,
         max_size: int = 10000,
-        prefilled_cache: Optional[Mapping[EntityType, int]] = None,
+        prefilled_cache: Mapping[EntityType, int] | None = None,
     ) -> None:
         """
         Args:
@@ -94,11 +94,11 @@ class StreamChangeCache:
         self._max_size = math.floor(max_size)
 
         # map from stream id to the set of entities which changed at that stream id.
-        self._cache: SortedDict[int, Set[EntityType]] = SortedDict()
+        self._cache: SortedDict[int, set[EntityType]] = SortedDict()
         # map from entity to the stream ID of the latest change for that entity.
         #
         # Must be kept in sync with _cache.
-        self._entity_to_key: Dict[EntityType, int] = {}
+        self._entity_to_key: dict[EntityType, int] = {}
 
         # the earliest stream_pos for which we can reliably answer
         # get_all_entities_changed. In other words, one less than the earliest
@@ -182,7 +182,7 @@ class StreamChangeCache:
 
     def get_entities_changed(
         self, entities: Collection[EntityType], stream_pos: int, _perf_factor: int = 1
-    ) -> Union[Set[EntityType], FrozenSet[EntityType]]:
+    ) -> set[EntityType] | frozenset[EntityType]:
         """
         Returns the subset of the given entities that have had changes after the given position.
 
@@ -291,7 +291,7 @@ class StreamChangeCache:
         if stream_pos < self._earliest_known_stream_pos:
             return AllEntitiesChangedResult(None)
 
-        changed_entities: List[EntityType] = []
+        changed_entities: list[EntityType] = []
 
         for k in self._cache.islice(start=self._cache.bisect_right(stream_pos)):
             changed_entities.extend(self._cache[k])
@@ -352,7 +352,7 @@ class StreamChangeCache:
             for entity in r:
                 self._entity_to_key.pop(entity, None)
 
-    def get_max_pos_of_last_change(self, entity: EntityType) -> Optional[int]:
+    def get_max_pos_of_last_change(self, entity: EntityType) -> int | None:
         """Returns an upper bound of the stream id of the last change to an
         entity.
 
diff --git a/synapse/util/caches/ttlcache.py b/synapse/util/caches/ttlcache.py
index 18c3a1e51c..25b87832d8 100644
--- a/synapse/util/caches/ttlcache.py
+++ b/synapse/util/caches/ttlcache.py
@@ -21,7 +21,7 @@
 
 import logging
 import time
-from typing import Any, Callable, Dict, Generic, Tuple, TypeVar, Union
+from typing import Any, Callable, Generic, TypeVar
 
 import attr
 from sortedcontainers import SortedList
@@ -56,7 +56,7 @@ class TTLCache(Generic[KT, VT]):
         """
 
         # map from key to _CacheEntry
-        self._data: Dict[KT, _CacheEntry[KT, VT]] = {}
+        self._data: dict[KT, _CacheEntry[KT, VT]] = {}
 
         # the _CacheEntries, sorted by expiry time
         self._expiry_list: SortedList[_CacheEntry[KT, VT]] = SortedList()
@@ -91,7 +91,7 @@ class TTLCache(Generic[KT, VT]):
         self._data[key] = entry
         self._expiry_list.add(entry)
 
-    def get(self, key: KT, default: T = SENTINEL) -> Union[VT, T]:
+    def get(self, key: KT, default: T = SENTINEL) -> VT | T:
         """Get a value from the cache
 
         Args:
@@ -113,7 +113,7 @@ class TTLCache(Generic[KT, VT]):
         self._metrics.inc_hits()
         return e.value
 
-    def get_with_expiry(self, key: KT) -> Tuple[VT, float, float]:
+    def get_with_expiry(self, key: KT) -> tuple[VT, float, float]:
         """Get a value, and its expiry time, from the cache
 
         Args:
@@ -134,7 +134,7 @@ class TTLCache(Generic[KT, VT]):
         self._metrics.inc_hits()
         return e.value, e.expiry_time, e.ttl
 
-    def pop(self, key: KT, default: T = SENTINEL) -> Union[VT, T]:
+    def pop(self, key: KT, default: T = SENTINEL) -> VT | T:
         """Remove a value from the cache
 
         If key is in the cache, remove it and return its value, else return default.
diff --git a/synapse/util/check_dependencies.py b/synapse/util/check_dependencies.py
index 1c79c0be48..cf7573c99d 100644
--- a/synapse/util/check_dependencies.py
+++ b/synapse/util/check_dependencies.py
@@ -28,9 +28,11 @@ require. But this is probably just symptomatic of Python's package management.
 
 import logging
 from importlib import metadata
-from typing import Iterable, NamedTuple, Optional
+from typing import Any, Iterable, NamedTuple, Sequence, cast
 
+from packaging.markers import Marker, Value, Variable, default_environment
 from packaging.requirements import Requirement
+from packaging.utils import canonicalize_name
 
 DISTRIBUTION_NAME = "matrix-synapse"
 
@@ -65,9 +67,23 @@ RUNTIME_EXTRAS = set(ALL_EXTRAS) - DEV_EXTRAS
 VERSION = metadata.version(DISTRIBUTION_NAME)
 
 
+def _marker_environment(extra: str) -> dict[str, str]:
+    """Return the marker environment for `extra`, seeded with the current interpreter."""
+
+    env = cast(dict[str, str], dict(default_environment()))
+    env["extra"] = extra
+    return env
+
+
 def _is_dev_dependency(req: Requirement) -> bool:
-    return req.marker is not None and any(
-        req.marker.evaluate({"extra": e}) for e in DEV_EXTRAS
+    """Return True if `req` is a development dependency."""
+    if req.marker is None:
+        return False
+
+    marker_extras = _extras_from_marker(req.marker)
+    return any(
+        extra in DEV_EXTRAS and req.marker.evaluate(_marker_environment(extra))
+        for extra in marker_extras
     )
 
 
@@ -81,7 +97,7 @@ def _should_ignore_runtime_requirement(req: Requirement) -> bool:
     # In any case, workaround this by ignoring setuptools_rust here. (It might be
     # slightly cleaner to put `setuptools_rust` in a `build` extra or similar, but for
     # now let's do something quick and dirty.
-    if req.name == "setuptools_rust":
+    if canonicalize_name(req.name) == "setuptools-rust":
         return True
     return False
 
@@ -95,6 +111,7 @@ def _generic_dependencies() -> Iterable[Dependency]:
     """Yield pairs (requirement, must_be_installed)."""
     requirements = metadata.requires(DISTRIBUTION_NAME)
     assert requirements is not None
+    env_no_extra = _marker_environment("")
     for raw_requirement in requirements:
         req = Requirement(raw_requirement)
         if _is_dev_dependency(req) or _should_ignore_runtime_requirement(req):
@@ -103,7 +120,7 @@ def _generic_dependencies() -> Iterable[Dependency]:
         # https://packaging.pypa.io/en/latest/markers.html#usage notes that
         #   > Evaluating an extra marker with no environment is an error
         # so we pass in a dummy empty extra value here.
-        must_be_installed = req.marker is None or req.marker.evaluate({"extra": ""})
+        must_be_installed = req.marker is None or req.marker.evaluate(env_no_extra)
         yield Dependency(req, must_be_installed)
 
 
@@ -111,6 +128,8 @@ def _dependencies_for_extra(extra: str) -> Iterable[Dependency]:
     """Yield additional dependencies needed for a given `extra`."""
     requirements = metadata.requires(DISTRIBUTION_NAME)
     assert requirements is not None
+    env_no_extra = _marker_environment("")
+    env_for_extra = _marker_environment(extra)
     for raw_requirement in requirements:
         req = Requirement(raw_requirement)
         if _is_dev_dependency(req):
@@ -118,13 +137,85 @@ def _dependencies_for_extra(extra: str) -> Iterable[Dependency]:
         # Exclude mandatory deps by only selecting deps needed with this extra.
         if (
             req.marker is not None
-            and req.marker.evaluate({"extra": extra})
-            and not req.marker.evaluate({"extra": ""})
+            and req.marker.evaluate(env_for_extra)
+            and not req.marker.evaluate(env_no_extra)
         ):
             yield Dependency(req, True)
 
 
-def _not_installed(requirement: Requirement, extra: Optional[str] = None) -> str:
+def _values_from_marker_value(value: Value) -> set[str]:
+    """Extract text values contained in a marker `Value`."""
+
+    raw: Any = value.value
+    if isinstance(raw, str):
+        return {raw}
+    if isinstance(raw, (tuple, list)):
+        return {str(item) for item in raw}
+    return {str(raw)}
+
+
+def _extras_from_marker(marker: Marker | None) -> set[str]:
+    """Return every `extra` referenced in the supplied marker tree."""
+
+    extras: set[str] = set()
+
+    if marker is None:
+        return extras
+
+    def collect(tree: object) -> None:
+        if isinstance(tree, list):
+            for item in tree:
+                collect(item)
+        elif isinstance(tree, tuple) and len(tree) == 3:
+            lhs, _op, rhs = tree
+            if (
+                isinstance(lhs, Variable)
+                and lhs.value == "extra"
+                and isinstance(rhs, Value)
+            ):
+                extras.update(_values_from_marker_value(rhs))
+            elif (
+                isinstance(rhs, Variable)
+                and rhs.value == "extra"
+                and isinstance(lhs, Value)
+            ):
+                extras.update(_values_from_marker_value(lhs))
+
+    collect(marker._markers)
+    return extras
+
+
+def _extras_to_consider_for_requirement(
+    marker: Marker, base_candidates: Sequence[str]
+) -> set[str]:
+    """
+    Augment `base_candidates` with extras explicitly mentioned in `marker`.
+
+    Markers can mention extras (e.g. `extra == "saml2"`).
+    """
+
+    # Avoid modifying the input sequence.
+    # Use a set to efficiently avoid duplicate extras.
+    extras = set(base_candidates)
+
+    for candidate in _extras_from_marker(marker):
+        extras.add(candidate)
+
+    return extras
+
+
+def _marker_applies_for_any_extra(requirement: Requirement, extras: set[str]) -> bool:
+    """Check whether a requirement's marker matches any evaluated `extra`."""
+
+    if requirement.marker is None:
+        return True
+
+    return any(
+        requirement.marker.evaluate(_marker_environment(extra)) for extra in extras
+    )
+
+
+def _not_installed(requirement: Requirement, extra: str | None = None) -> str:
     if extra:
         return (
             f"Synapse {VERSION} needs {requirement.name} for {extra}, "
@@ -135,7 +226,7 @@ def _not_installed(requirement: Requirement, extra: Optional[str] = None) -> str
 
 
 def _incorrect_version(
-    requirement: Requirement, got: str, extra: Optional[str] = None
+    requirement: Requirement, got: str, extra: str | None = None
 ) -> str:
     if extra:
         return (
@@ -148,7 +239,7 @@ def _incorrect_version(
         )
 
 
-def _no_reported_version(requirement: Requirement, extra: Optional[str] = None) -> str:
+def _no_reported_version(requirement: Requirement, extra: str | None = None) -> str:
     if extra:
         return (
             f"Synapse {VERSION} needs {requirement} for {extra}, "
@@ -161,10 +252,10 @@ def _no_reported_version(requirement: Requirement, extra: Optional[str] = None)
         )
 
 
-def check_requirements(extra: Optional[str] = None) -> None:
+def check_requirements(extra: str | None = None) -> None:
     """Check Synapse's dependencies are present and correctly versioned.
 
-    If provided, `extra` must be the name of an pacakging extra (e.g. "saml2" in
+    If provided, `extra` must be the name of an packaging extra (e.g. "saml2" in
     `pip install matrix-synapse[saml2]`).
 
     If `extra` is None, this function checks that
@@ -174,6 +265,15 @@ def check_requirements(extra: Optional[str] = None) -> None:
     If `extra` is not None, this function checks that
     - the dependencies needed for that extra are installed and correctly versioned.
 
+    `marker`s are optional attributes on each requirement which specify
+    conditions under which the requirement applies. For example, a requirement
+    might only be needed on Windows, or with Python < 3.14. Markers can
+    additionally mention `extras` themselves, meaning a requirement may not
+    apply if the marker mentions an extra that the user has not asked for.
+
+    This function skips a requirement when its markers do not apply in the
+    current environment.
+
     :raises DependencyException: if a dependency is missing or incorrectly versioned.
     :raises ValueError: if this extra does not exist.
     """
@@ -188,7 +288,25 @@ def check_requirements(extra: Optional[str] = None) -> None:
     deps_unfulfilled = []
     errors = []
 
+    if extra is None:
+        # Default to all mandatory dependencies (non-dev extras).
+        # "" means all dependencies that aren't conditional on an extra.
+        base_extra_candidates: Sequence[str] = ("", *RUNTIME_EXTRAS)
+    else:
+        base_extra_candidates = (extra,)
+
     for requirement, must_be_installed in dependencies:
+        if requirement.marker is not None:
+            candidate_extras = _extras_to_consider_for_requirement(
+                requirement.marker, base_extra_candidates
+            )
+            # Skip checking this dependency if the requirement's marker object
+            # (i.e. `python_version < "3.14" and os_name == "win32"`) does not
+            # apply for any of the extras we're considering.
+            if not _marker_applies_for_any_extra(requirement, candidate_extras):
+                continue
+
+        # Check if the requirement is installed and correctly versioned.
         try:
             dist: metadata.Distribution = metadata.distribution(requirement.name)
         except metadata.PackageNotFoundError:
diff --git a/synapse/util/clock.py b/synapse/util/clock.py
new file mode 100644
index 0000000000..7232a1331c
--- /dev/null
+++ b/synapse/util/clock.py
@@ -0,0 +1,610 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl_3.0.html>.
+#
+#
+
+
+import logging
+from functools import wraps
+from typing import (
+    Any,
+    Callable,
+)
+from weakref import WeakSet
+
+from typing_extensions import ParamSpec
+from zope.interface import implementer
+
+from twisted.internet import defer, task
+from twisted.internet.defer import Deferred
+from twisted.internet.interfaces import IDelayedCall
+from twisted.internet.task import LoopingCall
+
+from synapse.logging import context
+from synapse.logging.loggers import ExplicitlyConfiguredLogger
+from synapse.types import ISynapseThreadlessReactor
+from synapse.util import log_failure
+from synapse.util.duration import Duration
+from synapse.util.stringutils import random_string_insecure_fast
+
+P = ParamSpec("P")
+
+
+logger = logging.getLogger(__name__)
+
+original_logger_class = logging.getLoggerClass()
+logging.setLoggerClass(ExplicitlyConfiguredLogger)
+clock_debug_logger = logging.getLogger("synapse.util.clock.debug")
+"""
+A logger for debugging what is scheduling calls.
+
+Ideally, these wouldn't be gated behind an `ExplicitlyConfiguredLogger` as including logs
+from this logger would be helpful to track when things are being scheduled. However, for
+these logs to be meaningful, they need to include a stack trace to show what initiated the
+call in the first place.
+
+Since the stack traces can create a lot of noise and make the logs hard to read (unless you're
+specifically debugging scheduling issues) we want users to opt-in to seeing these logs. To enable
+this, they must explicitly set `synapse.util.clock.debug` in the logging configuration. Note that
+this setting won't inherit the log level from the parent logger.
+"""
+# Restore the original logger class
+logging.setLoggerClass(original_logger_class)
+
+
+def _try_wakeup_deferred(d: Deferred) -> None:
+    """Try to wake up a deferred, but ignore any exceptions raised by the
+    callback. This is useful when we want to wake up a deferred that may have
+    already been cancelled, and we don't care about the result."""
+    try:
+        d.callback(None)
+    except Exception:
+        pass
+
+
+class Clock:
+    """
+    A Clock wraps a Twisted reactor and provides utilities on top of it.
+
+    This clock should be used in place of calls to the base reactor wherever `LoopingCall`
+    or `DelayedCall` are made (such as when calling `reactor.callLater`. This is to
+    ensure the calls made by this `HomeServer` instance are tracked and can be cleaned
+    up during `HomeServer.shutdown()`.
+
+    We enforce usage of this clock instead of using the reactor directly via lints in
+    `scripts-dev/mypy_synapse_plugin.py`.
+
+
+    Args:
+        reactor: The Twisted reactor to use.
+    """
+
+    _reactor: ISynapseThreadlessReactor
+
+    def __init__(self, reactor: ISynapseThreadlessReactor, server_name: str) -> None:
+        self._reactor = reactor
+        self._server_name = server_name
+
+        self._delayed_call_id: int = 0
+        """Unique ID used to track delayed calls"""
+
+        self._looping_calls: WeakSet[LoopingCall] = WeakSet()
+        """List of active looping calls"""
+
+        self._call_id_to_delayed_call: dict[int, IDelayedCall] = {}
+        """
+        Mapping from unique call ID to delayed call.
+
+        For "performance", this only tracks a subset of delayed calls: those created
+        with `call_later` with `call_later_cancel_on_shutdown=True`.
+        """
+
+        self._is_shutdown = False
+        """Whether shutdown has been requested by the HomeServer"""
+
+    def shutdown(self) -> None:
+        self._is_shutdown = True
+        self.cancel_all_looping_calls()
+        self.cancel_all_delayed_calls()
+
+    async def sleep(self, duration: Duration) -> None:
+        d: defer.Deferred[float] = defer.Deferred()
+        # Start task in the `sentinel` logcontext, to avoid leaking the current context
+        # into the reactor once it finishes.
+        with context.PreserveLoggingContext():
+            # We can ignore the lint here since this class is the one location callLater should
+            # be called.
+            self._reactor.callLater(
+                duration.as_secs(),
+                lambda _: _try_wakeup_deferred(d),
+                duration.as_secs(),
+            )  # type: ignore[call-later-not-tracked]
+            await d
+
+    def time(self) -> float:
+        """Returns the current system time in seconds since epoch."""
+        return self._reactor.seconds()
+
+    def time_msec(self) -> int:
+        """Returns the current system time in milliseconds since epoch."""
+        return int(self.time() * 1000)
+
+    def looping_call(
+        self,
+        f: Callable[P, object],
+        duration: Duration,
+        *args: P.args,
+        **kwargs: P.kwargs,
+    ) -> LoopingCall:
+        """Call a function repeatedly.
+
+        Waits `duration` initially before calling `f` for the first time.
+
+        If the function given to `looping_call` returns an awaitable/deferred, the next
+        call isn't scheduled until after the returned awaitable has finished. We get
+        this functionality thanks to this function being a thin wrapper around
+        `twisted.internet.task.LoopingCall`.
+
+        Note that the function will be called with generic `looping_call` logcontext, so
+        if it is anything other than a trivial task, you probably want to wrap it in
+        `run_as_background_process` to give it more specific label and track metrics.
+
+        Args:
+            f: The function to call repeatedly.
+            duration: How long to wait between calls.
+            *args: Positional arguments to pass to function.
+            **kwargs: Key arguments to pass to function.
+        """
+        return self._looping_call_common(f, duration, False, *args, **kwargs)
+
+    def looping_call_now(
+        self,
+        f: Callable[P, object],
+        duration: Duration,
+        *args: P.args,
+        **kwargs: P.kwargs,
+    ) -> LoopingCall:
+        """Call a function immediately, and then repeatedly thereafter.
+
+        As with `looping_call`: subsequent calls are not scheduled until after the
+        the Awaitable returned by a previous call has finished.
+
+        Note that the function will be called with generic `looping_call` logcontext, so
+        if it is anything other than a trivial task, you probably want to wrap it in
+        `run_as_background_process` to give it more specific label and track metrics.
+
+        Args:
+            f: The function to call repeatedly.
+            duration: How long to wait between calls.
+            *args: Positional arguments to pass to function.
+            **kwargs: Key arguments to pass to function.
+        """
+        return self._looping_call_common(f, duration, True, *args, **kwargs)
+
+    def _looping_call_common(
+        self,
+        f: Callable[P, object],
+        duration: Duration,
+        now: bool,
+        *args: P.args,
+        **kwargs: P.kwargs,
+    ) -> LoopingCall:
+        """Common functionality for `looping_call` and `looping_call_now`"""
+        instance_id = random_string_insecure_fast(5)
+
+        if self._is_shutdown:
+            raise Exception("Cannot start looping call. Clock has been shutdown")
+
+        looping_call_context_string = "looping_call"
+        if now:
+            looping_call_context_string = "looping_call_now"
+
+        @wraps(f)
+        def wrapped_f(*args: P.args, **kwargs: P.kwargs) -> Deferred:
+            clock_debug_logger.debug(
+                "%s(%s): Executing callback", looping_call_context_string, instance_id
+            )
+
+            assert context.current_context() is context.SENTINEL_CONTEXT, (
+                "Expected `looping_call` callback from the reactor to start with the sentinel logcontext "
+                f"but saw {context.current_context()}. In other words, another task shouldn't have "
+                "leaked their logcontext to us."
+            )
+
+            # Because this is a callback from the reactor, we will be using the
+            # `sentinel` log context at this point. We want the function to log with
+            # some logcontext as we want to know which server the logs came from.
+            #
+            # We use `PreserveLoggingContext` to prevent our new `looping_call`
+            # logcontext from finishing as soon as we exit this function, in case `f`
+            # returns an awaitable/deferred which would continue running and may try to
+            # restore the `loop_call` context when it's done (because it's trying to
+            # adhere to the Synapse logcontext rules.)
+            #
+            # This also ensures that we return to the `sentinel` context when we exit
+            # this function and yield control back to the reactor to avoid leaking the
+            # current logcontext to the reactor (which would then get picked up and
+            # associated with the next thing the reactor does)
+            with context.PreserveLoggingContext(
+                context.LoggingContext(
+                    name="looping_call", server_name=self._server_name
+                )
+            ):
+                # We use `run_in_background` to reset the logcontext after `f` (or the
+                # awaitable returned by `f`) completes to avoid leaking the current
+                # logcontext to the reactor
+                return context.run_in_background(f, *args, **kwargs)
+
+        # We can ignore the lint here since this is the one location LoopingCall's
+        # should be created.
+        call = task.LoopingCall(wrapped_f, *args, **kwargs)  # type: ignore[prefer-synapse-clock-looping-call]
+        call.clock = self._reactor
+        # If `now=true`, the function will be called here immediately so we need to be
+        # in the sentinel context now.
+        #
+        # We want to start the task in the `sentinel` logcontext, to avoid leaking the
+        # current context into the reactor after the function finishes.
+        with context.PreserveLoggingContext():
+            d = call.start(duration.as_secs(), now=now)
+        d.addErrback(log_failure, "Looping call died", consumeErrors=False)
+        self._looping_calls.add(call)
+
+        clock_debug_logger.debug(
+            "%s(%s): Scheduled looping call every %sms later",
+            looping_call_context_string,
+            instance_id,
+            duration.as_millis(),
+            # Find out who is scheduling the call which makes it easy to follow in the
+            # logs.
+            stack_info=True,
+        )
+
+        return call
+
+    def cancel_all_looping_calls(self, consumeErrors: bool = True) -> None:
+        """
+        Stop all running looping calls.
+
+        Args:
+            consumeErrors: Whether to re-raise errors encountered when cancelling the
+            scheduled call.
+        """
+        for call in self._looping_calls:
+            try:
+                call.stop()
+            except Exception:
+                if not consumeErrors:
+                    raise
+        self._looping_calls.clear()
+
+    def call_later(
+        self,
+        delay: Duration,
+        callback: Callable,
+        *args: Any,
+        call_later_cancel_on_shutdown: bool = True,
+        **kwargs: Any,
+    ) -> "DelayedCallWrapper":
+        """Call something later
+
+        Note that the function will be called with generic `call_later` logcontext, so
+        if it is anything other than a trivial task, you probably want to wrap it in
+        `run_as_background_process` to give it more specific label and track metrics.
+
+        Args:
+            delay: How long to wait.
+            callback: Function to call
+            *args: Postional arguments to pass to function.
+            call_later_cancel_on_shutdown: Whether this call should be tracked for cleanup during
+                shutdown. In general, all calls should be tracked. There may be a use case
+                not to track calls with a `timeout` of 0 (or similarly short) since tracking
+                them may result in rapid insertions and removals of tracked calls
+                unnecessarily. But unless a specific instance of tracking proves to be an
+                issue, we can just track all delayed calls.
+            **kwargs: Key arguments to pass to function.
+        """
+        call_id = self._delayed_call_id
+        self._delayed_call_id = self._delayed_call_id + 1
+
+        if self._is_shutdown:
+            raise Exception("Cannot start delayed call. Clock has been shutdown")
+
+        @wraps(callback)
+        def wrapped_callback(*args: Any, **kwargs: Any) -> None:
+            clock_debug_logger.debug("call_later(%s): Executing callback", call_id)
+
+            assert context.current_context() is context.SENTINEL_CONTEXT, (
+                "Expected `call_later` callback from the reactor to start with the sentinel logcontext "
+                f"but saw {context.current_context()}. In other words, another task shouldn't have "
+                "leaked their logcontext to us."
+            )
+
+            # Because this is a callback from the reactor, we will be using the
+            # `sentinel` log context at this point. We want the function to log with
+            # some logcontext as we want to know which server the logs came from.
+            #
+            # We use `PreserveLoggingContext` to prevent our new `call_later`
+            # logcontext from finishing as soon as we exit this function, in case `f`
+            # returns an awaitable/deferred which would continue running and may try to
+            # restore the `call_later` context when it's done (because it's trying to
+            # adhere to the Synapse logcontext rules.)
+            #
+            # This also ensures that we return to the `sentinel` context when we exit
+            # this function and yield control back to the reactor to avoid leaking the
+            # current logcontext to the reactor (which would then get picked up and
+            # associated with the next thing the reactor does)
+            try:
+                with context.PreserveLoggingContext(
+                    context.LoggingContext(
+                        name="call_later", server_name=self._server_name
+                    )
+                ):
+                    # We use `run_in_background` to reset the logcontext after `f` (or the
+                    # awaitable returned by `f`) completes to avoid leaking the current
+                    # logcontext to the reactor
+                    context.run_in_background(callback, *args, **kwargs)
+            finally:
+                if call_later_cancel_on_shutdown:
+                    # We still want to remove the call from the tracking map. Even if
+                    # the callback raises an exception.
+                    self._call_id_to_delayed_call.pop(call_id)
+
+        # We can ignore the lint here since this class is the one location callLater should
+        # be called.
+        call = self._reactor.callLater(
+            delay.as_secs(), wrapped_callback, *args, **kwargs
+        )  # type: ignore[call-later-not-tracked]
+
+        clock_debug_logger.debug(
+            "call_later(%s): Scheduled call for %ss later (tracked for shutdown: %s)",
+            call_id,
+            delay,
+            call_later_cancel_on_shutdown,
+            # Find out who is scheduling the call which makes it easy to follow in the
+            # logs.
+            stack_info=True,
+        )
+
+        wrapped_call = DelayedCallWrapper(call, call_id, self)
+        if call_later_cancel_on_shutdown:
+            self._call_id_to_delayed_call[call_id] = wrapped_call
+
+        return wrapped_call
+
+    def cancel_call_later(
+        self, wrapped_call: "DelayedCallWrapper", ignore_errs: bool = False
+    ) -> None:
+        try:
+            clock_debug_logger.debug(
+                "cancel_call_later: cancelling scheduled call %s", wrapped_call.call_id
+            )
+            wrapped_call.delayed_call.cancel()
+        except Exception:
+            if not ignore_errs:
+                raise
+
+    def cancel_all_delayed_calls(self, ignore_errs: bool = True) -> None:
+        """
+        Stop all scheduled calls that were marked with `cancel_on_shutdown` when they were created.
+
+        Args:
+            ignore_errs: Whether to re-raise errors encountered when cancelling the
+            scheduled call.
+        """
+        # We make a copy here since calling `cancel()` on a delayed_call
+        # will result in the call removing itself from the map mid-iteration.
+        for call_id, call in list(self._call_id_to_delayed_call.items()):
+            try:
+                clock_debug_logger.debug(
+                    "cancel_all_delayed_calls: cancelling scheduled call %s", call_id
+                )
+                call.cancel()
+            except Exception:
+                if not ignore_errs:
+                    raise
+        self._call_id_to_delayed_call.clear()
+
+    def call_when_running(
+        self,
+        callback: Callable[P, object],
+        *args: P.args,
+        **kwargs: P.kwargs,
+    ) -> None:
+        """
+        Call a function when the reactor is running.
+
+        If the reactor has not started, the callable will be scheduled to run when it
+        does start. Otherwise, the callable will be invoked immediately.
+
+        Args:
+            callback: Function to call
+            *args: Postional arguments to pass to function.
+            **kwargs: Key arguments to pass to function.
+        """
+        instance_id = random_string_insecure_fast(5)
+
+        def wrapped_callback(*args: Any, **kwargs: Any) -> None:
+            clock_debug_logger.debug(
+                "call_when_running(%s): Executing callback", instance_id
+            )
+
+            # Since this callback can be invoked immediately if the reactor is already
+            # running, we can't always assume that we're running in the sentinel
+            # logcontext (i.e. we can't assert that we're in the sentinel context like
+            # we can in other methods).
+            #
+            # We will only be running in the sentinel logcontext if the reactor was not
+            # running when `call_when_running` was invoked and later starts up.
+            #
+            # assert context.current_context() is context.SENTINEL_CONTEXT
+
+            # Because this is a callback from the reactor, we will be using the
+            # `sentinel` log context at this point. We want the function to log with
+            # some logcontext as we want to know which server the logs came from.
+            #
+            # We use `PreserveLoggingContext` to prevent our new `call_when_running`
+            # logcontext from finishing as soon as we exit this function, in case `f`
+            # returns an awaitable/deferred which would continue running and may try to
+            # restore the `loop_call` context when it's done (because it's trying to
+            # adhere to the Synapse logcontext rules.)
+            #
+            # This also ensures that we return to the `sentinel` context when we exit
+            # this function and yield control back to the reactor to avoid leaking the
+            # current logcontext to the reactor (which would then get picked up and
+            # associated with the next thing the reactor does)
+            with context.PreserveLoggingContext(
+                context.LoggingContext(
+                    name="call_when_running", server_name=self._server_name
+                )
+            ):
+                # We use `run_in_background` to reset the logcontext after `f` (or the
+                # awaitable returned by `f`) completes to avoid leaking the current
+                # logcontext to the reactor
+                context.run_in_background(callback, *args, **kwargs)
+
+        # We can ignore the lint here since this class is the one location
+        # callWhenRunning should be called.
+        self._reactor.callWhenRunning(wrapped_callback, *args, **kwargs)  # type: ignore[prefer-synapse-clock-call-when-running]
+
+        clock_debug_logger.debug(
+            "call_when_running(%s): Scheduled call",
+            instance_id,
+            # Find out who is scheduling the call which makes it easy to follow in the
+            # logs.
+            stack_info=True,
+        )
+
+    def add_system_event_trigger(
+        self,
+        phase: str,
+        event_type: str,
+        callback: Callable[P, object],
+        *args: P.args,
+        **kwargs: P.kwargs,
+    ) -> Any:
+        """
+        Add a function to be called when a system event occurs.
+
+        Equivalent to `reactor.addSystemEventTrigger` (see the that docstring for more
+        details), but ensures that the callback is run in a logging context.
+
+        Args:
+            phase: a time to call the event -- either the string 'before', 'after', or
+                'during', describing when to call it relative to the event's execution.
+            eventType: this is a string describing the type of event.
+            callback: Function to call
+            *args: Postional arguments to pass to function.
+            **kwargs: Key arguments to pass to function.
+
+        Returns:
+            an ID that can be used to remove this call with `reactor.removeSystemEventTrigger`.
+        """
+        instance_id = random_string_insecure_fast(5)
+
+        def wrapped_callback(*args: Any, **kwargs: Any) -> None:
+            clock_debug_logger.debug(
+                "add_system_event_trigger(%s): Executing %s %s callback",
+                instance_id,
+                phase,
+                event_type,
+            )
+
+            assert context.current_context() is context.SENTINEL_CONTEXT, (
+                "Expected `add_system_event_trigger` callback from the reactor to start with the sentinel logcontext "
+                f"but saw {context.current_context()}. In other words, another task shouldn't have "
+                "leaked their logcontext to us."
+            )
+
+            # Because this is a callback from the reactor, we will be using the
+            # `sentinel` log context at this point. We want the function to log with
+            # some logcontext as we want to know which server the logs came from.
+            #
+            # We use `PreserveLoggingContext` to prevent our new `system_event`
+            # logcontext from finishing as soon as we exit this function, in case `f`
+            # returns an awaitable/deferred which would continue running and may try to
+            # restore the `loop_call` context when it's done (because it's trying to
+            # adhere to the Synapse logcontext rules.)
+            #
+            # This also ensures that we return to the `sentinel` context when we exit
+            # this function and yield control back to the reactor to avoid leaking the
+            # current logcontext to the reactor (which would then get picked up and
+            # associated with the next thing the reactor does)
+            with context.PreserveLoggingContext(
+                context.LoggingContext(
+                    name="system_event", server_name=self._server_name
+                )
+            ):
+                # We use `run_in_background` to reset the logcontext after `f` (or the
+                # awaitable returned by `f`) completes to avoid leaking the current
+                # logcontext to the reactor
+                context.run_in_background(callback, *args, **kwargs)
+
+        clock_debug_logger.debug(
+            "add_system_event_trigger(%s) for %s %s",
+            instance_id,
+            phase,
+            event_type,
+            # Find out who is scheduling the call which makes it easy to follow in the
+            # logs.
+            stack_info=True,
+        )
+
+        # We can ignore the lint here since this class is the one location
+        # `addSystemEventTrigger` should be called.
+        return self._reactor.addSystemEventTrigger(
+            phase, event_type, wrapped_callback, *args, **kwargs
+        )  # type: ignore[prefer-synapse-clock-add-system-event-trigger]
+
+
+@implementer(IDelayedCall)
+class DelayedCallWrapper:
+    """Wraps an `IDelayedCall` so that we can intercept the call to `cancel()` and
+    properly cleanup the delayed call from the tracking map of the `Clock`.
+
+    args:
+        delayed_call: The actual `IDelayedCall`
+        call_id: Unique identifier for this delayed call
+        clock: The clock instance tracking this call
+    """
+
+    def __init__(self, delayed_call: IDelayedCall, call_id: int, clock: Clock):
+        self.delayed_call = delayed_call
+        self.call_id = call_id
+        self.clock = clock
+
+    def cancel(self) -> None:
+        """Remove the call from the tracking map and propagate the call to the
+        underlying delayed_call.
+        """
+        self.delayed_call.cancel()
+        try:
+            self.clock._call_id_to_delayed_call.pop(self.call_id)
+        except KeyError:
+            # If the delayed call isn't being tracked anymore we can just move on.
+            pass
+
+    def getTime(self) -> float:
+        """Propagate the call to the underlying delayed_call."""
+        return self.delayed_call.getTime()
+
+    def delay(self, secondsLater: float) -> None:
+        """Propagate the call to the underlying delayed_call."""
+        self.delayed_call.delay(secondsLater)
+
+    def reset(self, secondsFromNow: float) -> None:
+        """Propagate the call to the underlying delayed_call."""
+        self.delayed_call.reset(secondsFromNow)
+
+    def active(self) -> bool:
+        """Propagate the call to the underlying delayed_call."""
+        return self.delayed_call.active()
diff --git a/synapse/util/daemonize.py b/synapse/util/daemonize.py
index 9fdefc5a76..63e0571a78 100644
--- a/synapse/util/daemonize.py
+++ b/synapse/util/daemonize.py
@@ -27,7 +27,13 @@ import os
 import signal
 import sys
 from types import FrameType, TracebackType
-from typing import NoReturn, Optional, Type
+from typing import NoReturn
+
+from synapse.logging.context import (
+    LoggingContext,
+    PreserveLoggingContext,
+    current_context,
+)
 
 
 def daemonize_process(pid_file: str, logger: logging.Logger, chdir: str = "/") -> None:
@@ -64,8 +70,14 @@ def daemonize_process(pid_file: str, logger: logging.Logger, chdir: str = "/") -
             pid_fh.write(old_pid)
         sys.exit(1)
 
-    # Fork, creating a new process for the child.
-    process_id = os.fork()
+    # Stop the existing context *before* we fork the process. Otherwise the cputime
+    # metrics get confused about the per-thread resource usage appearing to go backwards
+    # because we're comparing the resource usage from the original process to the forked
+    # process. `PreserveLoggingContext` already takes care of restarting the original
+    # context *after* the block.
+    with PreserveLoggingContext():
+        # Fork, creating a new process for the child.
+        process_id = os.fork()
 
     if process_id != 0:
         # parent process: exit.
@@ -107,9 +119,9 @@ def daemonize_process(pid_file: str, logger: logging.Logger, chdir: str = "/") -
     # also catch any other uncaught exceptions before we get that far.)
 
     def excepthook(
-        type_: Type[BaseException],
+        type_: type[BaseException],
         value: BaseException,
-        traceback: Optional[TracebackType],
+        traceback: TracebackType | None,
     ) -> None:
         logger.critical("Unhanded exception", exc_info=(type_, value, traceback))
 
@@ -132,17 +144,21 @@ def daemonize_process(pid_file: str, logger: logging.Logger, chdir: str = "/") -
         sys.exit(1)
 
     # write a log line on SIGTERM.
-    def sigterm(signum: int, frame: Optional[FrameType]) -> NoReturn:
+    def sigterm(signum: int, frame: FrameType | None) -> NoReturn:
         logger.warning("Caught signal %s. Stopping daemon.", signum)
         sys.exit(0)
 
     signal.signal(signal.SIGTERM, sigterm)
 
+    # Copy the `server_name` from the current logcontext
+    server_name = current_context().server_name
+
     # Cleanup pid file at exit.
     def exit() -> None:
-        logger.warning("Stopping daemon.")
-        os.remove(pid_file)
-        sys.exit(0)
+        with LoggingContext(name="atexit", server_name=server_name):
+            logger.warning("Stopping daemon.")
+            os.remove(pid_file)
+            sys.exit(0)
 
     atexit.register(exit)
 
diff --git a/synapse/util/distributor.py b/synapse/util/distributor.py
index f48ae3373c..23ef67c752 100644
--- a/synapse/util/distributor.py
+++ b/synapse/util/distributor.py
@@ -20,15 +20,12 @@
 #
 import logging
 from typing import (
+    TYPE_CHECKING,
     Any,
     Awaitable,
     Callable,
-    Dict,
     Generic,
-    List,
-    Optional,
     TypeVar,
-    Union,
 )
 
 from typing_extensions import ParamSpec
@@ -36,10 +33,13 @@ from typing_extensions import ParamSpec
 from twisted.internet import defer
 
 from synapse.logging.context import make_deferred_yieldable, run_in_background
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.types import UserID
 from synapse.util.async_helpers import maybe_awaitable
 
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
+
+
 logger = logging.getLogger(__name__)
 
 
@@ -58,15 +58,15 @@ class Distributor:
       model will do for today.
     """
 
-    def __init__(self, server_name: str) -> None:
+    def __init__(self, hs: "HomeServer") -> None:
         """
         Args:
             server_name: The homeserver name of the server (used to label metrics)
                 (this should be `hs.hostname`).
         """
-        self.server_name = server_name
-        self.signals: Dict[str, Signal] = {}
-        self.pre_registration: Dict[str, List[Callable]] = {}
+        self.hs = hs
+        self.signals: dict[str, Signal] = {}
+        self.pre_registration: dict[str, list[Callable]] = {}
 
     def declare(self, name: str) -> None:
         if name in self.signals:
@@ -97,8 +97,8 @@ class Distributor:
         if name not in self.signals:
             raise KeyError("%r does not have a signal named %s" % (self, name))
 
-        run_as_background_process(
-            name, self.server_name, self.signals[name].fire, *args, **kwargs
+        self.hs.run_as_background_process(
+            name, self.signals[name].fire, *args, **kwargs
         )
 
 
@@ -118,7 +118,7 @@ class Signal(Generic[P]):
 
     def __init__(self, name: str):
         self.name: str = name
-        self.observers: List[Callable[P, Any]] = []
+        self.observers: list[Callable[P, Any]] = []
 
     def observe(self, observer: Callable[P, Any]) -> None:
         """Adds a new callable to the observer list which will be invoked by
@@ -127,7 +127,7 @@ class Signal(Generic[P]):
         Each observer callable may return a Deferred."""
         self.observers.append(observer)
 
-    def fire(self, *args: P.args, **kwargs: P.kwargs) -> "defer.Deferred[List[Any]]":
+    def fire(self, *args: P.args, **kwargs: P.kwargs) -> "defer.Deferred[list[Any]]":
         """Invokes every callable in the observer list, passing in the args and
         kwargs. Exceptions thrown by observers are logged but ignored. It is
         not an error to fire a signal with no observers.
@@ -135,7 +135,7 @@ class Signal(Generic[P]):
         Returns a Deferred that will complete when all the observers have
         completed."""
 
-        async def do(observer: Callable[P, Union[R, Awaitable[R]]]) -> Optional[R]:
+        async def do(observer: Callable[P, R | Awaitable[R]]) -> R | None:
             try:
                 return await maybe_awaitable(observer(*args, **kwargs))
             except Exception as e:
diff --git a/synapse/util/duration.py b/synapse/util/duration.py
new file mode 100644
index 0000000000..135b980852
--- /dev/null
+++ b/synapse/util/duration.py
@@ -0,0 +1,117 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 Element Creations Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+
+from datetime import timedelta
+from typing import overload
+
+# Constant so we don't keep creating new timedelta objects when calling
+# `.as_millis()`.
+_ONE_MILLISECOND = timedelta(milliseconds=1)
+
+
+class Duration(timedelta):
+    """A subclass of timedelta that adds a convenience method for getting
+    the duration in milliseconds.
+
+    Examples:
+
+    ```
+    duration = Duration(hours=2)
+    print(duration.as_millis())  # Outputs: 7200000
+    ```
+    """
+
+    def as_millis(self) -> int:
+        """Returns the duration in milliseconds."""
+        return int(self / _ONE_MILLISECOND)
+
+    def as_secs(self) -> float:
+        """Returns the duration in seconds."""
+        return self.total_seconds()
+
+    # Override arithmetic operations to return Duration instances
+
+    def __add__(self, other: timedelta) -> "Duration":
+        """Add two durations together, returning a Duration."""
+        result = super().__add__(other)
+        return Duration(seconds=result.total_seconds())
+
+    def __radd__(self, other: timedelta) -> "Duration":
+        """Add two durations together (reversed), returning a Duration."""
+        result = super().__radd__(other)
+        return Duration(seconds=result.total_seconds())
+
+    def __sub__(self, other: timedelta) -> "Duration":
+        """Subtract two durations, returning a Duration."""
+        result = super().__sub__(other)
+        return Duration(seconds=result.total_seconds())
+
+    def __rsub__(self, other: timedelta) -> "Duration":
+        """Subtract two durations (reversed), returning a Duration."""
+        result = super().__rsub__(other)
+        return Duration(seconds=result.total_seconds())
+
+    def __mul__(self, other: float) -> "Duration":
+        """Multiply a duration by a scalar, returning a Duration."""
+        result = super().__mul__(other)
+        return Duration(seconds=result.total_seconds())
+
+    def __rmul__(self, other: float) -> "Duration":
+        """Multiply a duration by a scalar (reversed), returning a Duration."""
+        result = super().__rmul__(other)
+        return Duration(seconds=result.total_seconds())
+
+    @overload
+    def __truediv__(self, other: timedelta) -> float: ...
+
+    @overload
+    def __truediv__(self, other: float) -> "Duration": ...
+
+    def __truediv__(self, other: float | timedelta) -> "Duration | float":
+        """Divide a duration by a scalar or another duration.
+
+        If dividing by a scalar, returns a Duration.
+        If dividing by a timedelta, returns a float ratio.
+        """
+        result = super().__truediv__(other)
+        if isinstance(other, timedelta):
+            # Dividing by a timedelta gives a float ratio
+            assert isinstance(result, float)
+            return result
+        else:
+            # Dividing by a scalar gives a Duration
+            assert isinstance(result, timedelta)
+            return Duration(seconds=result.total_seconds())
+
+    @overload
+    def __floordiv__(self, other: timedelta) -> int: ...
+
+    @overload
+    def __floordiv__(self, other: int) -> "Duration": ...
+
+    def __floordiv__(self, other: int | timedelta) -> "Duration | int":
+        """Floor divide a duration by a scalar or another duration.
+
+        If dividing by a scalar, returns a Duration.
+        If dividing by a timedelta, returns an int ratio.
+        """
+        result = super().__floordiv__(other)
+        if isinstance(other, timedelta):
+            # Dividing by a timedelta gives an int ratio
+            assert isinstance(result, int)
+            return result
+        else:
+            # Dividing by a scalar gives a Duration
+            assert isinstance(result, timedelta)
+            return Duration(seconds=result.total_seconds())
diff --git a/synapse/util/events.py b/synapse/util/events.py
index 4808268702..19eca1c1ae 100644
--- a/synapse/util/events.py
+++ b/synapse/util/events.py
@@ -13,9 +13,10 @@
 #
 #
 
-from typing import Any, List, Optional
+from typing import Any
+
+from pydantic import Field, StrictStr, ValidationError, field_validator
 
-from synapse._pydantic_compat import Field, StrictStr, ValidationError, validator
 from synapse.types import JsonDict
 from synapse.util.pydantic_models import ParseModel
 from synapse.util.stringutils import random_string
@@ -40,7 +41,7 @@ class MTextRepresentation(ParseModel):
     """
 
     body: StrictStr
-    mimetype: Optional[StrictStr]
+    mimetype: StrictStr | None = None
 
 
 class MTopic(ParseModel):
@@ -52,7 +53,7 @@ class MTopic(ParseModel):
     See `TopicContentBlock` in the Matrix specification.
     """
 
-    m_text: Optional[List[MTextRepresentation]] = Field(alias="m.text")
+    m_text: list[MTextRepresentation] | None = Field(None, alias="m.text")
     """
     An ordered array of textual representations in different mimetypes.
     """
@@ -60,16 +61,17 @@ class MTopic(ParseModel):
     # Because "Receivers SHOULD use the first representation in the array that they
     # understand.", we ignore invalid representations in the `m.text` field and use
     # what we can.
-    @validator("m_text", pre=True)
+    @field_validator("m_text", mode="before")
+    @classmethod
     def ignore_invalid_representations(
         cls, m_text: Any
-    ) -> Optional[List[MTextRepresentation]]:
-        if not isinstance(m_text, list):
-            raise ValueError("m.text must be a list")
+    ) -> list[MTextRepresentation] | None:
+        if not isinstance(m_text, (list, tuple)):
+            raise ValueError("m.text must be a list or a tuple")
         representations = []
         for element in m_text:
             try:
-                representations.append(MTextRepresentation.parse_obj(element))
+                representations.append(MTextRepresentation.model_validate(element))
             except ValidationError:
                 continue
         return representations
@@ -85,22 +87,23 @@ class TopicContent(ParseModel):
     The topic in plain text.
     """
 
-    m_topic: Optional[MTopic] = Field(alias="m.topic")
+    m_topic: MTopic | None = Field(None, alias="m.topic")
     """
     Textual representation of the room topic in different mimetypes.
     """
 
     # We ignore invalid `m.topic` fields as we can always fall back to the plain-text
     # `topic` field.
-    @validator("m_topic", pre=True)
-    def ignore_invalid_m_topic(cls, m_topic: Any) -> Optional[MTopic]:
+    @field_validator("m_topic", mode="before")
+    @classmethod
+    def ignore_invalid_m_topic(cls, m_topic: Any) -> MTopic | None:
         try:
-            return MTopic.parse_obj(m_topic)
+            return MTopic.model_validate(m_topic)
         except ValidationError:
             return None
 
 
-def get_plain_text_topic_from_event_content(content: JsonDict) -> Optional[str]:
+def get_plain_text_topic_from_event_content(content: JsonDict) -> str | None:
     """
     Given the `content` of an `m.room.topic` event, returns the plain-text topic
     representation. Prefers pulling plain-text from the newer `m.topic` field if
@@ -114,7 +117,7 @@ def get_plain_text_topic_from_event_content(content: JsonDict) -> Optional[str]:
     """
 
     try:
-        topic_content = TopicContent.parse_obj(content)
+        topic_content = TopicContent.model_validate(content, strict=False)
     except ValidationError:
         return None
 
diff --git a/synapse/util/file_consumer.py b/synapse/util/file_consumer.py
index 9fa8d40234..c473c524f6 100644
--- a/synapse/util/file_consumer.py
+++ b/synapse/util/file_consumer.py
@@ -61,15 +61,15 @@ class BackgroundFileConsumer:
 
         # Queue of slices of bytes to be written. When producer calls
         # unregister a final None is sent.
-        self._bytes_queue: queue.Queue[Optional[bytes]] = queue.Queue()
+        self._bytes_queue: queue.Queue[bytes | None] = queue.Queue()
 
         # Deferred that is resolved when finished writing
         #
         # This is really Deferred[None], but mypy doesn't seem to like that.
-        self._finished_deferred: Optional[Deferred[Any]] = None
+        self._finished_deferred: Deferred[Any] | None = None
 
         # If the _writer thread throws an exception it gets stored here.
-        self._write_exception: Optional[Exception] = None
+        self._write_exception: Exception | None = None
 
     def registerProducer(
         self, producer: Union[IPushProducer, IPullProducer], streaming: bool
diff --git a/synapse/util/gai_resolver.py b/synapse/util/gai_resolver.py
index 3c7a966e87..f40de8dcc2 100644
--- a/synapse/util/gai_resolver.py
+++ b/synapse/util/gai_resolver.py
@@ -17,13 +17,8 @@ from socket import (
 from typing import (
     TYPE_CHECKING,
     Callable,
-    List,
     NoReturn,
-    Optional,
     Sequence,
-    Tuple,
-    Type,
-    Union,
 )
 
 from zope.interface import implementer
@@ -91,13 +86,13 @@ _socktypeToType = {
 }
 
 
-_GETADDRINFO_RESULT = List[
-    Tuple[
+_GETADDRINFO_RESULT = list[
+    tuple[
         AddressFamily,
         SocketKind,
         int,
         str,
-        Union[Tuple[str, int], Tuple[str, int, int, int], Tuple[int, bytes]],
+        tuple[str, int] | tuple[str, int, int, int] | tuple[int, bytes],
     ]
 ]
 
@@ -112,7 +107,7 @@ class GAIResolver:
     def __init__(
         self,
         reactor: IReactorThreads,
-        getThreadPool: Optional[Callable[[], "ThreadPool"]] = None,
+        getThreadPool: Callable[[], "ThreadPool"] | None = None,
         getaddrinfo: Callable[[str, int, int, int], _GETADDRINFO_RESULT] = getaddrinfo,
     ):
         """
@@ -141,7 +136,7 @@ class GAIResolver:
         resolutionReceiver: IResolutionReceiver,
         hostName: str,
         portNumber: int = 0,
-        addressTypes: Optional[Sequence[Type[IAddress]]] = None,
+        addressTypes: Sequence[type[IAddress]] | None = None,
         transportSemantics: str = "TCP",
     ) -> IHostResolution:
         """
diff --git a/synapse/util/httpresourcetree.py b/synapse/util/httpresourcetree.py
index 6471b31c94..46fa92a4c5 100644
--- a/synapse/util/httpresourcetree.py
+++ b/synapse/util/httpresourcetree.py
@@ -20,7 +20,6 @@
 #
 
 import logging
-from typing import Dict
 
 from twisted.web.resource import Resource
 
@@ -30,7 +29,7 @@ logger = logging.getLogger(__name__)
 
 
 def create_resource_tree(
-    desired_tree: Dict[str, Resource], root_resource: Resource
+    desired_tree: dict[str, Resource], root_resource: Resource
 ) -> Resource:
     """Create the resource tree for this homeserver.
 
@@ -48,7 +47,7 @@ def create_resource_tree(
     # unless you give it a Request object IN ADDITION to the name :/ So
     # instead, we'll store a copy of this mapping so we can actually add
     # extra resources to existing nodes. See self._resource_id for the key.
-    resource_mappings: Dict[str, Resource] = {}
+    resource_mappings: dict[str, Resource] = {}
     for full_path_str, res in desired_tree.items():
         # twisted requires all resources to be bytes
         full_path = full_path_str.encode("utf-8")
diff --git a/synapse/util/iterutils.py b/synapse/util/iterutils.py
index 0a6a30aab2..cb3b996073 100644
--- a/synapse/util/iterutils.py
+++ b/synapse/util/iterutils.py
@@ -22,22 +22,19 @@
 import heapq
 from itertools import islice
 from typing import (
+    Any,
     Callable,
     Collection,
-    Dict,
     Generator,
     Iterable,
     Iterator,
-    List,
     Mapping,
     Protocol,
-    Set,
     Sized,
-    Tuple,
     TypeVar,
 )
 
-T = TypeVar("T")
+T = TypeVar("T", bound=Any)
 S = TypeVar("S", bound="_SelfSlice")
 
 
@@ -52,7 +49,7 @@ class _SelfSlice(Sized, Protocol):
     def __getitem__(self: S, i: slice) -> S: ...
 
 
-def batch_iter(iterable: Iterable[T], size: int) -> Iterator[Tuple[T, ...]]:
+def batch_iter(iterable: Iterable[T], size: int) -> Iterator[tuple[T, ...]]:
     """batch an iterable up into tuples with a maximum size
 
     Args:
@@ -80,7 +77,7 @@ def chunk_seq(iseq: S, maxlen: int) -> Iterator[S]:
 
 def partition(
     iterable: Iterable[T], predicate: Callable[[T], bool]
-) -> Tuple[List[T], List[T]]:
+) -> tuple[list[T], list[T]]:
     """
     Separate a given iterable into two lists based on the result of a predicate function.
 
@@ -115,7 +112,7 @@ def sorted_topologically(
     # This is implemented by Kahn's algorithm.
 
     degree_map = dict.fromkeys(nodes, 0)
-    reverse_graph: Dict[T, Set[T]] = {}
+    reverse_graph: dict[T, set[T]] = {}
 
     for node, edges in graph.items():
         if node not in degree_map:
@@ -165,7 +162,7 @@ def sorted_topologically_batched(
     """
 
     degree_map = dict.fromkeys(nodes, 0)
-    reverse_graph: Dict[T, Set[T]] = {}
+    reverse_graph: dict[T, set[T]] = {}
 
     for node, edges in graph.items():
         if node not in degree_map:
diff --git a/synapse/util/json.py b/synapse/util/json.py
new file mode 100644
index 0000000000..b1091704a8
--- /dev/null
+++ b/synapse/util/json.py
@@ -0,0 +1,56 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl_3.0.html>.
+#
+#
+
+import json
+from typing import (
+    Any,
+)
+
+from immutabledict import immutabledict
+
+
+def _reject_invalid_json(val: Any) -> None:
+    """Do not allow Infinity, -Infinity, or NaN values in JSON."""
+    raise ValueError("Invalid JSON value: '%s'" % val)
+
+
+def _handle_immutabledict(obj: Any) -> dict[Any, Any]:
+    """Helper for json_encoder. Makes immutabledicts serializable by returning
+    the underlying dict
+    """
+    if type(obj) is immutabledict:
+        # fishing the protected dict out of the object is a bit nasty,
+        # but we don't really want the overhead of copying the dict.
+        try:
+            # Safety: we catch the AttributeError immediately below.
+            return obj._dict
+        except AttributeError:
+            # If all else fails, resort to making a copy of the immutabledict
+            return dict(obj)
+    raise TypeError(
+        "Object of type %s is not JSON serializable" % obj.__class__.__name__
+    )
+
+
+# A custom JSON encoder which:
+#   * handles immutabledicts
+#   * produces valid JSON (no NaNs etc)
+#   * reduces redundant whitespace
+json_encoder = json.JSONEncoder(
+    allow_nan=False, separators=(",", ":"), default=_handle_immutabledict
+)
+
+# Create a custom decoder to reject Python extensions to JSON.
+json_decoder = json.JSONDecoder(parse_constant=_reject_invalid_json)
diff --git a/synapse/util/linked_list.py b/synapse/util/linked_list.py
index 87f801c0cf..c7a164d02e 100644
--- a/synapse/util/linked_list.py
+++ b/synapse/util/linked_list.py
@@ -22,7 +22,7 @@
 """A circular doubly linked list implementation."""
 
 import threading
-from typing import Generic, Optional, Type, TypeVar
+from typing import Generic, TypeVar
 
 P = TypeVar("P")
 LN = TypeVar("LN", bound="ListNode")
@@ -47,13 +47,13 @@ class ListNode(Generic[P]):
         "next_node",
     ]
 
-    def __init__(self, cache_entry: Optional[P] = None) -> None:
+    def __init__(self, cache_entry: P | None = None) -> None:
         self.cache_entry = cache_entry
-        self.prev_node: Optional[ListNode[P]] = None
-        self.next_node: Optional[ListNode[P]] = None
+        self.prev_node: ListNode[P] | None = None
+        self.next_node: ListNode[P] | None = None
 
     @classmethod
-    def create_root_node(cls: Type["ListNode[P]"]) -> "ListNode[P]":
+    def create_root_node(cls: type["ListNode[P]"]) -> "ListNode[P]":
         """Create a new linked list by creating a "root" node, which is a node
         that has prev_node/next_node pointing to itself and no associated cache
         entry.
@@ -65,7 +65,7 @@ class ListNode(Generic[P]):
 
     @classmethod
     def insert_after(
-        cls: Type[LN],
+        cls: type[LN],
         cache_entry: P,
         node: "ListNode[P]",
     ) -> LN:
@@ -149,7 +149,7 @@ class ListNode(Generic[P]):
         prev_node.next_node = self
         next_node.prev_node = self
 
-    def get_cache_entry(self) -> Optional[P]:
+    def get_cache_entry(self) -> P | None:
         """Get the cache entry, returns None if this is the root node (i.e.
         cache_entry is None) or if the entry has been dropped.
         """
diff --git a/synapse/util/macaroons.py b/synapse/util/macaroons.py
index 6fa15543ec..178b6fa377 100644
--- a/synapse/util/macaroons.py
+++ b/synapse/util/macaroons.py
@@ -22,13 +22,14 @@
 
 """Utilities for manipulating macaroons"""
 
-from typing import Callable, Literal, Optional
+from typing import Callable, Literal
 
 import attr
 import pymacaroons
 from pymacaroons.exceptions import MacaroonVerificationFailedException
 
-from synapse.util import Clock, stringutils
+from synapse.util import stringutils
+from synapse.util.clock import Clock
 
 MacaroonType = Literal["access", "delete_pusher", "session"]
 
@@ -51,7 +52,7 @@ def get_value_from_macaroon(macaroon: pymacaroons.Macaroon, key: str) -> str:
              caveat in the macaroon, or if the caveat was not found in the macaroon.
     """
     prefix = key + " = "
-    result: Optional[str] = None
+    result: str | None = None
     for caveat in macaroon.caveats:
         if not caveat.caveat_id.startswith(prefix):
             continue
diff --git a/synapse/util/manhole.py b/synapse/util/manhole.py
index 63ec3e7e1b..859e9a9072 100644
--- a/synapse/util/manhole.py
+++ b/synapse/util/manhole.py
@@ -21,7 +21,7 @@
 import inspect
 import sys
 import traceback
-from typing import Any, Dict, Optional
+from typing import Any
 
 from twisted.conch import manhole_ssh
 from twisted.conch.insults import insults
@@ -71,7 +71,7 @@ EddTrx3TNpr1D5m/f+6mnXWrc8u9y1+GNx9yz889xMjIBTBI9KqaaOs=
 -----END RSA PRIVATE KEY-----"""
 
 
-def manhole(settings: ManholeConfig, globals: Dict[str, Any]) -> ServerFactory:
+def manhole(settings: ManholeConfig, globals: dict[str, Any]) -> ServerFactory:
     """Starts a ssh listener with password authentication using
     the given username and password. Clients connecting to the ssh
     listener will find themselves in a colored python shell with
@@ -130,7 +130,7 @@ class SynapseManhole(ColoredManhole):
 
 
 class SynapseManholeInterpreter(ManholeInterpreter):
-    def showsyntaxerror(self, filename: Optional[str] = None) -> None:
+    def showsyntaxerror(self, filename: str | None = None) -> None:
         """Display the syntax error that just occurred.
 
         Overrides the base implementation, ignoring sys.excepthook. We always want
diff --git a/synapse/util/metrics.py b/synapse/util/metrics.py
index 608a4d4848..5e86939e37 100644
--- a/synapse/util/metrics.py
+++ b/synapse/util/metrics.py
@@ -19,17 +19,21 @@
 #
 #
 
+# These imports are necessary for python <= 3.13 in order for the `InFlightGauge` type
+# annotations not to be evaluated at runtime.
+# Starting with python 3.14, annotations are lazily evaluated by default, which is the
+# behaviour we desire.
+# More info here: https://docs.python.org/3/reference/compound_stmts.html#annotations
+from __future__ import annotations
+
 import logging
 from functools import wraps
 from types import TracebackType
 from typing import (
     Awaitable,
     Callable,
-    Dict,
     Generator,
-    Optional,
     Protocol,
-    Type,
     TypeVar,
 )
 
@@ -42,7 +46,7 @@ from synapse.logging.context import (
     current_context,
 )
 from synapse.metrics import SERVER_NAME_LABEL, InFlightGauge
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 logger = logging.getLogger(__name__)
 
@@ -138,7 +142,7 @@ class HasClockAndServerName(Protocol):
 
 
 def measure_func(
-    name: Optional[str] = None,
+    name: str | None = None,
 ) -> Callable[[Callable[P, Awaitable[R]]], Callable[P, Awaitable[R]]]:
     """Decorate an async method with a `Measure` context manager.
 
@@ -217,8 +221,12 @@ class Measure:
         else:
             assert isinstance(curr_context, LoggingContext)
             parent_context = curr_context
-        self._logging_context = LoggingContext(str(curr_context), parent_context)
-        self.start: Optional[float] = None
+        self._logging_context = LoggingContext(
+            name=str(curr_context),
+            server_name=self.server_name,
+            parent_context=parent_context,
+        )
+        self.start: float | None = None
 
     def __enter__(self) -> "Measure":
         if self.start is not None:
@@ -234,9 +242,9 @@ class Measure:
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_val: Optional[BaseException],
-        exc_tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
     ) -> None:
         if self.start is None:
             raise RuntimeError("Measure() block exited without being entered")
@@ -289,21 +297,50 @@ class DynamicCollectorRegistry(CollectorRegistry):
 
     def __init__(self) -> None:
         super().__init__()
-        self._pre_update_hooks: Dict[str, Callable[[], None]] = {}
+        self._server_name_to_pre_update_hooks: dict[
+            str, dict[str, Callable[[], None]]
+        ] = {}
+        """
+        Mapping of server name to a mapping of metric name to metric pre-update
+        hook
+        """
 
     def collect(self) -> Generator[Metric, None, None]:
         """
         Collects metrics, calling pre-update hooks first.
         """
 
-        for pre_update_hook in self._pre_update_hooks.values():
-            pre_update_hook()
+        for pre_update_hooks in self._server_name_to_pre_update_hooks.values():
+            for pre_update_hook in pre_update_hooks.values():
+                pre_update_hook()
 
         yield from super().collect()
 
-    def register_hook(self, metric_name: str, hook: Callable[[], None]) -> None:
+    def register_hook(
+        self, server_name: str, metric_name: str, hook: Callable[[], None]
+    ) -> None:
         """
         Registers a hook that is called before metric collection.
         """
 
-        self._pre_update_hooks[metric_name] = hook
+        server_hooks = self._server_name_to_pre_update_hooks.setdefault(server_name, {})
+        if server_hooks.get(metric_name) is not None:
+            # TODO: This should be an `assert` since registering the same metric name
+            # multiple times will clobber the old metric.
+            #
+            # We currently rely on this behaviour in a few places:
+            #  - We instantiate multiple `SyncRestServlet`, one per listener, and in the
+            #   `__init__` we setup a new `LruCache`.
+            #  - We instantiate multiple `ApplicationService` (one per configured
+            #    application service) which use the `@cached` decorator on some methods.
+            #
+            # Once the above behaviour is changed, this should be changed to an `assert`.
+            logger.error(
+                "Metric named %s already registered for server %s",
+                metric_name,
+                server_name,
+            )
+        server_hooks[metric_name] = hook
+
+    def unregister_hooks_for_homeserver(self, server_name: str) -> None:
+        self._server_name_to_pre_update_hooks.pop(server_name, None)
diff --git a/synapse/util/module_loader.py b/synapse/util/module_loader.py
index a33c75d54e..ae50e302ed 100644
--- a/synapse/util/module_loader.py
+++ b/synapse/util/module_loader.py
@@ -21,7 +21,7 @@
 import importlib
 import importlib.util
 from types import ModuleType
-from typing import Any, Tuple, Type
+from typing import Any
 
 import jsonschema
 
@@ -30,7 +30,7 @@ from synapse.config._util import json_error_to_config_error
 from synapse.types import StrSequence
 
 
-def load_module(provider: dict, config_path: StrSequence) -> Tuple[Type, Any]:
+def load_module(provider: dict, config_path: StrSequence) -> tuple[type, Any]:
     """Loads a synapse module with its config
 
     Args:
diff --git a/synapse/util/patch_inline_callbacks.py b/synapse/util/patch_inline_callbacks.py
index c776ad65b3..fca166a5b8 100644
--- a/synapse/util/patch_inline_callbacks.py
+++ b/synapse/util/patch_inline_callbacks.py
@@ -21,7 +21,7 @@
 import functools
 import sys
 from types import GeneratorType
-from typing import Any, Callable, Generator, List, TypeVar, cast
+from typing import Any, Callable, Generator, TypeVar, cast
 
 from typing_extensions import ParamSpec
 
@@ -56,7 +56,7 @@ def do_patch() -> None:
         @functools.wraps(f)
         def wrapped(*args: P.args, **kwargs: P.kwargs) -> "Deferred[T]":
             start_context = current_context()
-            changes: List[str] = []
+            changes: list[str] = []
             orig: Callable[P, "Deferred[T]"] = orig_inline_callbacks(
                 _check_yield_points(f, changes)
             )
@@ -126,7 +126,7 @@ def do_patch() -> None:
 
 def _check_yield_points(
     f: Callable[P, Generator["Deferred[object]", object, T]],
-    changes: List[str],
+    changes: list[str],
 ) -> Callable:
     """Wraps a generator that is about to be passed to defer.inlineCallbacks
     checking that after every yield the log contexts are correct.
diff --git a/synapse/util/pydantic_models.py b/synapse/util/pydantic_models.py
index 4880709501..783d122013 100644
--- a/synapse/util/pydantic_models.py
+++ b/synapse/util/pydantic_models.py
@@ -13,21 +13,30 @@
 #
 #
 
-import re
-from typing import Any, Callable, Generator
+from typing import Annotated
 
-from synapse._pydantic_compat import BaseModel, Extra, StrictStr
+from pydantic import AfterValidator, BaseModel, ConfigDict, StrictStr, StringConstraints
+
+from synapse.api.errors import SynapseError
 from synapse.types import EventID
 
 
 class ParseModel(BaseModel):
     """A custom version of Pydantic's BaseModel which
 
-     - ignores unknown fields and
-     - does not allow fields to be overwritten after construction,
+     - ignores unknown fields,
+     - does not allow fields to be overwritten after construction and
+     - enables strict mode,
 
     but otherwise uses Pydantic's default behaviour.
 
+    Strict mode can adversely affect some types of fields, and should be disabled
+    for a field if:
+
+    - the field's type is a `Path` or `FilePath`. Strict mode will refuse to
+      coerce from `str` (likely what the yaml parser will produce) to `FilePath`,
+      raising a `ValidationError`.
+
     For now, ignore unknown fields. In the future, we could change this so that unknown
     config values cause a ValidationError, provided the error messages are meaningful to
     server operators.
@@ -36,48 +45,19 @@ class ParseModel(BaseModel):
     https://pydantic-docs.helpmanual.io/usage/model_config/#change-behaviour-globally
     """
 
-    class Config:
-        # By default, ignore fields that we don't recognise.
-        extra = Extra.ignore
-        # By default, don't allow fields to be reassigned after parsing.
-        allow_mutation = False
+    model_config = ConfigDict(extra="ignore", frozen=True, strict=True)
 
 
-class AnyEventId(StrictStr):
-    """
-    A validator for strings that need to be an Event ID.
+def validate_event_id_v1_and_2(value: str) -> str:
+    try:
+        EventID.from_string(value)
+    except SynapseError as e:
+        raise ValueError from e
+    return value
 
-    Accepts any valid grammar of Event ID from any room version.
-    """
 
-    EVENT_ID_HASH_ROOM_VERSION_3_PLUS = re.compile(
-        r"^([a-zA-Z0-9-_]{43}|[a-zA-Z0-9+/]{43})$"
-    )
-
-    @classmethod
-    def __get_validators__(cls) -> Generator[Callable[..., Any], Any, Any]:
-        yield from super().__get_validators__()  # type: ignore
-        yield cls.validate_event_id
-
-    @classmethod
-    def validate_event_id(cls, value: str) -> str:
-        if not value.startswith("$"):
-            raise ValueError("Event ID must start with `$`")
-
-        if ":" in value:
-            # Room versions 1 and 2
-            EventID.from_string(value)  # throws on fail
-        else:
-            # Room versions 3+: event ID is $ + a base64 sha256 hash
-            # Room version 3 is base64, 4+ are base64Url
-            # In both cases, the base64 is unpadded.
-            # refs:
-            # - https://spec.matrix.org/v1.15/rooms/v3/ e.g. $acR1l0raoZnm60CBwAVgqbZqoO/mYU81xysh1u7XcJk
-            # - https://spec.matrix.org/v1.15/rooms/v4/ e.g. $Rqnc-F-dvnEYJTyHq_iKxU2bZ1CI92-kuZq3a5lr5Zg
-            b64_hash = value[1:]
-            if cls.EVENT_ID_HASH_ROOM_VERSION_3_PLUS.fullmatch(b64_hash) is None:
-                raise ValueError(
-                    "Event ID must either have a domain part or be a valid hash"
-                )
-
-        return value
+EventIdV1And2 = Annotated[StrictStr, AfterValidator(validate_event_id_v1_and_2)]
+EventIdV3Plus = Annotated[
+    StrictStr, StringConstraints(pattern=r"^\$([a-zA-Z0-9-_]{43}|[a-zA-Z0-9+/]{43})$")
+]
+AnyEventId = EventIdV1And2 | EventIdV3Plus
diff --git a/synapse/util/ratelimitutils.py b/synapse/util/ratelimitutils.py
index f5e592d80e..d1053d227b 100644
--- a/synapse/util/ratelimitutils.py
+++ b/synapse/util/ratelimitutils.py
@@ -28,15 +28,9 @@ from typing import (
     Any,
     Callable,
     ContextManager,
-    DefaultDict,
-    Dict,
     Iterator,
-    List,
     Mapping,
     MutableSet,
-    Optional,
-    Set,
-    Tuple,
 )
 from weakref import WeakSet
 
@@ -53,7 +47,8 @@ from synapse.logging.context import (
 )
 from synapse.logging.opentracing import start_active_span
 from synapse.metrics import SERVER_NAME_LABEL, Histogram, LaterGauge
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 if typing.TYPE_CHECKING:
     from contextlib import _GeneratorContextManager
@@ -104,7 +99,7 @@ _rate_limiter_instances_lock = threading.Lock()
 
 def _get_counts_from_rate_limiter_instance(
     count_func: Callable[["FederationRateLimiter"], int],
-) -> Mapping[Tuple[str, ...], int]:
+) -> Mapping[tuple[str, ...], int]:
     """Returns a count of something (slept/rejected hosts) by (metrics_name)"""
     # Cast to a list to prevent it changing while the Prometheus
     # thread is collecting metrics
@@ -114,7 +109,7 @@ def _get_counts_from_rate_limiter_instance(
     # Map from (metrics_name,) -> int, the number of something like slept hosts
     # or rejected hosts. The key type is Tuple[str], but we leave the length
     # unspecified for compatability with LaterGauge's annotations.
-    counts: Dict[Tuple[str, ...], int] = {}
+    counts: dict[tuple[str, ...], int] = {}
     for rate_limiter_instance in rate_limiter_instances:
         # Only track metrics if they provided a `metrics_name` to
         # differentiate this instance of the rate limiter.
@@ -131,22 +126,28 @@ def _get_counts_from_rate_limiter_instance(
 # We track the number of affected hosts per time-period so we can
 # differentiate one really noisy homeserver from a general
 # ratelimit tuning problem across the federation.
-LaterGauge(
+sleep_affected_hosts_gauge = LaterGauge(
     name="synapse_rate_limit_sleep_affected_hosts",
     desc="Number of hosts that had requests put to sleep",
     labelnames=["rate_limiter_name", SERVER_NAME_LABEL],
-    caller=lambda: _get_counts_from_rate_limiter_instance(
+)
+sleep_affected_hosts_gauge.register_hook(
+    homeserver_instance_id=None,
+    hook=lambda: _get_counts_from_rate_limiter_instance(
         lambda rate_limiter_instance: sum(
             ratelimiter.should_sleep()
             for ratelimiter in rate_limiter_instance.ratelimiters.values()
         )
     ),
 )
-LaterGauge(
+reject_affected_hosts_gauge = LaterGauge(
     name="synapse_rate_limit_reject_affected_hosts",
     desc="Number of hosts that had requests rejected",
     labelnames=["rate_limiter_name", SERVER_NAME_LABEL],
-    caller=lambda: _get_counts_from_rate_limiter_instance(
+)
+reject_affected_hosts_gauge.register_hook(
+    homeserver_instance_id=None,
+    hook=lambda: _get_counts_from_rate_limiter_instance(
         lambda rate_limiter_instance: sum(
             ratelimiter.should_reject()
             for ratelimiter in rate_limiter_instance.ratelimiters.values()
@@ -163,7 +164,7 @@ class FederationRateLimiter:
         our_server_name: str,
         clock: Clock,
         config: FederationRatelimitSettings,
-        metrics_name: Optional[str] = None,
+        metrics_name: str | None = None,
     ):
         """
         Args:
@@ -185,7 +186,7 @@ class FederationRateLimiter:
                 metrics_name=metrics_name,
             )
 
-        self.ratelimiters: DefaultDict[str, "_PerHostRatelimiter"] = (
+        self.ratelimiters: collections.defaultdict[str, "_PerHostRatelimiter"] = (
             collections.defaultdict(new_limiter)
         )
 
@@ -216,7 +217,7 @@ class _PerHostRatelimiter:
         our_server_name: str,
         clock: Clock,
         config: FederationRatelimitSettings,
-        metrics_name: Optional[str] = None,
+        metrics_name: str | None = None,
     ):
         """
         Args:
@@ -238,7 +239,7 @@ class _PerHostRatelimiter:
         self.concurrent_requests = config.concurrent
 
         # request_id objects for requests which have been slept
-        self.sleeping_requests: Set[object] = set()
+        self.sleeping_requests: set[object] = set()
 
         # map from request_id object to Deferred for requests which are ready
         # for processing but have been queued
@@ -247,11 +248,11 @@ class _PerHostRatelimiter:
         ] = collections.OrderedDict()
 
         # request id objects for requests which are in progress
-        self.current_processing: Set[object] = set()
+        self.current_processing: set[object] = set()
 
         # times at which we have recently (within the last window_size ms)
         # received requests.
-        self.request_times: List[int] = []
+        self.request_times: list[int] = []
 
     @contextlib.contextmanager
     def ratelimit(self, host: str) -> "Iterator[defer.Deferred[None]]":
@@ -353,7 +354,9 @@ class _PerHostRatelimiter:
                     rate_limiter_name=self.metrics_name,
                     **{SERVER_NAME_LABEL: self.our_server_name},
                 ).inc()
-            ret_defer = run_in_background(self.clock.sleep, self.sleep_sec)
+            ret_defer = run_in_background(
+                self.clock.sleep, Duration(seconds=self.sleep_sec)
+            )
 
             self.sleeping_requests.add(request_id)
 
@@ -413,4 +416,7 @@ class _PerHostRatelimiter:
             except KeyError:
                 pass
 
-        self.clock.call_later(0.0, start_next_request)
+        self.clock.call_later(
+            Duration(seconds=0),
+            start_next_request,
+        )
diff --git a/synapse/util/retryutils.py b/synapse/util/retryutils.py
index 149df405b3..8a5aab50f1 100644
--- a/synapse/util/retryutils.py
+++ b/synapse/util/retryutils.py
@@ -21,17 +21,17 @@
 import logging
 import random
 from types import TracebackType
-from typing import TYPE_CHECKING, Any, Optional, Type
+from typing import TYPE_CHECKING, Any, Optional
 
 from synapse.api.errors import CodeMessageException
-from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.storage import DataStore
 from synapse.types import StrCollection
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 if TYPE_CHECKING:
     from synapse.notifier import Notifier
     from synapse.replication.tcp.handler import ReplicationCommandHandler
+    from synapse.server import HomeServer
 
 logger = logging.getLogger(__name__)
 
@@ -62,6 +62,7 @@ async def get_retry_limiter(
     *,
     destination: str,
     our_server_name: str,
+    hs: "HomeServer",
     clock: Clock,
     store: DataStore,
     ignore_backoff: bool = False,
@@ -124,6 +125,7 @@ async def get_retry_limiter(
     return RetryDestinationLimiter(
         destination=destination,
         our_server_name=our_server_name,
+        hs=hs,
         clock=clock,
         store=store,
         failure_ts=failure_ts,
@@ -163,9 +165,10 @@ class RetryDestinationLimiter:
         *,
         destination: str,
         our_server_name: str,
+        hs: "HomeServer",
         clock: Clock,
         store: DataStore,
-        failure_ts: Optional[int],
+        failure_ts: int | None,
         retry_interval: int,
         backoff_on_404: bool = False,
         backoff_on_failure: bool = True,
@@ -181,6 +184,7 @@ class RetryDestinationLimiter:
         Args:
             destination
             our_server_name: Our homeserver name (used to label metrics) (`hs.hostname`)
+            hs: The homeserver instance
             clock
             store
             failure_ts: when this destination started failing (in ms since
@@ -197,6 +201,7 @@ class RetryDestinationLimiter:
                 error code.
         """
         self.our_server_name = our_server_name
+        self.hs = hs
         self.clock = clock
         self.store = store
         self.destination = destination
@@ -225,9 +230,9 @@ class RetryDestinationLimiter:
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_val: Optional[BaseException],
-        exc_tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
     ) -> None:
         success = exc_type is None
         valid_err_code = False
@@ -331,6 +336,4 @@ class RetryDestinationLimiter:
                 logger.exception("Failed to store destination_retry_timings")
 
         # we deliberately do this in the background.
-        run_as_background_process(
-            "store_retry_timings", self.our_server_name, store_retry_timings
-        )
+        self.hs.run_as_background_process("store_retry_timings", store_retry_timings)
diff --git a/synapse/util/rust.py b/synapse/util/rust.py
index 37f43459f1..a7c9e976ea 100644
--- a/synapse/util/rust.py
+++ b/synapse/util/rust.py
@@ -24,7 +24,6 @@ import os
 import urllib.parse
 from hashlib import blake2b
 from importlib.metadata import Distribution, PackageNotFoundError
-from typing import Optional
 
 import synapse
 from synapse.synapse_rust import get_rust_file_digest
@@ -41,24 +40,24 @@ def check_rust_lib_up_to_date() -> None:
         return None
 
     # Get the hash of all Rust source files
-    rust_path = os.path.join(synapse_root, "rust", "src")
+    rust_path = os.path.join(synapse_root, "rust")
     if not os.path.exists(rust_path):
         return None
 
-    hash = _hash_rust_files_in_directory(rust_path)
+    hash = _hash_rust_files_in_directory(synapse_root)
 
     if hash != get_rust_file_digest():
         raise Exception("Rust module outdated. Please rebuild using `poetry install`")
 
 
-def _hash_rust_files_in_directory(directory: str) -> str:
+def _hash_rust_files_in_directory(synapse_root: str) -> str:
     """Get the hash of all files in a directory (recursively)"""
 
-    directory = os.path.abspath(directory)
+    src_directory = os.path.abspath(os.path.join(synapse_root, "rust", "src"))
 
     paths = []
 
-    dirs = [directory]
+    dirs = [src_directory]
     while dirs:
         dir = dirs.pop()
         with os.scandir(dir) as d:
@@ -68,19 +67,26 @@ def _hash_rust_files_in_directory(directory: str) -> str:
                 else:
                     paths.append(entry.path)
 
+    # Manually add Cargo.toml's, Cargo.lock and build.rs to the hash, since
+    # changes to these files should also invalidate the built module.
+    paths.append(os.path.join(synapse_root, "rust", "Cargo.toml"))
+    paths.append(os.path.join(synapse_root, "rust", "build.rs"))
+    paths.append(os.path.join(synapse_root, "Cargo.lock"))
+    paths.append(os.path.join(synapse_root, "Cargo.toml"))
+
     # We sort to make sure that we get a consistent and well-defined ordering.
     paths.sort()
 
     hasher = blake2b()
 
     for path in paths:
-        with open(os.path.join(directory, path), "rb") as f:
+        with open(path, "rb") as f:
             hasher.update(f.read())
 
     return hasher.hexdigest()
 
 
-def get_synapse_source_directory() -> Optional[str]:
+def get_synapse_source_directory() -> str | None:
     """Try and find the source directory of synapse for editable installs (like
     those used in development).
 
@@ -112,7 +118,38 @@ def get_synapse_source_directory() -> Optional[str]:
     # c.f. https://packaging.python.org/en/latest/specifications/direct-url/
     direct_url_json = package.read_text("direct_url.json")
     if direct_url_json is None:
-        return None
+        # No direct url metadata. Check if this is an egg-info install.
+        #
+        # An egg-info install is when there exists a `matrix_synapse.egg-info`
+        # directory alongside the source tree, containing the package metadata.
+        # This allows discovering packages in the current directory, without
+        # installing them properly to the environment wide `site-packages`
+        # directory.
+        #
+        # When searching for a package, Python will look for `.egg-info` files
+        # in the current working directory before looking in `site-packages`.
+        # This means that when running Synapse (or the tests) from the source
+        # tree Python will pick up the synapse package from the egg-info
+        # install.
+        #
+        # Poetry will create an egg-info install when running `poetry install`.
+        #
+        # The combination of the above means that it is very common for
+        # developers (e.g. running tests) to encounter egg-info installs.
+        #
+        # In this case we can find the source tree by looking for the
+        # `matrix_synapse.egg-info/PKG-INFO` file, and going up two directories
+        # from there.
+
+        metadata_path = package.locate_file("matrix_synapse.egg-info/PKG-INFO")
+        if not os.path.exists(str(metadata_path)):
+            # Not an egg-info install.
+            return None
+
+        # `metadata_path` points to the egg-info/PKG-INFO file, so go up two
+        # directories to get the root of the source tree.
+        source_dir = metadata_path.parent.parent
+        return os.fspath(source_dir)
 
     # c.f. https://packaging.python.org/en/latest/specifications/direct-url/ for
     # the format
diff --git a/synapse/util/constants.py b/synapse/util/sentinel.py
similarity index 70%
rename from synapse/util/constants.py
rename to synapse/util/sentinel.py
index 9986017147..c8434fc97a 100644
--- a/synapse/util/constants.py
+++ b/synapse/util/sentinel.py
@@ -12,9 +12,10 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 
-# Time-based constants.
-#
-# Laying these out incrementally, even if only some are required, helps with
-# readability and catching bugs.
-ONE_MINUTE_SECONDS = 60
-ONE_HOUR_SECONDS = 60 * ONE_MINUTE_SECONDS
+import enum
+
+
+class Sentinel(enum.Enum):
+    # defining a sentinel in this way allows mypy to correctly handle the
+    # type of a dictionary lookup and subsequent type narrowing.
+    UNSET_SENTINEL = object()
diff --git a/synapse/util/stringutils.py b/synapse/util/stringutils.py
index 32b5bc00c9..cc26c5181b 100644
--- a/synapse/util/stringutils.py
+++ b/synapse/util/stringutils.py
@@ -20,10 +20,11 @@
 #
 #
 import itertools
+import random
 import re
 import secrets
 import string
-from typing import Any, Iterable, Optional, Tuple
+from typing import Any, Iterable
 
 from netaddr import valid_ipv6
 
@@ -56,6 +57,10 @@ def random_string(length: int) -> str:
     """Generate a cryptographically secure string of random letters.
 
     Drawn from the characters: `a-z` and `A-Z`
+
+    Because this is generated from cryptographic sources, it takes a notable amount of
+    effort to generate (computationally expensive). If you don't need cryptographic
+    security, consider using `random_string_insecure_fast` for better performance.
     """
     return "".join(secrets.choice(string.ascii_letters) for _ in range(length))
 
@@ -68,6 +73,18 @@ def random_string_with_symbols(length: int) -> str:
     return "".join(secrets.choice(_string_with_symbols) for _ in range(length))
 
 
+def random_string_insecure_fast(length: int) -> str:
+    """
+    Generate a string of random letters (insecure, fast). This is a more performant but
+    insecure version of `random_string`.
+
+    WARNING: Not for security or cryptographic uses. Use `random_string` instead.
+
+    Drawn from the characters: `a-z` and `A-Z`
+    """
+    return "".join(random.choice(string.ascii_letters) for _ in range(length))
+
+
 def is_ascii(s: bytes) -> bool:
     try:
         s.decode("ascii").encode("ascii")
@@ -92,7 +109,7 @@ def assert_valid_client_secret(client_secret: str) -> None:
         )
 
 
-def parse_server_name(server_name: str) -> Tuple[str, Optional[int]]:
+def parse_server_name(server_name: str) -> tuple[str, int | None]:
     """Split a server name into host/port parts.
 
     Args:
@@ -123,7 +140,7 @@ def parse_server_name(server_name: str) -> Tuple[str, Optional[int]]:
 VALID_HOST_REGEX = re.compile("\\A[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*\\Z")
 
 
-def parse_and_validate_server_name(server_name: str) -> Tuple[str, Optional[int]]:
+def parse_and_validate_server_name(server_name: str) -> tuple[str, int | None]:
     """Split a server name into host/port parts and do some basic validation.
 
     Args:
@@ -190,7 +207,7 @@ def valid_id_server_location(id_server: str) -> bool:
     return "#" not in path and "?" not in path
 
 
-def parse_and_validate_mxc_uri(mxc: str) -> Tuple[str, Optional[int], str]:
+def parse_and_validate_mxc_uri(mxc: str) -> tuple[str, int | None, str]:
     """Parse the given string as an MXC URI
 
     Checks that the "server name" part is a valid server name
@@ -268,7 +285,7 @@ def base62_encode(num: int, minwidth: int = 1) -> str:
     return pad + res
 
 
-def non_null_str_or_none(val: Any) -> Optional[str]:
+def non_null_str_or_none(val: Any) -> str | None:
     """Check that the arg is a string containing no null (U+0000) codepoints.
 
     If so, returns the given string unmodified; otherwise, returns None.
diff --git a/synapse/util/task_scheduler.py b/synapse/util/task_scheduler.py
index fdcacdf128..c1790fd3ae 100644
--- a/synapse/util/task_scheduler.py
+++ b/synapse/util/task_scheduler.py
@@ -20,22 +20,23 @@
 #
 
 import logging
-from typing import TYPE_CHECKING, Awaitable, Callable, Dict, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Awaitable, Callable
 
+from twisted.internet import defer
 from twisted.python.failure import Failure
 
 from synapse.logging.context import (
     ContextResourceUsage,
     LoggingContext,
+    PreserveLoggingContext,
     nested_logging_context,
-    set_current_context,
 )
 from synapse.metrics import SERVER_NAME_LABEL, LaterGauge
 from synapse.metrics.background_process_metrics import (
-    run_as_background_process,
     wrap_as_background_process,
 )
 from synapse.types import JsonMapping, ScheduledTask, TaskStatus
+from synapse.util.duration import Duration
 from synapse.util.stringutils import random_string
 
 if TYPE_CHECKING:
@@ -44,11 +45,18 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+running_tasks_gauge = LaterGauge(
+    name="synapse_scheduler_running_tasks",
+    desc="The number of concurrent running tasks handled by the TaskScheduler",
+    labelnames=[SERVER_NAME_LABEL],
+)
+
+
 class TaskScheduler:
     """
     This is a simple task scheduler designed for resumable tasks. Normally,
-    you'd use `run_in_background` to start a background task or Twisted's
-    `deferLater` if you want to run it later.
+    you'd use `run_in_background` to start a background task or `clock.call_later`
+    if you want to run it later.
 
     The issue is that these tasks stop completely and won't resume if Synapse is
     shut down for any reason.
@@ -86,8 +94,8 @@ class TaskScheduler:
     """
 
     # Precision of the scheduler, evaluation of tasks to run will only happen
-    # every `SCHEDULE_INTERVAL_MS` ms
-    SCHEDULE_INTERVAL_MS = 1 * 60 * 1000  # 1mn
+    # every `SCHEDULE_INTERVAL`
+    SCHEDULE_INTERVAL = Duration(minutes=1)
     # How often to clean up old tasks.
     CLEANUP_INTERVAL_MS = 30 * 60 * 1000
     # Time before a complete or failed task is deleted from the DB
@@ -97,22 +105,21 @@ class TaskScheduler:
     # Time from the last task update after which we will log a warning
     LAST_UPDATE_BEFORE_WARNING_MS = 24 * 60 * 60 * 1000  # 24hrs
     # Report a running task's status and usage every so often.
-    OCCASIONAL_REPORT_INTERVAL_MS = 5 * 60 * 1000  # 5 minutes
+    OCCASIONAL_REPORT_INTERVAL = Duration(minutes=5)
 
     def __init__(self, hs: "HomeServer"):
-        self._hs = hs
-        self.server_name = (
-            hs.hostname
-        )  # nb must be called this for @wrap_as_background_process
+        self.hs = hs  # nb must be called this for @wrap_as_background_process
+        self.server_name = hs.hostname
         self._store = hs.get_datastores().main
         self._clock = hs.get_clock()
-        self._running_tasks: Set[str] = set()
+        # A map between a task's ID and a deferred linked to the task
+        self._running_tasks: dict[str, defer.Deferred] = {}
         # A map between action names and their registered function
-        self._actions: Dict[
+        self._actions: dict[
             str,
             Callable[
                 [ScheduledTask],
-                Awaitable[Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]],
+                Awaitable[tuple[TaskStatus, JsonMapping | None, str | None]],
             ],
         ] = {}
         self._run_background_tasks = hs.config.worker.run_background_tasks
@@ -123,25 +130,23 @@ class TaskScheduler:
         if self._run_background_tasks:
             self._clock.looping_call(
                 self._launch_scheduled_tasks,
-                TaskScheduler.SCHEDULE_INTERVAL_MS,
+                TaskScheduler.SCHEDULE_INTERVAL,
             )
             self._clock.looping_call(
                 self._clean_scheduled_tasks,
-                TaskScheduler.SCHEDULE_INTERVAL_MS,
+                TaskScheduler.SCHEDULE_INTERVAL,
             )
 
-        LaterGauge(
-            name="synapse_scheduler_running_tasks",
-            desc="The number of concurrent running tasks handled by the TaskScheduler",
-            labelnames=[SERVER_NAME_LABEL],
-            caller=lambda: {(self.server_name,): len(self._running_tasks)},
+        running_tasks_gauge.register_hook(
+            homeserver_instance_id=hs.get_instance_id(),
+            hook=lambda: {(self.server_name,): len(self._running_tasks)},
         )
 
     def register_action(
         self,
         function: Callable[
             [ScheduledTask],
-            Awaitable[Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]],
+            Awaitable[tuple[TaskStatus, JsonMapping | None, str | None]],
         ],
         action_name: str,
     ) -> None:
@@ -165,9 +170,9 @@ class TaskScheduler:
         self,
         action: str,
         *,
-        resource_id: Optional[str] = None,
-        timestamp: Optional[int] = None,
-        params: Optional[JsonMapping] = None,
+        resource_id: str | None = None,
+        timestamp: int | None = None,
+        params: JsonMapping | None = None,
     ) -> str:
         """Schedule a new potentially resumable task. A function matching the specified
         `action` should've been registered with `register_action` before the task is run.
@@ -210,7 +215,7 @@ class TaskScheduler:
             if self._run_background_tasks:
                 self._launch_scheduled_tasks()
             else:
-                self._hs.get_replication_command_handler().send_new_active_task(task.id)
+                self.hs.get_replication_command_handler().send_new_active_task(task.id)
 
         return task.id
 
@@ -218,10 +223,10 @@ class TaskScheduler:
         self,
         id: str,
         *,
-        timestamp: Optional[int] = None,
-        status: Optional[TaskStatus] = None,
-        result: Optional[JsonMapping] = None,
-        error: Optional[str] = None,
+        timestamp: int | None = None,
+        status: TaskStatus | None = None,
+        result: JsonMapping | None = None,
+        error: str | None = None,
     ) -> bool:
         """Update some task-associated values. This is exposed publicly so it can
         be used inside task functions, mainly to update the result or resume
@@ -261,7 +266,7 @@ class TaskScheduler:
             error=error,
         )
 
-    async def get_task(self, id: str) -> Optional[ScheduledTask]:
+    async def get_task(self, id: str) -> ScheduledTask | None:
         """Get a specific task description by id.
 
         Args:
@@ -276,12 +281,12 @@ class TaskScheduler:
     async def get_tasks(
         self,
         *,
-        actions: Optional[List[str]] = None,
-        resource_id: Optional[str] = None,
-        statuses: Optional[List[TaskStatus]] = None,
-        max_timestamp: Optional[int] = None,
-        limit: Optional[int] = None,
-    ) -> List[ScheduledTask]:
+        actions: list[str] | None = None,
+        resource_id: str | None = None,
+        statuses: list[TaskStatus] | None = None,
+        max_timestamp: int | None = None,
+        limit: int | None = None,
+    ) -> list[ScheduledTask]:
         """Get a list of tasks. Returns all the tasks if no args are provided.
 
         If an arg is `None`, all tasks matching the other args will be selected.
@@ -322,6 +327,37 @@ class TaskScheduler:
             raise Exception(f"Task {id} is currently ACTIVE and can't be deleted")
         await self._store.delete_scheduled_task(id)
 
+    async def cancel_task(self, id: str) -> None:
+        """Cancel an ACTIVE or SCHEDULED task.
+
+        Args:
+            id: id of the task to cancel
+        """
+        task = await self.get_task(id)
+        if not task:
+            logger.debug("Can't cancel task %s because it doesn't exist in the DB", id)
+            return
+
+        if not (
+            task.status == TaskStatus.ACTIVE or task.status == TaskStatus.SCHEDULED
+        ):
+            logger.debug(
+                "Can't cancel task %s because it is neither ACTIVE nor SCHEDULED", id
+            )
+            return
+
+        if self._run_background_tasks:
+            await self.on_cancel_task(id)
+        else:
+            self.hs.get_replication_command_handler().send_cancel_task(id)
+
+    async def on_cancel_task(self, id: str) -> None:
+        if id in self._running_tasks:
+            deferred = self._running_tasks[id]
+            deferred.cancel()
+            self._running_tasks.pop(id)
+        await self.update_task(id, status=TaskStatus.CANCELLED)
+
     def on_new_task(self, task_id: str) -> None:
         """Handle a notification that a new ready-to-run task has been added to the queue"""
         # Just run the scheduler
@@ -357,7 +393,7 @@ class TaskScheduler:
             finally:
                 self._launching_new_tasks = False
 
-        run_as_background_process("launch_scheduled_tasks", self.server_name, inner)
+        self.hs.run_as_background_process("launch_scheduled_tasks", inner)
 
     @wrap_as_background_process("clean_scheduled_tasks")
     async def _clean_scheduled_tasks(self) -> None:
@@ -420,26 +456,27 @@ class TaskScheduler:
             """
 
             current_time = self._clock.time()
-            calling_context = set_current_context(task_log_context)
-            try:
+            with PreserveLoggingContext(task_log_context):
                 usage = task_log_context.get_resource_usage()
                 TaskScheduler._log_task_usage(
                     "continuing", task, usage, current_time - start_time
                 )
-            finally:
-                set_current_context(calling_context)
 
         async def wrapper() -> None:
             with nested_logging_context(task.id) as log_context:
                 start_time = self._clock.time()
                 occasional_status_call = self._clock.looping_call(
                     _occasional_report,
-                    TaskScheduler.OCCASIONAL_REPORT_INTERVAL_MS,
+                    TaskScheduler.OCCASIONAL_REPORT_INTERVAL,
                     log_context,
                     start_time,
                 )
+                result = None
+                error = None
                 try:
                     (status, result, error) = await function(task)
+                except defer.CancelledError:
+                    status = TaskStatus.CANCELLED
                 except Exception:
                     f = Failure()
                     logger.error(
@@ -448,7 +485,6 @@ class TaskScheduler:
                         exc_info=(f.type, f.value, f.getTracebackObject()),
                     )
                     status = TaskStatus.FAILED
-                    result = None
                     error = f.getErrorMessage()
 
                 await self._store.update_scheduled_task(
@@ -458,7 +494,7 @@ class TaskScheduler:
                     result=result,
                     error=error,
                 )
-                self._running_tasks.remove(task.id)
+                self._running_tasks.pop(task.id)
 
                 current_time = self._clock.time()
                 usage = log_context.get_resource_usage()
@@ -468,7 +504,10 @@ class TaskScheduler:
                 occasional_status_call.stop()
 
             # Try launch a new task since we've finished with this one.
-            self._clock.call_later(0.1, self._launch_scheduled_tasks)
+            self._clock.call_later(
+                Duration(milliseconds=100),
+                self._launch_scheduled_tasks,
+            )
 
         if len(self._running_tasks) >= TaskScheduler.MAX_CONCURRENT_RUNNING_TASKS:
             return
@@ -486,6 +525,6 @@ class TaskScheduler:
         if task.id in self._running_tasks:
             return
 
-        self._running_tasks.add(task.id)
         await self.update_task(task.id, status=TaskStatus.ACTIVE)
-        run_as_background_process(f"task-{task.action}", self.server_name, wrapper)
+        deferred = self.hs.run_as_background_process(f"task-{task.action}", wrapper)
+        self._running_tasks[task.id] = deferred
diff --git a/synapse/util/templates.py b/synapse/util/templates.py
index fc5dbc069c..d399b167c1 100644
--- a/synapse/util/templates.py
+++ b/synapse/util/templates.py
@@ -23,7 +23,7 @@
 
 import time
 import urllib.parse
-from typing import TYPE_CHECKING, Callable, Optional, Sequence, Union
+from typing import TYPE_CHECKING, Callable, Sequence
 
 import jinja2
 
@@ -34,7 +34,7 @@ if TYPE_CHECKING:
 def build_jinja_env(
     template_search_directories: Sequence[str],
     config: "HomeServerConfig",
-    autoescape: Union[bool, Callable[[Optional[str]], bool], None] = None,
+    autoescape: bool | Callable[[str | None], bool] | None = None,
 ) -> jinja2.Environment:
     """Set up a Jinja2 environment to load templates from the given search path
 
@@ -82,7 +82,7 @@ def build_jinja_env(
 
 
 def _create_mxc_to_http_filter(
-    public_baseurl: Optional[str],
+    public_baseurl: str | None,
 ) -> Callable[[str, int, int, str], str]:
     """Create and return a jinja2 filter that converts MXC urls to HTTP
 
diff --git a/synapse/util/wheel_timer.py b/synapse/util/wheel_timer.py
index 95eb1d7185..fe4622fe99 100644
--- a/synapse/util/wheel_timer.py
+++ b/synapse/util/wheel_timer.py
@@ -19,10 +19,12 @@
 #
 #
 import logging
-from typing import Generic, Hashable, List, Set, TypeVar
+from typing import Generic, Hashable, TypeVar
 
 import attr
 
+from synapse.util.duration import Duration
+
 logger = logging.getLogger(__name__)
 
 T = TypeVar("T", bound=Hashable)
@@ -31,7 +33,7 @@ T = TypeVar("T", bound=Hashable)
 @attr.s(slots=True, frozen=True, auto_attribs=True)
 class _Entry(Generic[T]):
     end_key: int
-    elements: Set[T] = attr.Factory(set)
+    elements: set[T] = attr.Factory(set)
 
 
 class WheelTimer(Generic[T]):
@@ -39,14 +41,14 @@ class WheelTimer(Generic[T]):
     expired.
     """
 
-    def __init__(self, bucket_size: int = 5000) -> None:
+    def __init__(self, bucket_size: Duration = Duration(seconds=5)) -> None:
         """
         Args:
             bucket_size: Size of buckets in ms. Corresponds roughly to the
                 accuracy of the timer.
         """
-        self.bucket_size: int = bucket_size
-        self.entries: List[_Entry[T]] = []
+        self.bucket_size = bucket_size
+        self.entries: list[_Entry[T]] = []
 
     def insert(self, now: int, obj: T, then: int) -> None:
         """Inserts object into timer.
@@ -56,8 +58,8 @@ class WheelTimer(Generic[T]):
             obj: Object to be inserted
             then: When to return the object strictly after.
         """
-        then_key = int(then / self.bucket_size) + 1
-        now_key = int(now / self.bucket_size)
+        then_key = int(then / self.bucket_size.as_millis()) + 1
+        now_key = int(now / self.bucket_size.as_millis())
 
         if self.entries:
             min_key = self.entries[0].end_key
@@ -91,7 +93,7 @@ class WheelTimer(Generic[T]):
 
         self.entries[-1].elements.add(obj)
 
-    def fetch(self, now: int) -> List[T]:
+    def fetch(self, now: int) -> list[T]:
         """Fetch any objects that have timed out
 
         Args:
@@ -100,9 +102,9 @@ class WheelTimer(Generic[T]):
         Returns:
             List of objects that have timed out
         """
-        now_key = int(now / self.bucket_size)
+        now_key = int(now / self.bucket_size.as_millis())
 
-        ret: List[T] = []
+        ret: list[T] = []
         while self.entries and self.entries[0].end_key <= now_key:
             ret.extend(self.entries.pop(0).elements)
 
diff --git a/synapse/visibility.py b/synapse/visibility.py
index d460d8f4c2..5ba2a14a24 100644
--- a/synapse/visibility.py
+++ b/synapse/visibility.py
@@ -23,14 +23,8 @@ import logging
 from enum import Enum, auto
 from typing import (
     Collection,
-    Dict,
     Final,
-    FrozenSet,
-    List,
-    Optional,
     Sequence,
-    Set,
-    Tuple,
 )
 
 import attr
@@ -39,6 +33,7 @@ from synapse.api.constants import (
     EventTypes,
     EventUnsignedContentFields,
     HistoryVisibility,
+    JoinRules,
     Membership,
 )
 from synapse.events import EventBase
@@ -55,7 +50,7 @@ from synapse.types import (
     get_domain_from_id,
 )
 from synapse.types.state import StateFilter
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 logger = logging.getLogger(__name__)
 filtered_event_logger = logging.getLogger("synapse.visibility.filtered_event_debug")
@@ -76,18 +71,18 @@ MEMBERSHIP_PRIORITY = (
     Membership.BAN,
 )
 
-_HISTORY_VIS_KEY: Final[Tuple[str, str]] = (EventTypes.RoomHistoryVisibility, "")
+_HISTORY_VIS_KEY: Final[tuple[str, str]] = (EventTypes.RoomHistoryVisibility, "")
 
 
 @trace
-async def filter_events_for_client(
+async def filter_and_transform_events_for_client(
     storage: StorageControllers,
     user_id: str,
-    events: List[EventBase],
+    events: list[EventBase],
     is_peeking: bool = False,
-    always_include_ids: FrozenSet[str] = frozenset(),
+    always_include_ids: frozenset[str] = frozenset(),
     filter_send_to_client: bool = True,
-) -> List[EventBase]:
+) -> list[EventBase]:
     """
     Check which events a user is allowed to see. If the user can see the event but its
     sender asked for their data to be erased, prune the content of the event.
@@ -117,7 +112,17 @@ async def filter_events_for_client(
     # happen within the function.
     events_before_filtering = events.copy()
     # Default case is to *exclude* soft-failed events
-    events = [e for e in events if not e.internal_metadata.is_soft_failed()]
+    events = []
+    found_call_invite = False
+    for event in events_before_filtering:
+        if event.internal_metadata.is_soft_failed():
+            continue
+
+        if event.type == EventTypes.CallInvite and not event.is_state():
+            found_call_invite = True
+
+        events.append(event)
+
     client_config = await storage.main.get_admin_client_config_for_user(user_id)
     if filter_send_to_client and await storage.main.is_server_admin(user_id):
         if client_config.return_soft_failed_events:
@@ -145,7 +150,11 @@ async def filter_events_for_client(
                 [event.event_id for event in events],
             )
 
-    types = (_HISTORY_VIS_KEY, (EventTypes.Member, user_id))
+    types = [_HISTORY_VIS_KEY, (EventTypes.Member, user_id)]
+    if found_call_invite:
+        # We need to fetch the room's join rules state to determine
+        # whether to allow call invites in public rooms.
+        types.append((EventTypes.JoinRules, ""))
 
     # we exclude outliers at this point, and then handle them separately later
     event_id_to_state = await storage.state.get_state_for_events(
@@ -160,14 +169,14 @@ async def filter_events_for_client(
 
     if filter_send_to_client:
         room_ids = {e.room_id for e in events}
-        retention_policies: Dict[str, RetentionPolicy] = {}
+        retention_policies: dict[str, RetentionPolicy] = {}
 
         for room_id in room_ids:
             retention_policies[
                 room_id
             ] = await storage.main.get_retention_policy_for_room(room_id)
 
-    def allowed(event: EventBase) -> Optional[EventBase]:
+    def allowed(event: EventBase) -> EventBase | None:
         state_after_event = event_id_to_state.get(event.event_id)
         filtered = _check_client_allowed_to_see_event(
             user_id=user_id,
@@ -184,13 +193,32 @@ async def filter_events_for_client(
         if filtered is None:
             return None
 
+        # Filter out call invites in public rooms, as this would potentially
+        # ring a lot of users.
+        if event.type == EventTypes.CallInvite and not event.is_state():
+            # `state_after_event` should only be None if the event is an outlier,
+            # and earlier code should filter out outliers entirely.
+            #
+            # In addition, we only create outliers locally for out-of-band
+            # invite rejections, invites received over federation, or state
+            # events needed to authorise other events. None of this applies to
+            # call invites.
+            assert state_after_event is not None
+
+            room_join_rules = state_after_event.get((EventTypes.JoinRules, ""))
+            if (
+                room_join_rules is not None
+                and room_join_rules.content.get("join_rule") == JoinRules.PUBLIC
+            ):
+                return None
+
         # Annotate the event with the user's membership after the event.
         #
         # Normally we just look in `state_after_event`, but if the event is an outlier
         # we won't have such a state. The only outliers that are returned here are the
         # user's own membership event, so we can just inspect that.
 
-        user_membership_event: Optional[EventBase]
+        user_membership_event: EventBase | None
         if event.type == EventTypes.Member and event.state_key == user_id:
             user_membership_event = event
         elif state_after_event is not None:
@@ -209,6 +237,20 @@ async def filter_events_for_client(
         # to the cache!
         cloned = clone_event(filtered)
         cloned.unsigned[EventUnsignedContentFields.MEMBERSHIP] = user_membership
+        if storage.main.config.experimental.msc4354_enabled:
+            sticky_duration = cloned.sticky_duration()
+            if sticky_duration:
+                now_ms = storage.main.clock.time_msec()
+                expires_at = (
+                    # min() ensures that the origin server can't lie about the time and
+                    # send the event 'in the future', as that would allow them to exceed
+                    # the 1 hour limit on stickiness duration.
+                    min(cloned.origin_server_ts, now_ms) + sticky_duration.as_millis()
+                )
+                if expires_at > now_ms:
+                    cloned.unsigned[EventUnsignedContentFields.STICKY_TTL] = (
+                        expires_at - now_ms
+                    )
 
         return cloned
 
@@ -351,12 +393,12 @@ def _check_client_allowed_to_see_event(
     clock: Clock,
     filter_send_to_client: bool,
     is_peeking: bool,
-    always_include_ids: FrozenSet[str],
+    always_include_ids: frozenset[str],
     sender_ignored: bool,
     retention_policy: RetentionPolicy,
-    state: Optional[StateMap[EventBase]],
+    state: StateMap[EventBase] | None,
     sender_erased: bool,
-) -> Optional[EventBase]:
+) -> EventBase | None:
     """Check with the given user is allowed to see the given event
 
     See `filter_events_for_client` for details about args
@@ -652,7 +694,7 @@ async def filter_events_for_server(
     redact: bool,
     filter_out_erased_senders: bool,
     filter_out_remote_partial_state_events: bool,
-) -> List[EventBase]:
+) -> list[EventBase]:
     """Filter a list of events based on whether the target server is allowed to
     see them.
 
@@ -687,7 +729,7 @@ async def filter_events_for_server(
     # otherwise a room could be fully joined after we retrieve those, which would then bypass
     # this check but would base the filtering on an outdated view of the membership events.
 
-    partial_state_invisible_event_ids: Set[str] = set()
+    partial_state_invisible_event_ids: set[str] = set()
     if filter_out_remote_partial_state_events:
         for e in events:
             sender_domain = get_domain_from_id(e.sender)
@@ -733,7 +775,7 @@ async def filter_events_for_server(
 
 async def _event_to_history_vis(
     storage: StorageControllers, events: Collection[EventBase]
-) -> Dict[str, str]:
+) -> dict[str, str]:
     """Get the history visibility at each of the given events
 
     Returns a map from event id to history_visibility setting
@@ -758,7 +800,7 @@ async def _event_to_history_vis(
     }
     vis_events = await storage.main.get_events(visibility_ids)
 
-    result: Dict[str, str] = {}
+    result: dict[str, str] = {}
     for event in events:
         vis = HistoryVisibility.SHARED
         state_ids = event_to_state_ids.get(event.event_id)
@@ -780,7 +822,7 @@ async def _event_to_history_vis(
 
 async def _event_to_memberships(
     storage: StorageControllers, events: Collection[EventBase], server_name: str
-) -> Dict[str, StateMap[Tuple[str, str]]]:
+) -> dict[str, StateMap[tuple[str, str]]]:
     """Get the remote membership list at each of the given events
 
     Returns a map from event id to state map, which will contain only membership events
diff --git a/synmark/__main__.py b/synmark/__main__.py
index 4944c2f3b0..5308c96012 100644
--- a/synmark/__main__.py
+++ b/synmark/__main__.py
@@ -22,7 +22,7 @@ import sys
 from argparse import REMAINDER, Namespace
 from contextlib import redirect_stderr
 from io import StringIO
-from typing import Any, Callable, Coroutine, List, TypeVar
+from typing import Any, Callable, Coroutine, TypeVar
 
 import pyperf
 
@@ -62,7 +62,10 @@ def make_test(
                 return res
 
             d.addBoth(on_done)
-            reactor.callWhenRunning(lambda: d.callback(True))
+            # type-ignore: This is outside of Synapse (just a utility benchmark script)
+            # so we don't need to worry about  which server the logs are coming from
+            # (`Clock.call_when_running` manages the logcontext for us).
+            reactor.callWhenRunning(lambda: d.callback(True))  # type: ignore[prefer-synapse-clock-call-when-running]
             reactor.run()
 
         # mypy thinks this is an object for some reason.
@@ -73,7 +76,7 @@ def make_test(
 
 if __name__ == "__main__":
 
-    def add_cmdline_args(cmd: List[str], args: Namespace) -> None:
+    def add_cmdline_args(cmd: list[str], args: Namespace) -> None:
         if args.log:
             cmd.extend(["--log"])
         cmd.extend(args.tests)
diff --git a/synmark/suites/logging.py b/synmark/suites/logging.py
index 32282ba6cb..243f9dbca0 100644
--- a/synmark/suites/logging.py
+++ b/synmark/suites/logging.py
@@ -22,7 +22,6 @@ import logging
 import logging.config
 import warnings
 from io import StringIO
-from typing import Optional
 from unittest.mock import Mock
 
 from pyperf import perf_counter
@@ -33,11 +32,12 @@ from twisted.internet.protocol import ServerFactory
 from twisted.logger import LogBeginner, LogPublisher
 from twisted.protocols.basic import LineOnlyReceiver
 
-from synapse.config.logger import _setup_stdlib_logging
+from synapse.config.logger import _setup_stdlib_logging, one_time_logging_setup
 from synapse.logging import RemoteHandler
 from synapse.synapse_rust import reset_logging_config
 from synapse.types import ISynapseReactor
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 
 class LineCounter(LineOnlyReceiver):
@@ -58,7 +58,7 @@ class LineCounter(LineOnlyReceiver):
 class Factory(ServerFactory):
     protocol = LineCounter
     wait_for: int
-    on_done: Optional[Deferred]
+    on_done: Deferred | None
 
 
 async def main(reactor: ISynapseReactor, loops: int) -> float:
@@ -86,7 +86,9 @@ async def main(reactor: ISynapseReactor, loops: int) -> float:
     hs_config = Config()
 
     # To be able to sleep.
-    clock = Clock(reactor)
+    # Ignore linter error here since we are running outside of the context of a
+    # Synapse `HomeServer`.
+    clock = Clock(reactor, server_name=hs_config.server.server_name)  # type: ignore[multiple-internal-clocks]
 
     errors = StringIO()
     publisher = LogPublisher()
@@ -113,10 +115,10 @@ async def main(reactor: ISynapseReactor, loops: int) -> float:
     }
 
     logger = logging.getLogger("synapse")
+    one_time_logging_setup(logBeginner=beginner)
     _setup_stdlib_logging(
         hs_config,  # type: ignore[arg-type]
         None,
-        logBeginner=beginner,
     )
 
     # Force a new logging config without having to load it from a file.
@@ -140,7 +142,7 @@ async def main(reactor: ISynapseReactor, loops: int) -> float:
 
         if len(handler._buffer) == handler.maximum_buffer:
             while len(handler._buffer) > handler.maximum_buffer / 2:
-                await clock.sleep(0.01)
+                await clock.sleep(Duration(milliseconds=10))
 
     await logger_factory.on_done
 
diff --git a/synmark/suites/lrucache.py b/synmark/suites/lrucache.py
index d109441e55..830a3daa8f 100644
--- a/synmark/suites/lrucache.py
+++ b/synmark/suites/lrucache.py
@@ -23,13 +23,20 @@ from pyperf import perf_counter
 
 from synapse.types import ISynapseReactor
 from synapse.util.caches.lrucache import LruCache
+from synapse.util.clock import Clock
 
 
 async def main(reactor: ISynapseReactor, loops: int) -> float:
     """
     Benchmark `loops` number of insertions into LruCache without eviction.
     """
-    cache: LruCache[int, bool] = LruCache(max_size=loops)
+    # Ignore linter error here since we are running outside of the context of a
+    # Synapse `HomeServer`.
+    cache: LruCache[int, bool] = LruCache(
+        max_size=loops,
+        clock=Clock(reactor, server_name="synmark_benchmark"),  # type: ignore[multiple-internal-clocks]
+        server_name="synmark_benchmark",
+    )
 
     start = perf_counter()
 
diff --git a/synmark/suites/lrucache_evict.py b/synmark/suites/lrucache_evict.py
index 00cfdd0447..c67e0c9001 100644
--- a/synmark/suites/lrucache_evict.py
+++ b/synmark/suites/lrucache_evict.py
@@ -23,6 +23,7 @@ from pyperf import perf_counter
 
 from synapse.types import ISynapseReactor
 from synapse.util.caches.lrucache import LruCache
+from synapse.util.clock import Clock
 
 
 async def main(reactor: ISynapseReactor, loops: int) -> float:
@@ -30,7 +31,13 @@ async def main(reactor: ISynapseReactor, loops: int) -> float:
     Benchmark `loops` number of insertions into LruCache where half of them are
     evicted.
     """
-    cache: LruCache[int, bool] = LruCache(max_size=loops // 2)
+    # Ignore linter error here since we are running outside of the context of a
+    # Synapse `HomeServer`.
+    cache: LruCache[int, bool] = LruCache(
+        max_size=loops // 2,
+        clock=Clock(reactor, server_name="synmark_benchmark"),  # type: ignore[multiple-internal-clocks]
+        server_name="synmark_benchmark",
+    )
 
     start = perf_counter()
 
diff --git a/tests/api/test_auth.py b/tests/api/test_auth.py
index b8fb21ab0d..f7905ced7e 100644
--- a/tests/api/test_auth.py
+++ b/tests/api/test_auth.py
@@ -39,10 +39,9 @@ from synapse.appservice import ApplicationService
 from synapse.server import HomeServer
 from synapse.storage.databases.main.registration import TokenLookupResult
 from synapse.types import Requester, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
-from tests.unittest import override_config
 from tests.utils import mock_getRawHeaders
 
 
@@ -237,7 +236,6 @@ class AuthTestCase(unittest.HomeserverTestCase):
         request.requestHeaders.getRawHeaders = mock_getRawHeaders()
         self.get_failure(self.auth.get_user_by_req(request), AuthError)
 
-    @override_config({"experimental_features": {"msc3202_device_masquerading": True}})
     def test_get_user_by_req_appservice_valid_token_valid_device_id(self) -> None:
         """
         Tests that when an application service passes the device_id URL parameter
@@ -264,7 +262,7 @@ class AuthTestCase(unittest.HomeserverTestCase):
         request.getClientAddress.return_value.host = "127.0.0.1"
         request.args[b"access_token"] = [self.test_token]
         request.args[b"user_id"] = [masquerading_user_id]
-        request.args[b"org.matrix.msc3202.device_id"] = [masquerading_device_id]
+        request.args[b"device_id"] = [masquerading_device_id]
         request.requestHeaders.getRawHeaders = mock_getRawHeaders()
         requester = self.get_success(self.auth.get_user_by_req(request))
         self.assertEqual(
@@ -272,7 +270,6 @@ class AuthTestCase(unittest.HomeserverTestCase):
         )
         self.assertEqual(requester.device_id, masquerading_device_id.decode("utf8"))
 
-    @override_config({"experimental_features": {"msc3202_device_masquerading": True}})
     def test_get_user_by_req_appservice_valid_token_invalid_device_id(self) -> None:
         """
         Tests that when an application service passes the device_id URL parameter
@@ -299,12 +296,12 @@ class AuthTestCase(unittest.HomeserverTestCase):
         request.getClientAddress.return_value.host = "127.0.0.1"
         request.args[b"access_token"] = [self.test_token]
         request.args[b"user_id"] = [masquerading_user_id]
-        request.args[b"org.matrix.msc3202.device_id"] = [masquerading_device_id]
+        request.args[b"device_id"] = [masquerading_device_id]
         request.requestHeaders.getRawHeaders = mock_getRawHeaders()
 
         failure = self.get_failure(self.auth.get_user_by_req(request), AuthError)
         self.assertEqual(failure.value.code, 400)
-        self.assertEqual(failure.value.errcode, Codes.EXCLUSIVE)
+        self.assertEqual(failure.value.errcode, Codes.UNKNOWN_DEVICE)
 
     def test_get_user_by_req__puppeted_token__not_tracking_puppeted_mau(self) -> None:
         self.store.get_user_by_access_token = AsyncMock(
diff --git a/tests/api/test_filtering.py b/tests/api/test_filtering.py
index 8ad9a5a6f7..7742a06b4c 100644
--- a/tests/api/test_filtering.py
+++ b/tests/api/test_filtering.py
@@ -20,7 +20,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List
 from unittest.mock import patch
 
 import jsonschema
@@ -33,7 +32,7 @@ from synapse.api.filtering import Filter
 from synapse.api.presence import UserPresenceState
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.frozenutils import freeze
 
 from tests import unittest
@@ -50,7 +49,7 @@ class FilteringTestCase(unittest.HomeserverTestCase):
 
     def test_errors_on_invalid_filters(self) -> None:
         # See USER_FILTER_SCHEMA for the filter schema.
-        invalid_filters: List[JsonDict] = [
+        invalid_filters: list[JsonDict] = [
             # `account_data` must be a dictionary
             {"account_data": "Hello World"},
             # `event_format` must be "client" or "federation"
@@ -67,7 +66,7 @@ class FilteringTestCase(unittest.HomeserverTestCase):
     def test_ignores_unknown_filter_fields(self) -> None:
         # For forward compatibility, we must ignore unknown filter fields.
         # See USER_FILTER_SCHEMA for the filter schema.
-        filters: List[JsonDict] = [
+        filters: list[JsonDict] = [
             {"org.matrix.msc9999.future_option": True},
             {"presence": {"org.matrix.msc9999.future_option": True}},
             {"room": {"org.matrix.msc9999.future_option": True}},
@@ -78,7 +77,7 @@ class FilteringTestCase(unittest.HomeserverTestCase):
             # Must not raise.
 
     def test_valid_filters(self) -> None:
-        valid_filters: List[JsonDict] = [
+        valid_filters: list[JsonDict] = [
             {
                 "room": {
                     "timeline": {"limit": 20},
@@ -557,7 +556,7 @@ class FilteringTestCase(unittest.HomeserverTestCase):
                 room_id="!foo:bar",
             ),
         ]
-        jsondicts: List[JsonDict] = [{}]
+        jsondicts: list[JsonDict] = [{}]
 
         # For the following tests we patch the datastore method (intead of injecting
         # events). This is a bit cheeky, but tests the logic of _check_event_relations.
@@ -565,7 +564,7 @@ class FilteringTestCase(unittest.HomeserverTestCase):
         # Filter for a particular sender.
         definition = {"related_by_senders": ["@foo:bar"]}
 
-        async def events_have_relations(*args: object, **kwargs: object) -> List[str]:
+        async def events_have_relations(*args: object, **kwargs: object) -> list[str]:
             return ["$with_relation"]
 
         with patch.object(
diff --git a/tests/api/test_ratelimiting.py b/tests/api/test_ratelimiting.py
index 2e45d4e4d2..0ef537841d 100644
--- a/tests/api/test_ratelimiting.py
+++ b/tests/api/test_ratelimiting.py
@@ -1,5 +1,3 @@
-from typing import Optional
-
 from synapse.api.ratelimiting import LimitExceededError, Ratelimiter
 from synapse.appservice import ApplicationService
 from synapse.config.ratelimiting import RatelimitSettings
@@ -228,6 +226,21 @@ class TestRatelimiter(unittest.HomeserverTestCase):
 
         self.assertNotIn("test_id_1", limiter.actions)
 
+    def test_pruning_record_action(self) -> None:
+        """Test that entries added by record_action also get pruned."""
+        limiter = Ratelimiter(
+            store=self.hs.get_datastores().main,
+            clock=self.clock,
+            cfg=RatelimitSettings(key="", per_second=0.1, burst_count=1),
+        )
+        limiter.record_action(None, key="test_id_1", n_actions=1, _time_now_s=0)
+
+        self.assertIn("test_id_1", limiter.actions)
+
+        self.reactor.advance(60)
+
+        self.assertNotIn("test_id_1", limiter.actions)
+
     def test_db_user_override(self) -> None:
         """Test that users that have ratelimiting disabled in the DB aren't
         ratelimited.
@@ -474,7 +487,7 @@ class TestRatelimiter(unittest.HomeserverTestCase):
         # and limiter name.
         async def get_ratelimit_override_for_user(
             user_id: str, limiter_name: str
-        ) -> Optional[RatelimitOverride]:
+        ) -> RatelimitOverride | None:
             if user_id == test_user_id:
                 return RatelimitOverride(
                     per_second=0.1,
diff --git a/tests/api/test_urls.py b/tests/api/test_urls.py
index fecc7e3e2d..00f54237ab 100644
--- a/tests/api/test_urls.py
+++ b/tests/api/test_urls.py
@@ -17,7 +17,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.api.urls import LoginSSORedirectURIBuilder
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -53,3 +53,29 @@ class LoginSSORedirectURIBuilderTestCase(HomeserverTestCase):
             ),
             "https://test/_matrix/client/v3/login/sso/redirect/oidc-github?redirectUrl=https%3A%2F%2Fx%3F%3Cab+c%3E%26q%22%2B%253D%252B%22%3D%22f%C3%B6%2526%3Do%22",
         )
+
+    def test_idp_id_with_slash_is_escaped(self) -> None:
+        """
+        Test to make sure that we properly URL encode the IdP ID.
+        """
+        self.assertEqual(
+            self.login_sso_redirect_url_builder.build_login_sso_redirect_uri(
+                idp_id="foo/bar",
+                client_redirect_url="http://example.com/redirect",
+            ),
+            "https://test/_matrix/client/v3/login/sso/redirect/foo%2Fbar?redirectUrl=http%3A%2F%2Fexample.com%2Fredirect",
+        )
+
+    def test_url_as_idp_id_is_escaped(self) -> None:
+        """
+        Test to make sure that we properly URL encode the IdP ID.
+
+        The IdP ID shouldn't be a URL.
+        """
+        self.assertEqual(
+            self.login_sso_redirect_url_builder.build_login_sso_redirect_uri(
+                idp_id="http://should-not-be-url.com/",
+                client_redirect_url="http://example.com/redirect",
+            ),
+            "https://test/_matrix/client/v3/login/sso/redirect/http%3A%2F%2Fshould-not-be-url.com%2F?redirectUrl=http%3A%2F%2Fexample.com%2Fredirect",
+        )
diff --git a/tests/app/test_homeserver_shutdown.py b/tests/app/test_homeserver_shutdown.py
new file mode 100644
index 0000000000..0f5d1c7338
--- /dev/null
+++ b/tests/app/test_homeserver_shutdown.py
@@ -0,0 +1,271 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+# Originally licensed under the Apache License, Version 2.0:
+# <http://www.apache.org/licenses/LICENSE-2.0>.
+#
+# [This file includes modifications made by New Vector Limited]
+#
+#
+
+import gc
+import sys
+import weakref
+from typing import Any
+from unittest.mock import patch
+
+from synapse.app.homeserver import SynapseHomeServer
+from synapse.logging.context import LoggingContext
+from synapse.storage.background_updates import UpdaterStatus
+
+from tests.server import (
+    cleanup_test_reactor_system_event_triggers,
+    get_clock,
+    setup_test_homeserver,
+)
+from tests.unittest import HomeserverTestCase, logcontext_clean
+
+
+class HomeserverCleanShutdownTestCase(HomeserverTestCase):
+    def setUp(self) -> None:
+        pass
+
+    # NOTE: ideally we'd have another test to ensure we properly shutdown with
+    # real in-flight HTTP requests since those result in additional resources being
+    # setup that hold strong references to the homeserver.
+    # Mainly, the HTTP channel created by a real TCP connection from client to server
+    # is held open between requests and care needs to be taken in Twisted to ensure it is properly
+    # closed in a timely manner during shutdown. Simulating this behaviour in a unit test
+    # won't be as good as a proper integration test in complement.
+
+    @logcontext_clean
+    def test_clean_homeserver_shutdown(self) -> None:
+        """Ensure the `SynapseHomeServer` can be fully shutdown and garbage collected"""
+        self.reactor, self.clock = get_clock()
+        self.hs = setup_test_homeserver(
+            cleanup_func=self.addCleanup,
+            reactor=self.reactor,
+            homeserver_to_use=SynapseHomeServer,
+            clock=self.clock,
+        )
+        self.wait_for_background_updates()
+
+        hs_ref = weakref.ref(self.hs)
+
+        # Run the reactor so any `callWhenRunning` functions can be cleared out.
+        self.reactor.run()
+        # This would normally happen as part of `HomeServer.shutdown` but the `MemoryReactor`
+        # we use in tests doesn't handle this properly (see doc comment)
+        cleanup_test_reactor_system_event_triggers(self.reactor)
+
+        async def shutdown() -> None:
+            # Use a logcontext just to double-check that we don't mangle the logcontext
+            # during shutdown.
+            with LoggingContext(name="hs_shutdown", server_name=self.hs.hostname):
+                await self.hs.shutdown()
+
+        self.get_success(shutdown())
+
+        # Cleanup the internal reference in our test case
+        del self.hs
+
+        # Force garbage collection.
+        gc.collect()
+
+        # Ensure the `HomeServer` hs been garbage collected by attempting to use the
+        # weakref to it.
+        hs_after_shutdown = hs_ref()
+        if hs_after_shutdown is not None:
+            self.fail(
+                "HomeServer reference should not be valid at this point "
+                f"{get_memory_debug_info_for_object(hs_after_shutdown)}",
+            )
+
+    @logcontext_clean
+    def test_clean_homeserver_shutdown_mid_background_updates(self) -> None:
+        """Ensure the `SynapseHomeServer` can be fully shutdown and garbage collected
+        before background updates have completed"""
+        self.reactor, self.clock = get_clock()
+        self.hs = setup_test_homeserver(
+            cleanup_func=self.addCleanup,
+            reactor=self.reactor,
+            homeserver_to_use=SynapseHomeServer,
+            clock=self.clock,
+        )
+
+        # Pump the background updates by a single iteration, just to ensure any extra
+        # resources it uses have been started.
+        store = weakref.proxy(self.hs.get_datastores().main)
+        self.get_success(store.db_pool.updates.do_next_background_update(False), by=0.1)
+
+        hs_ref = weakref.ref(self.hs)
+
+        # Run the reactor so any `callWhenRunning` functions can be cleared out.
+        self.reactor.run()
+        # This would normally happen as part of `HomeServer.shutdown` but the `MemoryReactor`
+        # we use in tests doesn't handle this properly (see doc comment)
+        cleanup_test_reactor_system_event_triggers(self.reactor)
+
+        # Ensure the background updates are not complete.
+        self.assertNotEqual(store.db_pool.updates.get_status(), UpdaterStatus.COMPLETE)
+
+        async def shutdown() -> None:
+            # Use a logcontext just to double-check that we don't mangle the logcontext
+            # during shutdown.
+            with LoggingContext(name="hs_shutdown", server_name=self.hs.hostname):
+                await self.hs.shutdown()
+
+        self.get_success(shutdown())
+
+        # Cleanup the internal reference in our test case
+        del self.hs
+
+        # Force garbage collection.
+        gc.collect()
+
+        # Ensure the `HomeServer` hs been garbage collected by attempting to use the
+        # weakref to it.
+        hs_after_shutdown = hs_ref()
+        if hs_after_shutdown is not None:
+            self.fail(
+                "HomeServer reference should not be valid at this point "
+                f"{get_memory_debug_info_for_object(hs_after_shutdown)}",
+            )
+
+    @logcontext_clean
+    def test_clean_homeserver_shutdown_when_failed_to_setup(self) -> None:
+        """
+        Ensure the `SynapseHomeServer` can be fully shutdown and garbage collected if it
+        fails to be `setup`.
+        """
+        self.reactor, self.clock = get_clock()
+
+        # Patch `hs.setup()` to do nothing, so that the homeserver is not fully setup.
+        with patch.object(SynapseHomeServer, "setup", return_value=None) as mock_setup:
+            # Patch out the call to `start_test_homeserver` since we want access to the
+            # homeserver even before the server is setup (let alone started)
+            with patch("tests.server.start_test_homeserver", return_value=None):
+                self.hs = setup_test_homeserver(
+                    cleanup_func=self.addCleanup,
+                    reactor=self.reactor,
+                    homeserver_to_use=SynapseHomeServer,
+                    clock=self.clock,
+                )
+            # Sanity check that we patched the correct method (make sure it was the
+            # thing that was called)
+            mock_setup.assert_called_once_with()
+
+        hs_ref = weakref.ref(self.hs)
+
+        # Run the reactor so any `callWhenRunning` functions can be cleared out.
+        self.reactor.run()
+        # This would normally happen as part of `HomeServer.shutdown` but the `MemoryReactor`
+        # we use in tests doesn't handle this properly (see doc comment)
+        cleanup_test_reactor_system_event_triggers(self.reactor)
+
+        async def shutdown() -> None:
+            # Use a logcontext just to double-check that we don't mangle the logcontext
+            # during shutdown.
+            with LoggingContext(name="hs_shutdown", server_name=self.hs.hostname):
+                await self.hs.shutdown()
+
+        self.get_success(shutdown())
+
+        # Cleanup the internal reference in our test case
+        del self.hs
+
+        # Force garbage collection.
+        gc.collect()
+
+        # Ensure the `HomeServer` hs been garbage collected by attempting to use the
+        # weakref to it.
+        hs_after_shutdown = hs_ref()
+        if hs_after_shutdown is not None:
+            self.fail(
+                "HomeServer reference should not be valid at this point "
+                f"{get_memory_debug_info_for_object(hs_after_shutdown)}",
+            )
+
+
+def get_memory_debug_info_for_object(object: Any) -> dict[str, Any]:
+    """
+    Gathers some useful information to make it easier to figure out why the `object` is
+    still in memory.
+
+    Args:
+        object: The object to gather debug information for.
+    """
+    debug: dict[str, Any] = {}
+    if object is not None:
+        # The simplest tracing we can do is show the reference count for the object.
+        debug["reference_count"] = sys.getrefcount(object)
+
+        # Find the list of objects that directly refer to the object.
+        #
+        # Note: The `ref_count` can be >0 but `referrers` can be empty because
+        # the all of the objects were frozen. Look at the
+        # `frozen_object_count` to detect this scenario.
+        referrers = gc.get_referrers(object)
+        debug["gc_referrer_count"] = len(referrers)
+        debug["gc_referrers"] = referrers
+
+        # We don't expect to see frozen objects in normal operation of the
+        # `multi_synapse` shard.
+        #
+        # We can see frozen objects if you forget to `freeze=False` when
+        # starting the `SynapseHomeServer`. Frozen objects mean they are
+        # never considered for garbage collection. If the
+        # `SynapseHomeServer` (or anything that references the homeserver)
+        # is frozen, the homeserver can never be garbage collected and will
+        # linger in memory forever.
+        freeze_count = gc.get_freeze_count()
+        debug["gc_global_frozen_object_count"] = freeze_count
+
+    # To help debug this test when it fails, it is useful to leverage the
+    # `objgraph` module.
+    # The following code serves as an example of what I have found to be useful
+    # when tracking down references holding the `SynapseHomeServer` in memory:
+    #
+    # all_objects = gc.get_objects()
+    # for obj in all_objects:
+    #     try:
+    #         # These are a subset of types that are typically involved with
+    #         # holding the `HomeServer` in memory. You may want to inspect
+    #         # other types as well.
+    #         if isinstance(obj, DataStore):
+    #             print(sys.getrefcount(obj), "refs to", obj)
+    #             if not isinstance(obj, weakref.ProxyType):
+    #                 db_obj = obj
+    #         if isinstance(obj, SynapseHomeServer):
+    #             print(sys.getrefcount(obj), "refs to", obj)
+    #             if not isinstance(obj, weakref.ProxyType):
+    #                 synapse_hs = obj
+    #         if isinstance(obj, SynapseSite):
+    #             print(sys.getrefcount(obj), "refs to", obj)
+    #             if not isinstance(obj, weakref.ProxyType):
+    #                 sysite = obj
+    #         if isinstance(obj, DatabasePool):
+    #             print(sys.getrefcount(obj), "refs to", obj)
+    #             if not isinstance(obj, weakref.ProxyType):
+    #                 dbpool = obj
+    #     except Exception:
+    #         pass
+    #
+    # print(sys.getrefcount(hs_ref()), "refs to", hs_ref())
+    #
+    # # The following values for `max_depth` and `too_many` have been found to
+    # # render a useful amount of information without taking an overly long time
+    # # to generate the result.
+    # objgraph.show_backrefs(synapse_hs, max_depth=10, too_many=10)
+
+    return debug
diff --git a/tests/app/test_homeserver_start.py b/tests/app/test_homeserver_start.py
index 9dc20800b2..36a7170d12 100644
--- a/tests/app/test_homeserver_start.py
+++ b/tests/app/test_homeserver_start.py
@@ -37,4 +37,13 @@ class HomeserverAppStartTestCase(ConfigFileTestCase):
         self.add_lines_to_config(["  main:", "    host: 127.0.0.1", "    port: 1234"])
         # Ensure that starting master process with worker config raises an exception
         with self.assertRaises(ConfigError):
-            synapse.app.homeserver.setup(["-c", self.config_file])
+            # Do a normal homeserver creation and setup
+            homeserver_config = synapse.app.homeserver.load_or_generate_config(
+                ["-c", self.config_file]
+            )
+            # XXX: The error will be raised at this point
+            hs = synapse.app.homeserver.create_homeserver(homeserver_config)
+            # Continue with the setup. We don't expect this to run because we raised
+            # earlier, but in the future, the code could be refactored to raise the
+            # error in a different place.
+            synapse.app.homeserver.setup(hs)
diff --git a/tests/app/test_openid_listener.py b/tests/app/test_openid_listener.py
index 63cb5ff46f..6a1a630fe8 100644
--- a/tests/app/test_openid_listener.py
+++ b/tests/app/test_openid_listener.py
@@ -17,7 +17,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List
 from unittest.mock import Mock, patch
 
 from parameterized import parameterized
@@ -29,7 +28,7 @@ from synapse.app.homeserver import SynapseHomeServer
 from synapse.config.server import parse_listener_def
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.server import make_request
 from tests.unittest import HomeserverTestCase
@@ -58,7 +57,7 @@ class FederationReaderOpenIDListenerTests(HomeserverTestCase):
             (["openid"], "auth_fail"),
         ]
     )
-    def test_openid_listener(self, names: List[str], expectation: str) -> None:
+    def test_openid_listener(self, names: list[str], expectation: str) -> None:
         """
         Test different openid listener configurations.
 
@@ -106,7 +105,7 @@ class SynapseHomeserverOpenIDListenerTests(HomeserverTestCase):
             (["openid"], "auth_fail"),
         ]
     )
-    def test_openid_listener(self, names: List[str], expectation: str) -> None:
+    def test_openid_listener(self, names: list[str], expectation: str) -> None:
         """
         Test different openid listener configurations.
 
diff --git a/tests/app/test_phone_stats_home.py b/tests/app/test_phone_stats_home.py
index 93af614def..73c3a9fd98 100644
--- a/tests/app/test_phone_stats_home.py
+++ b/tests/app/test_phone_stats_home.py
@@ -2,7 +2,7 @@ import synapse
 from synapse.app.phone_stats_home import start_phone_stats_home
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.server import ThreadedMemoryReactorClock
 from tests.unittest import HomeserverTestCase
diff --git a/tests/appservice/test_api.py b/tests/appservice/test_api.py
index 5eba6d20c8..bf55f261bb 100644
--- a/tests/appservice/test_api.py
+++ b/tests/appservice/test_api.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, List, Mapping, Optional, Sequence, Union
+from typing import Any, Mapping, Sequence
 from unittest.mock import Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -26,7 +26,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.appservice import ApplicationService
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -80,8 +80,8 @@ class ApplicationServiceApiTestCase(unittest.HomeserverTestCase):
         async def get_json(
             url: str,
             args: Mapping[Any, Any],
-            headers: Mapping[Union[str, bytes], Sequence[Union[str, bytes]]],
-        ) -> List[JsonDict]:
+            headers: Mapping[str | bytes, Sequence[str | bytes]],
+        ) -> list[JsonDict]:
             # Ensure the access token is passed as a header.
             if not headers or not headers.get(b"Authorization"):
                 raise RuntimeError("Access token not provided")
@@ -154,10 +154,8 @@ class ApplicationServiceApiTestCase(unittest.HomeserverTestCase):
         async def get_json(
             url: str,
             args: Mapping[Any, Any],
-            headers: Optional[
-                Mapping[Union[str, bytes], Sequence[Union[str, bytes]]]
-            ] = None,
-        ) -> List[JsonDict]:
+            headers: Mapping[str | bytes, Sequence[str | bytes]] | None = None,
+        ) -> list[JsonDict]:
             # Ensure the access token is passed as a both a query param and in the headers.
             if not args.get(b"access_token"):
                 raise RuntimeError("Access token should be provided in query params.")
@@ -216,7 +214,7 @@ class ApplicationServiceApiTestCase(unittest.HomeserverTestCase):
         async def post_json_get_json(
             uri: str,
             post_json: Any,
-            headers: Mapping[Union[str, bytes], Sequence[Union[str, bytes]]],
+            headers: Mapping[str | bytes, Sequence[str | bytes]],
         ) -> JsonDict:
             # Ensure the access token is passed as both a header and query arg.
             if not headers.get(b"Authorization"):
diff --git a/tests/appservice/test_scheduler.py b/tests/appservice/test_scheduler.py
index 11319bc52d..3caf006386 100644
--- a/tests/appservice/test_scheduler.py
+++ b/tests/appservice/test_scheduler.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional, Sequence, Tuple, cast
+from typing import Sequence
 from unittest.mock import AsyncMock, Mock
 
 from typing_extensions import TypeAlias
@@ -41,16 +41,15 @@ from synapse.events import EventBase
 from synapse.logging.context import make_deferred_yieldable
 from synapse.server import HomeServer
 from synapse.types import DeviceListUpdates, JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
-
-from ..utils import MockClock
+from tests.server import get_clock
 
 
 class ApplicationServiceSchedulerTransactionCtrlTestCase(unittest.TestCase):
     def setUp(self) -> None:
-        self.clock = MockClock()
+        self.reactor, self.clock = get_clock()
         self.store = Mock()
         self.as_api = Mock()
 
@@ -168,16 +167,18 @@ class ApplicationServiceSchedulerTransactionCtrlTestCase(unittest.TestCase):
         )
 
 
-class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
+class ApplicationServiceSchedulerRecovererTestCase(unittest.HomeserverTestCase):
     def setUp(self) -> None:
-        self.clock = MockClock()
+        super().setUp()
+        self.reactor, self.clock = get_clock()
         self.as_api = Mock()
         self.store = Mock()
         self.service = Mock()
         self.callback = AsyncMock()
         self.recoverer = _Recoverer(
             server_name="test_server",
-            clock=cast(Clock, self.clock),
+            hs=self.hs,
+            clock=self.clock,
             as_api=self.as_api,
             store=self.store,
             service=self.service,
@@ -189,9 +190,7 @@ class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
         # return one txn to send, then no more old txns
         txns = [txn, None]
 
-        def take_txn(
-            *args: object, **kwargs: object
-        ) -> "defer.Deferred[Optional[Mock]]":
+        def take_txn(*args: object, **kwargs: object) -> "defer.Deferred[Mock | None]":
             return defer.succeed(txns.pop(0))
 
         self.store.get_oldest_unsent_txn = Mock(side_effect=take_txn)
@@ -202,7 +201,7 @@ class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
         txn.send = AsyncMock(return_value=True)
         txn.complete = AsyncMock(return_value=None)
         # wait for exp backoff
-        self.clock.advance_time(2)
+        self.reactor.advance(2)
         self.assertEqual(1, txn.send.call_count)
         self.assertEqual(1, txn.complete.call_count)
         # 2 because it needs to get None to know there are no more txns
@@ -215,9 +214,7 @@ class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
         txns = [txn, None]
         pop_txn = False
 
-        def take_txn(
-            *args: object, **kwargs: object
-        ) -> "defer.Deferred[Optional[Mock]]":
+        def take_txn(*args: object, **kwargs: object) -> "defer.Deferred[Mock | None]":
             if pop_txn:
                 return defer.succeed(txns.pop(0))
             else:
@@ -229,21 +226,21 @@ class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
         self.assertEqual(0, self.store.get_oldest_unsent_txn.call_count)
         txn.send = AsyncMock(return_value=False)
         txn.complete = AsyncMock(return_value=None)
-        self.clock.advance_time(2)
+        self.reactor.advance(2)
         self.assertEqual(1, txn.send.call_count)
         self.assertEqual(0, txn.complete.call_count)
         self.assertEqual(0, self.callback.call_count)
-        self.clock.advance_time(4)
+        self.reactor.advance(4)
         self.assertEqual(2, txn.send.call_count)
         self.assertEqual(0, txn.complete.call_count)
         self.assertEqual(0, self.callback.call_count)
-        self.clock.advance_time(8)
+        self.reactor.advance(8)
         self.assertEqual(3, txn.send.call_count)
         self.assertEqual(0, txn.complete.call_count)
         self.assertEqual(0, self.callback.call_count)
         txn.send = AsyncMock(return_value=True)  # successfully send the txn
         pop_txn = True  # returns the txn the first time, then no more.
-        self.clock.advance_time(16)
+        self.reactor.advance(16)
         self.assertEqual(1, txn.send.call_count)  # new mock reset call count
         self.assertEqual(1, txn.complete.call_count)
         self.callback.assert_called_once_with(self.recoverer)
@@ -253,9 +250,7 @@ class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
         txns = [txn, None]
         pop_txn = False
 
-        def take_txn(
-            *args: object, **kwargs: object
-        ) -> "defer.Deferred[Optional[Mock]]":
+        def take_txn(*args: object, **kwargs: object) -> "defer.Deferred[Mock | None]":
             if pop_txn:
                 return defer.succeed(txns.pop(0))
             else:
@@ -268,7 +263,7 @@ class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
         self.assertEqual(0, self.store.get_oldest_unsent_txn.call_count)
         txn.send = AsyncMock(return_value=False)
         txn.complete = AsyncMock(return_value=None)
-        self.clock.advance_time(2)
+        self.reactor.advance(2)
         self.assertEqual(1, txn.send.call_count)
         self.assertEqual(0, txn.complete.call_count)
         self.assertEqual(0, self.callback.call_count)
@@ -287,14 +282,14 @@ class ApplicationServiceSchedulerRecovererTestCase(unittest.TestCase):
 # Corresponds to synapse.appservice.scheduler._TransactionController.send
 TxnCtrlArgs: TypeAlias = """
 defer.Deferred[
-    Tuple[
+    tuple[
         ApplicationService,
         Sequence[EventBase],
-        Optional[List[JsonDict]],
-        Optional[List[JsonDict]],
-        Optional[TransactionOneTimeKeysCount],
-        Optional[TransactionUnusedFallbackKeys],
-        Optional[DeviceListUpdates],
+        list[JsonDict] | None,
+        list[JsonDict] | None,
+        TransactionOneTimeKeysCount | None,
+        TransactionUnusedFallbackKeys | None,
+        DeviceListUpdates | None,
     ]
 ]
 """
diff --git a/tests/config/test_cache.py b/tests/config/test_cache.py
index deb6bade46..74db2dab08 100644
--- a/tests/config/test_cache.py
+++ b/tests/config/test_cache.py
@@ -24,6 +24,7 @@ from synapse.config.cache import CacheConfig, add_resizable_cache
 from synapse.types import JsonDict
 from synapse.util.caches.lrucache import LruCache
 
+from tests.server import get_clock
 from tests.unittest import TestCase
 
 
@@ -32,6 +33,7 @@ class CacheConfigTests(TestCase):
         # Reset caches before each test since there's global state involved.
         self.config = CacheConfig(RootConfig())
         self.config.reset()
+        _, self.clock = get_clock()
 
     def tearDown(self) -> None:
         # Also reset the caches after each test to leave state pristine.
@@ -75,7 +77,9 @@ class CacheConfigTests(TestCase):
         the default cache size in the interim, and then resized once the config
         is loaded.
         """
-        cache: LruCache = LruCache(max_size=100)
+        cache: LruCache = LruCache(
+            max_size=100, clock=self.clock, server_name="test_server"
+        )
 
         add_resizable_cache("foo", cache_resize_callback=cache.set_cache_factor)
         self.assertEqual(cache.max_size, 50)
@@ -96,7 +100,9 @@ class CacheConfigTests(TestCase):
         self.config.read_config(config, config_dir_path="", data_dir_path="")
         self.config.resize_all_caches()
 
-        cache: LruCache = LruCache(max_size=100)
+        cache: LruCache = LruCache(
+            max_size=100, clock=self.clock, server_name="test_server"
+        )
         add_resizable_cache("foo", cache_resize_callback=cache.set_cache_factor)
         self.assertEqual(cache.max_size, 200)
 
@@ -106,7 +112,9 @@ class CacheConfigTests(TestCase):
         the default cache size in the interim, and then resized to the new
         default cache size once the config is loaded.
         """
-        cache: LruCache = LruCache(max_size=100)
+        cache: LruCache = LruCache(
+            max_size=100, clock=self.clock, server_name="test_server"
+        )
         add_resizable_cache("foo", cache_resize_callback=cache.set_cache_factor)
         self.assertEqual(cache.max_size, 50)
 
@@ -126,7 +134,9 @@ class CacheConfigTests(TestCase):
         self.config.read_config(config, config_dir_path="", data_dir_path="")
         self.config.resize_all_caches()
 
-        cache: LruCache = LruCache(max_size=100)
+        cache: LruCache = LruCache(
+            max_size=100, clock=self.clock, server_name="test_server"
+        )
         add_resizable_cache("foo", cache_resize_callback=cache.set_cache_factor)
         self.assertEqual(cache.max_size, 150)
 
@@ -145,15 +155,21 @@ class CacheConfigTests(TestCase):
         self.config.read_config(config, config_dir_path="", data_dir_path="")
         self.config.resize_all_caches()
 
-        cache_a: LruCache = LruCache(max_size=100)
+        cache_a: LruCache = LruCache(
+            max_size=100, clock=self.clock, server_name="test_server"
+        )
         add_resizable_cache("*cache_a*", cache_resize_callback=cache_a.set_cache_factor)
         self.assertEqual(cache_a.max_size, 200)
 
-        cache_b: LruCache = LruCache(max_size=100)
+        cache_b: LruCache = LruCache(
+            max_size=100, clock=self.clock, server_name="test_server"
+        )
         add_resizable_cache("*Cache_b*", cache_resize_callback=cache_b.set_cache_factor)
         self.assertEqual(cache_b.max_size, 300)
 
-        cache_c: LruCache = LruCache(max_size=100)
+        cache_c: LruCache = LruCache(
+            max_size=100, clock=self.clock, server_name="test_server"
+        )
         add_resizable_cache("*cache_c*", cache_resize_callback=cache_c.set_cache_factor)
         self.assertEqual(cache_c.max_size, 200)
 
@@ -168,7 +184,9 @@ class CacheConfigTests(TestCase):
 
         cache: LruCache = LruCache(
             max_size=self.config.event_cache_size,
+            clock=self.clock,
             apply_cache_factor_from_config=False,
+            server_name="test_server",
         )
         add_resizable_cache("event_cache", cache_resize_callback=cache.set_cache_factor)
 
diff --git a/tests/config/test_load.py b/tests/config/test_load.py
index b72365b6e3..c1b787346e 100644
--- a/tests/config/test_load.py
+++ b/tests/config/test_load.py
@@ -99,7 +99,14 @@ class ConfigLoadingFileTestCase(ConfigFileTestCase):
     def test_disable_registration(self) -> None:
         self.generate_config()
         self.add_lines_to_config(
-            ["enable_registration: true", "disable_registration: true"]
+            [
+                "enable_registration: true",
+                "disable_registration: true",
+                # We're not worried about open registration in this test. This test is
+                # focused on making sure that enable/disable_registration properly
+                # override each other.
+                "enable_registration_without_verification: true",
+            ]
         )
         # Check that disable_registration clobbers enable_registration.
         config = HomeServerConfig.load_config("", ["-c", self.config_file])
diff --git a/tests/config/test_oauth_delegation.py b/tests/config/test_oauth_delegation.py
index 833cfe628b..6105ca2b04 100644
--- a/tests/config/test_oauth_delegation.py
+++ b/tests/config/test_oauth_delegation.py
@@ -21,6 +21,7 @@
 
 import os
 import tempfile
+from pathlib import Path
 from unittest.mock import Mock
 
 from synapse.config import ConfigError
@@ -231,7 +232,10 @@ class MSC3861OAuthDelegation(TestCase):
         reactor, clock = get_clock()
         with self.assertRaises(ConfigError):
             setup_test_homeserver(
-                self.addCleanup, reactor=reactor, clock=clock, config=config
+                cleanup_func=self.addCleanup,
+                config=config,
+                reactor=reactor,
+                clock=clock,
             )
 
     def test_jwt_auth_cannot_be_enabled(self) -> None:
@@ -306,7 +310,9 @@ class MasAuthDelegation(TestCase):
     def test_secret_and_secret_path_are_mutually_exclusive(self) -> None:
         with tempfile.NamedTemporaryFile() as f:
             self.config_dict["matrix_authentication_service"]["secret"] = "verysecret"
-            self.config_dict["matrix_authentication_service"]["secret_path"] = f.name
+            self.config_dict["matrix_authentication_service"]["secret_path"] = Path(
+                f.name
+            )
             with self.assertRaises(ConfigError):
                 self.parse_config()
 
@@ -314,13 +320,15 @@ class MasAuthDelegation(TestCase):
         with tempfile.NamedTemporaryFile(buffering=0) as f:
             f.write(b"53C237")
             del self.config_dict["matrix_authentication_service"]["secret"]
-            self.config_dict["matrix_authentication_service"]["secret_path"] = f.name
+            self.config_dict["matrix_authentication_service"]["secret_path"] = Path(
+                f.name
+            )
             config = self.parse_config()
             self.assertEqual(config.mas.secret(), "53C237")
 
     def test_secret_path_must_exist(self) -> None:
         del self.config_dict["matrix_authentication_service"]["secret"]
-        self.config_dict["matrix_authentication_service"]["secret_path"] = (
+        self.config_dict["matrix_authentication_service"]["secret_path"] = Path(
             "/not/a/valid/file"
         )
         with self.assertRaises(ConfigError):
@@ -395,7 +403,10 @@ class MasAuthDelegation(TestCase):
         reactor, clock = get_clock()
         with self.assertRaises(ConfigError):
             setup_test_homeserver(
-                self.addCleanup, reactor=reactor, clock=clock, config=config
+                cleanup_func=self.addCleanup,
+                config=config,
+                reactor=reactor,
+                clock=clock,
             )
 
     @skip_unless(HAS_AUTHLIB, "requires authlib")
diff --git a/tests/config/test_registration_config.py b/tests/config/test_registration_config.py
index 7fd6df2f93..9eb5323a24 100644
--- a/tests/config/test_registration_config.py
+++ b/tests/config/test_registration_config.py
@@ -19,6 +19,8 @@
 #
 #
 
+import argparse
+
 import synapse.app.homeserver
 from synapse.config import ConfigError
 from synapse.config.homeserver import HomeServerConfig
@@ -99,6 +101,39 @@ class RegistrationConfigTestCase(ConfigFileTestCase):
         )
 
     def test_refuse_to_start_if_open_registration_and_no_verification(self) -> None:
+        """
+        Test that our utilities to start the main Synapse homeserver process refuses
+        to start if we detect open registration.
+        """
+        self.generate_config()
+        self.add_lines_to_config(
+            [
+                " ",
+                "enable_registration: true",
+                "registrations_require_3pid: []",
+                "enable_registration_captcha: false",
+                "registration_requires_token: false",
+            ]
+        )
+
+        # Test that allowing open registration without verification raises an error
+        with self.assertRaises(SystemExit):
+            # Do a normal homeserver creation and setup
+            homeserver_config = synapse.app.homeserver.load_or_generate_config(
+                ["-c", self.config_file]
+            )
+            # XXX: The error will be raised at this point
+            hs = synapse.app.homeserver.create_homeserver(homeserver_config)
+            # Continue with the setup. We don't expect this to run because we raised
+            # earlier, but in the future, the code could be refactored to raise the
+            # error in a different place.
+            synapse.app.homeserver.setup(hs)
+
+    def test_load_config_error_if_open_registration_and_no_verification(self) -> None:
+        """
+        Test that `HomeServerConfig.load_config(...)` raises an exception when we detect open
+        registration.
+        """
         self.generate_config()
         self.add_lines_to_config(
             [
@@ -112,4 +147,57 @@ class RegistrationConfigTestCase(ConfigFileTestCase):
 
         # Test that allowing open registration without verification raises an error
         with self.assertRaises(ConfigError):
-            synapse.app.homeserver.setup(["-c", self.config_file])
+            _homeserver_config = HomeServerConfig.load_config(
+                description="test", argv_options=["-c", self.config_file]
+            )
+
+    def test_load_or_generate_config_error_if_open_registration_and_no_verification(
+        self,
+    ) -> None:
+        """
+        Test that `HomeServerConfig.load_or_generate_config(...)` raises an exception when we detect open
+        registration.
+        """
+        self.generate_config()
+        self.add_lines_to_config(
+            [
+                " ",
+                "enable_registration: true",
+                "registrations_require_3pid: []",
+                "enable_registration_captcha: false",
+                "registration_requires_token: false",
+            ]
+        )
+
+        # Test that allowing open registration without verification raises an error
+        with self.assertRaises(ConfigError):
+            _homeserver_config = HomeServerConfig.load_or_generate_config(
+                description="test", argv_options=["-c", self.config_file]
+            )
+
+    def test_load_config_with_parser_error_if_open_registration_and_no_verification(
+        self,
+    ) -> None:
+        """
+        Test that `HomeServerConfig.load_config_with_parser(...)` raises an exception when we detect open
+        registration.
+        """
+        self.generate_config()
+        self.add_lines_to_config(
+            [
+                " ",
+                "enable_registration: true",
+                "registrations_require_3pid: []",
+                "enable_registration_captcha: false",
+                "registration_requires_token: false",
+            ]
+        )
+
+        # Test that allowing open registration without verification raises an error
+        with self.assertRaises(ConfigError):
+            config_parser = argparse.ArgumentParser(description="test")
+            HomeServerConfig.add_arguments_to_parser(config_parser)
+
+            _homeserver_config = HomeServerConfig.load_config_with_parser(
+                parser=config_parser, argv_options=["-c", self.config_file]
+            )
diff --git a/tests/config/test_room_directory.py b/tests/config/test_room_directory.py
index 5f3d8be2a5..4e044245e2 100644
--- a/tests/config/test_room_directory.py
+++ b/tests/config/test_room_directory.py
@@ -27,7 +27,7 @@ import synapse.rest.client.room
 from synapse.config._base import RootConfig
 from synapse.config.room_directory import RoomDirectoryConfig
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
diff --git a/tests/config/test_server.py b/tests/config/test_server.py
index 5eb2540439..d3c59ae14c 100644
--- a/tests/config/test_server.py
+++ b/tests/config/test_server.py
@@ -21,6 +21,7 @@
 import yaml
 
 from synapse.config._base import ConfigError, RootConfig
+from synapse.config.homeserver import HomeServerConfig
 from synapse.config.server import ServerConfig, generate_ip_set, is_threepid_reserved
 
 from tests import unittest
@@ -38,14 +39,23 @@ class ServerConfigTestCase(unittest.TestCase):
         self.assertFalse(is_threepid_reserved(config, user3))
         self.assertFalse(is_threepid_reserved(config, user1_msisdn))
 
-    def test_unsecure_listener_no_listeners_open_private_ports_false(self) -> None:
+    def test_default_set_of_listeners(self) -> None:
+        """
+        Test that we get a default set of listeners from the `RootConfig`
+        """
         conf = yaml.safe_load(
-            ServerConfig(RootConfig()).generate_config_section(
-                "CONFDIR", "/data_dir_path", "che.org", False, None
+            # We use `HomeServerConfig` instead of `RootConfig` as it has all of the
+            # `config_classes` defined.
+            HomeServerConfig().generate_config(
+                config_dir_path="CONFDIR",
+                data_dir_path="/data_dir_path",
+                server_name="che.org",
+                open_private_ports=False,
+                listeners=None,
             )
         )
 
-        expected_listeners = [
+        expected_listeners: list[dict] = [
             {
                 "port": 8008,
                 "tls": False,
@@ -58,25 +68,61 @@ class ServerConfigTestCase(unittest.TestCase):
 
         self.assertEqual(conf["listeners"], expected_listeners)
 
-    def test_unsecure_listener_no_listeners_open_private_ports_true(self) -> None:
+    def test_default_set_of_listeners_with_enable_metrics(self) -> None:
+        """
+        Test that the default set of listeners from the `RootConfig` gets a metrics
+        listener when `enable_metrics=True`.
+        """
         conf = yaml.safe_load(
-            ServerConfig(RootConfig()).generate_config_section(
-                "CONFDIR", "/data_dir_path", "che.org", True, None
+            # We use `HomeServerConfig` instead of `RootConfig` as it has all of the
+            # `config_classes` defined.
+            HomeServerConfig().generate_config(
+                config_dir_path="CONFDIR",
+                data_dir_path="/data_dir_path",
+                server_name="che.org",
+                open_private_ports=False,
+                enable_metrics=True,
+                listeners=None,
             )
         )
 
-        expected_listeners = [
+        expected_listeners: list[dict] = [
             {
                 "port": 8008,
                 "tls": False,
                 "type": "http",
                 "x_forwarded": True,
+                "bind_addresses": ["::1", "127.0.0.1"],
                 "resources": [{"names": ["client", "federation"], "compress": False}],
-            }
+            },
+            {
+                "port": 19090,
+                "tls": False,
+                "type": "metrics",
+                "bind_addresses": ["::1", "127.0.0.1"],
+            },
         ]
 
         self.assertEqual(conf["listeners"], expected_listeners)
 
+    def test_unsecure_listener_no_listeners(self) -> None:
+        conf = yaml.safe_load(
+            ServerConfig(RootConfig()).generate_config_section(
+                config_dir_path="CONFDIR",
+                data_dir_path="/data_dir_path",
+                server_name="che.org",
+                open_private_ports=False,
+                listeners=None,
+            )
+        )
+
+        # We expect `None` because we only operate with what's given to us. The default
+        # set of listeners comes from the logic one layer above in `RootConfig` (see
+        # tests above).
+        expected_listeners: list[dict] = []
+
+        self.assertEqual(conf["listeners"], expected_listeners)
+
     def test_listeners_set_correctly_open_private_ports_false(self) -> None:
         listeners = [
             {
@@ -95,7 +141,11 @@ class ServerConfigTestCase(unittest.TestCase):
 
         conf = yaml.safe_load(
             ServerConfig(RootConfig()).generate_config_section(
-                "CONFDIR", "/data_dir_path", "this.one.listens", True, listeners
+                config_dir_path="CONFDIR",
+                data_dir_path="/data_dir_path",
+                server_name="this.one.listens",
+                open_private_ports=True,
+                listeners=listeners,
             )
         )
 
@@ -129,7 +179,11 @@ class ServerConfigTestCase(unittest.TestCase):
 
         conf = yaml.safe_load(
             ServerConfig(RootConfig()).generate_config_section(
-                "CONFDIR", "/data_dir_path", "this.one.listens", True, listeners
+                config_dir_path="CONFDIR",
+                data_dir_path="/data_dir_path",
+                server_name="this.one.listens",
+                open_private_ports=True,
+                listeners=listeners,
             )
         )
 
diff --git a/tests/config/test_workers.py b/tests/config/test_workers.py
index 3a21975b89..55439a502c 100644
--- a/tests/config/test_workers.py
+++ b/tests/config/test_workers.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Mapping, Optional
+from typing import Any, Mapping
 from unittest.mock import Mock
 
 from immutabledict import immutabledict
@@ -35,7 +35,7 @@ class WorkerDutyConfigTestCase(TestCase):
     def _make_worker_config(
         self,
         worker_app: str,
-        worker_name: Optional[str],
+        worker_name: str | None,
         extras: Mapping[str, Any] = _EMPTY_IMMUTABLEDICT,
     ) -> WorkerConfig:
         root_config = Mock()
diff --git a/tests/config/utils.py b/tests/config/utils.py
index 3cba4ac588..efc63558db 100644
--- a/tests/config/utils.py
+++ b/tests/config/utils.py
@@ -24,7 +24,6 @@ import tempfile
 import unittest
 from contextlib import redirect_stdout
 from io import StringIO
-from typing import List
 
 from synapse.config.homeserver import HomeServerConfig
 
@@ -61,7 +60,7 @@ class ConfigFileTestCase(unittest.TestCase):
         with open(self.config_file, "w") as f:
             f.write("".join(contents))
 
-    def add_lines_to_config(self, lines: List[str]) -> None:
+    def add_lines_to_config(self, lines: list[str]) -> None:
         with open(self.config_file, "a") as f:
             for line in lines:
                 f.write(line + "\n")
diff --git a/tests/crypto/test_keyring.py b/tests/crypto/test_keyring.py
index 80f9bd097e..6bc935f272 100644
--- a/tests/crypto/test_keyring.py
+++ b/tests/crypto/test_keyring.py
@@ -19,8 +19,8 @@
 #
 #
 import time
-from typing import Any, Dict, List, Optional, cast
-from unittest.mock import Mock
+from typing import Any, cast
+from unittest.mock import Mock, patch
 
 import attr
 import canonicaljson
@@ -49,7 +49,7 @@ from synapse.logging.context import (
 from synapse.server import HomeServer
 from synapse.storage.keys import FetchKeyResult
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import logcontext_clean, override_config
@@ -60,7 +60,7 @@ class MockPerspectiveServer:
         self.server_name = "mock_server"
         self.key = signedjson.key.generate_signing_key("0")
 
-    def get_verify_keys(self) -> Dict[str, str]:
+    def get_verify_keys(self) -> dict[str, str]:
         vk = signedjson.key.get_verify_key(self.key)
         return {"%s:%s" % (vk.alg, vk.version): encode_verify_key_base64(vk)}
 
@@ -87,7 +87,7 @@ class FakeRequest:
 @logcontext_clean
 class KeyringTestCase(unittest.HomeserverTestCase):
     def check_context(
-        self, val: ContextRequest, expected: Optional[ContextRequest]
+        self, val: ContextRequest, expected: ContextRequest | None
     ) -> ContextRequest:
         self.assertEqual(getattr(current_context(), "request", None), expected)
         return val
@@ -95,7 +95,12 @@ class KeyringTestCase(unittest.HomeserverTestCase):
     def test_verify_json_objects_for_server_awaits_previous_requests(self) -> None:
         mock_fetcher = Mock()
         mock_fetcher.get_keys = Mock()
-        kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher,))
+        kr = keyring.Keyring(
+            self.hs,
+            test_only_key_fetchers=[
+                mock_fetcher,
+            ],
+        )
 
         # a signed object that we are going to try to validate
         key1 = signedjson.key.generate_signing_key("1")
@@ -107,8 +112,8 @@ class KeyringTestCase(unittest.HomeserverTestCase):
         first_lookup_deferred: "Deferred[None]" = Deferred()
 
         async def first_lookup_fetch(
-            server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-        ) -> Dict[str, FetchKeyResult]:
+            server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+        ) -> dict[str, FetchKeyResult]:
             # self.assertEqual(current_context().request.id, "context_11")
             self.assertEqual(server_name, "server10")
             self.assertEqual(key_ids, [get_key_id(key1)])
@@ -121,7 +126,9 @@ class KeyringTestCase(unittest.HomeserverTestCase):
 
         async def first_lookup() -> None:
             with LoggingContext(
-                "context_11", request=cast(ContextRequest, FakeRequest("context_11"))
+                name="context_11",
+                server_name=self.hs.hostname,
+                request=cast(ContextRequest, FakeRequest("context_11")),
             ):
                 res_deferreds = kr.verify_json_objects_for_server(
                     [("server10", json1, 0), ("server11", {}, 0)]
@@ -150,8 +157,8 @@ class KeyringTestCase(unittest.HomeserverTestCase):
         # should block rather than start a second call
 
         async def second_lookup_fetch(
-            server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-        ) -> Dict[str, FetchKeyResult]:
+            server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+        ) -> dict[str, FetchKeyResult]:
             # self.assertEqual(current_context().request.id, "context_12")
             return {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 100)}
 
@@ -161,7 +168,9 @@ class KeyringTestCase(unittest.HomeserverTestCase):
 
         async def second_lookup() -> None:
             with LoggingContext(
-                "context_12", request=cast(ContextRequest, FakeRequest("context_12"))
+                name="context_12",
+                server_name=self.hs.hostname,
+                request=cast(ContextRequest, FakeRequest("context_12")),
             ):
                 res_deferreds_2 = kr.verify_json_objects_for_server(
                     [
@@ -229,6 +238,51 @@ class KeyringTestCase(unittest.HomeserverTestCase):
         # self.assertFalse(d.called)
         self.get_success(d)
 
+    def test_verify_json_for_server_using_banned_key(self) -> None:
+        """Ensure that JSON signed using a banned server_signing_key fails verification."""
+        kr = keyring.Keyring(self.hs)
+
+        banned_signing_key = signedjson.key.generate_signing_key("1")
+        r = self.hs.get_datastores().main.store_server_keys_response(
+            "server9",
+            from_server="test",
+            ts_added_ms=int(time.time() * 1000),
+            verify_keys={
+                get_key_id(banned_signing_key): FetchKeyResult(
+                    verify_key=get_verify_key(banned_signing_key), valid_until_ts=1000
+                )
+            },
+            # The entire response gets signed & stored, just include the bits we
+            # care about.
+            response_json={
+                "verify_keys": {
+                    get_key_id(banned_signing_key): {
+                        "key": encode_verify_key_base64(
+                            get_verify_key(banned_signing_key)
+                        )
+                    }
+                }
+            },
+        )
+        self.get_success(r)
+
+        json1: JsonDict = {}
+        signedjson.sign.sign_json(json1, "server9", banned_signing_key)
+
+        # Ensure the signatures check out normally
+        d = kr.verify_json_for_server("server9", json1, 500)
+        self.get_success(d)
+
+        # Patch the list of banned signing keys and ensure the signature check fails
+        with patch.object(
+            keyring,
+            "BANNED_SERVER_SIGNING_KEYS",
+            (encode_verify_key_base64(get_verify_key(banned_signing_key))),
+        ):
+            # should fail on a signed object signed by the banned key
+            d = kr.verify_json_for_server("server9", json1, 500)
+            self.get_failure(d, SynapseError)
+
     def test_verify_for_local_server(self) -> None:
         """Ensure that locally signed JSON can be verified without fetching keys
         over federation
@@ -272,8 +326,8 @@ class KeyringTestCase(unittest.HomeserverTestCase):
 
         # set up a mock fetcher which will return the key
         async def get_keys(
-            server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-        ) -> Dict[str, FetchKeyResult]:
+            server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+        ) -> dict[str, FetchKeyResult]:
             self.assertEqual(server_name, self.hs.hostname)
             self.assertEqual(key_ids, [get_key_id(key2)])
 
@@ -282,7 +336,7 @@ class KeyringTestCase(unittest.HomeserverTestCase):
         mock_fetcher = Mock()
         mock_fetcher.get_keys = Mock(side_effect=get_keys)
         kr = keyring.Keyring(
-            self.hs, key_fetchers=(StoreKeyFetcher(self.hs), mock_fetcher)
+            self.hs, test_only_key_fetchers=[StoreKeyFetcher(self.hs), mock_fetcher]
         )
 
         # sign the json
@@ -298,8 +352,8 @@ class KeyringTestCase(unittest.HomeserverTestCase):
         key1 = signedjson.key.generate_signing_key("1")
 
         async def get_keys(
-            server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-        ) -> Dict[str, FetchKeyResult]:
+            server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+        ) -> dict[str, FetchKeyResult]:
             # there should only be one request object (with the max validity)
             self.assertEqual(server_name, "server1")
             self.assertEqual(key_ids, [get_key_id(key1)])
@@ -309,7 +363,7 @@ class KeyringTestCase(unittest.HomeserverTestCase):
 
         mock_fetcher = Mock()
         mock_fetcher.get_keys = Mock(side_effect=get_keys)
-        kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher,))
+        kr = keyring.Keyring(self.hs, test_only_key_fetchers=[mock_fetcher])
 
         json1: JsonDict = {}
         signedjson.sign.sign_json(json1, "server1", key1)
@@ -340,16 +394,16 @@ class KeyringTestCase(unittest.HomeserverTestCase):
         key1 = signedjson.key.generate_signing_key("1")
 
         async def get_keys1(
-            server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-        ) -> Dict[str, FetchKeyResult]:
+            server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+        ) -> dict[str, FetchKeyResult]:
             self.assertEqual(server_name, "server1")
             self.assertEqual(key_ids, [get_key_id(key1)])
             self.assertEqual(minimum_valid_until_ts, 1500)
             return {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 800)}
 
         async def get_keys2(
-            server_name: str, key_ids: List[str], minimum_valid_until_ts: int
-        ) -> Dict[str, FetchKeyResult]:
+            server_name: str, key_ids: list[str], minimum_valid_until_ts: int
+        ) -> dict[str, FetchKeyResult]:
             self.assertEqual(server_name, "server1")
             self.assertEqual(key_ids, [get_key_id(key1)])
             self.assertEqual(minimum_valid_until_ts, 1500)
@@ -359,7 +413,9 @@ class KeyringTestCase(unittest.HomeserverTestCase):
         mock_fetcher1.get_keys = Mock(side_effect=get_keys1)
         mock_fetcher2 = Mock()
         mock_fetcher2.get_keys = Mock(side_effect=get_keys2)
-        kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher1, mock_fetcher2))
+        kr = keyring.Keyring(
+            self.hs, test_only_key_fetchers=[mock_fetcher1, mock_fetcher2]
+        )
 
         json1: JsonDict = {}
         signedjson.sign.sign_json(json1, "server1", key1)
@@ -697,7 +753,7 @@ class PerspectivesKeyFetcherTestCase(unittest.HomeserverTestCase):
                 SERVER_NAME, testkey, VALID_UNTIL_TS
             )
 
-        def get_key_from_perspectives(response: JsonDict) -> Dict[str, FetchKeyResult]:
+        def get_key_from_perspectives(response: JsonDict) -> dict[str, FetchKeyResult]:
             fetcher = PerspectivesKeyFetcher(self.hs)
             self.expect_outgoing_key_query(SERVER_NAME, "key1", response)
             return self.get_success(fetcher.get_keys(SERVER_NAME, ["key1"], 0))
diff --git a/tests/events/test_auto_accept_invites.py b/tests/events/test_auto_accept_invites.py
index ab183f8106..72ade45758 100644
--- a/tests/events/test_auto_accept_invites.py
+++ b/tests/events/test_auto_accept_invites.py
@@ -19,9 +19,8 @@
 #
 #
 import asyncio
-from asyncio import Future
 from http import HTTPStatus
-from typing import Any, Awaitable, Dict, List, Optional, Tuple, TypeVar, cast
+from typing import Any, TypeVar, cast
 from unittest.mock import Mock
 
 import attr
@@ -35,13 +34,13 @@ from synapse.config._base import RootConfig
 from synapse.config.auto_accept_invites import AutoAcceptInvitesConfig
 from synapse.events.auto_accept_invites import InviteAutoAccepter
 from synapse.federation.federation_base import event_from_pdu_json
-from synapse.handlers.sync import JoinedSyncResult, SyncRequestKey, SyncVersion
+from synapse.handlers.sync import JoinedSyncResult, SyncRequestKey
 from synapse.module_api import ModuleApi
 from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import StreamToken, UserID, UserInfo, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.handlers.test_sync import generate_sync_config
 from tests.unittest import (
@@ -526,8 +525,8 @@ def generate_request_key() -> SyncRequestKey:
 def sync_join(
     testcase: HomeserverTestCase,
     user_id: str,
-    since_token: Optional[StreamToken] = None,
-) -> Tuple[List[JoinedSyncResult], StreamToken]:
+    since_token: StreamToken | None = None,
+) -> tuple[list[JoinedSyncResult], StreamToken]:
     """Perform a sync request for the given user and return the user join updates
     they've received, as well as the next_batch token.
 
@@ -548,7 +547,6 @@ def sync_join(
         testcase.hs.get_sync_handler().wait_for_sync_for_user(
             requester,
             sync_config,
-            SyncVersion.SYNC_V2,
             generate_request_key(),
             since_token,
         )
@@ -766,9 +764,9 @@ class MockEvent:
 
     sender: str
     type: str
-    content: Dict[str, Any]
+    content: dict[str, Any]
     room_id: str = "!someroom"
-    state_key: Optional[str] = None
+    state_key: str | None = None
 
     def is_state(self) -> bool:
         """Checks if the event is a state event by checking if it has a state key."""
@@ -788,29 +786,21 @@ TV = TypeVar("TV")
 
 
 async def make_awaitable(value: T) -> T:
+    """
+    Makes a fresh awaitable, suitable for mocking an `async` function.
+    """
     return value
 
 
-def make_multiple_awaitable(result: TV) -> Awaitable[TV]:
-    """
-    Makes an awaitable, suitable for mocking an `async` function.
-    This uses Futures as they can be awaited multiple times so can be returned
-    to multiple callers.
-    """
-    future: Future[TV] = Future()
-    future.set_result(result)
-    return future
-
-
 def create_module(
-    config_override: Optional[Dict[str, Any]] = None, worker_name: Optional[str] = None
+    config_override: dict[str, Any] | None = None, worker_name: str | None = None
 ) -> InviteAutoAccepter:
     # Create a mock based on the ModuleApi spec, but override some mocked functions
     # because some capabilities are needed for running the tests.
     module_api = Mock(spec=ModuleApi)
     module_api.is_mine.side_effect = lambda a: a.split(":")[1] == "test"
     module_api.worker_name = worker_name
-    module_api.sleep.return_value = make_multiple_awaitable(None)
+    module_api.sleep.return_value = lambda *_args, **_kwargs: make_awaitable(None)
     module_api.get_userinfo_by_id.return_value = UserInfo(
         user_id=UserID.from_string("@user:test"),
         is_admin=False,
diff --git a/tests/events/test_presence_router.py b/tests/events/test_presence_router.py
index a61f1369f4..4132050647 100644
--- a/tests/events/test_presence_router.py
+++ b/tests/events/test_presence_router.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict, Iterable, List, Optional, Set, Tuple, Union
+from typing import Iterable
 from unittest.mock import AsyncMock, Mock
 
 import attr
@@ -34,9 +34,9 @@ from synapse.rest import admin
 from synapse.rest.client import login, presence, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, StreamToken, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
-from tests.handlers.test_sync import SyncRequestKey, SyncVersion, generate_sync_config
+from tests.handlers.test_sync import SyncRequestKey, generate_sync_config
 from tests.unittest import (
     FederatingHomeserverTestCase,
     HomeserverTestCase,
@@ -46,7 +46,7 @@ from tests.unittest import (
 
 @attr.s
 class PresenceRouterTestConfig:
-    users_who_should_receive_all_presence = attr.ib(type=List[str], default=[])
+    users_who_should_receive_all_presence = attr.ib(type=list[str], default=[])
 
 
 class LegacyPresenceRouterTestModule:
@@ -56,14 +56,14 @@ class LegacyPresenceRouterTestModule:
 
     async def get_users_for_states(
         self, state_updates: Iterable[UserPresenceState]
-    ) -> Dict[str, Set[UserPresenceState]]:
+    ) -> dict[str, set[UserPresenceState]]:
         users_to_state = {
             user_id: set(state_updates)
             for user_id in self._config.users_who_should_receive_all_presence
         }
         return users_to_state
 
-    async def get_interested_users(self, user_id: str) -> Union[Set[str], str]:
+    async def get_interested_users(self, user_id: str) -> set[str] | str:
         if user_id in self._config.users_who_should_receive_all_presence:
             return PresenceRouter.ALL_USERS
 
@@ -106,14 +106,14 @@ class PresenceRouterTestModule:
 
     async def get_users_for_states(
         self, state_updates: Iterable[UserPresenceState]
-    ) -> Dict[str, Set[UserPresenceState]]:
+    ) -> dict[str, set[UserPresenceState]]:
         users_to_state = {
             user_id: set(state_updates)
             for user_id in self._config.users_who_should_receive_all_presence
         }
         return users_to_state
 
-    async def get_interested_users(self, user_id: str) -> Union[Set[str], str]:
+    async def get_interested_users(self, user_id: str) -> set[str] | str:
         if user_id in self._config.users_who_should_receive_all_presence:
             return PresenceRouter.ALL_USERS
 
@@ -482,7 +482,7 @@ def send_presence_update(
     user_id: str,
     access_token: str,
     presence_state: str,
-    status_message: Optional[str] = None,
+    status_message: str | None = None,
 ) -> JsonDict:
     # Build the presence body
     body = {"presence": presence_state}
@@ -510,8 +510,8 @@ def generate_request_key() -> SyncRequestKey:
 def sync_presence(
     testcase: HomeserverTestCase,
     user_id: str,
-    since_token: Optional[StreamToken] = None,
-) -> Tuple[List[UserPresenceState], StreamToken]:
+    since_token: StreamToken | None = None,
+) -> tuple[list[UserPresenceState], StreamToken]:
     """Perform a sync request for the given user and return the user presence updates
     they've received, as well as the next_batch token.
 
@@ -532,7 +532,6 @@ def sync_presence(
         testcase.hs.get_sync_handler().wait_for_sync_for_user(
             requester,
             sync_config,
-            SyncVersion.SYNC_V2,
             generate_request_key(),
             since_token,
         )
diff --git a/tests/events/test_snapshot.py b/tests/events/test_snapshot.py
index 6d24730ed7..4d1dca08ef 100644
--- a/tests/events/test_snapshot.py
+++ b/tests/events/test_snapshot.py
@@ -26,7 +26,7 @@ from synapse.events.snapshot import EventContext
 from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils.event_injection import create_event
diff --git a/tests/events/test_utils.py b/tests/events/test_utils.py
index c6ebefbf38..af44b5dec1 100644
--- a/tests/events/test_utils.py
+++ b/tests/events/test_utils.py
@@ -20,9 +20,8 @@
 #
 
 import unittest as stdlib_unittest
-from typing import Any, List, Mapping, Optional
+from typing import TYPE_CHECKING, Any, Mapping
 
-import attr
 from parameterized import parameterized
 
 from synapse.api.constants import EventContentFields
@@ -38,11 +37,15 @@ from synapse.events.utils import (
     make_config_for_admin,
     maybe_upsert_event_field,
     prune_event,
-    serialize_event,
 )
 from synapse.types import JsonDict, create_requester
 from synapse.util.frozenutils import freeze
 
+from tests.unittest import HomeserverTestCase
+
+if TYPE_CHECKING:
+    from synapse.server import HomeServer
+
 
 def MockEvent(**kwargs: Any) -> EventBase:
     if "event_id" not in kwargs:
@@ -553,11 +556,6 @@ class PruneEventTestCase(stdlib_unittest.TestCase):
             room_version=RoomVersions.V10,
         )
 
-        # Create a new room version.
-        msc3389_room_ver = attr.evolve(
-            RoomVersions.V10, msc3389_relation_redactions=True
-        )
-
         self.run_test(
             {
                 "type": "m.room.message",
@@ -581,7 +579,7 @@ class PruneEventTestCase(stdlib_unittest.TestCase):
                 "signatures": {},
                 "unsigned": {},
             },
-            room_version=msc3389_room_ver,
+            room_version=RoomVersions.MSC3389v10,
         )
 
         # If the field is not an object, redact it.
@@ -599,7 +597,7 @@ class PruneEventTestCase(stdlib_unittest.TestCase):
                 "signatures": {},
                 "unsigned": {},
             },
-            room_version=msc3389_room_ver,
+            room_version=RoomVersions.MSC3389v10,
         )
 
         # If the m.relates_to property would be empty, redact it.
@@ -614,7 +612,7 @@ class PruneEventTestCase(stdlib_unittest.TestCase):
                 "signatures": {},
                 "unsigned": {},
             },
-            room_version=msc3389_room_ver,
+            room_version=RoomVersions.MSC3389v10,
         )
 
 
@@ -644,19 +642,27 @@ class CloneEventTestCase(stdlib_unittest.TestCase):
         self.assertEqual(cloned.internal_metadata.txn_id, "txn")
 
 
-class SerializeEventTestCase(stdlib_unittest.TestCase):
+class SerializeEventTestCase(HomeserverTestCase):
+    def prepare(self, reactor: Any, clock: Any, hs: "HomeServer") -> None:
+        self._event_serializer = hs.get_event_client_serializer()
+
     def serialize(
         self,
         ev: EventBase,
-        fields: Optional[List[str]],
+        fields: list[str] | None,
         include_admin_metadata: bool = False,
+        redaction_map: Mapping[str, EventBase] | None = None,
     ) -> JsonDict:
-        return serialize_event(
-            ev,
-            1479807801915,
-            config=SerializeEventConfig(
-                only_event_fields=fields, include_admin_metadata=include_admin_metadata
-            ),
+        return self.get_success(
+            self._event_serializer.serialize_event(
+                ev,
+                1479807801915,
+                config=SerializeEventConfig(
+                    only_event_fields=fields,
+                    include_admin_metadata=include_admin_metadata,
+                ),
+                redaction_map=redaction_map,
+            )
         )
 
     def test_event_fields_works_with_keys(self) -> None:
@@ -770,9 +776,8 @@ class SerializeEventTestCase(stdlib_unittest.TestCase):
 
     def test_event_fields_fail_if_fields_not_str(self) -> None:
         with self.assertRaises(TypeError):
-            self.serialize(
-                MockEvent(room_id="!foo:bar", content={"foo": "bar"}),
-                ["room_id", 4],  # type: ignore[list-item]
+            SerializeEventConfig(
+                only_event_fields=["room_id", 4],  # type: ignore[list-item]
             )
 
     def test_default_serialize_config_excludes_admin_metadata(self) -> None:
@@ -873,6 +878,52 @@ class SerializeEventTestCase(stdlib_unittest.TestCase):
         )
         self.assertTrue(admin_config.include_admin_metadata)
 
+    def test_redacted_because_is_filtered_out(self) -> None:
+        """If an event's unsigned dict has a `redacted_by` field, then the
+        `redacted_because` should be filtered out if not specified in
+        `only_event_fields`."""
+
+        redaction_id = "$redaction_event_id"
+
+        event = MockEvent(
+            type="foo",
+            event_id="test",
+            room_id="!foo:bar",
+            content={"foo": "bar"},
+        )
+        event.internal_metadata.redacted_by = redaction_id
+
+        redaction_event = MockEvent(
+            type="m.room.redaction",
+            event_id=redaction_id,
+            content={"redacts": "test"},
+        )
+
+        self.assertEqual(
+            self.serialize(
+                event,
+                ["content.foo"],
+                redaction_map={redaction_id: redaction_event},
+            ),
+            {
+                "content": {"foo": "bar"},
+            },
+        )
+
+        self.assertEqual(
+            self.serialize(
+                event,
+                ["content.foo", "unsigned.redacted_because"],
+                redaction_map={redaction_id: redaction_event},
+            ),
+            {
+                "content": {"foo": "bar"},
+                "unsigned": {
+                    "redacted_because": self.serialize(redaction_event, fields=None),
+                },
+            },
+        )
+
 
 class CopyPowerLevelsContentTestCase(stdlib_unittest.TestCase):
     def setUp(self) -> None:
diff --git a/tests/federation/test_federation_base.py b/tests/federation/test_federation_base.py
new file mode 100644
index 0000000000..1bc1da1feb
--- /dev/null
+++ b/tests/federation/test_federation_base.py
@@ -0,0 +1,68 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl_3.0.html>.
+#
+#
+
+
+from unittest.mock import patch
+
+from signedjson.key import encode_verify_key_base64, get_verify_key
+
+from synapse.crypto import keyring
+from synapse.crypto.event_signing import add_hashes_and_signatures
+from synapse.events import make_event_from_dict
+from synapse.federation.federation_base import InvalidEventSignatureError
+
+from tests import unittest
+
+
+class FederationBaseTestCase(unittest.HomeserverTestCase):
+    def test_events_signed_by_banned_key_are_refused(self) -> None:
+        """Ensure that event JSON signed using a banned server_signing_key fails verification."""
+        event_dict = {
+            "content": {"body": "Here is the message content"},
+            "event_id": "$0:domain",
+            "origin_server_ts": 1000000,
+            "type": "m.room.message",
+            "room_id": "!r:domain",
+            "sender": f"@u:{self.hs.config.server.server_name}",
+            "signatures": {},
+            "unsigned": {"age_ts": 1000000},
+        }
+
+        add_hashes_and_signatures(
+            self.hs.config.server.default_room_version,
+            event_dict,
+            self.hs.config.server.server_name,
+            self.hs.signing_key,
+        )
+        event = make_event_from_dict(event_dict)
+        fs = self.hs.get_federation_server()
+
+        # Ensure the signatures check out normally
+        self.get_success(
+            fs._check_sigs_and_hash(self.hs.config.server.default_room_version, event)
+        )
+
+        # Patch the list of banned signing keys and ensure the signature check fails
+        with patch.object(
+            keyring,
+            "BANNED_SERVER_SIGNING_KEYS",
+            (encode_verify_key_base64(get_verify_key(self.hs.signing_key))),
+        ):
+            self.get_failure(
+                fs._check_sigs_and_hash(
+                    self.hs.config.server.default_room_version, event
+                ),
+                InvalidEventSignatureError,
+            )
diff --git a/tests/federation/test_federation_catch_up.py b/tests/federation/test_federation_catch_up.py
index f99911b102..fd1ef043bb 100644
--- a/tests/federation/test_federation_catch_up.py
+++ b/tests/federation/test_federation_catch_up.py
@@ -1,4 +1,4 @@
-from typing import Callable, Collection, List, Optional, Tuple
+from typing import Callable, Collection
 from unittest import mock
 from unittest.mock import AsyncMock, Mock
 
@@ -16,7 +16,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.retryutils import NotRetryingDestination
 
 from tests.test_utils import event_injection
@@ -55,8 +55,8 @@ class FederationCatchUpTestCases(FederatingHomeserverTestCase):
         )
 
         # whenever send_transaction is called, record the pdu data
-        self.pdus: List[JsonDict] = []
-        self.failed_pdus: List[JsonDict] = []
+        self.pdus: list[JsonDict] = []
+        self.failed_pdus: list[JsonDict] = []
         self.is_online = True
         self.federation_transport_client.send_transaction.side_effect = (
             self.record_transaction
@@ -72,7 +72,7 @@ class FederationCatchUpTestCases(FederatingHomeserverTestCase):
         return config
 
     async def record_transaction(
-        self, txn: Transaction, json_cb: Optional[Callable[[], JsonDict]]
+        self, txn: Transaction, json_cb: Callable[[], JsonDict] | None
     ) -> JsonDict:
         if json_cb is None:
             # The tests seem to expect that this method raises in this situation.
@@ -269,7 +269,7 @@ class FederationCatchUpTestCases(FederatingHomeserverTestCase):
 
     def make_fake_destination_queue(
         self, destination: str = "host2"
-    ) -> Tuple[PerDestinationQueue, List[EventBase]]:
+    ) -> tuple[PerDestinationQueue, list[EventBase]]:
         """
         Makes a fake per-destination queue.
         """
@@ -279,8 +279,8 @@ class FederationCatchUpTestCases(FederatingHomeserverTestCase):
 
         async def fake_send(
             destination_tm: str,
-            pending_pdus: List[EventBase],
-            _pending_edus: List[Edu],
+            pending_pdus: list[EventBase],
+            _pending_edus: list[Edu],
         ) -> None:
             assert destination == destination_tm
             results_list.extend(pending_pdus)
diff --git a/tests/federation/test_federation_client.py b/tests/federation/test_federation_client.py
index df688cd21f..0535aed107 100644
--- a/tests/federation/test_federation_client.py
+++ b/tests/federation/test_federation_client.py
@@ -30,7 +30,7 @@ from synapse.events import EventBase
 from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.test_utils import FakeResponse, event_injection
 from tests.unittest import FederatingHomeserverTestCase
diff --git a/tests/federation/test_federation_devices.py b/tests/federation/test_federation_devices.py
index bf6204a7e3..c935669ce2 100644
--- a/tests/federation/test_federation_devices.py
+++ b/tests/federation/test_federation_devices.py
@@ -26,7 +26,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.handlers.device import DeviceListUpdater
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.retryutils import NotRetryingDestination
 
 from tests import unittest
diff --git a/tests/federation/test_federation_media.py b/tests/federation/test_federation_media.py
index b9ec2794a3..9c4e813537 100644
--- a/tests/federation/test_federation_media.py
+++ b/tests/federation/test_federation_media.py
@@ -32,7 +32,7 @@ from synapse.media.storage_provider import (
 )
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.media.test_media_storage import small_png
@@ -49,6 +49,7 @@ class FederationMediaDownloadsTest(unittest.FederatingHomeserverTestCase):
 
         hs.config.media.media_store_path = self.primary_base_path
 
+        local_provider = FileStorageProviderBackend(hs, self.primary_base_path)
         storage_providers = [
             StorageProviderWrapper(
                 FileStorageProviderBackend(hs, self.secondary_base_path),
@@ -60,7 +61,7 @@ class FederationMediaDownloadsTest(unittest.FederatingHomeserverTestCase):
 
         self.filepaths = MediaFilePaths(self.primary_base_path)
         self.media_storage = MediaStorage(
-            hs, self.primary_base_path, self.filepaths, storage_providers
+            hs, self.filepaths, storage_providers, local_provider
         )
         self.media_repo = hs.get_media_repository()
 
@@ -187,7 +188,7 @@ class FederationMediaDownloadsTest(unittest.FederatingHomeserverTestCase):
         self.assertNotIn("body", channel.result)
 
 
-class FederationThumbnailTest(unittest.FederatingHomeserverTestCase):
+class FederationMediaTest(unittest.FederatingHomeserverTestCase):
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         super().prepare(reactor, clock, hs)
         self.test_dir = tempfile.mkdtemp(prefix="synapse-tests-")
@@ -197,6 +198,7 @@ class FederationThumbnailTest(unittest.FederatingHomeserverTestCase):
 
         hs.config.media.media_store_path = self.primary_base_path
 
+        local_provider = FileStorageProviderBackend(hs, self.primary_base_path)
         storage_providers = [
             StorageProviderWrapper(
                 FileStorageProviderBackend(hs, self.secondary_base_path),
@@ -208,7 +210,116 @@ class FederationThumbnailTest(unittest.FederatingHomeserverTestCase):
 
         self.filepaths = MediaFilePaths(self.primary_base_path)
         self.media_storage = MediaStorage(
-            hs, self.primary_base_path, self.filepaths, storage_providers
+            hs, self.filepaths, storage_providers, local_provider
+        )
+        self.media_repo = hs.get_media_repository()
+
+    def test_thumbnail_download_scaled(self) -> None:
+        content = io.BytesIO(small_png.data)
+        content_uri = self.get_success(
+            self.media_repo.create_or_update_content(
+                "image/png",
+                "test_png_thumbnail",
+                content,
+                67,
+                UserID.from_string("@user_id:whatever.org"),
+            )
+        )
+        # test with an image file
+        channel = self.make_signed_federation_request(
+            "GET",
+            f"/_matrix/federation/v1/media/thumbnail/{content_uri.media_id}?width=32&height=32&method=scale",
+        )
+        self.pump()
+        self.assertEqual(200, channel.code)
+
+        content_type = channel.headers.getRawHeaders("content-type")
+        assert content_type is not None
+        assert "multipart/mixed" in content_type[0]
+        assert "boundary" in content_type[0]
+
+        # extract boundary
+        boundary = content_type[0].split("boundary=")[1]
+        # split on boundary and check that json field and expected value exist
+        body = channel.result.get("body")
+        assert body is not None
+        stripped_bytes = body.split(b"\r\n" + b"--" + boundary.encode("utf-8"))
+        found_json = any(
+            b"\r\nContent-Type: application/json\r\n\r\n{}" in field
+            for field in stripped_bytes
+        )
+        self.assertTrue(found_json)
+
+        # check that the png file exists and matches the expected scaled bytes
+        found_file = any(small_png.expected_scaled in field for field in stripped_bytes)
+        self.assertTrue(found_file)
+
+    def test_thumbnail_download_cropped(self) -> None:
+        content = io.BytesIO(small_png.data)
+        content_uri = self.get_success(
+            self.media_repo.create_or_update_content(
+                "image/png",
+                "test_png_thumbnail",
+                content,
+                67,
+                UserID.from_string("@user_id:whatever.org"),
+            )
+        )
+        # test with an image file
+        channel = self.make_signed_federation_request(
+            "GET",
+            f"/_matrix/federation/v1/media/thumbnail/{content_uri.media_id}?width=32&height=32&method=crop",
+        )
+        self.pump()
+        self.assertEqual(200, channel.code)
+
+        content_type = channel.headers.getRawHeaders("content-type")
+        assert content_type is not None
+        assert "multipart/mixed" in content_type[0]
+        assert "boundary" in content_type[0]
+
+        # extract boundary
+        boundary = content_type[0].split("boundary=")[1]
+        # split on boundary and check that json field and expected value exist
+        body = channel.result.get("body")
+        assert body is not None
+        stripped_bytes = body.split(b"\r\n" + b"--" + boundary.encode("utf-8"))
+        found_json = any(
+            b"\r\nContent-Type: application/json\r\n\r\n{}" in field
+            for field in stripped_bytes
+        )
+        self.assertTrue(found_json)
+
+        # check that the png file exists and matches the expected cropped bytes
+        found_file = any(
+            small_png.expected_cropped in field for field in stripped_bytes
+        )
+        self.assertTrue(found_file)
+
+
+class FederationThumbnailTest(unittest.FederatingHomeserverTestCase):
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        super().prepare(reactor, clock, hs)
+        self.test_dir = tempfile.mkdtemp(prefix="synapse-tests-")
+        self.addCleanup(shutil.rmtree, self.test_dir)
+        self.primary_base_path = os.path.join(self.test_dir, "primary")
+        self.secondary_base_path = os.path.join(self.test_dir, "secondary")
+
+        hs.config.media.media_store_path = self.primary_base_path
+
+        local_provider = FileStorageProviderBackend(hs, self.primary_base_path)
+        storage_providers = [
+            StorageProviderWrapper(
+                FileStorageProviderBackend(hs, self.secondary_base_path),
+                store_local=True,
+                store_remote=False,
+                store_synchronous=True,
+            )
+        ]
+
+        self.filepaths = MediaFilePaths(self.primary_base_path)
+        self.media_storage = MediaStorage(
+            hs, self.filepaths, storage_providers, local_provider
         )
         self.media_repo = hs.get_media_repository()
 
diff --git a/tests/federation/test_federation_out_of_band_membership.py b/tests/federation/test_federation_out_of_band_membership.py
index acf343930f..a1ab72b7a1 100644
--- a/tests/federation/test_federation_out_of_band_membership.py
+++ b/tests/federation/test_federation_out_of_band_membership.py
@@ -23,7 +23,7 @@ import logging
 import time
 import urllib.parse
 from http import HTTPStatus
-from typing import Any, Callable, Optional, Set, Tuple, TypeVar, Union
+from typing import Any, Callable, TypeVar
 from unittest.mock import Mock
 
 import attr
@@ -50,7 +50,7 @@ from synapse.types import JsonDict, MutableStateMap, StateMap
 from synapse.types.handlers.sliding_sync import (
     StateValues,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.utils import test_timeout
@@ -146,8 +146,8 @@ class OutOfBandMembershipTests(unittest.FederatingHomeserverTestCase):
         self.storage_controllers = hs.get_storage_controllers()
 
     def do_sync(
-        self, sync_body: JsonDict, *, since: Optional[str] = None, tok: str
-    ) -> Tuple[JsonDict, str]:
+        self, sync_body: JsonDict, *, since: str | None = None, tok: str
+    ) -> tuple[JsonDict, str]:
         """Do a sliding sync request with given body.
 
         Asserts the request was successful.
@@ -326,13 +326,13 @@ class OutOfBandMembershipTests(unittest.FederatingHomeserverTestCase):
         async def get_json(
             destination: str,
             path: str,
-            args: Optional[QueryParams] = None,
+            args: QueryParams | None = None,
             retry_on_dns_fail: bool = True,
-            timeout: Optional[int] = None,
+            timeout: int | None = None,
             ignore_backoff: bool = False,
             try_trailing_slash_on_400: bool = False,
-            parser: Optional[ByteParser[T]] = None,
-        ) -> Union[JsonDict, T]:
+            parser: ByteParser[T] | None = None,
+        ) -> JsonDict | T:
             if (
                 path
                 == f"/_matrix/federation/v1/make_join/{urllib.parse.quote_plus(remote_room_id)}/{urllib.parse.quote_plus(local_user1_id)}"
@@ -350,22 +350,22 @@ class OutOfBandMembershipTests(unittest.FederatingHomeserverTestCase):
         self.federation_http_client.get_json.side_effect = get_json
 
         # PDU's that hs1 sent to hs2
-        collected_pdus_from_hs1_federation_send: Set[str] = set()
+        collected_pdus_from_hs1_federation_send: set[str] = set()
 
         async def put_json(
             destination: str,
             path: str,
-            args: Optional[QueryParams] = None,
-            data: Optional[JsonDict] = None,
-            json_data_callback: Optional[Callable[[], JsonDict]] = None,
+            args: QueryParams | None = None,
+            data: JsonDict | None = None,
+            json_data_callback: Callable[[], JsonDict] | None = None,
             long_retries: bool = False,
-            timeout: Optional[int] = None,
+            timeout: int | None = None,
             ignore_backoff: bool = False,
             backoff_on_404: bool = False,
             try_trailing_slash_on_400: bool = False,
-            parser: Optional[ByteParser[T]] = None,
+            parser: ByteParser[T] | None = None,
             backoff_on_all_error_codes: bool = False,
-        ) -> Union[JsonDict, T, SendJoinResponse]:
+        ) -> JsonDict | T | SendJoinResponse:
             if (
                 path.startswith(
                     f"/_matrix/federation/v2/send_join/{urllib.parse.quote_plus(remote_room_id)}/"
@@ -503,22 +503,22 @@ class OutOfBandMembershipTests(unittest.FederatingHomeserverTestCase):
         T = TypeVar("T")
 
         # PDU's that hs1 sent to hs2
-        collected_pdus_from_hs1_federation_send: Set[str] = set()
+        collected_pdus_from_hs1_federation_send: set[str] = set()
 
         async def put_json(
             destination: str,
             path: str,
-            args: Optional[QueryParams] = None,
-            data: Optional[JsonDict] = None,
-            json_data_callback: Optional[Callable[[], JsonDict]] = None,
+            args: QueryParams | None = None,
+            data: JsonDict | None = None,
+            json_data_callback: Callable[[], JsonDict] | None = None,
             long_retries: bool = False,
-            timeout: Optional[int] = None,
+            timeout: int | None = None,
             ignore_backoff: bool = False,
             backoff_on_404: bool = False,
             try_trailing_slash_on_400: bool = False,
-            parser: Optional[ByteParser[T]] = None,
+            parser: ByteParser[T] | None = None,
             backoff_on_all_error_codes: bool = False,
-        ) -> Union[JsonDict, T]:
+        ) -> JsonDict | T:
             if path.startswith("/_matrix/federation/v1/send/") and data is not None:
                 for pdu in data.get("pdus", []):
                     event = event_from_pdu_json(pdu, room_version)
diff --git a/tests/federation/test_federation_sender.py b/tests/federation/test_federation_sender.py
index b8dd61d04f..ced98a8b00 100644
--- a/tests/federation/test_federation_sender.py
+++ b/tests/federation/test_federation_sender.py
@@ -17,7 +17,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Callable, FrozenSet, List, Optional, Set
+from typing import Callable
 from unittest.mock import AsyncMock, Mock
 
 from signedjson import key, sign
@@ -36,7 +36,7 @@ from synapse.rest.client import login
 from synapse.server import HomeServer
 from synapse.storage.databases.main.events_worker import EventMetadata
 from synapse.types import JsonDict, ReadReceipt
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -435,7 +435,7 @@ class FederationSenderPresenceTestCases(HomeserverTestCase):
 
         # A set of all user presence we see, this should end up matching the
         # number we sent out above.
-        seen_users: Set[str] = set()
+        seen_users: set[str] = set()
 
         for edu in presence_edus:
             presence_states = edu["content"]["push"]
@@ -483,12 +483,12 @@ class FederationSenderDevicesTestCases(HomeserverTestCase):
 
         # stub out `get_rooms_for_user` and `get_current_hosts_in_room` so that the
         # server thinks the user shares a room with `@user2:host2`
-        def get_rooms_for_user(user_id: str) -> "defer.Deferred[FrozenSet[str]]":
+        def get_rooms_for_user(user_id: str) -> "defer.Deferred[frozenset[str]]":
             return defer.succeed(frozenset({test_room_id}))
 
         hs.get_datastores().main.get_rooms_for_user = get_rooms_for_user  # type: ignore[assignment]
 
-        async def get_current_hosts_in_room(room_id: str) -> Set[str]:
+        async def get_current_hosts_in_room(room_id: str) -> set[str]:
             if room_id == test_room_id:
                 return {"host2"}
             else:
@@ -504,13 +504,13 @@ class FederationSenderDevicesTestCases(HomeserverTestCase):
         self.device_handler = device_handler
 
         # whenever send_transaction is called, record the edu data
-        self.edus: List[JsonDict] = []
+        self.edus: list[JsonDict] = []
         self.federation_transport_client.send_transaction.side_effect = (
             self.record_transaction
         )
 
     async def record_transaction(
-        self, txn: Transaction, json_cb: Optional[Callable[[], JsonDict]] = None
+        self, txn: Transaction, json_cb: Callable[[], JsonDict] | None = None
     ) -> JsonDict:
         assert json_cb is not None
         data = json_cb()
@@ -592,7 +592,7 @@ class FederationSenderDevicesTestCases(HomeserverTestCase):
 
         # expect two edus
         self.assertEqual(len(self.edus), 2)
-        stream_id: Optional[int] = None
+        stream_id: int | None = None
         stream_id = self.check_device_update_edu(self.edus.pop(0), u1, "D1", stream_id)
         stream_id = self.check_device_update_edu(self.edus.pop(0), u1, "D2", stream_id)
 
@@ -754,7 +754,7 @@ class FederationSenderDevicesTestCases(HomeserverTestCase):
 
         # for each device, there should be a single update
         self.assertEqual(len(self.edus), 3)
-        stream_id: Optional[int] = None
+        stream_id: int | None = None
         for edu in self.edus:
             self.assertEqual(edu["edu_type"], EduTypes.DEVICE_LIST_UPDATE)
             c = edu["content"]
@@ -876,7 +876,7 @@ class FederationSenderDevicesTestCases(HomeserverTestCase):
         edu: JsonDict,
         user_id: str,
         device_id: str,
-        prev_stream_id: Optional[int],
+        prev_stream_id: int | None,
     ) -> int:
         """Check that the given EDU is an update for the given device
         Returns the stream_id.
diff --git a/tests/federation/test_federation_server.py b/tests/federation/test_federation_server.py
index 52fd32ba85..275e5dfa1d 100644
--- a/tests/federation/test_federation_server.py
+++ b/tests/federation/test_federation_server.py
@@ -20,7 +20,6 @@
 #
 import logging
 from http import HTTPStatus
-from typing import Optional, Union
 from unittest.mock import Mock
 
 from parameterized import parameterized
@@ -31,6 +30,7 @@ from synapse.api.constants import EventTypes, Membership
 from synapse.api.errors import FederationError
 from synapse.api.room_versions import KNOWN_ROOM_VERSIONS, RoomVersions
 from synapse.config.server import DEFAULT_ROOM_VERSION
+from synapse.crypto.event_signing import add_hashes_and_signatures
 from synapse.events import EventBase, make_event_from_dict
 from synapse.federation.federation_base import event_from_pdu_json
 from synapse.http.types import QueryParams
@@ -40,7 +40,7 @@ from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.storage.controllers.state import server_acl_evaluator_from_event
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -192,12 +192,12 @@ class MessageAcceptTests(unittest.FederatingHomeserverTestCase):
         async def post_json(
             destination: str,
             path: str,
-            data: Optional[JsonDict] = None,
+            data: JsonDict | None = None,
             long_retries: bool = False,
-            timeout: Optional[int] = None,
+            timeout: int | None = None,
             ignore_backoff: bool = False,
-            args: Optional[QueryParams] = None,
-        ) -> Union[JsonDict, list]:
+            args: QueryParams | None = None,
+        ) -> JsonDict | list:
             # If it asks us for new missing events, give them NOTHING
             if path.startswith("/_matrix/federation/v1/get_missing_events/"):
                 return {"events": []}
@@ -229,7 +229,10 @@ class MessageAcceptTests(unittest.FederatingHomeserverTestCase):
             room_version=RoomVersions.V10,
         )
 
-        with LoggingContext("test-context"):
+        with LoggingContext(
+            name="test-context",
+            server_name=self.hs.hostname,
+        ):
             failure = self.get_failure(
                 self.federation_event_handler.on_receive_pdu(
                     self.OTHER_SERVER_NAME, lying_event
@@ -321,6 +324,141 @@ class StateQueryTests(unittest.FederatingHomeserverTestCase):
         self.assertEqual(channel.json_body["errcode"], "M_FORBIDDEN")
 
 
+class UnstableGetExtremitiesTests(unittest.FederatingHomeserverTestCase):
+    servlets = [
+        admin.register_servlets,
+        room.register_servlets,
+        login.register_servlets,
+    ]
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        super().prepare(reactor, clock, hs)
+        self._storage_controllers = hs.get_storage_controllers()
+
+    def _make_endpoint_path(self, room_id: str) -> str:
+        return f"/_matrix/federation/unstable/org.matrix.msc4370/extremities/{room_id}"
+
+    def _remote_join(self, room_id: str, room_version: str) -> str:
+        # Note: other tests ensure the called endpoints in this function return useful
+        # and proper data.
+
+        # make_join first
+        joining_user = "@misspiggy:" + self.OTHER_SERVER_NAME
+        channel = self.make_signed_federation_request(
+            "GET",
+            f"/_matrix/federation/v1/make_join/{room_id}/{joining_user}?ver={room_version}",
+        )
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        join_result = channel.json_body
+
+        # Sign/populate the join
+        join_event_dict = join_result["event"]
+        self.add_hashes_and_signatures_from_other_server(
+            join_event_dict,
+            KNOWN_ROOM_VERSIONS[room_version],
+        )
+        if room_version in ["1", "2"]:
+            add_hashes_and_signatures(
+                KNOWN_ROOM_VERSIONS[room_version],
+                join_event_dict,
+                signature_name=self.hs.hostname,
+                signing_key=self.hs.signing_key,
+            )
+
+        # Send the join
+        channel = self.make_signed_federation_request(
+            "PUT",
+            f"/_matrix/federation/v2/send_join/{room_id}/x",
+            content=join_event_dict,
+        )
+
+        # Check that things went okay so the test doesn't become a total train wreck
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        r = self.get_success(self._storage_controllers.state.get_current_state(room_id))
+        self.assertEqual(r[("m.room.member", joining_user)].membership, "join")
+
+        return r[("m.room.member", joining_user)].event_id
+
+    def _test_get_extremities_common(self, room_version: str) -> None:
+        # Create a room to test with
+        creator_user_id = self.register_user("kermit", "test")
+        tok = self.login("kermit", "test")
+        room_id = self.helper.create_room_as(
+            room_creator=creator_user_id,
+            tok=tok,
+            room_version=room_version,
+            extra_content={
+                # Public preset uses `shared` history visibility, but makes joins
+                # easier in our tests.
+                # https://spec.matrix.org/v1.16/client-server-api/#post_matrixclientv3createroom
+                "preset": "public_chat"
+            },
+        )
+
+        # At this stage we should fail to get the extremities because we're not joined
+        # and therefore can't see the events (`shared` history visibility).
+        channel = self.make_signed_federation_request(
+            "GET", self._make_endpoint_path(room_id)
+        )
+        self.assertEqual(channel.code, HTTPStatus.FORBIDDEN, channel.json_body)
+        self.assertEqual(channel.json_body["error"], "Host not in room.")
+        self.assertEqual(channel.json_body["errcode"], "M_FORBIDDEN")
+
+        # Now join the room and try again
+        # Note: there should be just one extremity: the join
+        join_event_id = self._remote_join(room_id, room_version)
+        channel = self.make_signed_federation_request(
+            "GET", self._make_endpoint_path(room_id)
+        )
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        self.assertEqual(channel.json_body["prev_events"], [join_event_id])
+
+        # ACL the calling server and try again. This should cause an error getting extremities.
+        self.helper.send_state(
+            room_id,
+            "m.room.server_acl",
+            {
+                "allow": ["*"],
+                "allow_ip_literals": False,
+                "deny": [self.OTHER_SERVER_NAME],
+            },
+            tok=tok,
+            expect_code=HTTPStatus.OK,
+        )
+        channel = self.make_signed_federation_request(
+            "GET", self._make_endpoint_path(room_id)
+        )
+        self.assertEqual(channel.code, HTTPStatus.FORBIDDEN, channel.json_body)
+        self.assertEqual(channel.json_body["error"], "Server is banned from room")
+        self.assertEqual(channel.json_body["errcode"], "M_FORBIDDEN")
+
+    @parameterized.expand([(k,) for k in KNOWN_ROOM_VERSIONS.keys()])
+    @override_config(
+        {"use_frozen_dicts": True, "experimental_features": {"msc4370_enabled": True}}
+    )
+    def test_get_extremities_with_frozen_dicts(self, room_version: str) -> None:
+        """Test GET /extremities with USE_FROZEN_DICTS=True"""
+        self._test_get_extremities_common(room_version)
+
+    @parameterized.expand([(k,) for k in KNOWN_ROOM_VERSIONS.keys()])
+    @override_config(
+        {"use_frozen_dicts": False, "experimental_features": {"msc4370_enabled": True}}
+    )
+    def test_get_extremities_without_frozen_dicts(self, room_version: str) -> None:
+        """Test GET /extremities with USE_FROZEN_DICTS=False"""
+        self._test_get_extremities_common(room_version)
+
+    # note the lack of config-setting stuff on this test.
+    def test_get_extremities_unstable_not_enabled(self) -> None:
+        """Test that GET /extremities returns M_UNRECOGNIZED when MSC4370 is not enabled"""
+        # We shouldn't even have to create a room - the endpoint should just fail.
+        channel = self.make_signed_federation_request(
+            "GET", self._make_endpoint_path("!room:example.org")
+        )
+        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND, channel.json_body)
+        self.assertEqual(channel.json_body["errcode"], "M_UNRECOGNIZED")
+
+
 class SendJoinFederationTests(unittest.FederatingHomeserverTestCase):
     servlets = [
         admin.register_servlets,
@@ -354,19 +492,44 @@ class SendJoinFederationTests(unittest.FederatingHomeserverTestCase):
         self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
         return channel.json_body
 
-    def test_send_join(self) -> None:
+    def _test_send_join_common(self, room_version: str) -> None:
         """happy-path test of send_join"""
-        joining_user = "@misspiggy:" + self.OTHER_SERVER_NAME
-        join_result = self._make_join(joining_user)
+        creator_user_id = self.register_user(f"kermit_v{room_version}", "test")
+        tok = self.login(f"kermit_v{room_version}", "test")
+        room_id = self.helper.create_room_as(
+            room_creator=creator_user_id, tok=tok, room_version=room_version
+        )
 
+        # Second member joins
+        second_member_user_id = self.register_user(f"fozzie_v{room_version}", "bear")
+        tok2 = self.login(f"fozzie_v{room_version}", "bear")
+        self.helper.join(room_id, second_member_user_id, tok=tok2)
+
+        # Make join for remote user
+        joining_user = "@misspiggy:" + self.OTHER_SERVER_NAME
+        channel = self.make_signed_federation_request(
+            "GET",
+            f"/_matrix/federation/v1/make_join/{room_id}/{joining_user}?ver={room_version}",
+        )
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        join_result = channel.json_body
+
+        # Sign and send the join
         join_event_dict = join_result["event"]
         self.add_hashes_and_signatures_from_other_server(
             join_event_dict,
-            KNOWN_ROOM_VERSIONS[DEFAULT_ROOM_VERSION],
+            KNOWN_ROOM_VERSIONS[room_version],
         )
+        if room_version in ["1", "2"]:
+            add_hashes_and_signatures(
+                KNOWN_ROOM_VERSIONS[room_version],
+                join_event_dict,
+                signature_name=self.hs.hostname,
+                signing_key=self.hs.signing_key,
+            )
         channel = self.make_signed_federation_request(
             "PUT",
-            f"/_matrix/federation/v2/send_join/{self._room_id}/x",
+            f"/_matrix/federation/v2/send_join/{room_id}/x",
             content=join_event_dict,
         )
         self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
@@ -382,8 +545,8 @@ class SendJoinFederationTests(unittest.FederatingHomeserverTestCase):
                 ("m.room.power_levels", ""),
                 ("m.room.join_rules", ""),
                 ("m.room.history_visibility", ""),
-                ("m.room.member", "@kermit:test"),
-                ("m.room.member", "@fozzie:test"),
+                ("m.room.member", f"@kermit_v{room_version}:test"),
+                ("m.room.member", f"@fozzie_v{room_version}:test"),
                 # nb: *not* the joining user
             ],
         )
@@ -396,18 +559,28 @@ class SendJoinFederationTests(unittest.FederatingHomeserverTestCase):
             returned_auth_chain_events,
             [
                 ("m.room.create", ""),
-                ("m.room.member", "@kermit:test"),
+                ("m.room.member", f"@kermit_v{room_version}:test"),
                 ("m.room.power_levels", ""),
                 ("m.room.join_rules", ""),
             ],
         )
 
         # the room should show that the new user is a member
-        r = self.get_success(
-            self._storage_controllers.state.get_current_state(self._room_id)
-        )
+        r = self.get_success(self._storage_controllers.state.get_current_state(room_id))
         self.assertEqual(r[("m.room.member", joining_user)].membership, "join")
 
+    @parameterized.expand([(k,) for k in KNOWN_ROOM_VERSIONS.keys()])
+    @override_config({"use_frozen_dicts": True})
+    def test_send_join_with_frozen_dicts(self, room_version: str) -> None:
+        """Test send_join with USE_FROZEN_DICTS=True"""
+        self._test_send_join_common(room_version)
+
+    @parameterized.expand([(k,) for k in KNOWN_ROOM_VERSIONS.keys()])
+    @override_config({"use_frozen_dicts": False})
+    def test_send_join_without_frozen_dicts(self, room_version: str) -> None:
+        """Test send_join with USE_FROZEN_DICTS=False"""
+        self._test_send_join_common(room_version)
+
     def test_send_join_partial_state(self) -> None:
         """/send_join should return partial state, if requested"""
         joining_user = "@misspiggy:" + self.OTHER_SERVER_NAME
@@ -459,7 +632,7 @@ class SendJoinFederationTests(unittest.FederatingHomeserverTestCase):
         )
         self.assertEqual(r[("m.room.member", joining_user)].membership, "join")
 
-    @override_config({"rc_joins_per_room": {"per_second": 0, "burst_count": 3}})
+    @override_config({"rc_joins_per_room": {"per_second": 0.1, "burst_count": 3}})
     def test_make_join_respects_room_join_rate_limit(self) -> None:
         # In the test setup, two users join the room. Since the rate limiter burst
         # count is 3, a new make_join request to the room should be accepted.
@@ -481,7 +654,7 @@ class SendJoinFederationTests(unittest.FederatingHomeserverTestCase):
         )
         self.assertEqual(channel.code, HTTPStatus.TOO_MANY_REQUESTS, channel.json_body)
 
-    @override_config({"rc_joins_per_room": {"per_second": 0, "burst_count": 3}})
+    @override_config({"rc_joins_per_room": {"per_second": 0.1, "burst_count": 3}})
     def test_send_join_contributes_to_room_join_rate_limit_and_is_limited(self) -> None:
         # Make two make_join requests up front. (These are rate limited, but do not
         # contribute to the rate limit.)
diff --git a/tests/federation/transport/server/test__base.py b/tests/federation/transport/server/test__base.py
index 0e3b41ec4d..447d0a071e 100644
--- a/tests/federation/transport/server/test__base.py
+++ b/tests/federation/transport/server/test__base.py
@@ -20,7 +20,6 @@
 #
 
 from http import HTTPStatus
-from typing import Dict, List, Tuple
 
 from twisted.web.resource import Resource
 
@@ -31,10 +30,11 @@ from synapse.http.server import JsonResource
 from synapse.server import HomeServer
 from synapse.types import JsonDict
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 from synapse.util.ratelimitutils import FederationRateLimiter
 
 from tests import unittest
-from tests.http.server._base import test_disconnect
+from tests.http.server._base import disconnect_and_assert
 
 
 class CancellableFederationServlet(BaseFederationServlet):
@@ -52,15 +52,15 @@ class CancellableFederationServlet(BaseFederationServlet):
 
     @cancellable
     async def on_GET(
-        self, origin: str, content: None, query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+        self, origin: str, content: None, query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
     async def on_POST(
-        self, origin: str, content: JsonDict, query: Dict[bytes, List[bytes]]
-    ) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+        self, origin: str, content: JsonDict, query: dict[bytes, list[bytes]]
+    ) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
 
@@ -94,7 +94,7 @@ class BaseFederationServletCancellationTests(unittest.FederatingHomeserverTestCa
         # request won't be processed.
         self.pump()
 
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=True,
@@ -114,7 +114,7 @@ class BaseFederationServletCancellationTests(unittest.FederatingHomeserverTestCa
         # request won't be processed.
         self.pump()
 
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=False,
diff --git a/tests/federation/transport/test_client.py b/tests/federation/transport/test_client.py
index 3d882f99f2..9a6bbabd35 100644
--- a/tests/federation/transport/test_client.py
+++ b/tests/federation/transport/test_client.py
@@ -20,7 +20,6 @@
 #
 
 import json
-from typing import List, Optional
 from unittest.mock import Mock
 
 import ijson.common
@@ -98,7 +97,7 @@ class SendJoinParserTestCase(TestCase):
     def test_servers_in_room(self) -> None:
         """Check that the servers_in_room field is correctly parsed"""
 
-        def parse(response: JsonDict) -> Optional[List[str]]:
+        def parse(response: JsonDict) -> list[str] | None:
             parser = SendJoinParser(RoomVersions.V1, False)
             serialised_response = json.dumps(response).encode()
 
diff --git a/tests/federation/transport/test_knocking.py b/tests/federation/transport/test_knocking.py
index 14345be0f3..ec705676cc 100644
--- a/tests/federation/transport/test_knocking.py
+++ b/tests/federation/transport/test_knocking.py
@@ -19,7 +19,7 @@
 #
 #
 from collections import OrderedDict
-from typing import Any, Dict, List, Optional
+from typing import Any
 
 from twisted.internet.testing import MemoryReactor
 
@@ -31,7 +31,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import RoomAlias
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.test_utils import event_injection
 from tests.unittest import FederatingHomeserverTestCase, HomeserverTestCase
@@ -161,8 +161,8 @@ class KnockingStrippedStateEventHelperMixin(HomeserverTestCase):
 
     def check_knock_room_state_against_room_state(
         self,
-        knock_room_state: List[Dict],
-        expected_room_state: Dict,
+        knock_room_state: list[dict],
+        expected_room_state: dict,
     ) -> None:
         """Test a list of stripped room state events received over federation against a
         dict of expected state events.
@@ -232,7 +232,7 @@ class FederationKnockingTestCase(
         # Have this homeserver skip event auth checks. This is necessary due to
         # event auth checks ensuring that events were signed by the sender's homeserver.
         async def _check_event_auth(
-            origin: Optional[str], event: EventBase, context: EventContext
+            origin: str | None, event: EventBase, context: EventContext
         ) -> None:
             pass
 
diff --git a/tests/handlers/test_admin.py b/tests/handlers/test_admin.py
index 906d241f1a..49bd3ba3f4 100644
--- a/tests/handlers/test_admin.py
+++ b/tests/handlers/test_admin.py
@@ -31,7 +31,7 @@ from synapse.api.room_versions import RoomVersions
 from synapse.rest.client import knock, login, room
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/handlers/test_appservice.py b/tests/handlers/test_appservice.py
index a47b03b143..6336edb108 100644
--- a/tests/handlers/test_appservice.py
+++ b/tests/handlers/test_appservice.py
@@ -19,7 +19,14 @@
 #
 #
 
-from typing import Dict, Iterable, List, Optional
+from typing import (
+    TYPE_CHECKING,
+    Any,
+    Awaitable,
+    Callable,
+    Iterable,
+    TypeVar,
+)
 from unittest.mock import AsyncMock, Mock
 
 from parameterized import parameterized
@@ -36,6 +43,7 @@ from synapse.appservice import (
     TransactionUnusedFallbackKeys,
 )
 from synapse.handlers.appservice import ApplicationServicesHandler
+from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.rest.client import login, receipts, register, room, sendtodevice
 from synapse.server import HomeServer
 from synapse.types import (
@@ -45,13 +53,18 @@ from synapse.types import (
     StreamKeyType,
     UserID,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 from tests import unittest
+from tests.server import get_clock
 from tests.test_utils import event_injection
 from tests.unittest import override_config
-from tests.utils import MockClock
+
+if TYPE_CHECKING:
+    from typing_extensions import LiteralString
+
+R = TypeVar("R")
 
 
 class AppServiceHandlerTestCase(unittest.TestCase):
@@ -61,14 +74,27 @@ class AppServiceHandlerTestCase(unittest.TestCase):
         self.mock_store = Mock()
         self.mock_as_api = AsyncMock()
         self.mock_scheduler = Mock()
+        self.reactor, self.clock = get_clock()
+
         hs = Mock()
+
+        def test_run_as_background_process(
+            desc: "LiteralString",
+            func: Callable[..., Awaitable[R | None]],
+            *args: Any,
+            **kwargs: Any,
+        ) -> "defer.Deferred[R | None]":
+            # Ignore linter error as this is used only for testing purposes (i.e. outside of Synapse).
+            return run_as_background_process(desc, "test_server", func, *args, **kwargs)  # type: ignore[untracked-background-process]
+
+        hs.run_as_background_process = test_run_as_background_process
         hs.get_datastores.return_value = Mock(main=self.mock_store)
         self.mock_store.get_appservice_last_pos = AsyncMock(return_value=None)
         self.mock_store.set_appservice_last_pos = AsyncMock(return_value=None)
         self.mock_store.set_appservice_stream_type_pos = AsyncMock(return_value=None)
         hs.get_application_service_api.return_value = self.mock_as_api
         hs.get_application_service_scheduler.return_value = self.mock_scheduler
-        hs.get_clock.return_value = MockClock()
+        hs.get_clock.return_value = self.clock
         self.handler = ApplicationServicesHandler(hs)
         self.event_source = hs.get_event_sources()
 
@@ -266,7 +292,7 @@ class AppServiceHandlerTestCase(unittest.TestCase):
 
         async def get_3pe_protocol(
             service: ApplicationService, protocol: str
-        ) -> Optional[JsonDict]:
+        ) -> JsonDict | None:
             if service == service_one:
                 return {
                     "x-protocol-data": 42,
@@ -358,7 +384,7 @@ class AppServiceHandlerTestCase(unittest.TestCase):
         )
 
     def _mkservice(
-        self, is_interested_in_event: bool, protocols: Optional[Iterable] = None
+        self, is_interested_in_event: bool, protocols: Iterable | None = None
     ) -> Mock:
         """
         Create a new mock representing an ApplicationService.
@@ -421,7 +447,7 @@ class ApplicationServicesHandlerSendEventsTestCase(unittest.HomeserverTestCase):
         hs.get_application_service_handler().scheduler.txn_ctrl.send = self.send_mock  # type: ignore[method-assign]
 
         # Mock out application services, and allow defining our own in tests
-        self._services: List[ApplicationService] = []
+        self._services: list[ApplicationService] = []
         self.hs.get_datastores().main.get_app_services = Mock(  # type: ignore[method-assign]
             return_value=self._services
         )
@@ -855,7 +881,7 @@ class ApplicationServicesHandlerSendEventsTestCase(unittest.HomeserverTestCase):
         # Count the total number of to-device messages that were sent out per-service.
         # Ensure that we only sent to-device messages to interested services, and that
         # each interested service received the full count of to-device messages.
-        service_id_to_message_count: Dict[str, int] = {}
+        service_id_to_message_count: dict[str, int] = {}
 
         for call in self.send_mock.call_args_list:
             (
@@ -994,7 +1020,7 @@ class ApplicationServicesHandlerSendEventsTestCase(unittest.HomeserverTestCase):
 
     def _register_application_service(
         self,
-        namespaces: Optional[Dict[str, Iterable[Dict]]] = None,
+        namespaces: dict[str, Iterable[dict]] | None = None,
     ) -> ApplicationService:
         """
         Register a new application service, with the given namespaces of interest.
@@ -1044,7 +1070,7 @@ class ApplicationServicesHandlerDeviceListsTestCase(unittest.HomeserverTestCase)
         hs.get_application_service_api().put_json = self.put_json  # type: ignore[method-assign]
 
         # Mock out application services, and allow defining our own in tests
-        self._services: List[ApplicationService] = []
+        self._services: list[ApplicationService] = []
         self.hs.get_datastores().main.get_app_services = Mock(  # type: ignore[method-assign]
             return_value=self._services
         )
@@ -1289,8 +1315,8 @@ class ApplicationServicesHandlerOtkCountsTestCase(unittest.HomeserverTestCase):
         # Capture what was sent as an AS transaction.
         self.send_mock.assert_called()
         last_args, _last_kwargs = self.send_mock.call_args
-        otks: Optional[TransactionOneTimeKeysCount] = last_args[self.ARG_OTK_COUNTS]
-        unused_fallbacks: Optional[TransactionUnusedFallbackKeys] = last_args[
+        otks: TransactionOneTimeKeysCount | None = last_args[self.ARG_OTK_COUNTS]
+        unused_fallbacks: TransactionUnusedFallbackKeys | None = last_args[
             self.ARG_FALLBACK_KEYS
         ]
 
diff --git a/tests/handlers/test_auth.py b/tests/handlers/test_auth.py
index 0d9940c63e..648be7e7e7 100644
--- a/tests/handlers/test_auth.py
+++ b/tests/handlers/test_auth.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Optional
 from unittest.mock import AsyncMock
 
 import pymacaroons
@@ -29,7 +28,7 @@ from synapse.api.errors import AuthError, ResourceLimitError
 from synapse.rest import admin
 from synapse.rest.client import login
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -55,7 +54,7 @@ class AuthTestCase(unittest.HomeserverTestCase):
 
         self.user1 = self.register_user("a_user", "pass")
 
-    def token_login(self, token: str) -> Optional[str]:
+    def token_login(self, token: str) -> str | None:
         body = {
             "type": "m.login.token",
             "token": token,
diff --git a/tests/handlers/test_cas.py b/tests/handlers/test_cas.py
index 9de5e67863..02671fc264 100644
--- a/tests/handlers/test_cas.py
+++ b/tests/handlers/test_cas.py
@@ -18,14 +18,14 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict
+from typing import Any
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.handlers.cas import CasResponse
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase, override_config
 
@@ -35,7 +35,7 @@ SERVER_URL = "https://issuer/"
 
 
 class CasHandlerTestCase(HomeserverTestCase):
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["public_baseurl"] = BASE_URL
         cas_config = {
diff --git a/tests/handlers/test_deactivate_account.py b/tests/handlers/test_deactivate_account.py
index b7b8387780..1b749cee1f 100644
--- a/tests/handlers/test_deactivate_account.py
+++ b/tests/handlers/test_deactivate_account.py
@@ -28,7 +28,7 @@ from synapse.rest.client import account, login, room
 from synapse.server import HomeServer
 from synapse.synapse_rust.push import PushRule
 from synapse.types import UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/handlers/test_device.py b/tests/handlers/test_device.py
index 195cdfeaef..f99e3cd4a2 100644
--- a/tests/handlers/test_device.py
+++ b/tests/handlers/test_device.py
@@ -20,7 +20,6 @@
 #
 #
 
-from typing import Optional
 from unittest import mock
 
 from twisted.internet.defer import ensureDeferred
@@ -35,7 +34,7 @@ from synapse.rest.client import devices, login, register
 from synapse.server import HomeServer
 from synapse.storage.databases.main.appservice import _make_exclusive_regex
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.task_scheduler import TaskScheduler
 
 from tests import unittest
@@ -251,7 +250,7 @@ class DeviceTestCase(unittest.HomeserverTestCase):
         self.assertEqual(10, len(res))
 
         # wait for the task scheduler to do a second delete pass
-        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL_MS / 1000)
+        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL.as_secs())
 
         # remaining messages should now be deleted
         res = self.get_success(
@@ -312,8 +311,8 @@ class DeviceTestCase(unittest.HomeserverTestCase):
         user_id: str,
         device_id: str,
         display_name: str,
-        access_token: Optional[str] = None,
-        ip: Optional[str] = None,
+        access_token: str | None = None,
+        ip: str | None = None,
     ) -> None:
         device_id = self.get_success(
             self.handler.check_device_registered(
@@ -450,6 +449,33 @@ class DeviceTestCase(unittest.HomeserverTestCase):
             ],
         )
 
+    def test_delete_device_removes_refresh_tokens(self) -> None:
+        """Deleting a device should also purge any refresh tokens for it."""
+        self._record_users()
+
+        self.get_success(
+            self.store.add_refresh_token_to_user(
+                user_id=user1,
+                token="refresh_token",
+                device_id="abc",
+                expiry_ts=None,
+                ultimate_session_expiry_ts=None,
+            )
+        )
+
+        self.get_success(self.handler.delete_devices(user1, ["abc"]))
+
+        remaining_refresh_token = self.get_success(
+            self.store.db_pool.simple_select_one(
+                table="refresh_tokens",
+                keyvalues={"user_id": user1, "device_id": "abc"},
+                retcols=("id",),
+                desc="get_refresh_token_for_device",
+                allow_none=True,
+            )
+        )
+        self.assertIsNone(remaining_refresh_token)
+
 
 class DehydrationTestCase(unittest.HomeserverTestCase):
     servlets = [
@@ -471,90 +497,7 @@ class DehydrationTestCase(unittest.HomeserverTestCase):
         self.store = hs.get_datastores().main
         return hs
 
-    def test_dehydrate_and_rehydrate_device(self) -> None:
-        user_id = "@boris:dehydration"
-
-        self.get_success(self.store.register_user(user_id, "foobar"))
-
-        # First check if we can store and fetch a dehydrated device
-        stored_dehydrated_device_id = self.get_success(
-            self.handler.store_dehydrated_device(
-                user_id=user_id,
-                device_id=None,
-                device_data={"device_data": {"foo": "bar"}},
-                initial_device_display_name="dehydrated device",
-            )
-        )
-
-        result = self.get_success(self.handler.get_dehydrated_device(user_id=user_id))
-        assert result is not None
-        retrieved_device_id, device_data = result
-
-        self.assertEqual(retrieved_device_id, stored_dehydrated_device_id)
-        self.assertEqual(device_data, {"device_data": {"foo": "bar"}})
-
-        # Create a new login for the user and dehydrated the device
-        device_id, access_token, _expiration_time, refresh_token = self.get_success(
-            self.registration.register_device(
-                user_id=user_id,
-                device_id=None,
-                initial_display_name="new device",
-                should_issue_refresh_token=True,
-            )
-        )
-
-        # Trying to claim a nonexistent device should throw an error
-        self.get_failure(
-            self.handler.rehydrate_device(
-                user_id=user_id,
-                access_token=access_token,
-                device_id="not the right device ID",
-            ),
-            NotFoundError,
-        )
-
-        # dehydrating the right devices should succeed and change our device ID
-        # to the dehydrated device's ID
-        res = self.get_success(
-            self.handler.rehydrate_device(
-                user_id=user_id,
-                access_token=access_token,
-                device_id=retrieved_device_id,
-            )
-        )
-
-        self.assertEqual(res, {"success": True})
-
-        # make sure that our device ID has changed
-        user_info = self.get_success(self.auth.get_user_by_access_token(access_token))
-
-        self.assertEqual(user_info.device_id, retrieved_device_id)
-
-        # make sure the user device has the refresh token
-        assert refresh_token is not None
-        self.get_success(
-            self.auth_handler.refresh_token(refresh_token, 5 * 60 * 1000, 5 * 60 * 1000)
-        )
-
-        # make sure the device has the display name that was set from the login
-        res = self.get_success(self.handler.get_device(user_id, retrieved_device_id))
-
-        self.assertEqual(res["display_name"], "new device")
-
-        # make sure that the device ID that we were initially assigned no longer exists
-        self.get_failure(
-            self.handler.get_device(user_id, device_id),
-            NotFoundError,
-        )
-
-        # make sure that there's no device available for dehydrating now
-        ret = self.get_success(self.handler.get_dehydrated_device(user_id=user_id))
-
-        self.assertIsNone(ret)
-
-    @unittest.override_config(
-        {"experimental_features": {"msc2697_enabled": False, "msc3814_enabled": True}}
-    )
+    @unittest.override_config({"experimental_features": {"msc3814_enabled": True}})
     def test_dehydrate_v2_and_fetch_events(self) -> None:
         user_id = "@boris:server"
 
@@ -567,6 +510,7 @@ class DehydrationTestCase(unittest.HomeserverTestCase):
                 device_id=None,
                 device_data={"device_data": {"foo": "bar"}},
                 initial_device_display_name="dehydrated device",
+                keys_for_device={},
             )
         )
 
diff --git a/tests/handlers/test_directory.py b/tests/handlers/test_directory.py
index 4d6243ef74..76b145b92b 100644
--- a/tests/handlers/test_directory.py
+++ b/tests/handlers/test_directory.py
@@ -19,7 +19,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Awaitable, Callable, Dict
+from typing import Any, Awaitable, Callable
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -31,7 +31,7 @@ from synapse.events import EventBase
 from synapse.rest.client import directory, login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, RoomAlias, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -43,7 +43,7 @@ class DirectoryTestCase(unittest.HomeserverTestCase):
         self.mock_federation = AsyncMock()
         self.mock_registry = Mock()
 
-        self.query_handlers: Dict[str, Callable[[dict], Awaitable[JsonDict]]] = {}
+        self.query_handlers: dict[str, Callable[[dict], Awaitable[JsonDict]]] = {}
 
         def register_query_handler(
             query_type: str, handler: Callable[[dict], Awaitable[JsonDict]]
@@ -410,7 +410,7 @@ class TestCreateAliasACL(unittest.HomeserverTestCase):
 
     servlets = [directory.register_servlets, room.register_servlets]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         # Add custom alias creation rules to the config.
@@ -476,7 +476,7 @@ class TestCreatePublishedRoomACL(unittest.HomeserverTestCase):
     data = {"room_alias_name": "unofficial_test"}
     allowed_localpart = "allowed"
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         # Add custom room list publication rules to the config.
diff --git a/tests/handlers/test_e2e_keys.py b/tests/handlers/test_e2e_keys.py
index fda485d413..a4f9d55a13 100644
--- a/tests/handlers/test_e2e_keys.py
+++ b/tests/handlers/test_e2e_keys.py
@@ -20,7 +20,7 @@
 #
 #
 import time
-from typing import Dict, Iterable
+from typing import Iterable
 from unittest import mock
 
 from parameterized import parameterized
@@ -35,7 +35,7 @@ from synapse.handlers.device import DeviceWriterHandler
 from synapse.server import HomeServer
 from synapse.storage.databases.main.appservice import _make_exclusive_regex
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -291,7 +291,7 @@ class E2eKeysHandlerTestCase(unittest.HomeserverTestCase):
             (chris, "chris_dev_2", "alg2"): 1,
         }
         # Convert to the format the handler wants.
-        query: Dict[str, Dict[str, Dict[str, int]]] = {}
+        query: dict[str, dict[str, dict[str, int]]] = {}
         for (user_id, device_id, algorithm), count in claims_to_make.items():
             query.setdefault(user_id, {}).setdefault(device_id, {})[algorithm] = count
         claim_res = self.get_success(
@@ -410,7 +410,6 @@ class E2eKeysHandlerTestCase(unittest.HomeserverTestCase):
         device_id = "xyz"
         fallback_key = {"alg1:k1": "fallback_key1"}
         fallback_key2 = {"alg1:k2": "fallback_key2"}
-        fallback_key3 = {"alg1:k2": "fallback_key3"}
         otk = {"alg1:k2": "key2"}
 
         # we shouldn't have any unused fallback keys yet
@@ -531,28 +530,6 @@ class E2eKeysHandlerTestCase(unittest.HomeserverTestCase):
             {"failures": {}, "one_time_keys": {local_user: {device_id: fallback_key2}}},
         )
 
-        # using the unstable prefix should also set the fallback key
-        self.get_success(
-            self.handler.upload_keys_for_user(
-                local_user,
-                device_id,
-                {"org.matrix.msc2732.fallback_keys": fallback_key3},
-            )
-        )
-
-        claim_res = self.get_success(
-            self.handler.claim_one_time_keys(
-                {local_user: {device_id: {"alg1": 1}}},
-                self.requester,
-                timeout=None,
-                always_include_fallback_keys=False,
-            )
-        )
-        self.assertEqual(
-            claim_res,
-            {"failures": {}, "one_time_keys": {local_user: {device_id: fallback_key3}}},
-        )
-
     def test_fallback_key_bulk(self) -> None:
         """Like test_fallback_key, but claims multiple keys in one handler call."""
         alice = f"@alice:{self.hs.hostname}"
@@ -1533,7 +1510,7 @@ class E2eKeysHandlerTestCase(unittest.HomeserverTestCase):
         )
 
         # Setup a response.
-        response: Dict[str, Dict[str, Dict[str, JsonDict]]] = {
+        response: dict[str, dict[str, dict[str, JsonDict]]] = {
             local_user: {device_id_1: {**as_otk, **as_fallback_key}}
         }
         self.appservice_api.claim_client_keys.return_value = (response, [])
diff --git a/tests/handlers/test_e2e_room_keys.py b/tests/handlers/test_e2e_room_keys.py
index 9b280659ab..5085a0309b 100644
--- a/tests/handlers/test_e2e_room_keys.py
+++ b/tests/handlers/test_e2e_room_keys.py
@@ -21,13 +21,12 @@
 #
 
 import copy
-from unittest import mock
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.api.errors import SynapseError
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -50,7 +49,7 @@ room_keys = {
 
 class E2eRoomKeysHandlerTestCase(unittest.HomeserverTestCase):
     def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
-        return self.setup_test_homeserver(replication_layer=mock.Mock())
+        return self.setup_test_homeserver()
 
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.handler = hs.get_e2e_room_keys_handler()
diff --git a/tests/handlers/test_federation.py b/tests/handlers/test_federation.py
index 4de90e6578..7085531548 100644
--- a/tests/handlers/test_federation.py
+++ b/tests/handlers/test_federation.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import Collection, Optional, cast
+from typing import Collection, cast
 from unittest import TestCase
 from unittest.mock import AsyncMock, Mock, patch
 
@@ -38,12 +38,11 @@ from synapse.api.room_versions import RoomVersions
 from synapse.events import EventBase, make_event_from_dict
 from synapse.federation.federation_base import event_from_pdu_json
 from synapse.federation.federation_client import SendJoinResult
-from synapse.logging.context import LoggingContext, run_in_background
 from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.storage.databases.main.events_worker import EventCacheEntry
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.events import generate_fake_event_id
 
 from tests import unittest
@@ -149,11 +148,9 @@ class FederationTestCase(unittest.FederatingHomeserverTestCase):
             room_version,
         )
 
-        with LoggingContext("send_rejected"):
-            d = run_in_background(
-                self.hs.get_federation_event_handler().on_receive_pdu, OTHER_SERVER, ev
-            )
-        self.get_success(d)
+        self.get_success(
+            self.hs.get_federation_event_handler().on_receive_pdu(OTHER_SERVER, ev)
+        )
 
         # that should have been rejected
         e = self.get_success(self.store.get_event(ev.event_id, allow_rejected=True))
@@ -203,11 +200,9 @@ class FederationTestCase(unittest.FederatingHomeserverTestCase):
             room_version,
         )
 
-        with LoggingContext("send_rejected"):
-            d = run_in_background(
-                self.hs.get_federation_event_handler().on_receive_pdu, OTHER_SERVER, ev
-            )
-        self.get_success(d)
+        self.get_success(
+            self.hs.get_federation_event_handler().on_receive_pdu(OTHER_SERVER, ev)
+        )
 
         # that should have been rejected
         e = self.get_success(self.store.get_event(ev.event_id, allow_rejected=True))
@@ -323,15 +318,15 @@ class FederationTestCase(unittest.FederatingHomeserverTestCase):
 
         current_depth = 1
         limit = 100
-        with LoggingContext("receive_pdu"):
-            # Make sure backfill still works
-            d = run_in_background(
-                self.hs.get_federation_handler().maybe_backfill,
+
+        # Make sure backfill still works
+        self.get_success(
+            self.hs.get_federation_handler().maybe_backfill(
                 room_id,
                 current_depth,
                 limit,
             )
-        self.get_success(d)
+        )
 
     def test_backfill_ignores_known_events(self) -> None:
         """
@@ -491,13 +486,12 @@ class FederationTestCase(unittest.FederatingHomeserverTestCase):
         # the auth code requires that a signature exists, but doesn't check that
         # signature... go figure.
         join_event.signatures[other_server] = {"x": "y"}
-        with LoggingContext("send_join"):
-            d = run_in_background(
-                self.hs.get_federation_event_handler().on_send_membership_event,
-                other_server,
-                join_event,
+
+        self.get_success(
+            self.hs.get_federation_event_handler().on_send_membership_event(
+                other_server, join_event
             )
-        self.get_success(d)
+        )
 
         # sanity-check: the room should show that the new user is a member
         r = self.get_success(self.store.get_partial_current_state_ids(room_id))
@@ -695,7 +689,7 @@ class PartialJoinTestCase(unittest.FederatingHomeserverTestCase):
             return is_partial_state
 
         async def sync_partial_state_room(
-            initial_destination: Optional[str],
+            initial_destination: str | None,
             other_destinations: Collection[str],
             room_id: str,
         ) -> None:
@@ -750,7 +744,7 @@ class PartialJoinTestCase(unittest.FederatingHomeserverTestCase):
             return is_partial_state
 
         async def sync_partial_state_room(
-            initial_destination: Optional[str],
+            initial_destination: str | None,
             other_destinations: Collection[str],
             room_id: str,
         ) -> None:
diff --git a/tests/handlers/test_federation_event.py b/tests/handlers/test_federation_event.py
index 02dd60e76d..3d856b9346 100644
--- a/tests/handlers/test_federation_event.py
+++ b/tests/handlers/test_federation_event.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Optional
 from unittest import mock
 
 from twisted.internet.testing import MemoryReactor
@@ -39,7 +38,7 @@ from synapse.server import HomeServer
 from synapse.state import StateResolutionStore
 from synapse.state.v2 import _mainline_sort, _reverse_topological_power_sort
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils import event_injection
@@ -183,7 +182,7 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         else:
 
             async def get_event(
-                destination: str, event_id: str, timeout: Optional[int] = None
+                destination: str, event_id: str, timeout: int | None = None
             ) -> JsonDict:
                 self.assertEqual(destination, self.OTHER_SERVER_NAME)
                 self.assertEqual(event_id, prev_event.event_id)
@@ -224,7 +223,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         self.reactor.advance(60000)
 
         # Finally, the call under test: send the pulled event into _process_pulled_event
-        with LoggingContext("test"):
+        with LoggingContext(
+            name="test",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler()._process_pulled_event(
                     self.OTHER_SERVER_NAME, pulled_event, backfilled=False
@@ -321,7 +323,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         )
 
         # The function under test: try to process the pulled event
-        with LoggingContext("test"):
+        with LoggingContext(
+            name="test",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler()._process_pulled_event(
                     self.OTHER_SERVER_NAME, pulled_event, backfilled=True
@@ -339,7 +344,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         self.assertEqual(backfill_num_attempts, 1)
 
         # The function under test: try to process the pulled event again
-        with LoggingContext("test"):
+        with LoggingContext(
+            name="test",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler()._process_pulled_event(
                     self.OTHER_SERVER_NAME, pulled_event, backfilled=True
@@ -447,7 +455,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         self.assertEqual(backfill_num_attempts, 1)
 
         # The function under test: try to process the pulled event
-        with LoggingContext("test"):
+        with LoggingContext(
+            name="test",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler()._process_pulled_event(
                     self.OTHER_SERVER_NAME, pulled_event, backfilled=True
@@ -573,7 +584,7 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         room_state_endpoint_requested_count = 0
 
         async def get_event(
-            destination: str, event_id: str, timeout: Optional[int] = None
+            destination: str, event_id: str, timeout: int | None = None
         ) -> None:
             nonlocal event_endpoint_requested_count
             event_endpoint_requested_count += 1
@@ -602,7 +613,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         )
 
         # The function under test: try to backfill and process the pulled event
-        with LoggingContext("test"):
+        with LoggingContext(
+            name="test",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler().backfill(
                     self.OTHER_SERVER_NAME,
@@ -742,7 +756,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         }
 
         # The function under test: try to backfill and process the pulled event
-        with LoggingContext("test"):
+        with LoggingContext(
+            name="test",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler().backfill(
                     self.OTHER_SERVER_NAME,
@@ -887,7 +904,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         next_depth += 1
         next_timestamp += 100
 
-        with LoggingContext("send_rejected_power_levels_event"):
+        with LoggingContext(
+            name="send_rejected_power_levels_event",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler()._process_pulled_event(
                     self.OTHER_SERVER_NAME,
@@ -969,7 +989,10 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
             "during state resolution. The test setup is incorrect.",
         )
 
-        with LoggingContext("send_rejected_kick_event"):
+        with LoggingContext(
+            name="send_rejected_kick_event",
+            server_name=self.hs.hostname,
+        ):
             self.get_success(
                 self.hs.get_federation_event_handler()._process_pulled_event(
                     self.OTHER_SERVER_NAME, rejected_kick_event, backfilled=False
@@ -1085,10 +1108,13 @@ class FederationEventHandlerTests(unittest.FederatingHomeserverTestCase):
         # We have to bump the clock a bit, to keep the retry logic in
         # `FederationClient.get_pdu` happy
         self.reactor.advance(60000)
-        with LoggingContext("send_pulled_event"):
+        with LoggingContext(
+            name="send_pulled_event",
+            server_name=self.hs.hostname,
+        ):
 
             async def get_event(
-                destination: str, event_id: str, timeout: Optional[int] = None
+                destination: str, event_id: str, timeout: int | None = None
             ) -> JsonDict:
                 self.assertEqual(destination, self.OTHER_SERVER_NAME)
                 self.assertEqual(event_id, missing_event.event_id)
diff --git a/tests/handlers/test_message.py b/tests/handlers/test_message.py
index 0a1092eae4..6450a90444 100644
--- a/tests/handlers/test_message.py
+++ b/tests/handlers/test_message.py
@@ -19,7 +19,6 @@
 #
 #
 import logging
-from typing import Tuple
 
 from twisted.internet.testing import MemoryReactor
 
@@ -31,7 +30,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 from tests import unittest
@@ -64,7 +63,7 @@ class EventCreationTestCase(unittest.HomeserverTestCase):
 
         self.requester = create_requester(self.user_id, device_id=device_id)
 
-    def _create_and_persist_member_event(self) -> Tuple[EventBase, EventContext]:
+    def _create_and_persist_member_event(self) -> tuple[EventBase, EventContext]:
         # Create a member event we can use as an auth_event
         memberEvent, memberEventContext = self.get_success(
             create_event(
@@ -86,7 +85,7 @@ class EventCreationTestCase(unittest.HomeserverTestCase):
 
     def _create_duplicate_event(
         self, txn_id: str
-    ) -> Tuple[EventBase, UnpersistedEventContextBase]:
+    ) -> tuple[EventBase, UnpersistedEventContextBase]:
         """Create a new event with the given transaction ID. All events produced
         by this method will be considered duplicates.
         """
diff --git a/tests/handlers/test_oauth_delegation.py b/tests/handlers/test_oauth_delegation.py
index d24614f6a3..c88f2c2d15 100644
--- a/tests/handlers/test_oauth_delegation.py
+++ b/tests/handlers/test_oauth_delegation.py
@@ -25,7 +25,7 @@ import time
 from http import HTTPStatus
 from http.server import BaseHTTPRequestHandler, HTTPServer
 from io import BytesIO
-from typing import Any, ClassVar, Coroutine, Dict, Generator, Optional, TypeVar, Union
+from typing import Any, ClassVar, Coroutine, Generator, TypeVar, Union
 from unittest.mock import ANY, AsyncMock, Mock
 from urllib.parse import parse_qs
 
@@ -54,7 +54,7 @@ from synapse.rest import admin
 from synapse.rest.client import account, devices, keys, login, logout, register
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.server import FakeChannel
 from tests.test_utils import get_awaitable_result
@@ -130,7 +130,7 @@ class MSC3861OAuthDelegation(HomeserverTestCase):
         keys.register_servlets,
     ]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["public_baseurl"] = BASE_URL
         config["disable_registration"] = True
@@ -759,7 +759,7 @@ class FakeMasServer(HTTPServer):
     secret: str = "verysecret"
     """The shared secret used to authenticate the introspection endpoint."""
 
-    last_token_seen: Optional[str] = None
+    last_token_seen: str | None = None
     """What is the last access token seen by the introspection endpoint."""
 
     calls: int = 0
@@ -834,7 +834,7 @@ class MasAuthDelegation(HomeserverTestCase):
 
         return deferred
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["public_baseurl"] = BASE_URL
         config["disable_registration"] = True
@@ -889,11 +889,11 @@ class MasAuthDelegation(HomeserverTestCase):
             )
         )
 
-        self.assertEquals(requester.user.to_string(), USER_ID)
-        self.assertEquals(requester.device_id, DEVICE)
+        self.assertEqual(requester.user.to_string(), USER_ID)
+        self.assertEqual(requester.device_id, DEVICE)
         self.assertFalse(self.get_success(self._auth.is_server_admin(requester)))
 
-        self.assertEquals(
+        self.assertEqual(
             self.server.last_token_seen,
             "some_token",
         )
@@ -912,11 +912,11 @@ class MasAuthDelegation(HomeserverTestCase):
             )
         )
 
-        self.assertEquals(requester.user.to_string(), USER_ID)
-        self.assertEquals(requester.device_id, DEVICE)
+        self.assertEqual(requester.user.to_string(), USER_ID)
+        self.assertEqual(requester.device_id, DEVICE)
         self.assertFalse(self.get_success(self._auth.is_server_admin(requester)))
 
-        self.assertEquals(
+        self.assertEqual(
             self.server.last_token_seen,
             "some_token",
         )
@@ -1057,6 +1057,32 @@ class MasAuthDelegation(HomeserverTestCase):
         self.assertEqual(self.server.calls, 1)
 
 
+class MasAuthDelegationWithSubpath(MasAuthDelegation):
+    """Test MAS delegation when the MAS server is hosted on a subpath."""
+
+    def default_config(self) -> dict[str, Any]:
+        config = super().default_config()
+        # Override the endpoint to include a subpath
+        config["matrix_authentication_service"]["endpoint"] = (
+            self.server.endpoint + "auth/path/"
+        )
+        return config
+
+    def test_introspection_endpoint_uses_subpath(self) -> None:
+        """Test that the introspection endpoint correctly uses the configured subpath."""
+        expected_introspection_url = (
+            self.server.endpoint + "auth/path/oauth2/introspect"
+        )
+        self.assertEqual(self._auth._introspection_endpoint, expected_introspection_url)
+
+    def test_metadata_url_uses_subpath(self) -> None:
+        """Test that the metadata URL correctly uses the configured subpath."""
+        expected_metadata_url = (
+            self.server.endpoint + "auth/path/.well-known/openid-configuration"
+        )
+        self.assertEqual(self._auth._metadata_url, expected_metadata_url)
+
+
 @parameterized_class(
     ("config",),
     [
@@ -1100,9 +1126,9 @@ class DisabledEndpointsTestCase(HomeserverTestCase):
         admin.register_servlets,
     ]
 
-    config: Dict[str, Any]
+    config: dict[str, Any]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["public_baseurl"] = BASE_URL
         config["disable_registration"] = True
@@ -1110,7 +1136,7 @@ class DisabledEndpointsTestCase(HomeserverTestCase):
         return config
 
     def expect_unauthorized(
-        self, method: str, path: str, content: Union[bytes, str, JsonDict] = ""
+        self, method: str, path: str, content: bytes | str | JsonDict = ""
     ) -> None:
         channel = self.make_request(method, path, content, shorthand=False)
 
@@ -1120,7 +1146,7 @@ class DisabledEndpointsTestCase(HomeserverTestCase):
         self,
         method: str,
         path: str,
-        content: Union[bytes, str, JsonDict] = "",
+        content: bytes | str | JsonDict = "",
         auth: bool = False,
     ) -> None:
         channel = self.make_request(
@@ -1133,7 +1159,7 @@ class DisabledEndpointsTestCase(HomeserverTestCase):
         )
 
     def expect_forbidden(
-        self, method: str, path: str, content: Union[bytes, str, JsonDict] = ""
+        self, method: str, path: str, content: bytes | str | JsonDict = ""
     ) -> None:
         channel = self.make_request(method, path, content)
 
@@ -1219,7 +1245,11 @@ class DisabledEndpointsTestCase(HomeserverTestCase):
         channel = self.make_request(
             "POST",
             "/_matrix/client/v3/register",
-            {"username": "alice", "type": "m.login.application_service"},
+            {
+                "username": "alice",
+                "type": "m.login.application_service",
+                "inhibit_login": True,
+            },
             shorthand=False,
             access_token="i_am_an_app_service",
         )
diff --git a/tests/handlers/test_oidc.py b/tests/handlers/test_oidc.py
index db37e7d185..62b84c77a4 100644
--- a/tests/handlers/test_oidc.py
+++ b/tests/handlers/test_oidc.py
@@ -19,7 +19,7 @@
 #
 #
 import os
-from typing import Any, Awaitable, ContextManager, Dict, Optional, Tuple
+from typing import Any, ContextManager
 from unittest.mock import ANY, AsyncMock, Mock, patch
 from urllib.parse import parse_qs, urlparse
 
@@ -29,9 +29,10 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.handlers.sso import MappingException
 from synapse.http.site import SynapseRequest
+from synapse.logging.context import make_deferred_yieldable
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.macaroons import get_value_from_macaroon
 from synapse.util.stringutils import random_string
 
@@ -44,7 +45,7 @@ try:
     from authlib.oidc.core import UserInfo
     from authlib.oidc.discovery import OpenIDProviderMetadata
 
-    from synapse.handlers.oidc import Token, UserAttributeDict
+    from synapse.handlers.oidc import OidcMetadataError, Token, UserAttributeDict
 
     HAS_OIDC = True
 except ImportError:
@@ -152,7 +153,7 @@ class OidcHandlerTestCase(HomeserverTestCase):
     if not HAS_OIDC:
         skip = "requires OIDC"
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["public_baseurl"] = BASE_URL
         return config
@@ -204,7 +205,7 @@ class OidcHandlerTestCase(HomeserverTestCase):
         client_redirect_url: str = "http://client/redirect",
         scope: str = "openid",
         with_sid: bool = False,
-    ) -> Tuple[SynapseRequest, FakeAuthorizationGrant]:
+    ) -> tuple[SynapseRequest, FakeAuthorizationGrant]:
         """Start an authorization request, and get the callback request back."""
         nonce = random_string(10)
         state = random_string(10)
@@ -221,8 +222,8 @@ class OidcHandlerTestCase(HomeserverTestCase):
         return _build_callback_request(code, state, session), grant
 
     def assertRenderedError(
-        self, error: str, error_description: Optional[str] = None
-    ) -> Tuple[Any, ...]:
+        self, error: str, error_description: str | None = None
+    ) -> tuple[Any, ...]:
         self.render_error.assert_called_once()
         args = self.render_error.call_args[0]
         self.assertEqual(args[1], error)
@@ -264,6 +265,29 @@ class OidcHandlerTestCase(HomeserverTestCase):
         self.get_success(self.provider.load_metadata())
         self.fake_server.get_metadata_handler.assert_not_called()
 
+    @override_config({"oidc_config": {**DEFAULT_CONFIG, "discover": True}})
+    def test_startup_metadata_preload_failure_is_logged(self) -> None:
+        """
+        The metadata preload on startup causes logs to be emitted, but no
+        exceptions.
+        """
+        with self.fake_server.buggy_endpoint(metadata=True):
+            with self.assertLogs("synapse.handlers.oidc", level="CRITICAL") as logs:
+                self.get_success(
+                    make_deferred_yieldable(self.handler.preload_metadata())
+                )
+
+        self.assertIn(
+            "CRITICAL:synapse.handlers.oidc:Error while preloading OIDC provider 'oidc'. Login may be broken!",
+            [line for record in logs.output for line in record.split("\n")],
+        )
+
+        # Even though the preload failed, if we try to load the metadata later,
+        # the attempt still goes through.
+        self.fake_server.get_metadata_handler.assert_not_called()
+        self.get_success(self.provider.load_metadata())
+        self.fake_server.get_metadata_handler.assert_called_once()
+
     @override_config({"oidc_config": {**EXPLICIT_ENDPOINT_CONFIG, "discover": True}})
     def test_discovery_with_explicit_config(self) -> None:
         """
@@ -351,49 +375,53 @@ class OidcHandlerTestCase(HomeserverTestCase):
         """Provider metadatas are extensively validated."""
         h = self.provider
 
-        def force_load_metadata() -> Awaitable[None]:
+        def force_load_metadata() -> None:
             async def force_load() -> "OpenIDProviderMetadata":
                 return await h.load_metadata(force=True)
 
-            return get_awaitable_result(force_load())
+            get_awaitable_result(force_load())
 
         # Default test config does not throw
         force_load_metadata()
 
         with self.metadata_edit({"issuer": None}):
-            self.assertRaisesRegex(ValueError, "issuer", force_load_metadata)
+            self.assertRaisesRegex(OidcMetadataError, "issuer", force_load_metadata)
 
         with self.metadata_edit({"issuer": "http://insecure/"}):
-            self.assertRaisesRegex(ValueError, "issuer", force_load_metadata)
+            self.assertRaisesRegex(OidcMetadataError, "issuer", force_load_metadata)
 
         with self.metadata_edit({"issuer": "https://invalid/?because=query"}):
-            self.assertRaisesRegex(ValueError, "issuer", force_load_metadata)
+            self.assertRaisesRegex(OidcMetadataError, "issuer", force_load_metadata)
 
         with self.metadata_edit({"authorization_endpoint": None}):
             self.assertRaisesRegex(
-                ValueError, "authorization_endpoint", force_load_metadata
+                OidcMetadataError, "authorization_endpoint", force_load_metadata
             )
 
         with self.metadata_edit({"authorization_endpoint": "http://insecure/auth"}):
             self.assertRaisesRegex(
-                ValueError, "authorization_endpoint", force_load_metadata
+                OidcMetadataError, "authorization_endpoint", force_load_metadata
             )
 
         with self.metadata_edit({"token_endpoint": None}):
-            self.assertRaisesRegex(ValueError, "token_endpoint", force_load_metadata)
+            self.assertRaisesRegex(
+                OidcMetadataError, "token_endpoint", force_load_metadata
+            )
 
         with self.metadata_edit({"token_endpoint": "http://insecure/token"}):
-            self.assertRaisesRegex(ValueError, "token_endpoint", force_load_metadata)
+            self.assertRaisesRegex(
+                OidcMetadataError, "token_endpoint", force_load_metadata
+            )
 
         with self.metadata_edit({"jwks_uri": None}):
-            self.assertRaisesRegex(ValueError, "jwks_uri", force_load_metadata)
+            self.assertRaisesRegex(OidcMetadataError, "jwks_uri", force_load_metadata)
 
         with self.metadata_edit({"jwks_uri": "http://insecure/jwks.json"}):
-            self.assertRaisesRegex(ValueError, "jwks_uri", force_load_metadata)
+            self.assertRaisesRegex(OidcMetadataError, "jwks_uri", force_load_metadata)
 
         with self.metadata_edit({"response_types_supported": ["id_token"]}):
             self.assertRaisesRegex(
-                ValueError, "response_types_supported", force_load_metadata
+                OidcMetadataError, "response_types_supported", force_load_metadata
             )
 
         with self.metadata_edit(
@@ -406,7 +434,7 @@ class OidcHandlerTestCase(HomeserverTestCase):
             {"token_endpoint_auth_methods_supported": ["client_secret_post"]}
         ):
             self.assertRaisesRegex(
-                ValueError,
+                OidcMetadataError,
                 "token_endpoint_auth_methods_supported",
                 force_load_metadata,
             )
@@ -423,7 +451,9 @@ class OidcHandlerTestCase(HomeserverTestCase):
         h._scopes = []
         self.assertTrue(h._uses_userinfo)
         with self.metadata_edit({"userinfo_endpoint": None}):
-            self.assertRaisesRegex(ValueError, "userinfo_endpoint", force_load_metadata)
+            self.assertRaisesRegex(
+                OidcMetadataError, "userinfo_endpoint", force_load_metadata
+            )
 
         with self.metadata_edit({"jwks_uri": None}):
             # Shouldn't raise with a valid userinfo, even without jwks
diff --git a/tests/handlers/test_password_providers.py b/tests/handlers/test_password_providers.py
index 0a78fe0304..573ba58c4f 100644
--- a/tests/handlers/test_password_providers.py
+++ b/tests/handlers/test_password_providers.py
@@ -22,7 +22,7 @@
 """Tests for the password_auth_provider interface"""
 
 from http import HTTPStatus
-from typing import Any, Dict, List, Optional, Type, Union
+from typing import Any
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -35,7 +35,7 @@ from synapse.module_api import ModuleApi
 from synapse.rest.client import account, devices, login, logout, register
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeChannel
@@ -75,7 +75,7 @@ class LegacyCustomAuthProvider:
     def __init__(self, config: None, account_handler: AccountHandler):
         pass
 
-    def get_supported_login_types(self) -> Dict[str, List[str]]:
+    def get_supported_login_types(self) -> dict[str, list[str]]:
         return {"test.login_type": ["test_field"]}
 
     def check_auth(self, *args: str) -> Mock:
@@ -109,7 +109,7 @@ class LegacyPasswordCustomAuthProvider:
     def __init__(self, config: None, account_handler: AccountHandler):
         pass
 
-    def get_supported_login_types(self) -> Dict[str, List[str]]:
+    def get_supported_login_types(self) -> dict[str, list[str]]:
         return {"m.login.password": ["password"], "test.login_type": ["test_field"]}
 
     def check_auth(self, *args: str) -> Mock:
@@ -139,7 +139,7 @@ class PasswordCustomAuthProvider:
         return mock_password_provider.check_password(*args)
 
 
-def legacy_providers_config(*providers: Type[Any]) -> dict:
+def legacy_providers_config(*providers: type[Any]) -> dict:
     """Returns a config dict that will enable the given legacy password auth providers"""
     return {
         "password_providers": [
@@ -149,7 +149,7 @@ def legacy_providers_config(*providers: Type[Any]) -> dict:
     }
 
 
-def providers_config(*providers: Type[Any]) -> dict:
+def providers_config(*providers: type[Any]) -> dict:
     """Returns a config dict that will enable the given modules"""
     return {
         "modules": [
@@ -707,7 +707,7 @@ class PasswordAuthProviderTests(unittest.HomeserverTestCase):
         self.called = False
 
         async def on_logged_out(
-            user_id: str, device_id: Optional[str], access_token: str
+            user_id: str, device_id: str | None, access_token: str
         ) -> None:
             self.called = True
 
@@ -978,7 +978,7 @@ class PasswordAuthProviderTests(unittest.HomeserverTestCase):
         self,
         access_token: str,
         device: str,
-        body: Union[JsonDict, bytes] = b"",
+        body: JsonDict | bytes = b"",
     ) -> FakeChannel:
         """Delete an individual device."""
         channel = self.make_request(
diff --git a/tests/handlers/test_presence.py b/tests/handlers/test_presence.py
index 51b6c60531..44f1e6432d 100644
--- a/tests/handlers/test_presence.py
+++ b/tests/handlers/test_presence.py
@@ -19,7 +19,7 @@
 #
 #
 import itertools
-from typing import Optional, cast
+from typing import cast
 from unittest.mock import Mock, call
 
 from parameterized import parameterized
@@ -57,7 +57,7 @@ from synapse.server import HomeServer
 from synapse.storage.database import LoggingDatabaseConnection
 from synapse.storage.keys import FetchKeyResult
 from synapse.types import JsonDict, UserID, get_domain_from_id
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.replication._base import BaseMultiWorkerStreamTestCase
@@ -1650,7 +1650,7 @@ class PresenceHandlerTestCase(BaseMultiWorkerStreamTestCase):
         self.assertEqual(state.state, PresenceState.ONLINE)
 
     def _set_presencestate_with_status_msg(
-        self, state: str, status_msg: Optional[str]
+        self, state: str, status_msg: str | None
     ) -> None:
         """Set a PresenceState and status_msg and check the result.
 
diff --git a/tests/handlers/test_profile.py b/tests/handlers/test_profile.py
index 93934e9ff7..2e521a86b6 100644
--- a/tests/handlers/test_profile.py
+++ b/tests/handlers/test_profile.py
@@ -18,19 +18,24 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Awaitable, Callable, Dict
-from unittest.mock import AsyncMock, Mock
+from typing import Any, Awaitable, Callable
+from unittest.mock import AsyncMock, Mock, patch
 
 from parameterized import parameterized
 
 from twisted.internet.testing import MemoryReactor
 
 import synapse.types
+from synapse.api.constants import EventTypes
 from synapse.api.errors import AuthError, SynapseError
 from synapse.rest import admin
+from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.types.state import StateFilter
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+from synapse.util.task_scheduler import TaskStatus
 
 from tests import unittest
 
@@ -38,13 +43,17 @@ from tests import unittest
 class ProfileTestCase(unittest.HomeserverTestCase):
     """Tests profile management."""
 
-    servlets = [admin.register_servlets]
+    servlets = [
+        admin.register_servlets,
+        login.register_servlets,
+        room.register_servlets,
+    ]
 
     def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
         self.mock_federation = AsyncMock()
         self.mock_registry = Mock()
 
-        self.query_handlers: Dict[str, Callable[[dict], Awaitable[JsonDict]]] = {}
+        self.query_handlers: dict[str, Callable[[dict], Awaitable[JsonDict]]] = {}
 
         def register_query_handler(
             query_type: str, handler: Callable[[dict], Awaitable[JsonDict]]
@@ -62,12 +71,15 @@ class ProfileTestCase(unittest.HomeserverTestCase):
 
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.store = hs.get_datastores().main
+        self.storage_controllers = self.hs.get_storage_controllers()
+        self.task_scheduler = hs.get_task_scheduler()
 
         self.frank = UserID.from_string("@1234abcd:test")
         self.bob = UserID.from_string("@4567:test")
         self.alice = UserID.from_string("@alice:remote")
 
         self.register_user(self.frank.localpart, "frankpassword")
+        self.frank_token = self.login(self.frank.localpart, "frankpassword")
 
         self.handler = hs.get_profile_handler()
 
@@ -113,6 +125,195 @@ class ProfileTestCase(unittest.HomeserverTestCase):
             self.get_success(self.store.get_profile_displayname(self.frank))
         )
 
+    def test_update_room_membership_on_set_displayname(self) -> None:
+        """Test that `set_displayname` updates membership events in rooms."""
+
+        self.get_success(
+            self.handler.set_displayname(
+                self.frank, synapse.types.create_requester(self.frank), "Frank"
+            )
+        )
+
+        room_id = self.helper.create_room_as(
+            self.frank.to_string(), tok=self.frank_token
+        )
+
+        state_tuple = (EventTypes.Member, self.frank.to_string())
+
+        membership = self.get_success(
+            self.storage_controllers.state.get_current_state(
+                room_id, StateFilter.from_types([state_tuple])
+            )
+        )
+        self.assertEqual(membership[state_tuple].content["displayname"], "Frank")
+
+        self.get_success(
+            self.handler.set_displayname(
+                self.frank, synapse.types.create_requester(self.frank), "Frank Jr."
+            )
+        )
+
+        membership = self.get_success(
+            self.storage_controllers.state.get_current_state(
+                room_id, StateFilter.from_types([state_tuple])
+            )
+        )
+        self.assertEqual(membership[state_tuple].content["displayname"], "Frank Jr.")
+
+    def test_background_update_room_membership_on_set_displayname(self) -> None:
+        """Test that `set_displayname` returns immediately and that room membership updates are still done in background."""
+
+        self.get_success(
+            self.handler.set_displayname(
+                self.frank, synapse.types.create_requester(self.frank), "Frank"
+            )
+        )
+
+        room_id = self.helper.create_room_as(
+            self.frank.to_string(), tok=self.frank_token
+        )
+
+        original_update_membership = self.hs.get_room_member_handler().update_membership
+
+        async def slow_update_membership(*args: Any, **kwargs: Any) -> tuple[str, int]:
+            await self.clock.sleep(Duration(milliseconds=10))
+            return await original_update_membership(*args, **kwargs)
+
+        with patch.object(
+            self.hs.get_room_member_handler(),
+            "update_membership",
+            side_effect=slow_update_membership,
+        ):
+            state_tuple = (EventTypes.Member, self.frank.to_string())
+            self.get_success(
+                self.handler.set_displayname(
+                    self.frank, synapse.types.create_requester(self.frank), "Frank Jr."
+                )
+            )
+
+            membership = self.get_success(
+                self.storage_controllers.state.get_current_state(
+                    room_id, StateFilter.from_types([state_tuple])
+                )
+            )
+            self.assertEqual(membership[state_tuple].content["displayname"], "Frank")
+
+            # Let's be sure we are over the delay introduced by slow_update_membership
+            self.get_success(self.clock.sleep(Duration(milliseconds=20)), by=1)
+
+            membership = self.get_success(
+                self.storage_controllers.state.get_current_state(
+                    room_id, StateFilter.from_types([state_tuple])
+                )
+            )
+            self.assertEqual(
+                membership[state_tuple].content["displayname"], "Frank Jr."
+            )
+
+    def test_background_update_room_membership_resume_after_restart(self) -> None:
+        """Test that room membership updates triggered by changing the avatar or the display name are resumed after a restart."""
+
+        self.get_success(
+            self.handler.set_displayname(
+                self.frank, synapse.types.create_requester(self.frank), "Frank"
+            )
+        )
+
+        room_id_1 = self.helper.create_room_as(
+            self.frank.to_string(), tok=self.frank_token
+        )
+
+        room_id_2 = self.helper.create_room_as(
+            self.frank.to_string(), tok=self.frank_token
+        )
+
+        # Ensure `room_id_1` comes before `room_id_2` alphabetically
+        if room_id_1 > room_id_2:
+            room_id_1, room_id_2 = room_id_2, room_id_1
+
+        original_update_membership = self.hs.get_room_member_handler().update_membership
+
+        room_1_updated = False
+
+        async def potentially_slow_update_membership(
+            *args: Any, **kwargs: Any
+        ) -> tuple[str, int]:
+            if args[2] == room_id_2:
+                await self.clock.sleep(Duration(milliseconds=10))
+            if args[2] == room_id_1:
+                nonlocal room_1_updated
+                room_1_updated = True
+            return await original_update_membership(*args, **kwargs)
+
+        with patch.object(
+            self.hs.get_room_member_handler(),
+            "update_membership",
+            side_effect=potentially_slow_update_membership,
+        ):
+            state_tuple = (EventTypes.Member, self.frank.to_string())
+            self.get_success(
+                self.handler.set_displayname(
+                    self.frank, synapse.types.create_requester(self.frank), "Frank Jr."
+                )
+            )
+
+            # Check that the displayname is updated immediately for the first room
+            membership = self.get_success(
+                self.storage_controllers.state.get_current_state(
+                    room_id_1, StateFilter.from_types([state_tuple])
+                )
+            )
+            self.assertEqual(
+                membership[state_tuple].content["displayname"], "Frank Jr."
+            )
+
+            # Simulate a synapse restart by emptying the list of running tasks
+            # and canceling the deferred
+            _, deferred = self.task_scheduler._running_tasks.popitem()
+            deferred.cancel()
+
+            # Let's reset the flag to track whether room 1 was updated after the restart
+            room_1_updated = False
+
+            # Let's be sure we are over the delay introduced by slow_update_membership
+            # and that the task was not executed as expected
+            self.get_success(self.clock.sleep(Duration(milliseconds=20)), by=1)
+
+            membership = self.get_success(
+                self.storage_controllers.state.get_current_state(
+                    room_id_2, StateFilter.from_types([state_tuple])
+                )
+            )
+            self.assertEqual(membership[state_tuple].content["displayname"], "Frank")
+
+            cancelled_task = self.get_success(
+                self.task_scheduler.get_tasks(
+                    actions=["update_join_states"], statuses=[TaskStatus.CANCELLED]
+                )
+            )[0]
+
+            self.get_success(
+                self.task_scheduler.update_task(
+                    cancelled_task.id, status=TaskStatus.ACTIVE
+                )
+            )
+
+            # Let's be sure we are over the delay introduced by slow_update_membership
+            self.get_success(self.clock.sleep(Duration(milliseconds=20)), by=1)
+
+            # Updates should have been resumed from room 2 after the restart
+            # so room 1 should not have been updated this time
+            self.assertFalse(room_1_updated)
+
+            membership = self.get_success(
+                self.storage_controllers.state.get_current_state(
+                    room_id_2, StateFilter.from_types([state_tuple])
+                )
+            )
+            self.assertEqual(
+                membership[state_tuple].content["displayname"], "Frank Jr."
+            )
+
     def test_set_my_name_if_disabled(self) -> None:
         self.hs.config.registration.enable_set_displayname = False
 
@@ -377,7 +578,7 @@ class ProfileTestCase(unittest.HomeserverTestCase):
             self.get_success(self.handler.check_avatar_size_and_mime_type(remote_mxc))
         )
 
-    def _setup_local_files(self, names_and_props: Dict[str, Dict[str, Any]]) -> None:
+    def _setup_local_files(self, names_and_props: dict[str, dict[str, Any]]) -> None:
         """Stores metadata about files in the database.
 
         Args:
diff --git a/tests/handlers/test_receipts.py b/tests/handlers/test_receipts.py
index cf04ac6e00..bb9e84d644 100644
--- a/tests/handlers/test_receipts.py
+++ b/tests/handlers/test_receipts.py
@@ -20,14 +20,13 @@
 #
 
 from copy import deepcopy
-from typing import List
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.api.constants import EduTypes, ReceiptTypes
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -334,7 +333,7 @@ class ReceiptsTestCase(unittest.HomeserverTestCase):
         self.assertEqual(events, original_events)
 
     def _test_filters_private(
-        self, events: List[JsonDict], expected_output: List[JsonDict]
+        self, events: list[JsonDict], expected_output: list[JsonDict]
     ) -> None:
         """Tests that the _filter_out_private returns the expected output"""
         filtered_events = self.event_source.filter_out_private_receipts(
diff --git a/tests/handlers/test_register.py b/tests/handlers/test_register.py
index 43ded2fc10..0db7f30b1f 100644
--- a/tests/handlers/test_register.py
+++ b/tests/handlers/test_register.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, Collection, List, Optional, Tuple
+from typing import Any, Collection
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -43,7 +43,7 @@ from synapse.types import (
     UserID,
     create_requester,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import override_config
 from tests.utils import mock_getRawHeaders
@@ -63,10 +63,10 @@ class TestSpamChecker:
 
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
-        auth_provider_id: Optional[str],
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
+        auth_provider_id: str | None,
     ) -> RegistrationBehaviour:
         return RegistrationBehaviour.ALLOW
 
@@ -74,10 +74,10 @@ class TestSpamChecker:
 class DenyAll(TestSpamChecker):
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
-        auth_provider_id: Optional[str],
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
+        auth_provider_id: str | None,
     ) -> RegistrationBehaviour:
         return RegistrationBehaviour.DENY
 
@@ -85,10 +85,10 @@ class DenyAll(TestSpamChecker):
 class BanAll(TestSpamChecker):
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
-        auth_provider_id: Optional[str],
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
+        auth_provider_id: str | None,
     ) -> RegistrationBehaviour:
         return RegistrationBehaviour.SHADOW_BAN
 
@@ -96,10 +96,10 @@ class BanAll(TestSpamChecker):
 class BanBadIdPUser(TestSpamChecker):
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
-        auth_provider_id: Optional[str] = None,
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
+        auth_provider_id: str | None = None,
     ) -> RegistrationBehaviour:
         # Reject any user coming from CAS and whose username contains profanity
         if auth_provider_id == "cas" and username and "flimflob" in username:
@@ -113,9 +113,9 @@ class TestLegacyRegistrationSpamChecker:
 
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
     ) -> RegistrationBehaviour:
         return RegistrationBehaviour.ALLOW
 
@@ -123,9 +123,9 @@ class TestLegacyRegistrationSpamChecker:
 class LegacyAllowAll(TestLegacyRegistrationSpamChecker):
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
     ) -> RegistrationBehaviour:
         return RegistrationBehaviour.ALLOW
 
@@ -133,9 +133,9 @@ class LegacyAllowAll(TestLegacyRegistrationSpamChecker):
 class LegacyDenyAll(TestLegacyRegistrationSpamChecker):
     async def check_registration_for_spam(
         self,
-        email_threepid: Optional[dict],
-        username: Optional[str],
-        request_info: Collection[Tuple[str, str]],
+        email_threepid: dict | None,
+        username: str | None,
+        request_info: Collection[tuple[str, str]],
     ) -> RegistrationBehaviour:
         return RegistrationBehaviour.DENY
 
@@ -777,9 +777,9 @@ class RegistrationTestCase(unittest.HomeserverTestCase):
         self,
         requester: Requester,
         localpart: str,
-        displayname: Optional[str],
-        password_hash: Optional[str] = None,
-    ) -> Tuple[str, str]:
+        displayname: str | None,
+        password_hash: str | None = None,
+    ) -> tuple[str, str]:
         """Creates a new user if the user does not exist,
         else revokes all previous access tokens and generates a new one.
 
@@ -842,7 +842,7 @@ class RemoteAutoJoinTestCase(unittest.HomeserverTestCase):
 
         async def lookup_room_alias(
             *args: Any, **kwargs: Any
-        ) -> Tuple[RoomID, List[str]]:
+        ) -> tuple[RoomID, list[str]]:
             return RoomID.from_string(self.room_id), ["remotetest"]
 
         self.room_member_handler = Mock(spec=["update_membership", "lookup_room_alias"])
diff --git a/tests/handlers/test_room_list.py b/tests/handlers/test_room_list.py
index 45cef09b22..e7c4436d1d 100644
--- a/tests/handlers/test_room_list.py
+++ b/tests/handlers/test_room_list.py
@@ -1,5 +1,4 @@
 from http import HTTPStatus
-from typing import Optional, Set
 
 from synapse.rest import admin
 from synapse.rest.client import directory, login, room
@@ -18,7 +17,7 @@ class RoomListHandlerTestCase(unittest.HomeserverTestCase):
     ]
 
     def _create_published_room(
-        self, tok: str, extra_content: Optional[JsonDict] = None
+        self, tok: str, extra_content: JsonDict | None = None
     ) -> str:
         room_id = self.helper.create_room_as(tok=tok, extra_content=extra_content)
         channel = self.make_request(
@@ -69,7 +68,7 @@ class RoomListHandlerTestCase(unittest.HomeserverTestCase):
                 limit=50, from_federation_origin="test2"
             )
         )
-        room_ids_in_test2_list: Set[str] = {
+        room_ids_in_test2_list: set[str] = {
             entry["room_id"] for entry in room_list["chunk"]
         }
 
@@ -78,7 +77,7 @@ class RoomListHandlerTestCase(unittest.HomeserverTestCase):
                 limit=50, from_federation_origin="test3"
             )
         )
-        room_ids_in_test3_list: Set[str] = {
+        room_ids_in_test3_list: set[str] = {
             entry["room_id"] for entry in room_list["chunk"]
         }
 
diff --git a/tests/handlers/test_room_member.py b/tests/handlers/test_room_member.py
index 3084f180f5..3890abdbc8 100644
--- a/tests/handlers/test_room_member.py
+++ b/tests/handlers/test_room_member.py
@@ -15,7 +15,7 @@ from synapse.federation.federation_base import (
 from synapse.federation.federation_client import SendJoinResult
 from synapse.server import HomeServer
 from synapse.types import UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
 from tests.server import make_request
@@ -50,7 +50,7 @@ class TestJoinsLimitedByPerRoomRateLimiter(FederatingHomeserverTestCase):
 
         self.intially_unjoined_room_id = f"!example:{self.OTHER_SERVER_NAME}"
 
-    @override_config({"rc_joins_per_room": {"per_second": 0, "burst_count": 2}})
+    @override_config({"rc_joins_per_room": {"per_second": 0.1, "burst_count": 2}})
     def test_local_user_local_joins_contribute_to_limit_and_are_limited(self) -> None:
         # The rate limiter has accumulated one token from Alice's join after the create
         # event.
@@ -76,7 +76,7 @@ class TestJoinsLimitedByPerRoomRateLimiter(FederatingHomeserverTestCase):
             by=0.5,
         )
 
-    @override_config({"rc_joins_per_room": {"per_second": 0, "burst_count": 2}})
+    @override_config({"rc_joins_per_room": {"per_second": 0.1, "burst_count": 2}})
     def test_local_user_profile_edits_dont_contribute_to_limit(self) -> None:
         # The rate limiter has accumulated one token from Alice's join after the create
         # event. Alice should still be able to change her displayname.
@@ -100,7 +100,7 @@ class TestJoinsLimitedByPerRoomRateLimiter(FederatingHomeserverTestCase):
             )
         )
 
-    @override_config({"rc_joins_per_room": {"per_second": 0, "burst_count": 1}})
+    @override_config({"rc_joins_per_room": {"per_second": 0.1, "burst_count": 1}})
     def test_remote_joins_contribute_to_rate_limit(self) -> None:
         # Join once, to fill the rate limiter bucket.
         #
@@ -248,7 +248,7 @@ class TestReplicatedJoinsLimitedByPerRoomRateLimiter(BaseMultiWorkerStreamTestCa
         self.room_id = self.helper.create_room_as(self.alice, tok=self.alice_token)
         self.intially_unjoined_room_id = "!example:otherhs"
 
-    @override_config({"rc_joins_per_room": {"per_second": 0, "burst_count": 2}})
+    @override_config({"rc_joins_per_room": {"per_second": 0.01, "burst_count": 2}})
     def test_local_users_joining_on_another_worker_contribute_to_rate_limit(
         self,
     ) -> None:
@@ -458,7 +458,9 @@ class RoomMemberMasterHandlerTestCase(HomeserverTestCase):
         self.assertEqual(initial_count, new_count)
 
 
-class TestInviteFiltering(FederatingHomeserverTestCase):
+class TestMSC4155InviteFiltering(FederatingHomeserverTestCase):
+    """Tests for MSC4155-style invite filtering."""
+
     servlets = [
         synapse.rest.admin.register_servlets,
         synapse.rest.client.login.register_servlets,
@@ -501,7 +503,7 @@ class TestInviteFiltering(FederatingHomeserverTestCase):
             SynapseError,
         ).value
         self.assertEqual(f.code, 403)
-        self.assertEqual(f.errcode, "ORG.MATRIX.MSC4155.M_INVITE_BLOCKED")
+        self.assertEqual(f.errcode, "M_INVITE_BLOCKED")
 
     @override_config({"experimental_features": {"msc4155_enabled": False}})
     def test_msc4155_disabled_allow_invite_local(self) -> None:
@@ -571,7 +573,7 @@ class TestInviteFiltering(FederatingHomeserverTestCase):
             SynapseError,
         ).value
         self.assertEqual(f.code, 403)
-        self.assertEqual(f.errcode, "ORG.MATRIX.MSC4155.M_INVITE_BLOCKED")
+        self.assertEqual(f.errcode, "M_INVITE_BLOCKED")
 
     @override_config({"experimental_features": {"msc4155_enabled": True}})
     def test_msc4155_block_invite_remote_server(self) -> None:
@@ -617,4 +619,119 @@ class TestInviteFiltering(FederatingHomeserverTestCase):
             SynapseError,
         ).value
         self.assertEqual(f.code, 403)
-        self.assertEqual(f.errcode, "ORG.MATRIX.MSC4155.M_INVITE_BLOCKED")
+        self.assertEqual(f.errcode, "M_INVITE_BLOCKED")
+
+
+class TestMSC4380InviteBlocking(FederatingHomeserverTestCase):
+    """Tests for MSC4380-style invite filtering."""
+
+    servlets = [
+        synapse.rest.admin.register_servlets,
+        synapse.rest.client.login.register_servlets,
+        synapse.rest.client.room.register_servlets,
+    ]
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        self.handler = hs.get_room_member_handler()
+        self.fed_handler = hs.get_federation_handler()
+        self.store = hs.get_datastores().main
+
+        # Create two users.
+        self.alice = self.register_user("alice", "pass")
+        self.alice_token = self.login("alice", "pass")
+        self.bob = self.register_user("bob", "pass")
+        self.bob_token = self.login("bob", "pass")
+
+    def test_misc4380_block_invite_local(self) -> None:
+        """Test that MSC4380 will block a user from being invited to a room"""
+        room_id = self.helper.create_room_as(self.alice, tok=self.alice_token)
+
+        self.get_success(
+            self.store.add_account_data_for_user(
+                self.bob,
+                AccountDataTypes.INVITE_PERMISSION_CONFIG,
+                {
+                    "default_action": "block",
+                },
+            )
+        )
+
+        f = self.get_failure(
+            self.handler.update_membership(
+                requester=create_requester(self.alice),
+                target=UserID.from_string(self.bob),
+                room_id=room_id,
+                action=Membership.INVITE,
+            ),
+            SynapseError,
+        ).value
+        self.assertEqual(f.code, 403)
+        self.assertEqual(f.errcode, "M_INVITE_BLOCKED")
+
+    def test_misc4380_non_string_setting(self) -> None:
+        """Test that `default_action` being set to something non-stringy is the same as "accept"."""
+        room_id = self.helper.create_room_as(self.alice, tok=self.alice_token)
+
+        self.get_success(
+            self.store.add_account_data_for_user(
+                self.bob,
+                AccountDataTypes.INVITE_PERMISSION_CONFIG,
+                {
+                    "default_action": 1,
+                },
+            )
+        )
+
+        self.get_success(
+            self.handler.update_membership(
+                requester=create_requester(self.alice),
+                target=UserID.from_string(self.bob),
+                room_id=room_id,
+                action=Membership.INVITE,
+            )
+        )
+
+    def test_msc4380_block_invite_remote(self) -> None:
+        """Test that MSC4380 will block a user from being invited to a room by a remote user."""
+        # A remote user who sends the invite
+        remote_server = "otherserver"
+        remote_user = "@otheruser:" + remote_server
+
+        self.get_success(
+            self.store.add_account_data_for_user(
+                self.bob,
+                AccountDataTypes.INVITE_PERMISSION_CONFIG,
+                {"default_action": "block"},
+            )
+        )
+
+        room_id = self.helper.create_room_as(
+            room_creator=self.alice, tok=self.alice_token
+        )
+        room_version = self.get_success(self.store.get_room_version(room_id))
+
+        invite_event = event_from_pdu_json(
+            {
+                "type": EventTypes.Member,
+                "content": {"membership": "invite"},
+                "room_id": room_id,
+                "sender": remote_user,
+                "state_key": self.bob,
+                "depth": 32,
+                "prev_events": [],
+                "auth_events": [],
+                "origin_server_ts": self.clock.time_msec(),
+            },
+            room_version,
+        )
+
+        f = self.get_failure(
+            self.fed_handler.on_invite_request(
+                remote_server,
+                invite_event,
+                invite_event.room_version,
+            ),
+            SynapseError,
+        ).value
+        self.assertEqual(f.code, 403)
+        self.assertEqual(f.errcode, "M_INVITE_BLOCKED")
diff --git a/tests/handlers/test_room_policy.py b/tests/handlers/test_room_policy.py
index 3ea6f13cce..9adf0e38c2 100644
--- a/tests/handlers/test_room_policy.py
+++ b/tests/handlers/test_room_policy.py
@@ -12,18 +12,23 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 #
-from typing import Optional
 from unittest import mock
 
+import signedjson
+from signedjson.key import encode_verify_key_base64, get_verify_key
+
 from twisted.internet.testing import MemoryReactor
 
+from synapse.api.constants import EventTypes
+from synapse.api.errors import HttpResponseException, SynapseError
+from synapse.crypto.event_signing import compute_event_signature
 from synapse.events import EventBase, make_event_from_dict
+from synapse.handlers.room_policy import POLICY_SERVER_KEY_ID
 from synapse.rest import admin
-from synapse.rest.client import login, room
+from synapse.rest.client import filter, login, room, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.types.handlers.policy_server import RECOMMENDATION_OK, RECOMMENDATION_SPAM
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils import event_injection
@@ -36,14 +41,18 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
         admin.register_servlets,
         login.register_servlets,
         room.register_servlets,
+        filter.register_servlets,
+        sync.register_servlets,
     ]
 
     def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
         # mock out the federation transport client
         self.mock_federation_transport_client = mock.Mock(
-            spec=["get_policy_recommendation_for_pdu"]
+            spec=[
+                "ask_policy_server_to_sign_event",
+            ]
         )
-        self.mock_federation_transport_client.get_policy_recommendation_for_pdu = (
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event = (
             mock.AsyncMock()
         )
         return super().setup_test_homeserver(
@@ -62,6 +71,8 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
             room_creator=self.creator, tok=self.creator_token
         )
         room_version = self.get_success(main_store.get_room_version(self.room_id))
+        self.room_version = room_version
+        self.signing_key = signedjson.key.generate_signing_key("policy_server")
 
         # Create some sample events
         self.spammy_event = make_event_from_dict(
@@ -91,26 +102,50 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
             },
         )
 
-        # Prepare the policy server mock to decide spam vs not spam on those events
-        self.call_count = 0
+        # Mock policy server actions on signing events
+        async def policy_server_signs_event(
+            destination: str, pdu: EventBase, timeout: int | None = None
+        ) -> JsonDict | None:
+            sigs = compute_event_signature(
+                pdu.room_version,
+                pdu.get_dict(),
+                self.OTHER_SERVER_NAME,
+                self.signing_key,
+            )
+            return sigs
 
-        async def get_policy_recommendation_for_pdu(
-            destination: str,
-            pdu: EventBase,
-            timeout: Optional[int] = None,
-        ) -> JsonDict:
-            self.call_count += 1
-            self.assertEqual(destination, self.OTHER_SERVER_NAME)
-            if pdu.event_id == self.spammy_event.event_id:
-                return {"recommendation": RECOMMENDATION_SPAM}
-            elif pdu.event_id == self.not_spammy_event.event_id:
-                return {"recommendation": RECOMMENDATION_OK}
-            else:
-                self.fail("Unexpected event ID")
+        async def policy_server_signs_event_with_wrong_key(
+            destination: str, pdu: EventBase, timeout: int | None = None
+        ) -> JsonDict | None:
+            sk = signedjson.key.generate_signing_key("policy_server")
+            sigs = compute_event_signature(
+                pdu.room_version,
+                pdu.get_dict(),
+                self.OTHER_SERVER_NAME,
+                sk,
+            )
+            return sigs
 
-        self.mock_federation_transport_client.get_policy_recommendation_for_pdu.side_effect = get_policy_recommendation_for_pdu
+        async def policy_server_refuses_to_sign_event(
+            destination: str, pdu: EventBase, timeout: int | None = None
+        ) -> JsonDict | None:
+            return {}
 
-    def _add_policy_server_to_room(self) -> None:
+        async def policy_server_event_sign_error(
+            destination: str, pdu: EventBase, timeout: int | None = None
+        ) -> JsonDict | None:
+            raise HttpResponseException(
+                500, "Internal Server Error", b'{"errcode": "M_UNKNOWN"}'
+            )
+
+        self.policy_server_signs_event = policy_server_signs_event
+        self.policy_server_refuses_to_sign_event = policy_server_refuses_to_sign_event
+        self.policy_server_event_sign_error = policy_server_event_sign_error
+        self.policy_server_signs_event_with_wrong_key = (
+            policy_server_signs_event_with_wrong_key
+        )
+
+    def _add_policy_server_to_room(self, public_key: str | None = None) -> None:
         # Inject a member event into the room
         policy_user_id = f"@policy:{self.OTHER_SERVER_NAME}"
         self.get_success(
@@ -118,12 +153,17 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
                 self.hs, self.room_id, policy_user_id, "join"
             )
         )
+        content: JsonDict = {
+            "via": self.OTHER_SERVER_NAME,
+        }
+        if public_key is not None:
+            content["public_keys"] = {
+                "ed25519": public_key,
+            }
         self.helper.send_state(
             self.room_id,
-            "org.matrix.msc4284.policy",
-            {
-                "via": self.OTHER_SERVER_NAME,
-            },
+            EventTypes.RoomPolicy,
+            content,
             tok=self.creator_token,
             state_key="",
         )
@@ -133,12 +173,11 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
         # case where a room doesn't use a policy server.
         ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
         self.assertEqual(ok, True)
-        self.assertEqual(self.call_count, 0)
 
     def test_empty_policy_event_set(self) -> None:
         self.helper.send_state(
             self.room_id,
-            "org.matrix.msc4284.policy",
+            EventTypes.RoomPolicy,
             {
                 # empty content (no `via`)
             },
@@ -148,12 +187,11 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
 
         ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
         self.assertEqual(ok, True)
-        self.assertEqual(self.call_count, 0)
 
     def test_nonstring_policy_event_set(self) -> None:
         self.helper.send_state(
             self.room_id,
-            "org.matrix.msc4284.policy",
+            EventTypes.RoomPolicy,
             {
                 "via": 42,  # should be a server name
             },
@@ -163,12 +201,11 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
 
         ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
         self.assertEqual(ok, True)
-        self.assertEqual(self.call_count, 0)
 
     def test_self_policy_event_set(self) -> None:
         self.helper.send_state(
             self.room_id,
-            "org.matrix.msc4284.policy",
+            EventTypes.RoomPolicy,
             {
                 # We ignore events when the policy server is ourselves (for now?)
                 "via": (UserID.from_string(self.creator)).domain,
@@ -179,12 +216,11 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
 
         ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
         self.assertEqual(ok, True)
-        self.assertEqual(self.call_count, 0)
 
     def test_invalid_server_policy_event_set(self) -> None:
         self.helper.send_state(
             self.room_id,
-            "org.matrix.msc4284.policy",
+            EventTypes.RoomPolicy,
             {
                 "via": "|this| is *not* a (valid) server name.com",
             },
@@ -194,12 +230,11 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
 
         ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
         self.assertEqual(ok, True)
-        self.assertEqual(self.call_count, 0)
 
     def test_not_in_room_policy_event_set(self) -> None:
         self.helper.send_state(
             self.room_id,
-            "org.matrix.msc4284.policy",
+            EventTypes.RoomPolicy,
             {
                 "via": f"x.{self.OTHER_SERVER_NAME}",
             },
@@ -209,18 +244,225 @@ class RoomPolicyTestCase(unittest.FederatingHomeserverTestCase):
 
         ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
         self.assertEqual(ok, True)
-        self.assertEqual(self.call_count, 0)
+
+    def test_missing_public_key_event_set(self) -> None:
+        """
+        Tests that a missing public key in the `m.room.policy` state event (an invalid
+        configuration) is treated as though there is no policy server configured, thus
+        allowing all events.
+        """
+        self._add_policy_server_to_room()  # no public_key
+
+        ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
+        self.assertEqual(ok, True)
 
     def test_spammy_event_is_spam(self) -> None:
-        self._add_policy_server_to_room()
+        verify_key_str = encode_verify_key_base64(get_verify_key(self.signing_key))
+        self._add_policy_server_to_room(public_key=verify_key_str)
+
+        # Explicitly configure the policy server mock to refuse to sign the event.
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event.return_value = False
 
         ok = self.get_success(self.handler.is_event_allowed(self.spammy_event))
         self.assertEqual(ok, False)
-        self.assertEqual(self.call_count, 1)
 
-    def test_not_spammy_event_is_not_spam(self) -> None:
-        self._add_policy_server_to_room()
+        # Ensure we actually contacted the policy server once for this event.
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event.assert_awaited_once()
 
-        ok = self.get_success(self.handler.is_event_allowed(self.not_spammy_event))
+    def test_signed_event_is_not_spam(self) -> None:
+        verify_key_str = encode_verify_key_base64(get_verify_key(self.signing_key))
+        self._add_policy_server_to_room(public_key=verify_key_str)
+        event = make_event_from_dict(
+            room_version=self.room_version,
+            internal_metadata_dict={},
+            event_dict={
+                "room_id": self.room_id,
+                "type": "m.room.message",
+                "sender": "@spammy:example.org",
+                "content": {
+                    "msgtype": "m.text",
+                    "body": "This is a signed event.",
+                },
+            },
+        )
+
+        # We're going to sign the event and check it marks the event as not-spam, without hitting the
+        # policy server
+        sigs = compute_event_signature(
+            event.room_version,
+            event.get_dict(),
+            self.OTHER_SERVER_NAME,
+            self.signing_key,
+        )
+        event.signatures.update(sigs)
+
+        ok = self.get_success(self.handler.is_event_allowed(event))
         self.assertEqual(ok, True)
-        self.assertEqual(self.call_count, 1)
+
+    def test_ask_policy_server_to_sign_event_ok(self) -> None:
+        verify_key_str = encode_verify_key_base64(get_verify_key(self.signing_key))
+        self._add_policy_server_to_room(public_key=verify_key_str)
+        event = make_event_from_dict(
+            room_version=self.room_version,
+            internal_metadata_dict={},
+            event_dict={
+                "room_id": self.room_id,
+                "type": "m.room.message",
+                "sender": "@spammy:example.org",
+                "content": {
+                    "msgtype": "m.text",
+                    "body": "This is another signed event.",
+                },
+            },
+        )
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event.side_effect = self.policy_server_signs_event
+        self.get_success(
+            self.handler.ask_policy_server_to_sign_event(event, verify=True)
+        )
+        self.assertEqual(len(event.signatures), 1)
+
+    def test_ask_policy_server_to_sign_event_refuses(self) -> None:
+        verify_key_str = encode_verify_key_base64(get_verify_key(self.signing_key))
+        self._add_policy_server_to_room(public_key=verify_key_str)
+        event = make_event_from_dict(
+            room_version=self.room_version,
+            internal_metadata_dict={},
+            event_dict={
+                "room_id": self.room_id,
+                "type": "m.room.message",
+                "sender": "@spammy:example.org",
+                "content": {
+                    "msgtype": "m.text",
+                    "body": "This is spam and is refused.",
+                },
+            },
+        )
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event.side_effect = self.policy_server_refuses_to_sign_event
+        fail = self.get_failure(
+            self.handler.ask_policy_server_to_sign_event(event, verify=True),
+            SynapseError,
+        )
+        self.assertIsInstance(fail.value, SynapseError)
+        self.assertEqual(fail.value.code, 403)
+        self.assertEqual(
+            fail.value.msg,
+            "This event has been rejected as probable spam by the policy server",
+        )
+        self.assertEqual(len(event.signatures), 0)
+
+    def test_ask_policy_server_to_sign_event_cannot_reach(self) -> None:
+        verify_key_str = encode_verify_key_base64(get_verify_key(self.signing_key))
+        self._add_policy_server_to_room(public_key=verify_key_str)
+        event = make_event_from_dict(
+            room_version=self.room_version,
+            internal_metadata_dict={},
+            event_dict={
+                "room_id": self.room_id,
+                "type": "m.room.message",
+                "sender": "@spammy:example.org",
+                "content": {
+                    "msgtype": "m.text",
+                    "body": "This is spam and is refused.",
+                },
+            },
+        )
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event.side_effect = self.policy_server_event_sign_error
+        fail = self.get_failure(
+            self.handler.ask_policy_server_to_sign_event(event, verify=True),
+            SynapseError,
+        )
+        self.assertIsInstance(fail.value, SynapseError)
+        self.assertEqual(fail.value.code, 500)
+        self.assertEqual(len(event.signatures), 0)
+
+    def test_ask_policy_server_to_sign_event_wrong_sig(self) -> None:
+        verify_key_str = encode_verify_key_base64(get_verify_key(self.signing_key))
+        self._add_policy_server_to_room(public_key=verify_key_str)
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event.side_effect = self.policy_server_signs_event_with_wrong_key
+        unverified_event = make_event_from_dict(
+            room_version=self.room_version,
+            internal_metadata_dict={},
+            event_dict={
+                "room_id": self.room_id,
+                "type": "m.room.message",
+                "sender": "@spammy:example.org",
+                "content": {
+                    "msgtype": "m.text",
+                    "body": "This is signed but with the wrong key.",
+                },
+            },
+        )
+        # verify=False so it passes
+        self.get_success(
+            self.handler.ask_policy_server_to_sign_event(unverified_event, verify=False)
+        )
+        self.assertEqual(len(unverified_event.signatures), 1)
+
+        verified_event = make_event_from_dict(
+            room_version=self.room_version,
+            internal_metadata_dict={},
+            event_dict={
+                "room_id": self.room_id,
+                "type": "m.room.message",
+                "sender": "@spammy:example.org",
+                "content": {
+                    "msgtype": "m.text",
+                    "body": "This is signed but with the wrong key.",
+                },
+            },
+        )
+        # verify=True so it fails
+        self.get_failure(
+            self.handler.ask_policy_server_to_sign_event(verified_event, verify=True),
+            SynapseError,
+        )
+
+    def test_policy_server_signatures_end_to_end(self) -> None:
+        verify_key_str = encode_verify_key_base64(get_verify_key(self.signing_key))
+        self._add_policy_server_to_room(public_key=verify_key_str)
+        self.mock_federation_transport_client.ask_policy_server_to_sign_event.side_effect = self.policy_server_signs_event
+        # Send an event and ensure we get a policy server signature on it.
+        resp = self.helper.send_event(
+            self.room_id,
+            "m.room.message",
+            {"body": "honk", "msgtype": "m.text"},
+            tok=self.creator_token,
+        )
+        ev = self._fetch_federation_event(resp["event_id"])
+        assert ev is not None
+        sig = (
+            ev.get("signatures", {})
+            .get(self.OTHER_SERVER_NAME, {})
+            .get(POLICY_SERVER_KEY_ID, None)
+        )
+        self.assertNotEquals(
+            sig,
+            None,
+            f"event did not include policy server signature, signature block = {ev.get('signatures', None)}",
+        )
+
+    def _fetch_federation_event(self, event_id: str) -> JsonDict | None:
+        # Request federation events to see the signatures
+        channel = self.make_request(
+            "POST",
+            "/_matrix/client/v3/user/%s/filter" % (self.creator),
+            {"event_format": "federation"},
+            self.creator_token,
+        )
+        self.assertEqual(channel.code, 200)
+        filter_id = channel.json_body["filter_id"]
+        # Note: we could use `/context`, but given we don't test that neutral events are
+        # delivered over `/sync` anywhere else, might as well implicitly test it here.
+        channel = self.make_request(
+            "GET",
+            "/sync?filter=%s" % filter_id,
+            access_token=self.creator_token,
+        )
+        self.assertEqual(channel.code, 200, channel.result)
+
+        for ev in channel.json_body["rooms"]["join"][self.room_id]["timeline"][
+            "events"
+        ]:
+            if ev["event_id"] == event_id:
+                return ev
+        return None
diff --git a/tests/handlers/test_room_summary.py b/tests/handlers/test_room_summary.py
index 27646d7365..ee65cb1afb 100644
--- a/tests/handlers/test_room_summary.py
+++ b/tests/handlers/test_room_summary.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict, Iterable, List, Optional, Set, Tuple
+from typing import Any, Iterable
 from unittest import mock
 
 from twisted.internet.defer import ensureDeferred
@@ -42,14 +42,14 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
 
 
 def _create_event(
-    room_id: str, order: Optional[Any] = None, origin_server_ts: int = 0
+    room_id: str, order: Any | None = None, origin_server_ts: int = 0
 ) -> mock.Mock:
     result = mock.Mock(name=room_id)
     result.room_id = room_id
@@ -60,7 +60,7 @@ def _create_event(
     return result
 
 
-def _order(*events: mock.Mock) -> List[mock.Mock]:
+def _order(*events: mock.Mock) -> list[mock.Mock]:
     return sorted(events, key=_child_events_comparison_key)
 
 
@@ -151,8 +151,8 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
         space_id: str,
         room_id: str,
         token: str,
-        order: Optional[str] = None,
-        via: Optional[List[str]] = None,
+        order: str | None = None,
+        via: list[str] | None = None,
     ) -> None:
         """Add a child room to a space."""
         if via is None:
@@ -170,7 +170,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
         )
 
     def _assert_hierarchy(
-        self, result: JsonDict, rooms_and_children: Iterable[Tuple[str, Iterable[str]]]
+        self, result: JsonDict, rooms_and_children: Iterable[tuple[str, Iterable[str]]]
     ) -> None:
         """
         Assert that the expected room IDs are in the response.
@@ -393,7 +393,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
         self._assert_hierarchy(result2, [(self.space, [self.room])])
 
     def _create_room_with_join_rule(
-        self, join_rule: str, room_version: Optional[str] = None, **extra_content: Any
+        self, join_rule: str, room_version: str | None = None, **extra_content: Any
     ) -> str:
         """Create a room with the given join rule and add it to the space."""
         room_id = self.helper.create_room_as(
@@ -547,7 +547,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
         )
         # The result should have the space and all of the links, plus some of the
         # rooms and a pagination token.
-        expected: List[Tuple[str, Iterable[str]]] = [(self.space, room_ids)]
+        expected: list[tuple[str, Iterable[str]]] = [(self.space, room_ids)]
         expected += [(room_id, ()) for room_id in room_ids[:6]]
         self._assert_hierarchy(result, expected)
         self.assertIn("next_batch", result)
@@ -646,7 +646,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
                 create_requester(self.user), self.space, max_depth=0
             )
         )
-        expected: List[Tuple[str, Iterable[str]]] = [(spaces[0], [rooms[0], spaces[1]])]
+        expected: list[tuple[str, Iterable[str]]] = [(spaces[0], [rooms[0], spaces[1]])]
         self._assert_hierarchy(result, expected)
 
         # A single additional layer.
@@ -740,7 +740,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
 
         async def summarize_remote_room_hierarchy(
             _self: Any, room: Any, suggested_only: bool
-        ) -> Tuple[Optional[_RoomEntry], Dict[str, JsonDict], Set[str]]:
+        ) -> tuple[_RoomEntry | None, dict[str, JsonDict], set[str]]:
             return requested_room_entry, {subroom: child_room}, set()
 
         # Add a room to the space which is on another server.
@@ -793,7 +793,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
 
         async def summarize_remote_room_hierarchy(
             _self: Any, room: Any, suggested_only: bool
-        ) -> Tuple[Optional[_RoomEntry], Dict[str, JsonDict], Set[str]]:
+        ) -> tuple[_RoomEntry | None, dict[str, JsonDict], set[str]]:
             return requested_room_entry, {fed_subroom: child_room}, set()
 
         expected = [
@@ -921,7 +921,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
 
         async def summarize_remote_room_hierarchy(
             _self: Any, room: Any, suggested_only: bool
-        ) -> Tuple[Optional[_RoomEntry], Dict[str, JsonDict], Set[str]]:
+        ) -> tuple[_RoomEntry | None, dict[str, JsonDict], set[str]]:
             return subspace_room_entry, dict(children_rooms), set()
 
         # Add a room to the space which is on another server.
@@ -985,7 +985,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
 
         async def summarize_remote_room_hierarchy(
             _self: Any, room: Any, suggested_only: bool
-        ) -> Tuple[Optional[_RoomEntry], Dict[str, JsonDict], Set[str]]:
+        ) -> tuple[_RoomEntry | None, dict[str, JsonDict], set[str]]:
             return fed_room_entry, {}, set()
 
         # Add a room to the space which is on another server.
@@ -1120,7 +1120,7 @@ class SpaceSummaryTestCase(unittest.HomeserverTestCase):
 
         async def summarize_remote_room_hierarchy(
             _self: Any, room: Any, suggested_only: bool
-        ) -> Tuple[Optional[_RoomEntry], Dict[str, JsonDict], Set[str]]:
+        ) -> tuple[_RoomEntry | None, dict[str, JsonDict], set[str]]:
             return requested_room_entry, {fed_subroom: child_room}, set()
 
         expected = [
@@ -1233,7 +1233,7 @@ class RoomSummaryTestCase(unittest.HomeserverTestCase):
 
         async def summarize_remote_room_hierarchy(
             _self: Any, room: Any, suggested_only: bool
-        ) -> Tuple[Optional[_RoomEntry], Dict[str, JsonDict], Set[str]]:
+        ) -> tuple[_RoomEntry | None, dict[str, JsonDict], set[str]]:
             return requested_room_entry, {}, set()
 
         with mock.patch(
diff --git a/tests/handlers/test_saml.py b/tests/handlers/test_saml.py
index 98a4276a3a..c2aeab5f7e 100644
--- a/tests/handlers/test_saml.py
+++ b/tests/handlers/test_saml.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, Dict, Optional, Set, Tuple
+from typing import Any
 from unittest.mock import AsyncMock, Mock
 
 import attr
@@ -30,7 +30,7 @@ from synapse.api.errors import RedirectException
 from synapse.module_api import ModuleApi
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase, override_config
 
@@ -61,7 +61,7 @@ BASE_URL = "https://synapse/"
 class FakeAuthnResponse:
     ava = attr.ib(type=dict)
     assertions = attr.ib(type=list, factory=list)
-    in_response_to = attr.ib(type=Optional[str], default=None)
+    in_response_to = attr.ib(type=(str | None), default=None)
 
 
 class TestMappingProvider:
@@ -73,7 +73,7 @@ class TestMappingProvider:
         return None
 
     @staticmethod
-    def get_saml_attributes(config: None) -> Tuple[Set[str], Set[str]]:
+    def get_saml_attributes(config: None) -> tuple[set[str], set[str]]:
         return {"uid"}, {"displayName"}
 
     def get_remote_user_id(
@@ -102,10 +102,10 @@ class TestRedirectMappingProvider(TestMappingProvider):
 
 
 class SamlHandlerTestCase(HomeserverTestCase):
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["public_baseurl"] = BASE_URL
-        saml_config: Dict[str, Any] = {
+        saml_config: dict[str, Any] = {
             "sp_config": {"metadata": {}},
             # Disable grandfathering.
             "grandfathered_mxid_source_attribute": None,
diff --git a/tests/handlers/test_send_email.py b/tests/handlers/test_send_email.py
index 5f7839c82c..eea88cd136 100644
--- a/tests/handlers/test_send_email.py
+++ b/tests/handlers/test_send_email.py
@@ -20,7 +20,7 @@
 #
 
 
-from typing import Callable, List, Tuple, Type, Union
+from typing import Callable
 from unittest.mock import patch
 
 from zope.interface import implementer
@@ -58,18 +58,18 @@ def TestingESMTPTLSClientFactory(
 class _DummyMessageDelivery:
     def __init__(self) -> None:
         # (recipient, message) tuples
-        self.messages: List[Tuple[smtp.Address, bytes]] = []
+        self.messages: list[tuple[smtp.Address, bytes]] = []
 
     def receivedHeader(
         self,
-        helo: Tuple[bytes, bytes],
+        helo: tuple[bytes, bytes],
         origin: smtp.Address,
-        recipients: List[smtp.User],
+        recipients: list[smtp.User],
     ) -> None:
         return None
 
     def validateFrom(
-        self, helo: Tuple[bytes, bytes], origin: smtp.Address
+        self, helo: tuple[bytes, bytes], origin: smtp.Address
     ) -> smtp.Address:
         return origin
 
@@ -89,7 +89,7 @@ class _DummyMessage:
     def __init__(self, delivery: _DummyMessageDelivery, user: smtp.User):
         self._delivery = delivery
         self._user = user
-        self._buffer: List[bytes] = []
+        self._buffer: list[bytes] = []
 
     def lineReceived(self, line: bytes) -> None:
         self._buffer.append(line)
@@ -104,7 +104,7 @@ class _DummyMessage:
 
 
 class SendEmailHandlerTestCaseIPv4(HomeserverTestCase):
-    ip_class: Union[Type[IPv4Address], Type[IPv6Address]] = IPv4Address
+    ip_class: type[IPv4Address] | type[IPv6Address] = IPv4Address
 
     def setUp(self) -> None:
         super().setUp()
diff --git a/tests/handlers/test_sliding_sync.py b/tests/handlers/test_sliding_sync.py
index 8c390f0c57..2293988036 100644
--- a/tests/handlers/test_sliding_sync.py
+++ b/tests/handlers/test_sliding_sync.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import AbstractSet, Dict, Mapping, Optional, Set, Tuple
+from typing import AbstractSet
 from unittest.mock import patch
 
 import attr
@@ -38,15 +38,19 @@ from synapse.handlers.sliding_sync import (
     RoomSyncConfig,
     StateValues,
     _required_state_changes,
+    _RequiredStateChangesReturn,
 )
 from synapse.rest import admin
 from synapse.rest.client import knock, login, room
 from synapse.server import HomeServer
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
 from synapse.types import JsonDict, StateMap, StreamToken, UserID, create_requester
-from synapse.types.handlers.sliding_sync import PerConnectionState, SlidingSyncConfig
+from synapse.types.handlers.sliding_sync import (
+    PerConnectionState,
+    SlidingSyncConfig,
+)
 from synapse.types.state import StateFilter
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.replication._base import BaseMultiWorkerStreamTestCase
@@ -62,7 +66,7 @@ class RoomSyncConfigTestCase(TestCase):
         self,
         actual: RoomSyncConfig,
         expected: RoomSyncConfig,
-        message_prefix: Optional[str] = None,
+        message_prefix: str | None = None,
     ) -> None:
         self.assertEqual(actual.timeline_limit, expected.timeline_limit, message_prefix)
 
@@ -3277,8 +3281,8 @@ class FilterRoomsRelevantForSyncTestCase(HomeserverTestCase):
         self,
         user: UserID,
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
-    ) -> Tuple[Dict[str, RoomsForUserType], AbstractSet[str], AbstractSet[str]]:
+        from_token: StreamToken | None,
+    ) -> tuple[dict[str, RoomsForUserType], AbstractSet[str], AbstractSet[str]]:
         """
         Get the rooms the user should be syncing with
         """
@@ -3614,8 +3618,8 @@ class SortRoomsTestCase(HomeserverTestCase):
         self,
         user: UserID,
         to_token: StreamToken,
-        from_token: Optional[StreamToken],
-    ) -> Tuple[Dict[str, RoomsForUserType], AbstractSet[str], AbstractSet[str]]:
+        from_token: StreamToken | None,
+    ) -> tuple[dict[str, RoomsForUserType], AbstractSet[str], AbstractSet[str]]:
         """
         Get the rooms the user should be syncing with
         """
@@ -3824,15 +3828,14 @@ class SortRoomsTestCase(HomeserverTestCase):
 
 @attr.s(slots=True, auto_attribs=True, frozen=True)
 class RequiredStateChangesTestParameters:
-    previous_required_state_map: Dict[str, Set[str]]
-    request_required_state_map: Dict[str, Set[str]]
+    previous_required_state_map: dict[str, set[str]]
+    request_required_state_map: dict[str, set[str]]
     state_deltas: StateMap[str]
-    expected_with_state_deltas: Tuple[
-        Optional[Mapping[str, AbstractSet[str]]], StateFilter
-    ]
-    expected_without_state_deltas: Tuple[
-        Optional[Mapping[str, AbstractSet[str]]], StateFilter
-    ]
+    expected_with_state_deltas: _RequiredStateChangesReturn
+    expected_without_state_deltas: _RequiredStateChangesReturn
+
+    previously_returned_lazy_user_ids: AbstractSet[str] = frozenset()
+    request_lazy_load_user_ids: AbstractSet[str] = frozenset()
 
 
 class RequiredStateChangesTestCase(unittest.TestCase):
@@ -3848,8 +3851,12 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     request_required_state_map={"type1": {"state_key"}},
                     state_deltas={("type1", "state_key"): "$event_id"},
                     # No changes
-                    expected_with_state_deltas=(None, StateFilter.none()),
-                    expected_without_state_deltas=(None, StateFilter.none()),
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
+                        None, StateFilter.none()
+                    ),
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
+                        None, StateFilter.none()
+                    ),
                 ),
             ),
             (
@@ -3862,14 +3869,14 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         "type2": {"state_key"},
                     },
                     state_deltas={("type2", "state_key"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # We've added a type so we should persist the changed required state
                         # config.
                         {"type1": {"state_key"}, "type2": {"state_key"}},
                         # We should see the new type added
                         StateFilter.from_types([("type2", "state_key")]),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key"}, "type2": {"state_key"}},
                         StateFilter.from_types([("type2", "state_key")]),
                     ),
@@ -3885,7 +3892,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         "type2": {"state_key"},
                     },
                     state_deltas={("type2", "state_key"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # We've added a type so we should persist the changed required state
                         # config.
                         {"type1": {"state_key"}, "type2": {"state_key"}},
@@ -3894,7 +3901,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                             [("type1", "state_key"), ("type2", "state_key")]
                         ),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key"}, "type2": {"state_key"}},
                         StateFilter.from_types(
                             [("type1", "state_key"), ("type2", "state_key")]
@@ -3909,14 +3916,14 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={"type": {"state_key1"}},
                     request_required_state_map={"type": {"state_key1", "state_key2"}},
                     state_deltas={("type", "state_key2"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # We've added a key so we should persist the changed required state
                         # config.
                         {"type": {"state_key1", "state_key2"}},
                         # We should see the new state_keys added
                         StateFilter.from_types([("type", "state_key2")]),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type": {"state_key1", "state_key2"}},
                         StateFilter.from_types([("type", "state_key2")]),
                     ),
@@ -3929,7 +3936,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={"type": {"state_key1"}},
                     request_required_state_map={"type": {"state_key2", "state_key3"}},
                     state_deltas={("type", "state_key2"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # We've added a key so we should persist the changed required state
                         # config.
                         #
@@ -3940,7 +3947,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                             [("type", "state_key2"), ("type", "state_key3")]
                         ),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type": {"state_key1", "state_key2", "state_key3"}},
                         StateFilter.from_types(
                             [("type", "state_key2"), ("type", "state_key3")]
@@ -3964,7 +3971,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     },
                     request_required_state_map={"type1": {"state_key"}},
                     state_deltas={("type2", "state_key"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Remove `type2` since there's been a change to that state,
                         # (persist the change to required state). That way next time,
                         # they request `type2`, we see that we haven't sent it before
@@ -3975,7 +3982,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # `type2` is no longer requested but since that state hasn't
                         # changed, nothing should change (we should still keep track
                         # that we've sent `type2` before).
@@ -3998,7 +4005,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     },
                     request_required_state_map={},
                     state_deltas={("type2", "state_key"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Remove `type2` since there's been a change to that state,
                         # (persist the change to required state). That way next time,
                         # they request `type2`, we see that we haven't sent it before
@@ -4009,7 +4016,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # `type2` is no longer requested but since that state hasn't
                         # changed, nothing should change (we should still keep track
                         # that we've sent `type2` before).
@@ -4029,7 +4036,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={"type": {"state_key1", "state_key2"}},
                     request_required_state_map={"type": {"state_key1"}},
                     state_deltas={("type", "state_key2"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Remove `(type, state_key2)` since there's been a change
                         # to that state (persist the change to required state).
                         # That way next time, they request `(type, state_key2)`, we see
@@ -4041,7 +4048,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # `(type, state_key2)` is no longer requested but since that
                         # state hasn't changed, nothing should change (we should still
                         # keep track that we've sent `(type, state_key1)` and `(type,
@@ -4073,11 +4080,11 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         ("other_type", "state_key"): "$event_id",
                     },
                     # We've added a wildcard, so we persist the change and request everything
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key2"}, StateValues.WILDCARD: {"state_key"}},
                         StateFilter.all(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key2"}, StateValues.WILDCARD: {"state_key"}},
                         StateFilter.all(),
                     ),
@@ -4103,13 +4110,13 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         ("other_type", "state_key"): "$event_id",
                     },
                     # We've removed a type wildcard, so we persist the change but don't request anything
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key2"}},
                         # We don't need to request anything more if they are requesting
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key2"}},
                         # We don't need to request anything more if they are requesting
                         # less state now
@@ -4129,11 +4136,11 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     state_deltas={("type2", "state_key"): "$event_id"},
                     # We've added a wildcard state_key, so we persist the change and
                     # request all of the state for that type
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key"}, "type2": {StateValues.WILDCARD}},
                         StateFilter.from_types([("type2", None)]),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key"}, "type2": {StateValues.WILDCARD}},
                         StateFilter.from_types([("type2", None)]),
                     ),
@@ -4151,7 +4158,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     state_deltas={("type2", "state_key"): "$event_id"},
                     # We've removed a state_key wildcard, so we persist the change and
                     # request nothing
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"state_key"}},
                         # We don't need to request anything more if they are requesting
                         # less state now
@@ -4160,7 +4167,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     # We've removed a state_key wildcard but there have been no matching
                     # state changes, so no changes needed, just persist the
                     # `request_required_state_map` as-is.
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         None,
                         # We don't need to request anything more if they are requesting
                         # less state now
@@ -4180,7 +4187,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     },
                     request_required_state_map={"type1": {"state_key1"}},
                     state_deltas={("type1", "state_key3"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # We've removed some state keys from the type, but only state_key3 was
                         # changed so only that one should be removed.
                         {"type1": {"state_key1", "state_key2"}},
@@ -4188,7 +4195,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # No changes needed, just persist the
                         # `request_required_state_map` as-is
                         None,
@@ -4207,14 +4214,14 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={},
                     request_required_state_map={"type1": {StateValues.ME}},
                     state_deltas={("type1", "@user:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # We've added a type so we should persist the changed required state
                         # config.
                         {"type1": {StateValues.ME}},
                         # We should see the new state_keys added
                         StateFilter.from_types([("type1", "@user:test")]),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {StateValues.ME}},
                         StateFilter.from_types([("type1", "@user:test")]),
                     ),
@@ -4229,7 +4236,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={"type1": {StateValues.ME}},
                     request_required_state_map={},
                     state_deltas={("type1", "@user:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Remove `type1` since there's been a change to that state,
                         # (persist the change to required state). That way next time,
                         # they request `type1`, we see that we haven't sent it before
@@ -4240,7 +4247,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # `type1` is no longer requested but since that state hasn't
                         # changed, nothing should change (we should still keep track
                         # that we've sent `type1` before).
@@ -4260,14 +4267,14 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={},
                     request_required_state_map={"type1": {"@user:test"}},
                     state_deltas={("type1", "@user:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # We've added a type so we should persist the changed required state
                         # config.
                         {"type1": {"@user:test"}},
                         # We should see the new state_keys added
                         StateFilter.from_types([("type1", "@user:test")]),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {"@user:test"}},
                         StateFilter.from_types([("type1", "@user:test")]),
                     ),
@@ -4282,7 +4289,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={"type1": {"@user:test"}},
                     request_required_state_map={},
                     state_deltas={("type1", "@user:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Remove `type1` since there's been a change to that state,
                         # (persist the change to required state). That way next time,
                         # they request `type1`, we see that we haven't sent it before
@@ -4293,7 +4300,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # `type1` is no longer requested but since that state hasn't
                         # changed, nothing should change (we should still keep track
                         # that we've sent `type1` before).
@@ -4313,13 +4320,13 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={},
                     request_required_state_map={EventTypes.Member: {StateValues.LAZY}},
                     state_deltas={(EventTypes.Member, "@user:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # If a "$LAZY" has been added or removed we always update the
                         # required state to what was requested for simplicity.
                         {EventTypes.Member: {StateValues.LAZY}},
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {EventTypes.Member: {StateValues.LAZY}},
                         StateFilter.none(),
                     ),
@@ -4334,7 +4341,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     previous_required_state_map={EventTypes.Member: {StateValues.LAZY}},
                     request_required_state_map={},
                     state_deltas={(EventTypes.Member, "@user:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # If a "$LAZY" has been added or removed we always update the
                         # required state to what was requested for simplicity.
                         {},
@@ -4342,7 +4349,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # less state now
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # `EventTypes.Member` is no longer requested but since that
                         # state hasn't changed, nothing should change (we should still
                         # keep track that we've sent `EventTypes.Member` before).
@@ -4361,41 +4368,40 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                 we're sending down another response without any timeline events.
                 """,
                 RequiredStateChangesTestParameters(
-                    previous_required_state_map={
-                        EventTypes.Member: {
-                            StateValues.LAZY,
-                            "@user2:test",
-                            "@user3:test",
-                        }
-                    },
+                    previous_required_state_map={EventTypes.Member: {StateValues.LAZY}},
                     request_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    previously_returned_lazy_user_ids={"@user2:test", "@user3:test"},
+                    request_lazy_load_user_ids=set(),
                     state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
+                        # The `request_required_state_map` hasn't changed
+                        None,
+                        # We don't need to request anything more if they are requesting
+                        # less state now
+                        StateFilter.none(),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
                         # Remove "@user2:test" since that state has changed and is no
                         # longer being requested anymore. Since something was removed,
                         # we should persist the changed to required state. That way next
                         # time, they request "@user2:test", we see that we haven't sent
                         # it before and send the new state. (we should still keep track
                         # that we've sent specific `EventTypes.Member` before)
-                        {
-                            EventTypes.Member: {
-                                StateValues.LAZY,
-                                "@user3:test",
-                            }
-                        },
-                        # We don't need to request anything more if they are requesting
-                        # less state now
-                        StateFilter.none(),
+                        lazy_members_invalidated={"@user2:test"},
                     ),
-                    expected_without_state_deltas=(
-                        # We're not requesting any specific `EventTypes.Member` now but
-                        # since that state hasn't changed, nothing should change (we
-                        # should still keep track that we've sent specific
-                        # `EventTypes.Member` before).
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
+                        # The `request_required_state_map` hasn't changed
                         None,
                         # We don't need to request anything more if they are requesting
                         # less state now
                         StateFilter.none(),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        # Nothing should change (we should still keep track that
+                        # we've sent specific `EventTypes.Member` before).
+                        lazy_members_invalidated=frozenset(),
                     ),
                 ),
             ),
@@ -4407,50 +4413,37 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                 we're sending down another response with a new event from user4.
                 """,
                 RequiredStateChangesTestParameters(
-                    previous_required_state_map={
-                        EventTypes.Member: {
-                            StateValues.LAZY,
-                            "@user2:test",
-                            "@user3:test",
-                        }
-                    },
-                    request_required_state_map={
-                        EventTypes.Member: {StateValues.LAZY, "@user4:test"}
-                    },
+                    previous_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    request_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    previously_returned_lazy_user_ids={"@user2:test", "@user3:test"},
+                    request_lazy_load_user_ids={"@user4:test"},
                     state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
-                    expected_with_state_deltas=(
-                        # Since "@user4:test" was added, we should persist the changed
-                        # required state config.
-                        #
-                        # Also remove "@user2:test" since that state has changed and is no
-                        # longer being requested anymore. Since something was removed,
-                        # we also should persist the changed to required state. That way next
-                        # time, they request "@user2:test", we see that we haven't sent
-                        # it before and send the new state. (we should still keep track
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
+                        # The `request_required_state_map` hasn't changed
+                        None,
+                        # We should see the new state_keys added
+                        StateFilter.from_types([(EventTypes.Member, "@user4:test")]),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        # Remove "@user2:test" since that state has changed and
+                        # is no longer being requested anymore. Since something
+                        # was removed, we also should persist the changed to
+                        # required state. That way next time, they request
+                        # "@user2:test", we see that we haven't sent it before
+                        # and send the new state. (we should still keep track
                         # that we've sent specific `EventTypes.Member` before)
-                        {
-                            EventTypes.Member: {
-                                StateValues.LAZY,
-                                "@user3:test",
-                                "@user4:test",
-                            }
-                        },
-                        # We should see the new state_keys added
-                        StateFilter.from_types([(EventTypes.Member, "@user4:test")]),
+                        lazy_members_invalidated={"@user2:test"},
                     ),
-                    expected_without_state_deltas=(
-                        # Since "@user4:test" was added, we should persist the changed
-                        # required state config.
-                        {
-                            EventTypes.Member: {
-                                StateValues.LAZY,
-                                "@user2:test",
-                                "@user3:test",
-                                "@user4:test",
-                            }
-                        },
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
+                        # The `request_required_state_map` hasn't changed
+                        None,
                         # We should see the new state_keys added
                         StateFilter.from_types([(EventTypes.Member, "@user4:test")]),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        lazy_members_invalidated=frozenset(),
                     ),
                 ),
             ),
@@ -4464,40 +4457,81 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         EventTypes.Member: {"@user2:test", "@user3:test"}
                     },
                     request_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    previously_returned_lazy_user_ids=frozenset(),
+                    request_lazy_load_user_ids=frozenset(),
                     state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Since `StateValues.LAZY` was added, we should persist the
                         # changed required state config.
-                        #
-                        # Also remove "@user2:test" since that state has changed and is no
-                        # longer being requested anymore. Since something was removed,
-                        # we also should persist the changed to required state. That way next
-                        # time, they request "@user2:test", we see that we haven't sent
-                        # it before and send the new state. (we should still keep track
-                        # that we've sent specific `EventTypes.Member` before)
-                        {
-                            EventTypes.Member: {
-                                StateValues.LAZY,
-                                "@user3:test",
-                            }
-                        },
-                        # We don't need to request anything more if they are requesting
-                        # less state now
+                        {EventTypes.Member: {StateValues.LAZY}},
+                        # No users are being lazy loaded, so nothing to request.
                         StateFilter.none(),
+                        # Remember the fact that we've sent @user3 down before,
+                        # but not @user2 as that has been invalidated.
+                        extra_users_to_add_to_lazy_cache={"@user3:test"},
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # Since `StateValues.LAZY` was added, we should persist the
                         # changed required state config.
-                        {
-                            EventTypes.Member: {
-                                StateValues.LAZY,
-                                "@user2:test",
-                                "@user3:test",
-                            }
-                        },
-                        # We don't need to request anything more if they are requesting
-                        # less state now
+                        {EventTypes.Member: {StateValues.LAZY}},
+                        # No users are being lazy loaded, so nothing to request.
                         StateFilter.none(),
+                        # Remember the fact that we've sent the users down before.
+                        extra_users_to_add_to_lazy_cache={"@user2:test", "@user3:test"},
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
+                    ),
+                ),
+            ),
+            (
+                "state_key_expand_lazy_keep_previous_memberships_need_previous_sent",
+                """
+                Test expanding the `required_state` to lazy-loading room
+                members. If a previously explicit membership is requested then
+                we should not send it again (as it was already sent before).
+                """,
+                RequiredStateChangesTestParameters(
+                    previous_required_state_map={
+                        EventTypes.Member: {"@user2:test", "@user3:test"}
+                    },
+                    request_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    previously_returned_lazy_user_ids=frozenset(),
+                    request_lazy_load_user_ids={"@user3:test"},
+                    state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
+                        # Since `StateValues.LAZY` was added, we should persist the
+                        # changed required state config.
+                        {EventTypes.Member: {StateValues.LAZY}},
+                        # We have already sent @user3 down before.
+                        #
+                        # `@user3:test` is required for lazy loading, but we've
+                        # already sent it down before (due to it being in
+                        # `previous_required_state_map`), so we don't need to
+                        # request it again.
+                        StateFilter.none(),
+                        # Remember the fact that we've sent @user3 down before,
+                        # but not @user2 as that has been invalidated.
+                        extra_users_to_add_to_lazy_cache={"@user3:test"},
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
+                    ),
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
+                        # Since `StateValues.LAZY` was added, we should persist the
+                        # changed required state config.
+                        {EventTypes.Member: {StateValues.LAZY}},
+                        # We have already sent @user3 down before.
+                        #
+                        # `@user3:test` is required for lazy loading, but we've
+                        # already sent it down before (due to it being in
+                        # `previous_required_state_map`), so we don't need to
+                        # request it again.
+                        StateFilter.none(),
+                        # Remember the fact that we've sent the users down before.
+                        extra_users_to_add_to_lazy_cache={"@user2:test", "@user3:test"},
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
                     ),
                 ),
             ),
@@ -4507,36 +4541,33 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                 Test retracting the `required_state` to no longer lazy-loading room members.
                 """,
                 RequiredStateChangesTestParameters(
-                    previous_required_state_map={
-                        EventTypes.Member: {
-                            StateValues.LAZY,
-                            "@user2:test",
-                            "@user3:test",
-                        }
-                    },
+                    previous_required_state_map={EventTypes.Member: {StateValues.LAZY}},
                     request_required_state_map={},
+                    previously_returned_lazy_user_ids={"@user2:test", "@user3:test"},
+                    request_lazy_load_user_ids=set(),
                     state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Remove `EventTypes.Member` since there's been a change to that
-                        # state, (persist the change to required state). That way next
-                        # time, they request `EventTypes.Member`, we see that we haven't
-                        # sent it before and send the new state. (if we were tracking
-                        # that we sent any other state, we should still keep track
-                        # that).
-                        #
-                        # This acts the same as the `simple_remove_type` test. It's
-                        # possible that we could remember the specific `state_keys` that
-                        # we have sent down before but this currently just acts the same
-                        # as if a whole `type` was removed. Perhaps it's good that we
-                        # "garbage collect" and forget what we've sent before for a
-                        # given `type`  when the client stops caring about a certain
-                        # `type`.
+                        # state, (persist the change to required state).
                         {},
                         # We don't need to request anything more if they are requesting
                         # less state now
                         StateFilter.none(),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        # Explicitly remove the now invalidated @user2:test
+                        # membership.
+                        #
+                        # We don't invalidate @user3:test as that membership
+                        # hasn't changed. We continue to store the existing lazy
+                        # members since they might be useful for future
+                        # requests. (Alternatively, we could invalidate all
+                        # members in the room when the client stops lazy
+                        # loading, but we opt to keep track of them).
+                        lazy_members_invalidated={"@user2:test"},
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # `EventTypes.Member` is no longer requested but since that
                         # state hasn't changed, nothing should change (we should still
                         # keep track that we've sent `EventTypes.Member` before).
@@ -4544,13 +4575,20 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         # We don't need to request anything more if they are requesting
                         # less state now
                         StateFilter.none(),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        # Nothing has been invalidated.
+                        lazy_members_invalidated=frozenset(),
                     ),
                 ),
             ),
             (
-                "state_key_retract_lazy_keep_previous_memberships_with_new_memberships",
+                "state_key_retract_lazy_keep_previous_explicit_memberships",
                 """
-                Test retracting the `required_state` to no longer lazy-loading room members.
+                Test removing explicit memberships from the `required_state`
+                when lazy-loading room members tracks previously sent
+                memberships.
                 """,
                 RequiredStateChangesTestParameters(
                     previous_required_state_map={
@@ -4560,39 +4598,144 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                             "@user3:test",
                         }
                     },
-                    request_required_state_map={EventTypes.Member: {"@user4:test"}},
+                    request_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    previously_returned_lazy_user_ids=frozenset(),
+                    request_lazy_load_user_ids={"@user3:test"},
                     state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
+                        # Since an explicit membership was removed, we record
+                        # the new required state config and move them to lazy
+                        # members.
+                        {EventTypes.Member: {StateValues.LAZY}},
+                        # We have already sent @user3 down before.
+                        #
+                        # `@user3:test` is required for lazy loading, but we've
+                        # already sent it down before (due to it being in
+                        # `previous_required_state_map`), so we don't need to
+                        # request it again.
+                        StateFilter.none(),
+                        # Remember the fact that we've sent @user3 down before,
+                        # but not @user2 as that has been invalidated.
+                        extra_users_to_add_to_lazy_cache={"@user3:test"},
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
+                    ),
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
+                        # While some explicit memberships were removed, there were no
+                        # state changes, so we don't need to persist the new required
+                        # state config yet.
+                        None,
+                        # We have already sent @user3 down before.
+                        #
+                        # `@user3:test` is required for lazy loading, but we've
+                        # already sent it down before (due to it being in
+                        # `previous_required_state_map`), so we don't need to
+                        # request it again.
+                        StateFilter.none(),
+                        # Remember the fact that we've sent the users down before.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
+                    ),
+                ),
+            ),
+            (
+                "state_key_retract_lazy_keep_previous_explicit_me_memberships",
+                """
+                Test removing explicit $ME memberships from the `required_state`
+                when lazy-loading room members tracks previously sent
+                memberships.
+                """,
+                RequiredStateChangesTestParameters(
+                    previous_required_state_map={
+                        EventTypes.Member: {
+                            StateValues.LAZY,
+                            StateValues.ME,
+                            "@user2:test",
+                        }
+                    },
+                    request_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    previously_returned_lazy_user_ids=frozenset(),
+                    request_lazy_load_user_ids={"@user:test"},
+                    state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
+                        # Since an explicit membership was removed, we record
+                        # the new required state config and move them to lazy
+                        # members.
+                        {EventTypes.Member: {StateValues.LAZY}},
+                        # We have already sent @user down before.
+                        #
+                        # `@user:test` is required for lazy loading, but we've
+                        # already sent it down before (due to `StateValues.ME`
+                        # being in `previous_required_state_map`), so we don't
+                        # need to request it again.
+                        StateFilter.none(),
+                        # Remember the fact that we've sent @user down before,
+                        # but not @user2 as that has been invalidated.
+                        extra_users_to_add_to_lazy_cache={"@user:test"},
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
+                    ),
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
+                        # While some explicit memberships were removed, there were no
+                        # state changes, so we don't need to persist the new required
+                        # state config yet.
+                        None,
+                        # We have already sent @user down before.
+                        #
+                        # `@user:test` is required for lazy loading, but we've
+                        # already sent it down before (due to `StateValues.ME`
+                        # being in `previous_required_state_map`), so we don't
+                        # need to request it again.
+                        StateFilter.none(),
+                        # No relevant state has changed and we don't persist the
+                        # changed required_state_map, so we don't yet move the
+                        # $ME state to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        # Nothing to invalidate as there are no existing lazy members.
+                        lazy_members_invalidated=frozenset(),
+                    ),
+                ),
+            ),
+            (
+                "state_key_retract_lazy_keep_previous_memberships_with_new_memberships",
+                """
+                Test retracting the `required_state` to no longer lazy-loading room members.
+                """,
+                RequiredStateChangesTestParameters(
+                    previous_required_state_map={EventTypes.Member: {StateValues.LAZY}},
+                    request_required_state_map={EventTypes.Member: {"@user4:test"}},
+                    previously_returned_lazy_user_ids={"@user2:test", "@user3:test"},
+                    request_lazy_load_user_ids=frozenset(),
+                    state_deltas={(EventTypes.Member, "@user2:test"): "$event_id"},
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         # Since "@user4:test" was added, we should persist the changed
                         # required state config.
-                        #
+                        {EventTypes.Member: {"@user4:test"}},
+                        # We should see the new state_keys added
+                        StateFilter.from_types([(EventTypes.Member, "@user4:test")]),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
                         # Also remove "@user2:test" since that state has changed and is no
                         # longer being requested anymore. Since something was removed,
                         # we also should persist the changed to required state. That way next
                         # time, they request "@user2:test", we see that we haven't sent
                         # it before and send the new state. (we should still keep track
                         # that we've sent specific `EventTypes.Member` before)
-                        {
-                            EventTypes.Member: {
-                                "@user3:test",
-                                "@user4:test",
-                            }
-                        },
-                        # We should see the new state_keys added
-                        StateFilter.from_types([(EventTypes.Member, "@user4:test")]),
+                        lazy_members_invalidated={"@user2:test"},
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         # Since "@user4:test" was added, we should persist the changed
                         # required state config.
-                        {
-                            EventTypes.Member: {
-                                "@user2:test",
-                                "@user3:test",
-                                "@user4:test",
-                            }
-                        },
+                        {EventTypes.Member: {"@user4:test"}},
                         # We should see the new state_keys added
                         StateFilter.from_types([(EventTypes.Member, "@user4:test")]),
+                        # Previous request did not include any explicit members,
+                        # so there is no extra users to add to the lazy cache.
+                        extra_users_to_add_to_lazy_cache=frozenset(),
+                        # We don't invalidate user2 as they haven't changed
+                        lazy_members_invalidated=frozenset(),
                     ),
                 ),
             ),
@@ -4613,7 +4756,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     # room required state config to match the request. And since we we're previously
                     # already fetching everything, we don't have to fetch anything now that they've
                     # narrowed.
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {
                             StateValues.WILDCARD: {
                                 "state_key1",
@@ -4623,7 +4766,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         },
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {
                             StateValues.WILDCARD: {
                                 "state_key1",
@@ -4649,11 +4792,11 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     },
                     state_deltas={("type1", "state_key1"): "$event_id"},
                     # We've added a wildcard, so we persist the change and request everything
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {StateValues.WILDCARD: {StateValues.WILDCARD}},
                         StateFilter.all(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {StateValues.WILDCARD: {StateValues.WILDCARD}},
                         StateFilter.all(),
                     ),
@@ -4673,7 +4816,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     # request. And since we we're previously already fetching
                     # everything, we don't have to fetch anything now that they've
                     # narrowed.
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {
                             "type1": {
                                 "state_key1",
@@ -4683,7 +4826,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                         },
                         StateFilter.none(),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {
                             "type1": {
                                 "state_key1",
@@ -4708,11 +4851,11 @@ class RequiredStateChangesTestCase(unittest.TestCase):
                     # update the effective room required state config to match the
                     # request. And we need to request all of the state for that type
                     # because we previously, only sent down a few keys.
-                    expected_with_state_deltas=(
+                    expected_with_state_deltas=_RequiredStateChangesReturn(
                         {"type1": {StateValues.WILDCARD, "state_key2", "state_key3"}},
                         StateFilter.from_types([("type1", None)]),
                     ),
-                    expected_without_state_deltas=(
+                    expected_without_state_deltas=_RequiredStateChangesReturn(
                         {
                             "type1": {
                                 StateValues.WILDCARD,
@@ -4734,42 +4877,66 @@ class RequiredStateChangesTestCase(unittest.TestCase):
         test_parameters: RequiredStateChangesTestParameters,
     ) -> None:
         # Without `state_deltas`
-        changed_required_state_map, added_state_filter = _required_state_changes(
+        state_changes = _required_state_changes(
             user_id="@user:test",
             prev_required_state_map=test_parameters.previous_required_state_map,
             request_required_state_map=test_parameters.request_required_state_map,
+            previously_returned_lazy_user_ids=test_parameters.previously_returned_lazy_user_ids,
+            request_lazy_load_user_ids=test_parameters.request_lazy_load_user_ids,
             state_deltas={},
         )
 
         self.assertEqual(
-            changed_required_state_map,
-            test_parameters.expected_without_state_deltas[0],
+            state_changes.changed_required_state_map,
+            test_parameters.expected_without_state_deltas.changed_required_state_map,
             "changed_required_state_map does not match (without state_deltas)",
         )
         self.assertEqual(
-            added_state_filter,
-            test_parameters.expected_without_state_deltas[1],
+            state_changes.added_state_filter,
+            test_parameters.expected_without_state_deltas.added_state_filter,
             "added_state_filter does not match (without state_deltas)",
         )
+        self.assertEqual(
+            state_changes.lazy_members_invalidated,
+            test_parameters.expected_without_state_deltas.lazy_members_invalidated,
+            "lazy_members_invalidated does not match (without state_deltas)",
+        )
+        self.assertEqual(
+            state_changes.extra_users_to_add_to_lazy_cache,
+            test_parameters.expected_without_state_deltas.extra_users_to_add_to_lazy_cache,
+            "lazy_members_previously_returned does not match (without state_deltas)",
+        )
 
         # With `state_deltas`
-        changed_required_state_map, added_state_filter = _required_state_changes(
+        state_changes = _required_state_changes(
             user_id="@user:test",
             prev_required_state_map=test_parameters.previous_required_state_map,
             request_required_state_map=test_parameters.request_required_state_map,
+            previously_returned_lazy_user_ids=test_parameters.previously_returned_lazy_user_ids,
+            request_lazy_load_user_ids=test_parameters.request_lazy_load_user_ids,
             state_deltas=test_parameters.state_deltas,
         )
 
         self.assertEqual(
-            changed_required_state_map,
-            test_parameters.expected_with_state_deltas[0],
+            state_changes.changed_required_state_map,
+            test_parameters.expected_with_state_deltas.changed_required_state_map,
             "changed_required_state_map does not match (with state_deltas)",
         )
         self.assertEqual(
-            added_state_filter,
-            test_parameters.expected_with_state_deltas[1],
+            state_changes.added_state_filter,
+            test_parameters.expected_with_state_deltas.added_state_filter,
             "added_state_filter does not match (with state_deltas)",
         )
+        self.assertEqual(
+            state_changes.lazy_members_invalidated,
+            test_parameters.expected_with_state_deltas.lazy_members_invalidated,
+            "lazy_members_invalidated does not match (with state_deltas)",
+        )
+        self.assertEqual(
+            state_changes.extra_users_to_add_to_lazy_cache,
+            test_parameters.expected_with_state_deltas.extra_users_to_add_to_lazy_cache,
+            "lazy_members_previously_returned does not match (with state_deltas)",
+        )
 
     @parameterized.expand(
         [
@@ -4785,7 +4952,7 @@ class RequiredStateChangesTestCase(unittest.TestCase):
         self,
         _test_label: str,
         event_type: str,
-        extra_state_keys: Set[str],
+        extra_state_keys: set[str],
     ) -> None:
         """
         Test that we limit the number of state_keys that we remember but always include
@@ -4805,12 +4972,16 @@ class RequiredStateChangesTestCase(unittest.TestCase):
         }
 
         # (function under test)
-        changed_required_state_map, added_state_filter = _required_state_changes(
+        state_changes = _required_state_changes(
             user_id="@user:test",
             prev_required_state_map=previous_required_state_map,
             request_required_state_map=request_required_state_map,
+            previously_returned_lazy_user_ids=frozenset(),
+            request_lazy_load_user_ids=frozenset(),
             state_deltas={},
         )
+        changed_required_state_map = state_changes.changed_required_state_map
+
         assert changed_required_state_map is not None
 
         # We should only remember up to the maximum number of state keys
@@ -4874,12 +5045,16 @@ class RequiredStateChangesTestCase(unittest.TestCase):
         )
 
         # (function under test)
-        changed_required_state_map, added_state_filter = _required_state_changes(
+        state_changes = _required_state_changes(
             user_id="@user:test",
             prev_required_state_map=previous_required_state_map,
             request_required_state_map=request_required_state_map,
+            previously_returned_lazy_user_ids=frozenset(),
+            request_lazy_load_user_ids=frozenset(),
             state_deltas={},
         )
+        changed_required_state_map = state_changes.changed_required_state_map
+
         assert changed_required_state_map is not None
 
         # Should include all of the requested state
diff --git a/tests/handlers/test_sso.py b/tests/handlers/test_sso.py
index 896e4fac9a..95595b8ff9 100644
--- a/tests/handlers/test_sso.py
+++ b/tests/handlers/test_sso.py
@@ -18,7 +18,7 @@
 #
 #
 from http import HTTPStatus
-from typing import BinaryIO, Callable, Dict, List, Optional, Tuple
+from typing import BinaryIO, Callable
 from unittest.mock import Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -27,7 +27,7 @@ from twisted.web.http_headers import Headers
 from synapse.api.errors import Codes, SynapseError
 from synapse.http.client import RawHeaders
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils import SMALL_PNG, FakeResponse
@@ -117,10 +117,10 @@ class TestSSOHandler(unittest.HomeserverTestCase):
 async def mock_get_file(
     url: str,
     output_stream: BinaryIO,
-    max_size: Optional[int] = None,
-    headers: Optional[RawHeaders] = None,
-    is_allowed_content_type: Optional[Callable[[str], bool]] = None,
-) -> Tuple[int, Dict[bytes, List[bytes]], str, int]:
+    max_size: int | None = None,
+    headers: RawHeaders | None = None,
+    is_allowed_content_type: Callable[[str], bool] | None = None,
+) -> tuple[int, dict[bytes, list[bytes]], str, int]:
     fake_response = FakeResponse(code=404)
     if url == "http://my.server/me.png":
         fake_response = FakeResponse(
diff --git a/tests/handlers/test_stats.py b/tests/handlers/test_stats.py
index cd17cd86e0..0072327044 100644
--- a/tests/handlers/test_stats.py
+++ b/tests/handlers/test_stats.py
@@ -18,7 +18,7 @@
 #
 #
 
-from typing import Any, Dict, List, Optional, Tuple, cast
+from typing import Any, cast
 
 from twisted.internet.testing import MemoryReactor
 
@@ -26,7 +26,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.storage.databases.main import stats
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -74,9 +74,9 @@ class StatsRoomTests(unittest.HomeserverTestCase):
             )
         )
 
-    async def get_all_room_state(self) -> List[Optional[str]]:
+    async def get_all_room_state(self) -> list[str | None]:
         rows = cast(
-            List[Tuple[Optional[str]]],
+            list[tuple[str | None]],
             await self.store.db_pool.simple_select_list(
                 "room_stats_state", None, retcols=("topic",)
             ),
@@ -85,7 +85,7 @@ class StatsRoomTests(unittest.HomeserverTestCase):
 
     def _get_current_stats(
         self, stats_type: str, stat_id: str
-    ) -> Optional[Dict[str, Any]]:
+    ) -> dict[str, Any] | None:
         table, id_col = stats.TYPE_TO_TABLE[stats_type]
 
         cols = list(stats.ABSOLUTE_STATS_FIELDS[stats_type])
diff --git a/tests/handlers/test_sync.py b/tests/handlers/test_sync.py
index cea61bed6a..18ec2ca6b6 100644
--- a/tests/handlers/test_sync.py
+++ b/tests/handlers/test_sync.py
@@ -18,7 +18,7 @@
 #
 #
 from http import HTTPStatus
-from typing import Collection, ContextManager, List, Optional
+from typing import Collection, ContextManager
 from unittest.mock import AsyncMock, Mock, patch
 
 from parameterized import parameterized, parameterized_class
@@ -37,7 +37,6 @@ from synapse.handlers.sync import (
     SyncConfig,
     SyncRequestKey,
     SyncResult,
-    SyncVersion,
     TimelineBatch,
 )
 from synapse.rest import admin
@@ -51,7 +50,7 @@ from synapse.types import (
     UserID,
     create_requester,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 import tests.unittest
 import tests.utils
@@ -113,7 +112,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 requester,
                 sync_config,
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -124,7 +122,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 requester,
                 sync_config,
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             ),
             ResourceLimitError,
@@ -142,7 +139,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 requester,
                 sync_config,
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             ),
             ResourceLimitError,
@@ -167,7 +163,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                 sync_config=generate_sync_config(
                     user, device_id="dev", use_state_after=self.use_state_after
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -203,7 +198,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                 sync_config=generate_sync_config(
                     user, use_state_after=self.use_state_after
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -218,7 +212,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                 sync_config=generate_sync_config(
                     user, device_id="dev", use_state_after=self.use_state_after
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=initial_result.next_batch,
             )
@@ -252,7 +245,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                 sync_config=generate_sync_config(
                     user, use_state_after=self.use_state_after
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -267,7 +259,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                 sync_config=generate_sync_config(
                     user, device_id="dev", use_state_after=self.use_state_after
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=initial_result.next_batch,
             )
@@ -310,7 +301,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 create_requester(owner),
                 generate_sync_config(owner, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -336,7 +326,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 eve_requester,
                 eve_sync_config,
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -363,7 +352,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 eve_requester,
                 eve_sync_config,
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=eve_sync_after_ban.next_batch,
             )
@@ -376,7 +364,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 eve_requester,
                 eve_sync_config,
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=None,
             )
@@ -411,7 +398,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 alice_requester,
                 generate_sync_config(alice, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -441,7 +427,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                     ),
                     use_state_after=self.use_state_after,
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=initial_sync_result.next_batch,
             )
@@ -487,7 +472,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 alice_requester,
                 generate_sync_config(alice, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -527,7 +511,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                     ),
                     use_state_after=self.use_state_after,
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=initial_sync_result.next_batch,
             )
@@ -576,7 +559,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 alice_requester,
                 generate_sync_config(alice, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -603,7 +585,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                     ),
                     use_state_after=self.use_state_after,
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=initial_sync_result.next_batch,
             )
@@ -643,7 +624,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                     ),
                     use_state_after=self.use_state_after,
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=incremental_sync.next_batch,
             )
@@ -717,7 +697,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 alice_requester,
                 generate_sync_config(alice, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -743,7 +722,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                     ),
                     use_state_after=self.use_state_after,
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -769,7 +747,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 alice_requester,
                 generate_sync_config(alice, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=initial_sync_result.next_batch,
             )
@@ -833,7 +810,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 bob_requester,
                 generate_sync_config(bob, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -867,7 +843,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
                     filter_collection=FilterCollection(self.hs, filter_dict),
                     use_state_after=self.use_state_after,
                 ),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=None if initial_sync else initial_sync_result.next_batch,
             )
@@ -897,7 +872,7 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             # ... And the state should be empty
             self.assertEqual(sync_room_result.state, {})
 
-    def _patch_get_latest_events(self, latest_events: List[str]) -> ContextManager:
+    def _patch_get_latest_events(self, latest_events: list[str]) -> ContextManager:
         """Monkey-patch `get_prev_events_for_room`
 
         Returns a context manager which will replace the implementation of
@@ -918,7 +893,7 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
         federation_event_handler = self.hs.get_federation_event_handler()
 
         async def _check_event_auth(
-            origin: Optional[str], event: EventBase, context: EventContext
+            origin: str | None, event: EventBase, context: EventContext
         ) -> None:
             pass
 
@@ -927,7 +902,7 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
 
         async def _check_sigs_and_hash_for_pulled_events_and_fetch(
             dest: str, pdus: Collection[EventBase], room_version: RoomVersion
-        ) -> List[EventBase]:
+        ) -> list[EventBase]:
             return list(pdus)
 
         self.client._check_sigs_and_hash_for_pulled_events_and_fetch = (  # type: ignore[method-assign]
@@ -967,7 +942,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 create_requester(user),
                 generate_sync_config(user, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -1016,7 +990,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 create_requester(user2),
                 generate_sync_config(user2, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -1042,7 +1015,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 create_requester(user),
                 generate_sync_config(user, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
             )
         )
@@ -1079,7 +1051,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 create_requester(user),
                 generate_sync_config(user, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=since_token,
                 timeout=0,
@@ -1134,7 +1105,6 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
             self.sync_handler.wait_for_sync_for_user(
                 create_requester(user),
                 generate_sync_config(user, use_state_after=self.use_state_after),
-                sync_version=SyncVersion.SYNC_V2,
                 request_key=generate_request_key(),
                 since_token=since_token,
                 timeout=0,
@@ -1147,8 +1117,8 @@ class SyncTestCase(tests.unittest.HomeserverTestCase):
 
 def generate_sync_config(
     user_id: str,
-    device_id: Optional[str] = "device_id",
-    filter_collection: Optional[FilterCollection] = None,
+    device_id: str | None = "device_id",
+    filter_collection: FilterCollection | None = None,
     use_state_after: bool = False,
 ) -> SyncConfig:
     """Generate a sync config (with a unique request key).
diff --git a/tests/handlers/test_typing.py b/tests/handlers/test_typing.py
index 614b12c62a..623eef0ecb 100644
--- a/tests/handlers/test_typing.py
+++ b/tests/handlers/test_typing.py
@@ -21,7 +21,6 @@
 
 
 import json
-from typing import Dict, List, Set
 from unittest.mock import ANY, AsyncMock, Mock, call
 
 from netaddr import IPSet
@@ -36,7 +35,7 @@ from synapse.handlers.typing import FORGET_TIMEOUT, TypingWriterHandler
 from synapse.http.federation.matrix_federation_agent import MatrixFederationAgent
 from synapse.server import HomeServer
 from synapse.types import JsonDict, Requester, StreamKeyType, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import ThreadedMemoryReactorClock
@@ -79,15 +78,17 @@ class TypingNotificationsTestCase(unittest.HomeserverTestCase):
     ) -> HomeServer:
         # we mock out the keyring so as to skip the authentication check on the
         # federation API call.
-        mock_keyring = Mock(spec=["verify_json_for_server"])
+        mock_keyring = Mock(spec=["verify_json_for_server", "shutdown"])
         mock_keyring.verify_json_for_server = AsyncMock(return_value=True)
+        mock_keyring.shutdown = Mock()
 
         # we mock out the federation client too
         self.mock_federation_client = AsyncMock(spec=["put_json"])
         self.mock_federation_client.put_json.return_value = (200, "OK")
         self.mock_federation_client.agent = MatrixFederationAgent(
             server_name="OUR_STUB_HOMESERVER_NAME",
-            reactor=reactor,
+            reactor=self.reactor,
+            clock=self.clock,
             tls_client_options_factory=None,
             user_agent=b"SynapseInTrialTest/0.0.0",
             ip_allowlist=None,
@@ -96,7 +97,7 @@ class TypingNotificationsTestCase(unittest.HomeserverTestCase):
         )
 
         # the tests assume that we are starting at unix time 1000
-        reactor.pump((1000,))
+        self.reactor.pump((1000,))
 
         self.mock_hs_notifier = Mock()
         hs = self.setup_test_homeserver(
@@ -108,7 +109,7 @@ class TypingNotificationsTestCase(unittest.HomeserverTestCase):
 
         return hs
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         d = super().create_resource_dict()
         d["/_matrix/federation"] = TransportLayerServer(self.hs)
         return d
@@ -141,7 +142,7 @@ class TypingNotificationsTestCase(unittest.HomeserverTestCase):
             return_value=None
         )
 
-        self.room_members: List[UserID] = []
+        self.room_members: list[UserID] = []
 
         async def check_user_in_room(room_id: str, requester: Requester) -> None:
             if requester.user.to_string() not in [
@@ -161,7 +162,7 @@ class TypingNotificationsTestCase(unittest.HomeserverTestCase):
             side_effect=check_host_in_room
         )
 
-        async def get_current_hosts_in_room(room_id: str) -> Set[str]:
+        async def get_current_hosts_in_room(room_id: str) -> set[str]:
             return {member.domain for member in self.room_members}
 
         hs.get_storage_controllers().state.get_current_hosts_in_room = Mock(  # type: ignore[method-assign]
@@ -172,7 +173,7 @@ class TypingNotificationsTestCase(unittest.HomeserverTestCase):
             side_effect=get_current_hosts_in_room
         )
 
-        async def get_users_in_room(room_id: str) -> Set[str]:
+        async def get_users_in_room(room_id: str) -> set[str]:
             return {str(u) for u in self.room_members}
 
         self.datastore.get_users_in_room = Mock(side_effect=get_users_in_room)
@@ -543,7 +544,7 @@ class TypingNotificationsTestCase(unittest.HomeserverTestCase):
         )
         self.assertEqual(rows, [(2, [ROOM_ID, []])])
 
-        self.reactor.advance(FORGET_TIMEOUT)
+        self.reactor.advance(FORGET_TIMEOUT.as_secs())
 
         rows, _, _ = self.get_success(
             self.handler.get_all_typing_updates(
diff --git a/tests/handlers/test_user_directory.py b/tests/handlers/test_user_directory.py
index 7458fe0885..f50fa1f4a0 100644
--- a/tests/handlers/test_user_directory.py
+++ b/tests/handlers/test_user_directory.py
@@ -17,7 +17,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Tuple
+from typing import Any
 from unittest.mock import AsyncMock, Mock, patch
 from urllib.parse import quote
 
@@ -32,7 +32,7 @@ from synapse.rest.client import login, register, room, user_directory
 from synapse.server import HomeServer
 from synapse.storage.roommember import ProfileInfo
 from synapse.types import JsonDict, UserID, UserProfile, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.storage.test_user_directory import GetUserDirectoryTables
@@ -313,7 +313,7 @@ class UserDirectoryTestCase(unittest.HomeserverTestCase):
 
     def _create_rooms_and_inject_memberships(
         self, creator: str, token: str, joiner: str
-    ) -> Tuple[str, str]:
+    ) -> tuple[str, str]:
         """Create a public and private room as a normal user.
         Then get the `joiner` into those rooms.
         """
diff --git a/tests/handlers/test_worker_lock.py b/tests/handlers/test_worker_lock.py
index 3d3904eac7..61ff51ff92 100644
--- a/tests/handlers/test_worker_lock.py
+++ b/tests/handlers/test_worker_lock.py
@@ -26,7 +26,7 @@ from twisted.internet import defer
 from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.replication._base import BaseMultiWorkerStreamTestCase
diff --git a/tests/http/__init__.py b/tests/http/__init__.py
index 3c20e5e442..b19a484004 100644
--- a/tests/http/__init__.py
+++ b/tests/http/__init__.py
@@ -19,7 +19,6 @@
 #
 import os.path
 import subprocess
-from typing import List
 
 from incremental import Version
 from zope.interface import implementer
@@ -85,7 +84,7 @@ subjectAltName = %(sanentries)s
 """
 
 
-def create_test_cert_file(sanlist: List[bytes]) -> str:
+def create_test_cert_file(sanlist: list[bytes]) -> str:
     """build an x509 certificate file
 
     Args:
@@ -151,7 +150,7 @@ class TestServerTLSConnectionFactory:
     """An SSL connection creator which returns connections which present a certificate
     signed by our test CA."""
 
-    def __init__(self, sanlist: List[bytes]):
+    def __init__(self, sanlist: list[bytes]):
         """
         Args:
             sanlist: a list of subjectAltName values for the cert
@@ -166,7 +165,7 @@ class TestServerTLSConnectionFactory:
 
 
 def wrap_server_factory_for_tls(
-    factory: IProtocolFactory, clock: IReactorTime, sanlist: List[bytes]
+    factory: IProtocolFactory, clock: IReactorTime, sanlist: list[bytes]
 ) -> TLSMemoryBIOFactory:
     """Wrap an existing Protocol Factory with a test TLSMemoryBIOFactory
 
diff --git a/tests/http/federation/test_matrix_federation_agent.py b/tests/http/federation/test_matrix_federation_agent.py
index 12428e64a9..49ecaa30ff 100644
--- a/tests/http/federation/test_matrix_federation_agent.py
+++ b/tests/http/federation/test_matrix_federation_agent.py
@@ -20,7 +20,7 @@
 import base64
 import logging
 import os
-from typing import Generator, List, Optional, cast
+from typing import Generator, cast
 from unittest.mock import AsyncMock, call, patch
 
 import treq
@@ -65,7 +65,7 @@ from synapse.util.caches.ttlcache import TTLCache
 
 from tests import unittest
 from tests.http import dummy_address, get_test_ca_cert_file, wrap_server_factory_for_tls
-from tests.server import FakeTransport, ThreadedMemoryReactorClock
+from tests.server import FakeTransport, get_clock
 from tests.utils import checked_cast, default_config
 
 logger = logging.getLogger(__name__)
@@ -73,7 +73,7 @@ logger = logging.getLogger(__name__)
 
 class MatrixFederationAgentTests(unittest.TestCase):
     def setUp(self) -> None:
-        self.reactor = ThreadedMemoryReactorClock()
+        self.reactor, self.clock = get_clock()
 
         self.mock_resolver = AsyncMock(spec=SrvResolver)
 
@@ -85,7 +85,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
 
         self.tls_factory = FederationPolicyForHTTPS(config)
 
-        self.well_known_cache: TTLCache[bytes, Optional[bytes]] = TTLCache(
+        self.well_known_cache: TTLCache[bytes, bytes | None] = TTLCache(
             cache_name="test_cache",
             server_name="test_server",
             timer=self.reactor.seconds,
@@ -98,6 +98,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
         self.well_known_resolver = WellKnownResolver(
             server_name="OUR_STUB_HOMESERVER_NAME",
             reactor=self.reactor,
+            clock=self.clock,
             agent=Agent(self.reactor, contextFactory=self.tls_factory),
             user_agent=b"test-agent",
             well_known_cache=self.well_known_cache,
@@ -108,8 +109,8 @@ class MatrixFederationAgentTests(unittest.TestCase):
         self,
         client_factory: IProtocolFactory,
         ssl: bool = True,
-        expected_sni: Optional[bytes] = None,
-        tls_sanlist: Optional[List[bytes]] = None,
+        expected_sni: bytes | None = None,
+        tls_sanlist: list[bytes] | None = None,
     ) -> HTTPChannel:
         """Builds a test server, and completes the outgoing client connection
         Args:
@@ -200,7 +201,10 @@ class MatrixFederationAgentTests(unittest.TestCase):
         """
         Sends a simple GET request via the agent, and checks its logcontext management
         """
-        with LoggingContext("one") as context:
+        with LoggingContext(
+            name="one",
+            server_name="test_server",
+        ) as context:
             fetch_d: Deferred[IResponse] = self.agent.request(b"GET", uri)
 
             # Nothing happened yet
@@ -224,7 +228,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
         client_factory: IProtocolFactory,
         expected_sni: bytes,
         content: bytes,
-        response_headers: Optional[dict] = None,
+        response_headers: dict | None = None,
     ) -> HTTPChannel:
         """Handle an outgoing HTTPs connection: wire it up to a server, check that the
         request is for a .well-known, and send the response.
@@ -253,7 +257,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
         self,
         request: Request,
         content: bytes,
-        headers: Optional[dict] = None,
+        headers: dict | None = None,
     ) -> None:
         """Check that an incoming request looks like a valid .well-known request, and
         send back the response.
@@ -277,6 +281,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
         return MatrixFederationAgent(
             server_name="OUR_STUB_HOMESERVER_NAME",
             reactor=cast(ISynapseReactor, self.reactor),
+            clock=self.clock,
             tls_client_options_factory=self.tls_factory,
             user_agent=b"test-agent",  # Note that this is unused since _well_known_resolver is provided.
             ip_allowlist=IPSet(),
@@ -392,7 +397,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
     def _do_get_via_proxy(
         self,
         expect_proxy_ssl: bool = False,
-        expected_auth_credentials: Optional[bytes] = None,
+        expected_auth_credentials: bytes | None = None,
     ) -> None:
         """Send a https federation request via an agent and check that it is correctly
             received at the proxy and client. The proxy can use either http or https.
@@ -1021,6 +1026,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
         agent = MatrixFederationAgent(
             server_name="OUR_STUB_HOMESERVER_NAME",
             reactor=self.reactor,
+            clock=self.clock,
             tls_client_options_factory=tls_factory,
             user_agent=b"test-agent",  # This is unused since _well_known_resolver is passed below.
             ip_allowlist=IPSet(),
@@ -1030,6 +1036,7 @@ class MatrixFederationAgentTests(unittest.TestCase):
             _well_known_resolver=WellKnownResolver(
                 server_name="OUR_STUB_HOMESERVER_NAME",
                 reactor=cast(ISynapseReactor, self.reactor),
+                clock=self.clock,
                 agent=Agent(self.reactor, contextFactory=tls_factory),
                 user_agent=b"test-agent",
                 well_known_cache=self.well_known_cache,
diff --git a/tests/http/federation/test_srv_resolver.py b/tests/http/federation/test_srv_resolver.py
index ffcbf4b3ca..54f3168a01 100644
--- a/tests/http/federation/test_srv_resolver.py
+++ b/tests/http/federation/test_srv_resolver.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict, Generator, List, Tuple, cast
+from typing import Generator, cast
 from unittest.mock import Mock
 
 from twisted.internet import defer
@@ -30,7 +30,7 @@ from synapse.http.federation.srv_resolver import Server, SrvResolver
 from synapse.logging.context import LoggingContext, current_context
 
 from tests import unittest
-from tests.utils import MockClock
+from tests.server import get_clock
 
 
 class SrvResolverTestCase(unittest.TestCase):
@@ -44,17 +44,20 @@ class SrvResolverTestCase(unittest.TestCase):
             type=dns.SRV, payload=dns.Record_SRV(target=host_name)
         )
 
-        result_deferred: "Deferred[Tuple[List[dns.RRHeader], None, None]]" = Deferred()
+        result_deferred: "Deferred[tuple[list[dns.RRHeader], None, None]]" = Deferred()
         dns_client_mock.lookupService.return_value = result_deferred
 
-        cache: Dict[bytes, List[Server]] = {}
+        cache: dict[bytes, list[Server]] = {}
         resolver = SrvResolver(dns_client=dns_client_mock, cache=cache)
 
         @defer.inlineCallbacks
-        def do_lookup() -> Generator["Deferred[object]", object, List[Server]]:
-            with LoggingContext("one") as ctx:
+        def do_lookup() -> Generator["Deferred[object]", object, list[Server]]:
+            with LoggingContext(
+                name="one",
+                server_name="test_server",
+            ) as ctx:
                 resolve_d = resolver.resolve_service(service_name)
-                result: List[Server]
+                result: list[Server]
                 result = yield defer.ensureDeferred(resolve_d)  # type: ignore[assignment]
 
                 # should have restored our context
@@ -92,7 +95,7 @@ class SrvResolverTestCase(unittest.TestCase):
         cache = {service_name: [cast(Server, entry)]}
         resolver = SrvResolver(dns_client=dns_client_mock, cache=cache)
 
-        servers: List[Server]
+        servers: list[Server]
         servers = yield defer.ensureDeferred(resolver.resolve_service(service_name))  # type: ignore[assignment]
 
         dns_client_mock.lookupService.assert_called_once_with(service_name)
@@ -102,7 +105,7 @@ class SrvResolverTestCase(unittest.TestCase):
 
     @defer.inlineCallbacks
     def test_from_cache(self) -> Generator["Deferred[object]", object, None]:
-        clock = MockClock()
+        reactor, clock = get_clock()
 
         dns_client_mock = Mock(spec_set=["lookupService"])
         dns_client_mock.lookupService = Mock(spec_set=[])
@@ -119,7 +122,7 @@ class SrvResolverTestCase(unittest.TestCase):
             dns_client=dns_client_mock, cache=cache, get_time=clock.time
         )
 
-        servers: List[Server]
+        servers: list[Server]
         servers = yield defer.ensureDeferred(resolver.resolve_service(service_name))  # type: ignore[assignment]
 
         self.assertFalse(dns_client_mock.lookupService.called)
@@ -135,7 +138,7 @@ class SrvResolverTestCase(unittest.TestCase):
 
         service_name = b"test_service.example.com"
 
-        cache: Dict[bytes, List[Server]] = {}
+        cache: dict[bytes, list[Server]] = {}
         resolver = SrvResolver(dns_client=dns_client_mock, cache=cache)
 
         with self.assertRaises(error.DNSServerError):
@@ -149,10 +152,10 @@ class SrvResolverTestCase(unittest.TestCase):
 
         service_name = b"test_service.example.com"
 
-        cache: Dict[bytes, List[Server]] = {}
+        cache: dict[bytes, list[Server]] = {}
         resolver = SrvResolver(dns_client=dns_client_mock, cache=cache)
 
-        servers: List[Server]
+        servers: list[Server]
         servers = yield defer.ensureDeferred(resolver.resolve_service(service_name))  # type: ignore[assignment]
 
         self.assertEqual(len(servers), 0)
@@ -164,10 +167,10 @@ class SrvResolverTestCase(unittest.TestCase):
         """
         service_name = b"test_service.example.com"
 
-        lookup_deferred: "Deferred[Tuple[List[dns.RRHeader], None, None]]" = Deferred()
+        lookup_deferred: "Deferred[tuple[list[dns.RRHeader], None, None]]" = Deferred()
         dns_client_mock = Mock()
         dns_client_mock.lookupService.return_value = lookup_deferred
-        cache: Dict[bytes, List[Server]] = {}
+        cache: dict[bytes, list[Server]] = {}
         resolver = SrvResolver(dns_client=dns_client_mock, cache=cache)
 
         # Old versions of Twisted don't have an ensureDeferred in failureResultOf.
@@ -190,10 +193,10 @@ class SrvResolverTestCase(unittest.TestCase):
         """
         service_name = b"test_service.example.com"
 
-        lookup_deferred: "Deferred[Tuple[List[dns.RRHeader], None, None]]" = Deferred()
+        lookup_deferred: "Deferred[tuple[list[dns.RRHeader], None, None]]" = Deferred()
         dns_client_mock = Mock()
         dns_client_mock.lookupService.return_value = lookup_deferred
-        cache: Dict[bytes, List[Server]] = {}
+        cache: dict[bytes, list[Server]] = {}
         resolver = SrvResolver(dns_client=dns_client_mock, cache=cache)
 
         # Old versions of Twisted don't have an ensureDeferred in successResultOf.
diff --git a/tests/http/server/_base.py b/tests/http/server/_base.py
index 393f3ab0bd..41dcc0e095 100644
--- a/tests/http/server/_base.py
+++ b/tests/http/server/_base.py
@@ -26,14 +26,8 @@ from typing import (
     Any,
     Callable,
     ContextManager,
-    Dict,
     Generator,
-    List,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
 )
 from unittest import mock
 from unittest.mock import Mock
@@ -65,12 +59,12 @@ logger = logging.getLogger(__name__)
 T = TypeVar("T")
 
 
-def test_disconnect(
+def disconnect_and_assert(
     reactor: MemoryReactorClock,
     channel: FakeChannel,
     expect_cancellation: bool,
-    expected_body: Union[bytes, JsonDict],
-    expected_code: Optional[int] = None,
+    expected_body: bytes | JsonDict,
+    expected_code: int | None = None,
 ) -> None:
     """Disconnects an in-flight request and checks the response.
 
@@ -150,9 +144,9 @@ def make_request_with_cancellation_test(
     site: Site,
     method: str,
     path: str,
-    content: Union[bytes, str, JsonDict] = b"",
+    content: bytes | str | JsonDict = b"",
     *,
-    token: Optional[str] = None,
+    token: str | None = None,
 ) -> FakeChannel:
     """Performs a request repeatedly, disconnecting at successive `await`s, until
     one completes.
@@ -208,7 +202,7 @@ def make_request_with_cancellation_test(
 
     # The set of previously seen `await`s.
     # Each element is a stringified stack trace.
-    seen_awaits: Set[Tuple[str, ...]] = set()
+    seen_awaits: set[tuple[str, ...]] = set()
 
     _log_for_request(
         0, f"Running make_request_with_cancellation_test for {test_name}..."
@@ -337,7 +331,7 @@ class Deferred__await__Patch:
             deferred_patch.unblock_awaits()
     """
 
-    def __init__(self, seen_awaits: Set[Tuple[str, ...]], request_number: int):
+    def __init__(self, seen_awaits: set[tuple[str, ...]], request_number: int):
         """
         Args:
             seen_awaits: The set of stack traces of `await`s that have been previously
@@ -365,10 +359,10 @@ class Deferred__await__Patch:
         # unresolved `Deferred` and return it out of `Deferred.__await__` /
         # `coroutine.send()`. We have to resolve it later, in case the `await`ing
         # coroutine is part of some shared processing, such as `@cached`.
-        self._to_unblock: Dict[Deferred, Union[object, Failure]] = {}
+        self._to_unblock: dict[Deferred, object | Failure] = {}
 
         # The last stack we logged.
-        self._previous_stack: List[inspect.FrameInfo] = []
+        self._previous_stack: list[inspect.FrameInfo] = []
 
     def patch(self) -> ContextManager[Mock]:
         """Returns a context manager which patches `Deferred.__await__`."""
@@ -502,13 +496,13 @@ def _log_for_request(request_number: int, message: str) -> None:
     """Logs a message for an iteration of `make_request_with_cancellation_test`."""
     # We want consistent alignment when logging stack traces, so ensure the logging
     # context has a fixed width name.
-    with LoggingContext(name=f"request-{request_number:<2}"):
+    with LoggingContext(name=f"request-{request_number:<2}", server_name="test_server"):
         logger.info(message)
 
 
 def _log_await_stack(
-    stack: List[inspect.FrameInfo],
-    previous_stack: List[inspect.FrameInfo],
+    stack: list[inspect.FrameInfo],
+    previous_stack: list[inspect.FrameInfo],
     request_number: int,
     note: str,
 ) -> None:
@@ -566,7 +560,7 @@ def _format_stack_frame(frame_info: inspect.FrameInfo) -> str:
     )
 
 
-def _get_stack(skip_frames: int) -> List[inspect.FrameInfo]:
+def _get_stack(skip_frames: int) -> list[inspect.FrameInfo]:
     """Captures the stack for a request.
 
     Skips any twisted frames and stops at `JsonResource.wrapped_async_request_handler`.
@@ -622,6 +616,6 @@ def _get_stack_frame_method_name(frame_info: inspect.FrameInfo) -> str:
     return method_name
 
 
-def _hash_stack(stack: List[inspect.FrameInfo]) -> Tuple[str, ...]:
+def _hash_stack(stack: list[inspect.FrameInfo]) -> tuple[str, ...]:
     """Turns a stack into a hashable value that can be put into a set."""
     return tuple(_format_stack_frame(frame) for frame in stack)
diff --git a/tests/http/test_client.py b/tests/http/test_client.py
index a02f6fc728..5c8c1220e4 100644
--- a/tests/http/test_client.py
+++ b/tests/http/test_client.py
@@ -20,7 +20,6 @@
 #
 
 from io import BytesIO
-from typing import Tuple, Union
 from unittest.mock import Mock
 
 from netaddr import IPSet
@@ -58,8 +57,8 @@ class ReadMultipartResponseTests(TestCase):
     redirect_data = b"\r\n\r\n--6067d4698f8d40a0a794ea7d7379d53a\r\nContent-Type: application/json\r\n\r\n{}\r\n--6067d4698f8d40a0a794ea7d7379d53a\r\nLocation: https://cdn.example.org/ab/c1/2345.txt\r\n\r\n--6067d4698f8d40a0a794ea7d7379d53a--\r\n\r\n"
 
     def _build_multipart_response(
-        self, response_length: Union[int, str], max_length: int
-    ) -> Tuple[
+        self, response_length: int | str, max_length: int
+    ) -> tuple[
         BytesIO,
         "Deferred[MultipartResponse]",
         _MultipartParserProtocol,
@@ -208,8 +207,8 @@ class ReadMultipartResponseTests(TestCase):
 
 class ReadBodyWithMaxSizeTests(TestCase):
     def _build_response(
-        self, length: Union[int, str] = UNKNOWN_LENGTH
-    ) -> Tuple[
+        self, length: int | str = UNKNOWN_LENGTH
+    ) -> tuple[
         BytesIO,
         "Deferred[int]",
         _DiscardBodyWithMaxSizeProtocol,
diff --git a/tests/http/test_matrixfederationclient.py b/tests/http/test_matrixfederationclient.py
index 224883b635..4792bdc9bc 100644
--- a/tests/http/test_matrixfederationclient.py
+++ b/tests/http/test_matrixfederationclient.py
@@ -18,7 +18,7 @@
 #
 #
 import io
-from typing import Any, Dict, Generator
+from typing import Any, Generator
 from unittest.mock import ANY, Mock, create_autospec
 
 from netaddr import IPSet
@@ -48,7 +48,7 @@ from synapse.logging.context import (
     current_context,
 )
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
 from tests.server import FakeTransport
@@ -63,10 +63,6 @@ def check_logcontext(context: LoggingContextOrSentinel) -> None:
 
 
 class FederationClientTests(HomeserverTestCase):
-    def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
-        hs = self.setup_test_homeserver(reactor=reactor, clock=clock)
-        return hs
-
     def prepare(
         self, reactor: MemoryReactor, clock: Clock, homeserver: HomeServer
     ) -> None:
@@ -80,7 +76,10 @@ class FederationClientTests(HomeserverTestCase):
 
         @defer.inlineCallbacks
         def do_request() -> Generator["Deferred[Any]", object, object]:
-            with LoggingContext("one") as context:
+            with LoggingContext(
+                name="one",
+                server_name=self.hs.hostname,
+            ) as context:
                 fetch_d = defer.ensureDeferred(
                     self.cl.get_json("testserv:8008", "foo/bar")
                 )
@@ -415,6 +414,65 @@ class FederationClientTests(HomeserverTestCase):
         self.assertEqual(length, len(data))
         self.assertEqual(output_stream.getvalue(), data)
 
+    @override_config(
+        {
+            "federation": {
+                # Set the timeout to a deterministic value, in case the defaults
+                # change.
+                "client_timeout": "10s",
+            }
+        }
+    )
+    def test_authed_media_timeout_reading_body(self) -> None:
+        """
+        If the HTTP request is connected, but gets no response before being
+        timed out, it'll give a RequestSendFailed with can_retry.
+
+        Regression test for https://github.com/element-hq/synapse/issues/19061
+        """
+        limiter = Ratelimiter(
+            store=self.hs.get_datastores().main,
+            clock=self.clock,
+            cfg=RatelimitSettings(key="", per_second=0.17, burst_count=1048576),
+        )
+
+        output_stream = io.BytesIO()
+
+        d = defer.ensureDeferred(
+            # timeout is set by `client_timeout`, which we override above.
+            self.cl.federation_get_file(
+                "testserv:8008", "path", output_stream, limiter, "127.0.0.1", 10000
+            )
+        )
+
+        self.pump()
+
+        conn = Mock()
+        clients = self.reactor.tcpClients
+        client = clients[0][2].buildProtocol(None)
+        client.makeConnection(conn)
+
+        # Deferred does not have a result
+        self.assertNoResult(d)
+
+        # Send it the HTTP response
+        client.dataReceived(
+            b"HTTP/1.1 200 OK\r\n"
+            b"Server: Fake\r\n"
+            # Set a large content length, prompting the federation client to
+            # wait to receive the rest of the body.
+            b"Content-Length: 1000\r\n"
+            b"Content-Type: multipart/mixed; boundary=6067d4698f8d40a0a794ea7d7379d53a\r\n\r\n"
+        )
+
+        # Push by enough to time it out
+        self.reactor.advance(10.5)
+        f = self.failureResultOf(d)
+
+        self.assertIsInstance(f.value, RequestSendFailed)
+        self.assertTrue(f.value.can_retry)
+        self.assertIsInstance(f.value.inner_exception, defer.TimeoutError)
+
     @parameterized.expand(["get_json", "post_json", "delete_json", "put_json"])
     def test_timeout_reading_body(self, method_name: str) -> None:
         """
@@ -746,7 +804,7 @@ class FederationClientTests(HomeserverTestCase):
 
 
 class FederationClientProxyTests(BaseMultiWorkerStreamTestCase):
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         conf = super().default_config()
         conf["instance_map"] = {
             "main": {"host": "testserv", "port": 8765},
diff --git a/tests/http/test_proxy.py b/tests/http/test_proxy.py
index 7110dcf9f9..59a9b073bc 100644
--- a/tests/http/test_proxy.py
+++ b/tests/http/test_proxy.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Set
 
 from parameterized import parameterized
 
@@ -64,7 +63,7 @@ class ProxyTests(TestCase):
     def test_parse_connection_header_value(
         self,
         connection_header_value: bytes,
-        expected_extra_headers_to_remove: Set[str],
+        expected_extra_headers_to_remove: set[str],
     ) -> None:
         """
         Tests that the connection header value is parsed correctly
diff --git a/tests/http/test_proxyagent.py b/tests/http/test_proxyagent.py
index 5bc5d18d81..c65115b3e5 100644
--- a/tests/http/test_proxyagent.py
+++ b/tests/http/test_proxyagent.py
@@ -21,7 +21,6 @@
 import base64
 import logging
 import os
-from typing import List, Optional
 from unittest.mock import patch
 
 import treq
@@ -195,7 +194,7 @@ class ProxyParserTests(TestCase):
         expected_scheme: bytes,
         expected_hostname: bytes,
         expected_port: int,
-        expected_credentials: Optional[bytes],
+        expected_credentials: bytes | None,
     ) -> None:
         """
         Tests that a given proxy URL will be broken into the components.
@@ -251,8 +250,8 @@ class ProxyAgentTests(TestCase):
         client_factory: IProtocolFactory,
         server_factory: IProtocolFactory,
         ssl: bool = False,
-        expected_sni: Optional[bytes] = None,
-        tls_sanlist: Optional[List[bytes]] = None,
+        expected_sni: bytes | None = None,
+        tls_sanlist: list[bytes] | None = None,
     ) -> IProtocol:
         """Builds a test server, and completes the outgoing client connection
 
@@ -602,7 +601,7 @@ class ProxyAgentTests(TestCase):
         self,
         proxy_config: ProxyConfig,
         expect_proxy_ssl: bool = False,
-        expected_auth_credentials: Optional[bytes] = None,
+        expected_auth_credentials: bytes | None = None,
     ) -> None:
         """Send a http request via an agent and check that it is correctly received at
             the proxy. The proxy can use either http or https.
@@ -682,7 +681,7 @@ class ProxyAgentTests(TestCase):
         self,
         proxy_config: ProxyConfig,
         expect_proxy_ssl: bool = False,
-        expected_auth_credentials: Optional[bytes] = None,
+        expected_auth_credentials: bytes | None = None,
     ) -> None:
         """Send a https request via an agent and check that it is correctly received at
             the proxy and client. The proxy can use either http or https.
diff --git a/tests/http/test_servlet.py b/tests/http/test_servlet.py
index db39ecf244..389d3f2e6e 100644
--- a/tests/http/test_servlet.py
+++ b/tests/http/test_servlet.py
@@ -21,7 +21,6 @@
 import json
 from http import HTTPStatus
 from io import BytesIO
-from typing import Tuple, Union
 from unittest.mock import Mock
 
 from synapse.api.errors import Codes, SynapseError
@@ -35,12 +34,13 @@ from synapse.rest.client._base import client_patterns
 from synapse.server import HomeServer
 from synapse.types import JsonDict
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 
 from tests import unittest
-from tests.http.server._base import test_disconnect
+from tests.http.server._base import disconnect_and_assert
 
 
-def make_request(content: Union[bytes, JsonDict]) -> Mock:
+def make_request(content: bytes | JsonDict) -> Mock:
     """Make an object that acts enough like a request."""
     request = Mock(spec=["method", "uri", "content"])
 
@@ -108,12 +108,12 @@ class CancellableRestServlet(RestServlet):
         self.clock = hs.get_clock()
 
     @cancellable
-    async def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+    async def on_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
-    async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+    async def on_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
 
@@ -127,7 +127,7 @@ class TestRestServletCancellation(unittest.HomeserverTestCase):
     def test_cancellable_disconnect(self) -> None:
         """Test that handlers with the `@cancellable` flag can be cancelled."""
         channel = self.make_request("GET", "/sleep", await_result=False)
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=True,
@@ -137,7 +137,7 @@ class TestRestServletCancellation(unittest.HomeserverTestCase):
     def test_uncancellable_disconnect(self) -> None:
         """Test that handlers without the `@cancellable` flag cannot be cancelled."""
         channel = self.make_request("POST", "/sleep", await_result=False)
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=False,
diff --git a/tests/http/test_simple_client.py b/tests/http/test_simple_client.py
index c5ead59988..25c0e1081b 100644
--- a/tests/http/test_simple_client.py
+++ b/tests/http/test_simple_client.py
@@ -29,7 +29,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.http import RequestTimedOutError
 from synapse.http.client import SimpleHttpClient
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/http/test_site.py b/tests/http/test_site.py
index 2eca4587e7..654ec3190b 100644
--- a/tests/http/test_site.py
+++ b/tests/http/test_site.py
@@ -22,9 +22,10 @@
 from twisted.internet.address import IPv6Address
 from twisted.internet.testing import MemoryReactor, StringTransport
 
+from synapse.app._base import max_request_body_size
 from synapse.app.homeserver import SynapseHomeServer
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -143,3 +144,104 @@ class SynapseRequestTestCase(HomeserverTestCase):
 
         # we should get a 415
         self.assertRegex(transport.value().decode(), r"^HTTP/1\.1 415 ")
+
+    def test_content_length_too_large(self) -> None:
+        """HTTP requests with Content-Length exceeding max size should be rejected with 413"""
+        self.hs.start_listening()
+
+        # find the HTTP server which is configured to listen on port 0
+        (port, factory, _backlog, interface) = self.reactor.tcpServers[0]
+        self.assertEqual(interface, "::")
+        self.assertEqual(port, 0)
+
+        # complete the connection and wire it up to a fake transport
+        client_address = IPv6Address("TCP", "::1", 2345)
+        protocol = factory.buildProtocol(client_address)
+        transport = StringTransport()
+        protocol.makeConnection(transport)
+
+        # Send a request with Content-Length header that exceeds the limit.
+        # Default max is 50MB (from media max_upload_size), so send something larger.
+        oversized_length = 1 + max_request_body_size(self.hs.config)
+        protocol.dataReceived(
+            b"POST / HTTP/1.1\r\n"
+            b"Connection: close\r\n"
+            b"Content-Length: " + str(oversized_length).encode() + b"\r\n"
+            b"\r\n"
+            b"" + b"x" * oversized_length + b"\r\n"
+            b"\r\n"
+        )
+
+        # Advance the reactor to process the request
+        while not transport.disconnecting:
+            self.reactor.advance(1)
+
+        # We should get a 413 Content Too Large
+        response = transport.value().decode()
+        self.assertRegex(response, r"^HTTP/1\.1 413 ")
+        self.assertSubstring("M_TOO_LARGE", response)
+
+    def test_too_many_content_length_headers(self) -> None:
+        """HTTP requests with multiple Content-Length headers should be rejected with 400"""
+        self.hs.start_listening()
+
+        # find the HTTP server which is configured to listen on port 0
+        (port, factory, _backlog, interface) = self.reactor.tcpServers[0]
+        self.assertEqual(interface, "::")
+        self.assertEqual(port, 0)
+
+        # complete the connection and wire it up to a fake transport
+        client_address = IPv6Address("TCP", "::1", 2345)
+        protocol = factory.buildProtocol(client_address)
+        transport = StringTransport()
+        protocol.makeConnection(transport)
+
+        protocol.dataReceived(
+            b"POST / HTTP/1.1\r\n"
+            b"Connection: close\r\n"
+            b"Content-Length: " + str(5).encode() + b"\r\n"
+            b"Content-Length: " + str(5).encode() + b"\r\n"
+            b"\r\n"
+            b"" + b"xxxxx" + b"\r\n"
+            b"\r\n"
+        )
+
+        # Advance the reactor to process the request
+        while not transport.disconnecting:
+            self.reactor.advance(1)
+
+        # We should get a 400
+        response = transport.value().decode()
+        self.assertRegex(response, r"^HTTP/1\.1 400 ")
+
+    def test_invalid_content_length_headers(self) -> None:
+        """HTTP requests with invalid Content-Length header should be rejected with 400"""
+        self.hs.start_listening()
+
+        # find the HTTP server which is configured to listen on port 0
+        (port, factory, _backlog, interface) = self.reactor.tcpServers[0]
+        self.assertEqual(interface, "::")
+        self.assertEqual(port, 0)
+
+        # complete the connection and wire it up to a fake transport
+        client_address = IPv6Address("TCP", "::1", 2345)
+        protocol = factory.buildProtocol(client_address)
+        transport = StringTransport()
+        protocol.makeConnection(transport)
+
+        protocol.dataReceived(
+            b"POST / HTTP/1.1\r\n"
+            b"Connection: close\r\n"
+            b"Content-Length: eight\r\n"
+            b"\r\n"
+            b"" + b"xxxxx" + b"\r\n"
+            b"\r\n"
+        )
+
+        # Advance the reactor to process the request
+        while not transport.disconnecting:
+            self.reactor.advance(1)
+
+        # We should get a 400
+        response = transport.value().decode()
+        self.assertRegex(response, r"^HTTP/1\.1 400 ")
diff --git a/tests/logging/test_opentracing.py b/tests/logging/test_opentracing.py
index 5fe57d100e..d5e643585d 100644
--- a/tests/logging/test_opentracing.py
+++ b/tests/logging/test_opentracing.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Awaitable, Dict, cast
+from typing import Awaitable, cast
 
 from twisted.internet import defer
 from twisted.internet.testing import MemoryReactorClock
@@ -35,20 +35,26 @@ from synapse.logging.opentracing import (
     tag_args,
     trace_with_opname,
 )
-from synapse.util import Clock
+from synapse.metrics.background_process_metrics import run_as_background_process
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
-try:
-    import opentracing
-    from opentracing.scope_managers.contextvars import ContextVarsScopeManager
-except ImportError:
-    opentracing = None  # type: ignore
-    ContextVarsScopeManager = None  # type: ignore
+from tests.server import get_clock
 
 try:
     import jaeger_client
 except ImportError:
     jaeger_client = None  # type: ignore
 
+
+try:
+    import opentracing
+
+    from synapse.logging.scopecontextmanager import LogContextScopeManager
+except ImportError:
+    opentracing = None  # type: ignore
+    LogContextScopeManager = None  # type: ignore
+
 import logging
 
 from tests.unittest import TestCase
@@ -56,7 +62,7 @@ from tests.unittest import TestCase
 logger = logging.getLogger(__name__)
 
 
-class TracingScopeTestCase(TestCase):
+class LogContextScopeManagerTestCase(TestCase):
     """
     Test that our tracing machinery works well in a variety of situations (especially
     with Twisted's runtime and deferreds).
@@ -67,7 +73,7 @@ class TracingScopeTestCase(TestCase):
     opentracing backend is Jaeger.
     """
 
-    if opentracing is None:
+    if opentracing is None or LogContextScopeManager is None:
         skip = "Requires opentracing"  # type: ignore[unreachable]
     if jaeger_client is None:
         skip = "Requires jaeger_client"  # type: ignore[unreachable]
@@ -77,9 +83,8 @@ class TracingScopeTestCase(TestCase):
         # global variables that power opentracing. We create our own tracer instance
         # and test with it.
 
-        scope_manager = ContextVarsScopeManager()
         config = jaeger_client.config.Config(
-            config={}, service_name="test", scope_manager=scope_manager
+            config={}, service_name="test", scope_manager=LogContextScopeManager()
         )
 
         self._reporter = jaeger_client.reporter.InMemoryReporter()
@@ -91,7 +96,7 @@ class TracingScopeTestCase(TestCase):
 
     def test_start_active_span(self) -> None:
         # the scope manager assumes a logging context of some sort.
-        with LoggingContext("root context"):
+        with LoggingContext(name="root context", server_name="test_server"):
             self.assertIsNone(self._tracer.active_span)
 
             # start_active_span should start and activate a span.
@@ -115,7 +120,7 @@ class TracingScopeTestCase(TestCase):
     def test_nested_spans(self) -> None:
         """Starting two spans off inside each other should work"""
 
-        with LoggingContext("root context"):
+        with LoggingContext(name="root context", server_name="test_server"):
             with start_active_span("root span", tracer=self._tracer) as root_scope:
                 self.assertEqual(self._tracer.active_span, root_scope.span)
                 root_context = cast(jaeger_client.SpanContext, root_scope.span.context)
@@ -159,7 +164,16 @@ class TracingScopeTestCase(TestCase):
     def test_overlapping_spans(self) -> None:
         """Overlapping spans which are not neatly nested should work"""
         reactor = MemoryReactorClock()
-        clock = Clock(reactor)
+        # type-ignore: mypy-zope doesn't seem to recognise that `MemoryReactorClock`
+        # implements `ISynapseThreadlessReactor` (combination of the normal Twisted
+        # Reactor/Clock interfaces), via inheritance from
+        # `twisted.internet.testing.MemoryReactor` and `twisted.internet.testing.Clock`
+        # Ignore `multiple-internal-clocks` linter error here since we are creating a `Clock`
+        # for testing purposes.
+        clock = Clock(  # type: ignore[multiple-internal-clocks]
+            reactor,  # type: ignore[arg-type]
+            server_name="test_server",
+        )
 
         scopes = []
 
@@ -171,7 +185,7 @@ class TracingScopeTestCase(TestCase):
             scopes.append(scope)
 
             self.assertEqual(self._tracer.active_span, scope.span)
-            await clock.sleep(4)
+            await clock.sleep(Duration(seconds=4))
             self.assertEqual(self._tracer.active_span, scope.span)
             scope.close()
 
@@ -181,7 +195,7 @@ class TracingScopeTestCase(TestCase):
                 scopes.append(root_scope)
 
                 d1 = run_in_background(task, 1)
-                await clock.sleep(2)
+                await clock.sleep(Duration(seconds=2))
                 d2 = run_in_background(task, 2)
 
                 # because we did run_in_background, the active span should still be the
@@ -194,7 +208,7 @@ class TracingScopeTestCase(TestCase):
 
                 self.assertEqual(self._tracer.active_span, root_scope.span)
 
-        with LoggingContext("root context"):
+        with LoggingContext(name="root context", server_name="test_server"):
             # start the test off
             d1 = defer.ensureDeferred(root())
 
@@ -211,141 +225,12 @@ class TracingScopeTestCase(TestCase):
             [scopes[1].span, scopes[2].span, scopes[0].span],
         )
 
-    def test_run_in_background_active_scope_still_available(self) -> None:
-        """
-        Test that tasks running via `run_in_background` still have access to the
-        active tracing scope.
-
-        This is a regression test for a previous Synapse issue where the tracing scope
-        would `__exit__` and close before the `run_in_background` task completed and our
-        own previous custom `_LogContextScope.close(...)` would clear
-        `LoggingContext.scope` preventing further tracing spans from having the correct
-        parent.
-        """
-        reactor = MemoryReactorClock()
-        clock = Clock(reactor)
-
-        scope_map: Dict[str, opentracing.Scope] = {}
-
-        async def async_task() -> None:
-            root_scope = scope_map["root"]
-            root_context = cast(jaeger_client.SpanContext, root_scope.span.context)
-
-            self.assertEqual(
-                self._tracer.active_span,
-                root_scope.span,
-                "expected to inherit the root tracing scope from where this was run",
-            )
-
-            # Return control back to the reactor thread and wait an arbitrary amount
-            await clock.sleep(4)
-
-            # This is a key part of what we're testing! In a previous version of
-            # Synapse, we would lose the active span at this point.
-            self.assertEqual(
-                self._tracer.active_span,
-                root_scope.span,
-                "expected to still have a root tracing scope/span active",
-            )
-
-            # For complete-ness sake, let's also trace more sub-tasks here and assert
-            # they have the correct span parents as well (root)
-
-            # Start tracing some other sub-task.
-            #
-            # This is a key part of what we're testing! In a previous version of
-            # Synapse, it would have the incorrect span parents.
-            scope = start_active_span(
-                "task1",
-                tracer=self._tracer,
-            )
-            scope_map["task1"] = scope
-
-            # Ensure the span parent is pointing to the root scope
-            context = cast(jaeger_client.SpanContext, scope.span.context)
-            self.assertEqual(
-                context.parent_id,
-                root_context.span_id,
-                "expected task1 parent to be the root span",
-            )
-
-            # Ensure that the active span is our new sub-task now
-            self.assertEqual(self._tracer.active_span, scope.span)
-            # Return control back to the reactor thread and wait an arbitrary amount
-            await clock.sleep(4)
-            # We should still see the active span as the scope wasn't closed yet
-            self.assertEqual(self._tracer.active_span, scope.span)
-            scope.close()
-
-        async def root() -> None:
-            with start_active_span(
-                "root span",
-                tracer=self._tracer,
-                # We will close this off later. We're basically just mimicking the same
-                # pattern for how we handle requests. We pass the span off to the
-                # request for it to finish.
-                finish_on_close=False,
-            ) as root_scope:
-                scope_map["root"] = root_scope
-                self.assertEqual(self._tracer.active_span, root_scope.span)
-
-                # Fire-and-forget a task
-                #
-                # XXX: The root scope context manager will `__exit__` before this task
-                # completes.
-                run_in_background(async_task)
-
-                # Because we used `run_in_background`, the active span should still be
-                # the root.
-                self.assertEqual(self._tracer.active_span, root_scope.span)
-
-            # We shouldn't see any active spans outside of the scope
-            self.assertIsNone(self._tracer.active_span)
-
-        with LoggingContext("root context"):
-            # Start the test off
-            d_root = defer.ensureDeferred(root())
-
-            # Let the tasks complete
-            reactor.pump((2,) * 8)
-            self.successResultOf(d_root)
-
-            # After we see all of the tasks are done (like a request when it
-            # `_finished_processing`), let's finish our root span
-            scope_map["root"].span.finish()
-
-            # Sanity check again: We shouldn't see any active spans leftover in this
-            # this context.
-            self.assertIsNone(self._tracer.active_span)
-
-        # The spans should be reported in order of their finishing: task 1, task 2,
-        # root.
-        #
-        # We use `assertIncludes` just as an easier way to see if items are missing or
-        # added. We assert the order just below
-        self.assertIncludes(
-            set(self._reporter.get_spans()),
-            {
-                scope_map["task1"].span,
-                scope_map["root"].span,
-            },
-            exact=True,
-        )
-        # This is where we actually assert the correct order
-        self.assertEqual(
-            self._reporter.get_spans(),
-            [
-                scope_map["task1"].span,
-                scope_map["root"].span,
-            ],
-        )
-
     def test_trace_decorator_sync(self) -> None:
         """
         Test whether we can use `@trace_with_opname` (`@trace`) and `@tag_args`
         with sync functions
         """
-        with LoggingContext("root context"):
+        with LoggingContext(name="root context", server_name="test_server"):
 
             @trace_with_opname("fixture_sync_func", tracer=self._tracer)
             @tag_args
@@ -366,7 +251,7 @@ class TracingScopeTestCase(TestCase):
         Test whether we can use `@trace_with_opname` (`@trace`) and `@tag_args`
         with functions that return deferreds
         """
-        with LoggingContext("root context"):
+        with LoggingContext(name="root context", server_name="test_server"):
 
             @trace_with_opname("fixture_deferred_func", tracer=self._tracer)
             @tag_args
@@ -390,7 +275,7 @@ class TracingScopeTestCase(TestCase):
         Test whether we can use `@trace_with_opname` (`@trace`) and `@tag_args`
         with async functions
         """
-        with LoggingContext("root context"):
+        with LoggingContext(name="root context", server_name="test_server"):
 
             @trace_with_opname("fixture_async_func", tracer=self._tracer)
             @tag_args
@@ -412,7 +297,7 @@ class TracingScopeTestCase(TestCase):
         Test whether we can use `@trace_with_opname` (`@trace`) and `@tag_args`
         with functions that return an awaitable (e.g. a coroutine)
         """
-        with LoggingContext("root context"):
+        with LoggingContext(name="root context", server_name="test_server"):
             # Something we can return without `await` to get a coroutine
             async def fixture_async_func() -> str:
                 return "foo"
@@ -437,3 +322,203 @@ class TracingScopeTestCase(TestCase):
             [span.operation_name for span in self._reporter.get_spans()],
             ["fixture_awaitable_return_func"],
         )
+
+    async def test_run_as_background_process_standalone(self) -> None:
+        """
+        Test to make sure that the background process work starts its own trace.
+        """
+        reactor, clock = get_clock()
+
+        callback_finished = False
+        active_span_in_callback: jaeger_client.Span | None = None
+
+        async def bg_task() -> None:
+            nonlocal callback_finished, active_span_in_callback
+            try:
+                assert isinstance(self._tracer.active_span, jaeger_client.Span)
+                active_span_in_callback = self._tracer.active_span
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        # type-ignore: We ignore because the point is to test the bare function
+        run_as_background_process(  # type: ignore[untracked-background-process]
+            desc="some-bg-task",
+            server_name="test_server",
+            func=bg_task,
+            test_only_tracer=self._tracer,
+        )
+
+        # Now wait for the background process to finish
+        while not callback_finished:
+            await clock.sleep(Duration(seconds=0))
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        self.assertEqual(
+            active_span_in_callback.operation_name if active_span_in_callback else None,
+            "bgproc.some-bg-task",
+            "expected a new span to be started for the background task",
+        )
+
+        # The spans should be reported in order of their finishing.
+        #
+        # We use `assertIncludes` just as an easier way to see if items are missing or
+        # added. We assert the order just below
+        actual_spans = [span.operation_name for span in self._reporter.get_spans()]
+        expected_spans = ["bgproc.some-bg-task"]
+        self.assertIncludes(
+            set(actual_spans),
+            set(expected_spans),
+            exact=True,
+        )
+        # This is where we actually assert the correct order
+        self.assertEqual(
+            actual_spans,
+            expected_spans,
+        )
+
+    async def test_run_as_background_process_cross_link(self) -> None:
+        """
+        Test to make sure that the background process work has its own trace and is
+        disconnected from any currently active trace (like a request). But we still have
+        cross-links between the two traces if there was already an active trace/span when
+        we kicked off the background process.
+        """
+        reactor, clock = get_clock()
+
+        callback_finished = False
+        active_span_in_callback: jaeger_client.Span | None = None
+
+        async def bg_task() -> None:
+            nonlocal callback_finished, active_span_in_callback
+            try:
+                assert isinstance(self._tracer.active_span, jaeger_client.Span)
+                active_span_in_callback = self._tracer.active_span
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="some-request", server_name="test_server"):
+            with start_active_span(
+                "some-request",
+                tracer=self._tracer,
+            ):
+                # type-ignore: We ignore because the point is to test the bare function
+                run_as_background_process(  # type: ignore[untracked-background-process]
+                    desc="some-bg-task",
+                    server_name="test_server",
+                    func=bg_task,
+                    test_only_tracer=self._tracer,
+                )
+
+        # Now wait for the background process to finish
+        while not callback_finished:
+            await clock.sleep(Duration(seconds=0))
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # We start `bgproc.some-bg-task` and `bgproc_child.some-bg-task` (see
+        # `run_as_background_process` implementation for why). Either is fine but for
+        # now we expect the child as its the innermost one that was started.
+        self.assertEqual(
+            active_span_in_callback.operation_name if active_span_in_callback else None,
+            "bgproc_child.some-bg-task",
+            "expected a new span to be started for the background task",
+        )
+
+        # The spans should be reported in order of their finishing.
+        #
+        # We use `assertIncludes` just as an easier way to see if items are missing or
+        # added. We assert the order just below
+        actual_spans = [span.operation_name for span in self._reporter.get_spans()]
+        expected_spans = [
+            "start_bgproc.some-bg-task",
+            "bgproc_child.some-bg-task",
+            "bgproc.some-bg-task",
+            "some-request",
+        ]
+        self.assertIncludes(
+            set(actual_spans),
+            set(expected_spans),
+            exact=True,
+        )
+        # This is where we actually assert the correct order
+        self.assertEqual(
+            actual_spans,
+            expected_spans,
+        )
+
+        span_map = {span.operation_name: span for span in self._reporter.get_spans()}
+        span_id_to_friendly_name = {
+            span.span_id: span.operation_name for span in self._reporter.get_spans()
+        }
+
+        def get_span_friendly_name(span_id: int | None) -> str:
+            if span_id is None:
+                return "None"
+
+            return span_id_to_friendly_name.get(span_id, f"unknown span {span_id}")
+
+        # Ensure the background process trace/span is disconnected from the request
+        # trace/span.
+        self.assertNotEqual(
+            get_span_friendly_name(span_map["bgproc.some-bg-task"].parent_id),
+            get_span_friendly_name(span_map["some-request"].span_id),
+        )
+
+        # We should see a cross-link in the request trace pointing to the background
+        # process trace.
+        #
+        # Make sure `start_bgproc.some-bg-task` is part of the request trace
+        self.assertEqual(
+            get_span_friendly_name(span_map["start_bgproc.some-bg-task"].parent_id),
+            get_span_friendly_name(span_map["some-request"].span_id),
+        )
+        # And has some references to the background process trace
+        self.assertIncludes(
+            {
+                f"{reference.type}:{get_span_friendly_name(reference.referenced_context.span_id)}"
+                if isinstance(reference.referenced_context, jaeger_client.SpanContext)
+                else f"{reference.type}:None"
+                for reference in (
+                    span_map["start_bgproc.some-bg-task"].references or []
+                )
+            },
+            {
+                f"follows_from:{get_span_friendly_name(span_map['bgproc.some-bg-task'].span_id)}"
+            },
+            exact=True,
+        )
+
+        # We should see a cross-link in the background process trace pointing to the
+        # request trace that kicked off the work.
+        #
+        # Make sure `start_bgproc.some-bg-task` is part of the request trace
+        self.assertEqual(
+            get_span_friendly_name(span_map["bgproc_child.some-bg-task"].parent_id),
+            get_span_friendly_name(span_map["bgproc.some-bg-task"].span_id),
+        )
+        # And has some references to the background process trace
+        self.assertIncludes(
+            {
+                f"{reference.type}:{get_span_friendly_name(reference.referenced_context.span_id)}"
+                if isinstance(reference.referenced_context, jaeger_client.SpanContext)
+                else f"{reference.type}:None"
+                for reference in (
+                    span_map["bgproc_child.some-bg-task"].references or []
+                )
+            },
+            {
+                f"follows_from:{get_span_friendly_name(span_map['some-request'].span_id)}"
+            },
+            exact=True,
+        )
diff --git a/tests/logging/test_remote_handler.py b/tests/logging/test_remote_handler.py
index e0fd12ccf7..534a1fc4ee 100644
--- a/tests/logging/test_remote_handler.py
+++ b/tests/logging/test_remote_handler.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Tuple
 
 from twisted.internet.protocol import Protocol
 from twisted.internet.testing import AccumulatingProtocol, MemoryReactorClock
@@ -33,7 +32,7 @@ from tests.utils import checked_cast
 
 def connect_logging_client(
     reactor: MemoryReactorClock, client_id: int
-) -> Tuple[Protocol, AccumulatingProtocol]:
+) -> tuple[Protocol, AccumulatingProtocol]:
     # This is essentially tests.server.connect_client, but disabling autoflush on
     # the client transport. This is necessary to avoid an infinite loop due to
     # sending of data via the logging transport causing additional logs to be
diff --git a/tests/logging/test_terse_json.py b/tests/logging/test_terse_json.py
index 60de8d786f..a857737ddf 100644
--- a/tests/logging/test_terse_json.py
+++ b/tests/logging/test_terse_json.py
@@ -63,13 +63,13 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
         log = self.get_log_line()
 
         # The terse logger should give us these keys.
-        expected_log_keys = [
+        expected_log_keys = {
             "log",
             "time",
             "level",
             "namespace",
-        ]
-        self.assertCountEqual(log.keys(), expected_log_keys)
+        }
+        self.assertIncludes(log.keys(), expected_log_keys, exact=True)
         self.assertEqual(log["log"], "Hello there, wally!")
 
     def test_extra_data(self) -> None:
@@ -87,7 +87,7 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
         log = self.get_log_line()
 
         # The terse logger should give us these keys.
-        expected_log_keys = [
+        expected_log_keys = {
             "log",
             "time",
             "level",
@@ -96,8 +96,8 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
             "foo",
             "int",
             "bool",
-        ]
-        self.assertCountEqual(log.keys(), expected_log_keys)
+        }
+        self.assertIncludes(log.keys(), expected_log_keys, exact=True)
 
         # Check the values of the extra fields.
         self.assertEqual(log["foo"], "bar")
@@ -117,12 +117,12 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
         log = self.get_log_line()
 
         # The terse logger should give us these keys.
-        expected_log_keys = [
+        expected_log_keys = {
             "log",
             "level",
             "namespace",
-        ]
-        self.assertCountEqual(log.keys(), expected_log_keys)
+        }
+        self.assertIncludes(log.keys(), expected_log_keys, exact=True)
         self.assertEqual(log["log"], "Hello there, wally!")
 
     def test_with_context(self) -> None:
@@ -134,19 +134,20 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
         handler.addFilter(LoggingContextFilter())
         logger = self.get_logger(handler)
 
-        with LoggingContext("name"):
+        with LoggingContext(name="name", server_name="test_server"):
             logger.info("Hello there, %s!", "wally")
 
         log = self.get_log_line()
 
         # The terse logger should give us these keys.
-        expected_log_keys = [
+        expected_log_keys = {
             "log",
             "level",
             "namespace",
             "request",
-        ]
-        self.assertCountEqual(log.keys(), expected_log_keys)
+            "server_name",
+        }
+        self.assertIncludes(log.keys(), expected_log_keys, exact=True)
         self.assertEqual(log["log"], "Hello there, wally!")
         self.assertEqual(log["request"], "name")
 
@@ -187,14 +188,16 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
         request.requester = "@foo:test"
 
         with LoggingContext(
-            request.get_request_id(), parent_context=request.logcontext
+            name=request.get_request_id(),
+            server_name="test_server",
+            parent_context=request.logcontext,
         ):
             logger.info("Hello there, %s!", "wally")
 
         log = self.get_log_line()
 
         # The terse logger includes additional request information, if possible.
-        expected_log_keys = [
+        expected_log_keys = {
             "log",
             "level",
             "namespace",
@@ -207,8 +210,9 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
             "url",
             "protocol",
             "user_agent",
-        ]
-        self.assertCountEqual(log.keys(), expected_log_keys)
+            "server_name",
+        }
+        self.assertIncludes(log.keys(), expected_log_keys, exact=True)
         self.assertEqual(log["log"], "Hello there, wally!")
         self.assertTrue(log["request"].startswith("POST-"))
         self.assertEqual(log["ip_address"], "127.0.0.1")
@@ -236,14 +240,14 @@ class TerseJsonTestCase(LoggerCleanupMixin, TestCase):
         log = self.get_log_line()
 
         # The terse logger should give us these keys.
-        expected_log_keys = [
+        expected_log_keys = {
             "log",
             "level",
             "namespace",
             "exc_type",
             "exc_value",
-        ]
-        self.assertCountEqual(log.keys(), expected_log_keys)
+        }
+        self.assertIncludes(log.keys(), expected_log_keys, exact=True)
         self.assertEqual(log["log"], "Hello there, wally!")
         self.assertEqual(log["exc_type"], "ValueError")
         self.assertEqual(log["exc_value"], "That's wrong, you wally!")
diff --git a/tests/media/test_media_retention.py b/tests/media/test_media_retention.py
index 6e01b9aecb..f27a9ed685 100644
--- a/tests/media/test_media_retention.py
+++ b/tests/media/test_media_retention.py
@@ -20,7 +20,7 @@
 #
 
 import io
-from typing import Iterable, Optional
+from typing import Iterable
 
 from matrix_common.types.mxc_uri import MXCUri
 
@@ -30,14 +30,13 @@ from synapse.rest import admin
 from synapse.rest.client import login, register, room
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import (
     random_string,
 )
 
 from tests import unittest
 from tests.unittest import override_config
-from tests.utils import MockClock
 
 
 class MediaRetentionTestCase(unittest.HomeserverTestCase):
@@ -51,12 +50,6 @@ class MediaRetentionTestCase(unittest.HomeserverTestCase):
         admin.register_servlets_for_client_rest_resource,
     ]
 
-    def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
-        # We need to be able to test advancing time in the homeserver, so we
-        # replace the test homeserver's default clock with a MockClock, which
-        # supports advancing time.
-        return self.setup_test_homeserver(clock=MockClock())
-
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.remote_server_name = "remote.homeserver"
         self.store = hs.get_datastores().main
@@ -70,9 +63,9 @@ class MediaRetentionTestCase(unittest.HomeserverTestCase):
         media_repository = hs.get_media_repository()
 
         def _create_media_and_set_attributes(
-            last_accessed_ms: Optional[int],
-            is_quarantined: Optional[bool] = False,
-            is_protected: Optional[bool] = False,
+            last_accessed_ms: int | None,
+            is_quarantined: bool | None = False,
+            is_protected: bool | None = False,
         ) -> MXCUri:
             # "Upload" some media to the local media store
             # If the meda
@@ -120,8 +113,8 @@ class MediaRetentionTestCase(unittest.HomeserverTestCase):
 
         def _cache_remote_media_and_set_attributes(
             media_id: str,
-            last_accessed_ms: Optional[int],
-            is_quarantined: Optional[bool] = False,
+            last_accessed_ms: int | None,
+            is_quarantined: bool | None = False,
         ) -> MXCUri:
             # Pretend to cache some remote media
             self.get_success(
diff --git a/tests/media/test_media_storage.py b/tests/media/test_media_storage.py
index bf334c0371..631718a366 100644
--- a/tests/media/test_media_storage.py
+++ b/tests/media/test_media_storage.py
@@ -23,7 +23,7 @@ import shutil
 import tempfile
 from binascii import unhexlify
 from io import BytesIO
-from typing import Any, BinaryIO, ClassVar, Dict, List, Literal, Optional, Tuple, Union
+from typing import Any, BinaryIO, ClassVar, Literal
 from unittest.mock import MagicMock, Mock, patch
 from urllib import parse
 
@@ -48,7 +48,10 @@ from synapse.logging.context import make_deferred_yieldable
 from synapse.media._base import FileInfo, ThumbnailInfo
 from synapse.media.filepath import MediaFilePaths
 from synapse.media.media_storage import MediaStorage, ReadableFileWrapper
-from synapse.media.storage_provider import FileStorageProviderBackend
+from synapse.media.storage_provider import (
+    FileStorageProviderBackend,
+    StorageProviderWrapper,
+)
 from synapse.media.thumbnailer import ThumbnailProvider
 from synapse.module_api import ModuleApi
 from synapse.module_api.callbacks.spamchecker_callbacks import load_legacy_spam_checkers
@@ -56,7 +59,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, media
 from synapse.server import HomeServer
 from synapse.types import JsonDict, RoomAlias
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeChannel
@@ -77,11 +80,19 @@ class MediaStorageTests(unittest.HomeserverTestCase):
 
         hs.config.media.media_store_path = self.primary_base_path
 
-        storage_providers = [FileStorageProviderBackend(hs, self.secondary_base_path)]
+        local_provider = FileStorageProviderBackend(hs, self.primary_base_path)
+        storage_providers = [
+            StorageProviderWrapper(
+                FileStorageProviderBackend(hs, self.secondary_base_path),
+                store_local=True,
+                store_remote=False,
+                store_synchronous=True,
+            ),
+        ]
 
         self.filepaths = MediaFilePaths(self.primary_base_path)
         self.media_storage = MediaStorage(
-            hs, self.primary_base_path, self.filepaths, storage_providers
+            hs, self.filepaths, storage_providers, local_provider
         )
 
     def test_ensure_media_is_in_local_cache(self) -> None:
@@ -102,29 +113,31 @@ class MediaStorageTests(unittest.HomeserverTestCase):
         # to the local cache.
         file_info = FileInfo(None, media_id)
 
+        async def test_ensure_media() -> None:
+            async with self.media_storage.ensure_media_is_in_local_cache(
+                file_info
+            ) as local_path:
+                self.assertTrue(os.path.exists(local_path))
+
+                # Asserts the file is under the expected local cache directory
+                self.assertEqual(
+                    os.path.commonprefix([self.primary_base_path, local_path]),
+                    self.primary_base_path,
+                )
+
+                with open(local_path) as f:
+                    body = f.read()
+
+                self.assertEqual(test_body, body)
+
         # This uses a real blocking threadpool so we have to wait for it to be
         # actually done :/
-        x = defer.ensureDeferred(
-            self.media_storage.ensure_media_is_in_local_cache(file_info)
-        )
+        x = defer.ensureDeferred(test_ensure_media())
 
         # Hotloop until the threadpool does its job...
         self.wait_on_thread(x)
 
-        local_path = self.get_success(x)
-
-        self.assertTrue(os.path.exists(local_path))
-
-        # Asserts the file is under the expected local cache directory
-        self.assertEqual(
-            os.path.commonprefix([self.primary_base_path, local_path]),
-            self.primary_base_path,
-        )
-
-        with open(local_path) as f:
-            body = f.read()
-
-        self.assertEqual(test_body, body)
+        self.get_success(x)
 
 
 @attr.s(auto_attribs=True, slots=True, frozen=True)
@@ -150,8 +163,8 @@ class TestImage:
     data: bytes
     content_type: bytes
     extension: bytes
-    expected_cropped: Optional[bytes] = None
-    expected_scaled: Optional[bytes] = None
+    expected_cropped: bytes | None = None
+    expected_scaled: bytes | None = None
     expected_found: bool = True
     unable_to_thumbnail: bool = False
     is_inline: bool = True
@@ -297,12 +310,12 @@ class MediaRepoTests(unittest.HomeserverTestCase):
     user_id = "@test:user"
 
     def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
-        self.fetches: List[
-            Tuple[
-                "Deferred[Tuple[bytes, Tuple[int, Dict[bytes, List[bytes]]]]]",
+        self.fetches: list[
+            tuple[
+                "Deferred[tuple[bytes, tuple[int, dict[bytes, list[bytes]]]]]",
                 str,
                 str,
-                Optional[QueryParams],
+                QueryParams | None,
             ]
         ] = []
 
@@ -313,16 +326,16 @@ class MediaRepoTests(unittest.HomeserverTestCase):
             download_ratelimiter: Ratelimiter,
             ip_address: Any,
             max_size: int,
-            args: Optional[QueryParams] = None,
+            args: QueryParams | None = None,
             retry_on_dns_fail: bool = True,
             ignore_backoff: bool = False,
             follow_redirects: bool = False,
-        ) -> "Deferred[Tuple[int, Dict[bytes, List[bytes]]]]":
+        ) -> "Deferred[tuple[int, dict[bytes, list[bytes]]]]":
             """A mock for MatrixFederationHttpClient.get_file."""
 
             def write_to(
-                r: Tuple[bytes, Tuple[int, Dict[bytes, List[bytes]]]],
-            ) -> Tuple[int, Dict[bytes, List[bytes]]]:
+                r: tuple[bytes, tuple[int, dict[bytes, list[bytes]]]],
+            ) -> tuple[int, dict[bytes, list[bytes]]]:
                 data, response = r
                 output_stream.write(data)
                 return response
@@ -332,7 +345,7 @@ class MediaRepoTests(unittest.HomeserverTestCase):
                 output_stream.write(f.value.response)
                 return f
 
-            d: Deferred[Tuple[bytes, Tuple[int, Dict[bytes, List[bytes]]]]] = Deferred()
+            d: Deferred[tuple[bytes, tuple[int, dict[bytes, list[bytes]]]]] = Deferred()
             self.fetches.append((d, destination, path, args))
             # Note that this callback changes the value held by d.
             d_after_callback = d.addCallbacks(write_to, write_err)
@@ -370,13 +383,13 @@ class MediaRepoTests(unittest.HomeserverTestCase):
 
         self.media_id = "example.com/12345"
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
 
     def _req(
-        self, content_disposition: Optional[bytes], include_content_type: bool = True
+        self, content_disposition: bytes | None, include_content_type: bool = True
     ) -> FakeChannel:
         channel = self.make_request(
             "GET",
@@ -654,7 +667,7 @@ class MediaRepoTests(unittest.HomeserverTestCase):
     def _test_thumbnail(
         self,
         method: str,
-        expected_body: Optional[bytes],
+        expected_body: bytes | None,
         expected_found: bool,
         unable_to_thumbnail: bool = False,
     ) -> None:
@@ -860,15 +873,15 @@ class TestSpamCheckerLegacy:
     Uses the legacy Spam-Checker API.
     """
 
-    def __init__(self, config: Dict[str, Any], api: ModuleApi) -> None:
+    def __init__(self, config: dict[str, Any], api: ModuleApi) -> None:
         self.config = config
         self.api = api
 
     @staticmethod
-    def parse_config(config: Dict[str, Any]) -> Dict[str, Any]:
+    def parse_config(config: dict[str, Any]) -> dict[str, Any]:
         return config
 
-    async def check_event_for_spam(self, event: EventBase) -> Union[bool, str]:
+    async def check_event_for_spam(self, event: EventBase) -> bool | str:
         return False  # allow all events
 
     async def user_may_invite(
@@ -911,12 +924,12 @@ class SpamCheckerTestCaseLegacy(unittest.HomeserverTestCase):
 
         load_legacy_spam_checkers(hs)
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = default_config("test")
 
         config.update(
@@ -965,14 +978,14 @@ class SpamCheckerTestCase(unittest.HomeserverTestCase):
             check_media_file_for_spam=self.check_media_file_for_spam
         )
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
 
     async def check_media_file_for_spam(
         self, file_wrapper: ReadableFileWrapper, file_info: FileInfo
-    ) -> Union[Codes, Literal["NOT_SPAM"], Tuple[Codes, JsonDict]]:
+    ) -> Codes | Literal["NOT_SPAM"] | tuple[Codes, JsonDict]:
         buf = BytesIO()
         await file_wrapper.write_chunks_to(buf.write)
 
@@ -1028,7 +1041,7 @@ class RemoteDownloadLimiterTestCase(unittest.HomeserverTestCase):
         self.client = hs.get_federation_http_client()
         self.store = hs.get_datastores().main
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         # We need to manually set the resource tree to include media, the
         # default only does `/_matrix/client` APIs.
         return {"/_matrix/media": self.hs.get_media_repository_resource()}
@@ -1259,7 +1272,7 @@ class RemoteDownloadLimiterTestCase(unittest.HomeserverTestCase):
 
 
 def read_body(
-    response: IResponse, stream: ByteWriteable, max_size: Optional[int]
+    response: IResponse, stream: ByteWriteable, max_size: int | None
 ) -> Deferred:
     d: Deferred = defer.Deferred()
     stream.write(SMALL_PNG)
@@ -1280,7 +1293,7 @@ class MediaHashesTestCase(unittest.HomeserverTestCase):
         self.store = hs.get_datastores().main
         self.client = hs.get_federation_http_client()
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
@@ -1377,7 +1390,7 @@ class MediaRepoSizeModuleCallbackTestCase(unittest.HomeserverTestCase):
             is_user_allowed_to_upload_media_of_size=self.is_user_allowed_to_upload_media_of_size,
         )
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
diff --git a/tests/media/test_oembed.py b/tests/media/test_oembed.py
index afae7e048c..dc13c03df3 100644
--- a/tests/media/test_oembed.py
+++ b/tests/media/test_oembed.py
@@ -29,7 +29,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.media.oembed import OEmbedProvider, OEmbedResult
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/media/test_url_previewer.py b/tests/media/test_url_previewer.py
index bd7190e3e9..3d706c7e90 100644
--- a/tests/media/test_url_previewer.py
+++ b/tests/media/test_url_previewer.py
@@ -23,7 +23,7 @@ import os
 from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
diff --git a/tests/metrics/test_metrics.py b/tests/metrics/test_metrics.py
index 61874564a6..174b165679 100644
--- a/tests/metrics/test_metrics.py
+++ b/tests/metrics/test_metrics.py
@@ -18,17 +18,32 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict, Protocol, Tuple
+
+# These imports are necessary for python <= 3.13 in order for the `InFlightGauge` type
+# annotations not to be evaluated at runtime.
+# Starting with python 3.14, annotations are lazily evaluated by default, which is the
+# behaviour we desire.
+# More info here: https://docs.python.org/3/reference/compound_stmts.html#annotations
+from __future__ import annotations
+
+from typing import NoReturn, Protocol
 
 from prometheus_client.core import Sample
 
-from synapse.metrics import REGISTRY, InFlightGauge, generate_latest
+from synapse.metrics import (
+    REGISTRY,
+    SERVER_NAME_LABEL,
+    InFlightGauge,
+    LaterGauge,
+    all_later_gauges_to_clean_up_on_shutdown,
+    generate_latest,
+)
 from synapse.util.caches.deferred_cache import DeferredCache
 
 from tests import unittest
 
 
-def get_sample_labels_value(sample: Sample) -> Tuple[Dict[str, str], float]:
+def get_sample_labels_value(sample: Sample) -> tuple[dict[str, str], float]:
     """Extract the labels and values of a sample.
 
     prometheus_client 0.5 changed the sample type to a named tuple with more
@@ -47,7 +62,7 @@ def get_sample_labels_value(sample: Sample) -> Tuple[Dict[str, str], float]:
     # Otherwise fall back to treating it as a plain 3 tuple.
     else:
         # In older versions of prometheus_client Sample was a 3-tuple.
-        labels: Dict[str, str]
+        labels: dict[str, str]
         value: float
         _, labels, value = sample  # type: ignore[misc]
         return labels, value
@@ -120,7 +135,7 @@ class TestMauLimit(unittest.TestCase):
 
     def get_metrics_from_gauge(
         self, gauge: InFlightGauge
-    ) -> Dict[str, Dict[Tuple[str, ...], float]]:
+    ) -> dict[str, dict[tuple[str, ...], float]]:
         results = {}
 
         for r in gauge.collect():
@@ -157,7 +172,10 @@ class CacheMetricsTests(unittest.HomeserverTestCase):
         """
         CACHE_NAME = "cache_metrics_test_fgjkbdfg"
         cache: DeferredCache[str, str] = DeferredCache(
-            name=CACHE_NAME, server_name=self.hs.hostname, max_entries=777
+            name=CACHE_NAME,
+            clock=self.hs.get_clock(),
+            server_name=self.hs.hostname,
+            max_entries=777,
         )
 
         metrics_map = get_latest_metrics()
@@ -205,10 +223,10 @@ class CacheMetricsTests(unittest.HomeserverTestCase):
         """
         CACHE_NAME = "cache_metric_multiple_servers_test"
         cache1: DeferredCache[str, str] = DeferredCache(
-            name=CACHE_NAME, server_name="hs1", max_entries=777
+            name=CACHE_NAME, clock=self.clock, server_name="hs1", max_entries=777
         )
         cache2: DeferredCache[str, str] = DeferredCache(
-            name=CACHE_NAME, server_name="hs2", max_entries=777
+            name=CACHE_NAME, clock=self.clock, server_name="hs2", max_entries=777
         )
 
         metrics_map = get_latest_metrics()
@@ -285,7 +303,96 @@ class CacheMetricsTests(unittest.HomeserverTestCase):
         self.assertEqual(hs2_cache_max_size_metric_value, "777.0")
 
 
-def get_latest_metrics() -> Dict[str, str]:
+class LaterGaugeTests(unittest.HomeserverTestCase):
+    def setUp(self) -> None:
+        super().setUp()
+        self.later_gauge = LaterGauge(
+            name="foo",
+            desc="",
+            labelnames=[SERVER_NAME_LABEL],
+        )
+
+    def tearDown(self) -> None:
+        super().tearDown()
+
+        REGISTRY.unregister(self.later_gauge)
+        all_later_gauges_to_clean_up_on_shutdown.pop(self.later_gauge.name, None)
+
+    def test_later_gauge_multiple_servers(self) -> None:
+        """
+        Test that LaterGauge metrics are reported correctly across multiple servers. We
+        will have an metrics entry for each homeserver that is labeled with the
+        `server_name` label.
+        """
+        self.later_gauge.register_hook(
+            homeserver_instance_id="123", hook=lambda: {("hs1",): 1}
+        )
+        self.later_gauge.register_hook(
+            homeserver_instance_id="456", hook=lambda: {("hs2",): 2}
+        )
+
+        metrics_map = get_latest_metrics()
+
+        # Find the metrics from both homeservers
+        hs1_metric = 'foo{server_name="hs1"}'
+        hs1_metric_value = metrics_map.get(hs1_metric)
+        self.assertIsNotNone(
+            hs1_metric_value,
+            f"Missing metric {hs1_metric} in metrics {metrics_map}",
+        )
+        self.assertEqual(hs1_metric_value, "1.0")
+
+        hs2_metric = 'foo{server_name="hs2"}'
+        hs2_metric_value = metrics_map.get(hs2_metric)
+        self.assertIsNotNone(
+            hs2_metric_value,
+            f"Missing metric {hs2_metric} in metrics {metrics_map}",
+        )
+        self.assertEqual(hs2_metric_value, "2.0")
+
+    def test_later_gauge_hook_exception(self) -> None:
+        """
+        Test that LaterGauge metrics are collected across multiple servers even if one
+        hooks is throwing an exception.
+        """
+
+        def raise_exception() -> NoReturn:
+            raise Exception("fake error generating data")
+
+        # Make the hook for hs1 throw an exception
+        self.later_gauge.register_hook(
+            homeserver_instance_id="123", hook=raise_exception
+        )
+        # Metrics from hs2 still work fine
+        self.later_gauge.register_hook(
+            homeserver_instance_id="456", hook=lambda: {("hs2",): 2}
+        )
+
+        metrics_map = get_latest_metrics()
+
+        # Since we encountered an exception while trying to collect metrics from hs1, we
+        # don't expect to see it here.
+        hs1_metric = 'foo{server_name="hs1"}'
+        hs1_metric_value = metrics_map.get(hs1_metric)
+        self.assertIsNone(
+            hs1_metric_value,
+            (
+                "Since we encountered an exception while trying to collect metrics from hs1"
+                f"we don't expect to see it the metrics_map {metrics_map}"
+            ),
+        )
+
+        # We should still see metrics from hs2 though
+        hs2_metric = 'foo{server_name="hs2"}'
+        hs2_metric_value = metrics_map.get(hs2_metric)
+        self.assertIsNotNone(
+            hs2_metric_value,
+            f"Missing metric {hs2_metric} in cache metrics {metrics_map}",
+        )
+        self.assertEqual(hs2_metric_value, "2.0")
+
+
+def get_latest_metrics() -> dict[str, str]:
     """
     Collect the latest metrics from the registry and parse them into an easy to use map.
     The key includes the metric name and labels.
diff --git a/tests/metrics/test_phone_home_stats.py b/tests/metrics/test_phone_home_stats.py
index cf18d8635d..dfb88588cd 100644
--- a/tests/metrics/test_phone_home_stats.py
+++ b/tests/metrics/test_phone_home_stats.py
@@ -17,13 +17,13 @@ from unittest.mock import AsyncMock
 from twisted.internet.testing import MemoryReactor
 
 from synapse.app.phone_stats_home import (
-    PHONE_HOME_INTERVAL_SECONDS,
+    PHONE_HOME_INTERVAL,
     start_phone_stats_home,
 )
 from synapse.rest import admin, login, register, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import ThreadedMemoryReactorClock
@@ -78,7 +78,7 @@ class PhoneHomeStatsTestCase(unittest.HomeserverTestCase):
 
     def _get_latest_phone_home_stats(self) -> JsonDict:
         # Wait for `phone_stats_home` to be called again + a healthy margin (50s).
-        self.reactor.advance(2 * PHONE_HOME_INTERVAL_SECONDS + 50)
+        self.reactor.advance(2 * PHONE_HOME_INTERVAL.as_secs() + 50)
 
         # Extract the reported stats from our http client mock
         mock_calls = self.put_json_mock.call_args_list
diff --git a/tests/module_api/test_account_data_manager.py b/tests/module_api/test_account_data_manager.py
index 6539871c11..0397c6a786 100644
--- a/tests/module_api/test_account_data_manager.py
+++ b/tests/module_api/test_account_data_manager.py
@@ -23,7 +23,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.api.errors import SynapseError
 from synapse.rest import admin
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/module_api/test_api.py b/tests/module_api/test_api.py
index 6b761de36d..12c8942bc8 100644
--- a/tests/module_api/test_api.py
+++ b/tests/module_api/test_api.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict, Optional
+from typing import Any
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet import defer
@@ -36,7 +36,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, notifications, presence, profile, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.events.test_presence_router import send_presence_update, sync_presence
 from tests.replication._base import BaseMultiWorkerStreamTestCase
@@ -803,10 +803,10 @@ class ModuleApiTestCase(BaseModuleApiTestCase):
         )
 
         # Setup a callback counting the number of pushers.
-        number_of_pushers_in_callback: Optional[int] = None
+        number_of_pushers_in_callback: int | None = None
 
         async def _on_logged_out_mock(
-            user_id: str, device_id: Optional[str], access_token: str
+            user_id: str, device_id: str | None, access_token: str
         ) -> None:
             nonlocal number_of_pushers_in_callback
             number_of_pushers_in_callback = len(
@@ -839,7 +839,7 @@ class ModuleApiWorkerTestCase(BaseModuleApiTestCase, BaseMultiWorkerStreamTestCa
         presence.register_servlets,
     ]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         conf = super().default_config()
         conf["stream_writers"] = {"presence": ["presence_writer"]}
         conf["instance_map"] = {
diff --git a/tests/module_api/test_event_unsigned_addition.py b/tests/module_api/test_event_unsigned_addition.py
index 52e3858e6f..b6b43c469f 100644
--- a/tests/module_api/test_event_unsigned_addition.py
+++ b/tests/module_api/test_event_unsigned_addition.py
@@ -24,7 +24,7 @@ from synapse.events import EventBase
 from synapse.rest import admin, login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/module_api/test_spamchecker.py b/tests/module_api/test_spamchecker.py
index fa19232ee9..42ef969ce0 100644
--- a/tests/module_api/test_spamchecker.py
+++ b/tests/module_api/test_spamchecker.py
@@ -12,15 +12,16 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 #
-from typing import Literal, Union
+from typing import Literal
 
 from twisted.internet.testing import MemoryReactor
 
+from synapse.api.constants import EventContentFields, EventTypes
 from synapse.config.server import DEFAULT_ROOM_VERSION
 from synapse.rest import admin, login, room, room_upgrade_rest_servlet
 from synapse.server import HomeServer
 from synapse.types import Codes, JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.server import FakeChannel
 from tests.unittest import HomeserverTestCase
@@ -51,14 +52,14 @@ class SpamCheckerTestCase(HomeserverTestCase):
 
         return channel
 
-    def test_may_user_create_room(self) -> None:
-        """Test that the may_user_create_room callback is called when a user
+    def test_user_may_create_room(self) -> None:
+        """Test that the user_may_create_room callback is called when a user
         creates a room, and that it receives the correct parameters.
         """
 
         async def user_may_create_room(
             user_id: str, room_config: JsonDict
-        ) -> Union[Literal["NOT_SPAM"], Codes]:
+        ) -> Literal["NOT_SPAM"] | Codes:
             self.last_room_config = room_config
             self.last_user_id = user_id
             return "NOT_SPAM"
@@ -67,22 +68,56 @@ class SpamCheckerTestCase(HomeserverTestCase):
             user_may_create_room=user_may_create_room
         )
 
-        channel = self.create_room({"foo": "baa"})
+        expected_room_config = {"foo": "baa"}
+        channel = self.create_room(expected_room_config)
+
         self.assertEqual(channel.code, 200)
         self.assertEqual(self.last_user_id, self.user_id)
-        self.assertEqual(self.last_room_config["foo"], "baa")
+        self.assertEqual(self.last_room_config, expected_room_config)
 
-    def test_may_user_create_room_on_upgrade(self) -> None:
-        """Test that the may_user_create_room callback is called when a room is upgraded."""
+    def test_user_may_create_room_with_initial_state(self) -> None:
+        """Test that the user_may_create_room callback is called when a user
+        creates a room with some initial state events, and that it receives the correct parameters.
+        """
+
+        async def user_may_create_room(
+            user_id: str, room_config: JsonDict
+        ) -> Literal["NOT_SPAM"] | Codes:
+            self.last_room_config = room_config
+            self.last_user_id = user_id
+            return "NOT_SPAM"
+
+        self._module_api.register_spam_checker_callbacks(
+            user_may_create_room=user_may_create_room
+        )
+
+        expected_room_config = {
+            "foo": "baa",
+            "initial_state": [
+                {
+                    "type": EventTypes.Topic,
+                    "content": {EventContentFields.TOPIC: "foo"},
+                }
+            ],
+        }
+        channel = self.create_room(expected_room_config)
+
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(self.last_user_id, self.user_id)
+        self.assertEqual(self.last_room_config, expected_room_config)
+
+    def test_user_may_create_room_on_upgrade(self) -> None:
+        """Test that the user_may_create_room callback is called when a room is upgraded."""
 
         # First, create a room to upgrade.
-        channel = self.create_room({"topic": "foo"})
+        channel = self.create_room({EventContentFields.TOPIC: "foo"})
+
         self.assertEqual(channel.code, 200)
         room_id = channel.json_body["room_id"]
 
         async def user_may_create_room(
             user_id: str, room_config: JsonDict
-        ) -> Union[Literal["NOT_SPAM"], Codes]:
+        ) -> Literal["NOT_SPAM"] | Codes:
             self.last_room_config = room_config
             self.last_user_id = user_id
             return "NOT_SPAM"
@@ -107,19 +142,21 @@ class SpamCheckerTestCase(HomeserverTestCase):
         # Check that the initial state received by callback contains the topic event.
         self.assertTrue(
             any(
-                event[0][0] == "m.room.topic" and event[1].get("topic") == "foo"
+                event.get("type") == EventTypes.Topic
+                and event.get("state_key") == ""
+                and event.get("content").get(EventContentFields.TOPIC) == "foo"
                 for event in self.last_room_config["initial_state"]
             )
         )
 
-    def test_may_user_create_room_disallowed(self) -> None:
-        """Test that the codes response from may_user_create_room callback is respected
+    def test_user_may_create_room_disallowed(self) -> None:
+        """Test that the codes response from user_may_create_room callback is respected
         and returned via the API.
         """
 
         async def user_may_create_room(
             user_id: str, room_config: JsonDict
-        ) -> Union[Literal["NOT_SPAM"], Codes]:
+        ) -> Literal["NOT_SPAM"] | Codes:
             self.last_room_config = room_config
             self.last_user_id = user_id
             return Codes.UNAUTHORIZED
@@ -128,21 +165,23 @@ class SpamCheckerTestCase(HomeserverTestCase):
             user_may_create_room=user_may_create_room
         )
 
-        channel = self.create_room({"foo": "baa"})
+        expected_room_config = {"foo": "baa"}
+        channel = self.create_room(expected_room_config)
+
         self.assertEqual(channel.code, 403)
         self.assertEqual(channel.json_body["errcode"], Codes.UNAUTHORIZED)
         self.assertEqual(self.last_user_id, self.user_id)
-        self.assertEqual(self.last_room_config["foo"], "baa")
+        self.assertEqual(self.last_room_config, expected_room_config)
 
-    def test_may_user_create_room_compatibility(self) -> None:
-        """Test that the may_user_create_room callback is called when a user
+    def test_user_may_create_room_compatibility(self) -> None:
+        """Test that the user_may_create_room callback is called when a user
         creates a room for a module that uses the old callback signature
         (without the `room_config` parameter)
         """
 
         async def user_may_create_room(
             user_id: str,
-        ) -> Union[Literal["NOT_SPAM"], Codes]:
+        ) -> Literal["NOT_SPAM"] | Codes:
             self.last_user_id = user_id
             return "NOT_SPAM"
 
@@ -151,6 +190,7 @@ class SpamCheckerTestCase(HomeserverTestCase):
         )
 
         channel = self.create_room({"foo": "baa"})
+
         self.assertEqual(channel.code, 200)
         self.assertEqual(self.last_user_id, self.user_id)
 
@@ -165,7 +205,7 @@ class SpamCheckerTestCase(HomeserverTestCase):
             event_type: str,
             state_key: str,
             content: JsonDict,
-        ) -> Union[Literal["NOT_SPAM"], Codes]:
+        ) -> Literal["NOT_SPAM"] | Codes:
             self.last_user_id = user_id
             self.last_room_id = room_id
             self.last_event_type = event_type
@@ -178,6 +218,7 @@ class SpamCheckerTestCase(HomeserverTestCase):
         )
 
         channel = self.create_room({})
+
         self.assertEqual(channel.code, 200)
 
         room_id = channel.json_body["room_id"]
@@ -214,7 +255,7 @@ class SpamCheckerTestCase(HomeserverTestCase):
             event_type: str,
             state_key: str,
             content: JsonDict,
-        ) -> Union[Literal["NOT_SPAM"], Codes]:
+        ) -> Literal["NOT_SPAM"] | Codes:
             return Codes.FORBIDDEN
 
         self._module_api.register_spam_checker_callbacks(
@@ -222,6 +263,7 @@ class SpamCheckerTestCase(HomeserverTestCase):
         )
 
         channel = self.create_room({})
+
         self.assertEqual(channel.code, 200)
 
         room_id = channel.json_body["room_id"]
diff --git a/tests/push/test_bulk_push_rule_evaluator.py b/tests/push/test_bulk_push_rule_evaluator.py
index fad5c7affb..137bbe24b2 100644
--- a/tests/push/test_bulk_push_rule_evaluator.py
+++ b/tests/push/test_bulk_push_rule_evaluator.py
@@ -19,7 +19,8 @@
 #
 #
 
-from typing import Any, Optional
+from http import HTTPStatus
+from typing import Any
 from unittest.mock import AsyncMock, patch
 
 from parameterized import parameterized
@@ -30,10 +31,10 @@ from synapse.api.constants import EventContentFields, EventTypes, RelationTypes
 from synapse.api.room_versions import RoomVersions
 from synapse.push.bulk_push_rule_evaluator import BulkPushRuleEvaluator
 from synapse.rest import admin
-from synapse.rest.client import login, register, room
+from synapse.rest.client import login, push_rule, register, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase, override_config
 
@@ -44,6 +45,7 @@ class TestBulkPushRuleEvaluator(HomeserverTestCase):
         room.register_servlets,
         login.register_servlets,
         register.register_servlets,
+        push_rule.register_servlets,
     ]
 
     def prepare(
@@ -208,7 +210,7 @@ class TestBulkPushRuleEvaluator(HomeserverTestCase):
     def _create_and_process(
         self,
         bulk_evaluator: BulkPushRuleEvaluator,
-        content: Optional[JsonDict] = None,
+        content: JsonDict | None = None,
         type: str = "test",
     ) -> bool:
         """Returns true iff the `mentions` trigger an event push action."""
@@ -494,6 +496,135 @@ class TestBulkPushRuleEvaluator(HomeserverTestCase):
             )
         )
 
+    @override_config({"experimental_features": {"msc4306_enabled": True}})
+    def test_thread_subscriptions_suppression_after_keyword_mention_overrides(
+        self,
+    ) -> None:
+        """
+        Tests one of the purposes of the `postcontent` push rule section:
+        When a keyword mention is configured (in the `content` section),
+        it does not get suppressed by the thread being unsubscribed.
+        """
+        # add a keyword mention to alice's push rules
+        channel = self.make_request(
+            "PUT",
+            "/_matrix/client/v3/pushrules/global/content/biscuits",
+            {"pattern": "biscuits", "actions": ["notify"]},
+            access_token=self.token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.OK)
+
+        bulk_evaluator = BulkPushRuleEvaluator(self.hs)
+        (thread_root_id,) = self.helper.send_messages(self.room_id, 1, tok=self.token)
+
+        self.assertFalse(
+            self._create_and_process(
+                bulk_evaluator,
+                {
+                    "msgtype": "m.text",
+                    "body": "do you want some cookies?",
+                    "m.relates_to": {
+                        "rel_type": RelationTypes.THREAD,
+                        "event_id": thread_root_id,
+                    },
+                },
+                type="m.room.message",
+            ),
+            "alice is not subscribed to thread and does not have a mention on 'cookies' so should not be notified",
+        )
+
+        self.assertTrue(
+            self._create_and_process(
+                bulk_evaluator,
+                {
+                    "msgtype": "m.text",
+                    "body": "biscuits are available in the kitchen",
+                    "m.relates_to": {
+                        "rel_type": RelationTypes.THREAD,
+                        "event_id": thread_root_id,
+                    },
+                },
+                type="m.room.message",
+            ),
+            "alice is not subscribed to thread but DOES have a mention on 'biscuits' so should be notified",
+        )
+
+    @override_config({"experimental_features": {"msc4306_enabled": True}})
+    def test_thread_subscriptions_notification_before_keywords_and_mentions(
+        self,
+    ) -> None:
+        """
+        Tests one of the purposes of the `postcontent` push rule section:
+        When a room is set to (what is commonly known as) 'keywords & mentions', we still receive notifications
+        for messages in threads that we are subscribed to.
+        Effectively making this 'keywords, mentions & subscriptions'
+        """
+        # add a 'keywords & mentions' setting to the room alice's push rules
+        # In case this rule isn't clear: by adding a rule in the `room` section that does nothing,
+        # it stops execution of the push rules before we fall through to the `underride` section,
+        # where intuitively many kinds of messages will ambiently generate notifications.
+        # Mentions and keywords are triggered before the `room` block, so this doesn't suppress those.
+        channel = self.make_request(
+            "PUT",
+            f"/_matrix/client/v3/pushrules/global/room/{self.room_id}",
+            {"actions": []},
+            access_token=self.token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.OK)
+
+        bulk_evaluator = BulkPushRuleEvaluator(self.hs)
+        (thread_root_id,) = self.helper.send_messages(self.room_id, 1, tok=self.token)
+
+        # sanity check that our mentions still work
+        self.assertFalse(
+            self._create_and_process(
+                bulk_evaluator,
+                {
+                    "msgtype": "m.text",
+                    "body": "this is a plain message with no mention",
+                },
+                type="m.room.message",
+            ),
+            "alice should not be notified (mentions & keywords room setting)",
+        )
+        self.assertTrue(
+            self._create_and_process(
+                bulk_evaluator,
+                {
+                    "msgtype": "m.text",
+                    "body": "this is a message that mentions alice",
+                },
+                type="m.room.message",
+            ),
+            "alice should be notified (mentioned)",
+        )
+
+        # let's have alice subscribe to the thread
+        self.get_success(
+            self.hs.get_datastores().main.subscribe_user_to_thread(
+                self.alice,
+                self.room_id,
+                thread_root_id,
+                automatic_event_orderings=None,
+            )
+        )
+
+        self.assertTrue(
+            self._create_and_process(
+                bulk_evaluator,
+                {
+                    "msgtype": "m.text",
+                    "body": "some message in the thread",
+                    "m.relates_to": {
+                        "rel_type": RelationTypes.THREAD,
+                        "event_id": thread_root_id,
+                    },
+                },
+                type="m.room.message",
+            ),
+            "alice is subscribed to thread so should be notified",
+        )
+
     def test_with_disabled_thread_subscriptions(self) -> None:
         """
         Test what happens with threaded events when MSC4306 is disabled.
diff --git a/tests/push/test_email.py b/tests/push/test_email.py
index 4d885c78eb..d3822b8643 100644
--- a/tests/push/test_email.py
+++ b/tests/push/test_email.py
@@ -18,12 +18,12 @@
 #
 #
 import email.message
+import importlib.resources as importlib_resources
 import os
 from http import HTTPStatus
-from typing import Any, Dict, List, Sequence, Tuple
+from typing import Any, Sequence
 
 import attr
-import pkg_resources
 from parameterized import parameterized
 
 from twisted.internet.defer import Deferred
@@ -31,11 +31,12 @@ from twisted.internet.testing import MemoryReactor
 
 import synapse.rest.admin
 from synapse.api.errors import Codes, SynapseError
+from synapse.logging.context import make_deferred_yieldable
 from synapse.push.emailpusher import EmailPusher
 from synapse.rest.client import login, room
 from synapse.rest.synapse.client.unsubscribe import UnsubscribeResource
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.server import FakeSite, make_request
 from tests.unittest import HomeserverTestCase
@@ -59,11 +60,12 @@ class EmailPusherTests(HomeserverTestCase):
 
     def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
         config = self.default_config()
+        templates = (
+            importlib_resources.files("synapse").joinpath("res").joinpath("templates")
+        )
         config["email"] = {
             "enable_notifs": True,
-            "template_dir": os.path.abspath(
-                pkg_resources.resource_filename("synapse", "res/templates")
-            ),
+            "template_dir": os.path.abspath(str(templates)),
             "expiry_template_html": "notice_expiry.html",
             "expiry_template_text": "notice_expiry.txt",
             "notif_template_html": "notif_mail.html",
@@ -81,14 +83,14 @@ class EmailPusherTests(HomeserverTestCase):
 
         hs = self.setup_test_homeserver(config=config)
 
-        # List[Tuple[Deferred, args, kwargs]]
-        self.email_attempts: List[Tuple[Deferred, Sequence, Dict]] = []
+        # list[tuple[Deferred, args, kwargs]]
+        self.email_attempts: list[tuple[Deferred, Sequence, dict]] = []
 
         def sendmail(*args: Any, **kwargs: Any) -> Deferred:
             # This mocks out synapse.reactor.send_email._sendmail.
             d: Deferred = Deferred()
             self.email_attempts.append((d, args, kwargs))
-            return d
+            return make_deferred_yieldable(d)
 
         hs.get_send_email_handler()._sendmail = sendmail  # type: ignore[assignment]
 
@@ -508,7 +510,7 @@ class EmailPusherTests(HomeserverTestCase):
         )
         self.assertEqual(len(pushers), 0)
 
-    def _check_for_mail(self) -> Tuple[Sequence, Dict]:
+    def _check_for_mail(self) -> tuple[Sequence, dict]:
         """
         Assert that synapse sent off exactly one email notification.
 
diff --git a/tests/push/test_http.py b/tests/push/test_http.py
index 370233c730..ca2ced01ed 100644
--- a/tests/push/test_http.py
+++ b/tests/push/test_http.py
@@ -17,7 +17,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict, List, Tuple
+from typing import Any
 from unittest.mock import Mock
 
 from parameterized import parameterized
@@ -32,7 +32,7 @@ from synapse.rest.admin.experimental_features import ExperimentalFeature
 from synapse.rest.client import login, push_rule, pusher, receipts, room, versions
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase, override_config
 
@@ -51,7 +51,7 @@ class HTTPPusherTests(HomeserverTestCase):
     hijack_auth = False
 
     def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
-        self.push_attempts: List[Tuple[Deferred, str, dict]] = []
+        self.push_attempts: list[tuple[Deferred, str, dict]] = []
 
         m = Mock()
 
@@ -747,7 +747,7 @@ class HTTPPusherTests(HomeserverTestCase):
 
     def _make_user_with_pusher(
         self, username: str, enabled: bool = True
-    ) -> Tuple[str, str]:
+    ) -> tuple[str, str]:
         """Registers a user and creates a pusher for them.
 
         Args:
@@ -925,7 +925,7 @@ class HTTPPusherTests(HomeserverTestCase):
         ret = self.get_success(
             self.hs.get_datastores().main.get_pushers_by({"user_name": user_id})
         )
-        pushers: List[PusherConfig] = list(ret)
+        pushers: list[PusherConfig] = list(ret)
 
         # Check that we still have one pusher, and that the device ID associated with
         # it didn't change.
@@ -1118,7 +1118,7 @@ class HTTPPusherTests(HomeserverTestCase):
         device_id = user_tuple.device_id
 
         # Set the push data dict based on test input parameters
-        push_data: Dict[str, Any] = {
+        push_data: dict[str, Any] = {
             "url": "http://example.com/_matrix/push/v1/notify",
         }
         if disable_badge_count:
diff --git a/tests/push/test_presentable_names.py b/tests/push/test_presentable_names.py
index bd42fc0580..2558f2c0b2 100644
--- a/tests/push/test_presentable_names.py
+++ b/tests/push/test_presentable_names.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Iterable, List, Optional, Tuple, cast
+from typing import Iterable, cast
 
 from synapse.api.constants import EventTypes, Membership
 from synapse.api.room_versions import RoomVersions
@@ -36,7 +36,7 @@ class MockDataStore:
     (I.e. the state key is used as the event ID.)
     """
 
-    def __init__(self, events: Iterable[Tuple[StateKey, dict]]):
+    def __init__(self, events: Iterable[tuple[StateKey, dict]]):
         """
         Args:
             events: A state map to event contents.
@@ -59,11 +59,11 @@ class MockDataStore:
 
     async def get_event(
         self, event_id: str, allow_none: bool = False
-    ) -> Optional[FrozenEvent]:
+    ) -> FrozenEvent | None:
         assert allow_none, "Mock not configured for allow_none = False"
 
         # Decode the state key from the event ID.
-        state_key = cast(Tuple[str, str], tuple(event_id.split("|", 1)))
+        state_key = cast(tuple[str, str], tuple(event_id.split("|", 1)))
         return self._events.get(state_key)
 
     async def get_events(self, event_ids: Iterable[StateKey]) -> StateMap[EventBase]:
@@ -77,11 +77,11 @@ class PresentableNamesTestCase(unittest.HomeserverTestCase):
 
     def _calculate_room_name(
         self,
-        events: Iterable[Tuple[Tuple[str, str], dict]],
+        events: Iterable[tuple[tuple[str, str], dict]],
         user_id: str = "",
         fallback_to_members: bool = True,
         fallback_to_single_member: bool = True,
-    ) -> Optional[str]:
+    ) -> str | None:
         # Encode the state key into the event ID.
         room_state_ids = {k[0]: "|".join(k[0]) for k in events}
 
@@ -97,7 +97,7 @@ class PresentableNamesTestCase(unittest.HomeserverTestCase):
 
     def test_name(self) -> None:
         """A room name event should be used."""
-        events: List[Tuple[Tuple[str, str], dict]] = [
+        events: list[tuple[tuple[str, str], dict]] = [
             ((EventTypes.Name, ""), {"name": "test-name"}),
         ]
         self.assertEqual("test-name", self._calculate_room_name(events))
@@ -111,7 +111,7 @@ class PresentableNamesTestCase(unittest.HomeserverTestCase):
 
     def test_canonical_alias(self) -> None:
         """An canonical alias should be used."""
-        events: List[Tuple[Tuple[str, str], dict]] = [
+        events: list[tuple[tuple[str, str], dict]] = [
             ((EventTypes.CanonicalAlias, ""), {"alias": "#test-name:test"}),
         ]
         self.assertEqual("#test-name:test", self._calculate_room_name(events))
@@ -125,7 +125,7 @@ class PresentableNamesTestCase(unittest.HomeserverTestCase):
 
     def test_invite(self) -> None:
         """An invite has special behaviour."""
-        events: List[Tuple[Tuple[str, str], dict]] = [
+        events: list[tuple[tuple[str, str], dict]] = [
             ((EventTypes.Member, self.USER_ID), {"membership": Membership.INVITE}),
             ((EventTypes.Member, self.OTHER_USER_ID), {"displayname": "Other User"}),
         ]
@@ -151,7 +151,7 @@ class PresentableNamesTestCase(unittest.HomeserverTestCase):
 
     def test_no_members(self) -> None:
         """Behaviour of an empty room."""
-        events: List[Tuple[Tuple[str, str], dict]] = []
+        events: list[tuple[tuple[str, str], dict]] = []
         self.assertEqual("Empty Room", self._calculate_room_name(events))
 
         # Note that events with invalid (or missing) membership are ignored.
diff --git a/tests/push/test_push_rule_evaluator.py b/tests/push/test_push_rule_evaluator.py
index 3a351acffa..a786d74bf1 100644
--- a/tests/push/test_push_rule_evaluator.py
+++ b/tests/push/test_push_rule_evaluator.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, Dict, List, Optional, Union, cast
+from typing import Any, cast
 
 from twisted.internet.testing import MemoryReactor
 
@@ -36,7 +36,7 @@ from synapse.server import HomeServer
 from synapse.storage.databases.main.appservice import _make_exclusive_regex
 from synapse.synapse_rust.push import PushRuleEvaluator
 from synapse.types import JsonDict, JsonMapping, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.frozenutils import freeze
 
 from tests import unittest
@@ -60,7 +60,7 @@ class FlattenDictTestCase(unittest.TestCase):
 
     def test_non_string(self) -> None:
         """String, booleans, ints, nulls and list of those should be kept while other items are dropped."""
-        input: Dict[str, Any] = {
+        input: dict[str, Any] = {
             "woo": "woo",
             "foo": True,
             "bar": 1,
@@ -148,7 +148,7 @@ class PushRuleEvaluatorTestCase(unittest.TestCase):
         self,
         content: JsonMapping,
         *,
-        related_events: Optional[JsonDict] = None,
+        related_events: JsonDict | None = None,
         msc4210: bool = False,
         msc4306: bool = False,
     ) -> PushRuleEvaluator:
@@ -165,13 +165,13 @@ class PushRuleEvaluatorTestCase(unittest.TestCase):
         )
         room_member_count = 0
         sender_power_level = 0
-        power_levels: Dict[str, Union[int, Dict[str, int]]] = {}
+        power_levels: dict[str, int | dict[str, int]] = {}
         return PushRuleEvaluator(
             _flatten_dict(event),
             False,
             room_member_count,
             sender_power_level,
-            cast(Dict[str, int], power_levels.get("notifications", {})),
+            cast(dict[str, int], power_levels.get("notifications", {})),
             {} if related_events is None else related_events,
             related_event_match_enabled=True,
             room_version_feature_flags=event.room_version.msc3931_push_features,
@@ -205,13 +205,13 @@ class PushRuleEvaluatorTestCase(unittest.TestCase):
         self.assertTrue(evaluator.matches(condition, "@user:test", "foo bar"))
 
     def _assert_matches(
-        self, condition: JsonDict, content: JsonMapping, msg: Optional[str] = None
+        self, condition: JsonDict, content: JsonMapping, msg: str | None = None
     ) -> None:
         evaluator = self._get_evaluator(content)
         self.assertTrue(evaluator.matches(condition, "@user:test", "display_name"), msg)
 
     def _assert_not_matches(
-        self, condition: JsonDict, content: JsonDict, msg: Optional[str] = None
+        self, condition: JsonDict, content: JsonDict, msg: str | None = None
     ) -> None:
         evaluator = self._get_evaluator(content)
         self.assertFalse(
@@ -588,7 +588,7 @@ class PushRuleEvaluatorTestCase(unittest.TestCase):
         This tests the behaviour of tweaks_for_actions.
         """
 
-        actions: List[Union[Dict[str, str], str]] = [
+        actions: list[dict[str, str] | str] = [
             {"set_tweak": "sound", "value": "default"},
             {"set_tweak": "highlight"},
             "notify",
diff --git a/tests/replication/_base.py b/tests/replication/_base.py
index 453eb7750b..b23696668f 100644
--- a/tests/replication/_base.py
+++ b/tests/replication/_base.py
@@ -19,7 +19,7 @@
 #
 import logging
 from collections import defaultdict
-from typing import Any, Dict, List, Optional, Set, Tuple
+from typing import Any
 
 from twisted.internet.address import IPv4Address
 from twisted.internet.protocol import Protocol, connectionDone
@@ -32,14 +32,13 @@ from synapse.config.workers import InstanceTcpLocationConfig, InstanceUnixLocati
 from synapse.http.site import SynapseRequest, SynapseSite
 from synapse.replication.http import ReplicationRestResource
 from synapse.replication.tcp.client import ReplicationDataHandler
-from synapse.replication.tcp.handler import ReplicationCommandHandler
 from synapse.replication.tcp.protocol import (
     ClientReplicationStreamProtocol,
     ServerReplicationStreamProtocol,
 )
 from synapse.replication.tcp.resource import ReplicationStreamProtocolFactory
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeTransport
@@ -97,7 +96,7 @@ class BaseStreamTestCase(unittest.HomeserverTestCase):
         self.test_handler = self._build_replication_data_handler()
         self.worker_hs._replication_data_handler = self.test_handler  # type: ignore[attr-defined]
 
-        repl_handler = ReplicationCommandHandler(self.worker_hs)
+        repl_handler = self.worker_hs.get_replication_command_handler()
         self.client = ClientReplicationStreamProtocol(
             self.worker_hs,
             "client",
@@ -106,10 +105,10 @@ class BaseStreamTestCase(unittest.HomeserverTestCase):
             repl_handler,
         )
 
-        self._client_transport: Optional[FakeTransport] = None
-        self._server_transport: Optional[FakeTransport] = None
+        self._client_transport: FakeTransport | None = None
+        self._server_transport: FakeTransport | None = None
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         d = super().create_resource_dict()
         d["/_synapse/replication"] = ReplicationRestResource(self.hs)
         return d
@@ -174,11 +173,17 @@ class BaseStreamTestCase(unittest.HomeserverTestCase):
 
         # Set up the server side protocol
         server_address = IPv4Address("TCP", host, port)
-        channel = self.site.buildProtocol((host, port))
+        # The type ignore is here because mypy doesn't think the host/port tuple is of
+        # the correct type, even though it is the exact example given for
+        # `twisted.internet.interfaces.IAddress`.
+        # Mypy was happy with the type before we overrode `buildProtocol` in
+        # `SynapseSite`, probably because there was enough inheritance indirection before
+        # withe the argument not having a type associated with it.
+        channel = self.site.buildProtocol((host, port))  # type: ignore[arg-type]
 
         # hook into the channel's request factory so that we can keep a record
         # of the requests
-        requests: List[SynapseRequest] = []
+        requests: list[SynapseRequest] = []
         real_request_factory = channel.requestFactory
 
         def request_factory(*args: Any, **kwargs: Any) -> SynapseRequest:
@@ -186,7 +191,7 @@ class BaseStreamTestCase(unittest.HomeserverTestCase):
             requests.append(request)
             return request
 
-        channel.requestFactory = request_factory
+        channel.requestFactory = request_factory  # type: ignore[method-assign]
 
         # Connect client to server and vice versa.
         client_to_server_transport = FakeTransport(
@@ -209,7 +214,12 @@ class BaseStreamTestCase(unittest.HomeserverTestCase):
         client_to_server_transport.loseConnection()
 
         # there should have been exactly one request
-        self.assertEqual(len(requests), 1)
+        self.assertEqual(
+            len(requests),
+            1,
+            "Expected to handle exactly one HTTP replication request but saw %d - requests=%s"
+            % (len(requests), requests),
+        )
 
         return requests[0]
 
@@ -246,7 +256,7 @@ class BaseMultiWorkerStreamTestCase(unittest.HomeserverTestCase):
         # Redis replication only takes place on Postgres
         skip = "Requires Postgres"
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         """
         Overrides the default config to enable Redis.
         Even if the test only uses make_worker_hs, the main process needs Redis
@@ -315,7 +325,7 @@ class BaseMultiWorkerStreamTestCase(unittest.HomeserverTestCase):
         return resource
 
     def make_worker_hs(
-        self, worker_app: str, extra_config: Optional[dict] = None, **kwargs: Any
+        self, worker_app: str, extra_config: dict | None = None, **kwargs: Any
     ) -> HomeServer:
         """Make a new worker HS instance, correctly connecting replication
         stream to the master HS.
@@ -428,7 +438,7 @@ class BaseMultiWorkerStreamTestCase(unittest.HomeserverTestCase):
 
         # Set up the server side protocol
         server_address = IPv4Address("TCP", host, port)
-        channel = self._hs_to_site[hs].buildProtocol((host, port))
+        channel = self._hs_to_site[hs].buildProtocol((host, port))  # type: ignore[arg-type]
 
         # Connect client to server and vice versa.
         client_to_server_transport = FakeTransport(
@@ -481,7 +491,7 @@ class TestReplicationDataHandler(ReplicationDataHandler):
         super().__init__(hs)
 
         # list of received (stream_name, token, row) tuples
-        self.received_rdata_rows: List[Tuple[str, int, Any]] = []
+        self.received_rdata_rows: list[tuple[str, int, Any]] = []
 
     async def on_rdata(
         self, stream_name: str, instance_name: str, token: int, rows: list
@@ -495,7 +505,7 @@ class FakeRedisPubSubServer:
     """A fake Redis server for pub/sub."""
 
     def __init__(self) -> None:
-        self._subscribers_by_channel: Dict[bytes, Set["FakeRedisPubSubProtocol"]] = (
+        self._subscribers_by_channel: dict[bytes, set["FakeRedisPubSubProtocol"]] = (
             defaultdict(set)
         )
 
@@ -524,7 +534,7 @@ class FakeRedisPubSubServer:
 class FakeRedisPubSubProtocol(Protocol):
     """A connection from a client talking to the fake Redis server."""
 
-    transport: Optional[FakeTransport] = None
+    transport: FakeTransport | None = None
 
     def __init__(self, server: FakeRedisPubSubServer):
         self._server = server
diff --git a/tests/replication/http/test__base.py b/tests/replication/http/test__base.py
index 31d3163c01..58ea542bef 100644
--- a/tests/replication/http/test__base.py
+++ b/tests/replication/http/test__base.py
@@ -20,7 +20,6 @@
 #
 
 from http import HTTPStatus
-from typing import Tuple
 
 from twisted.web.server import Request
 
@@ -31,9 +30,10 @@ from synapse.replication.http._base import ReplicationEndpoint
 from synapse.server import HomeServer
 from synapse.types import JsonDict
 from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 
 from tests import unittest
-from tests.http.server._base import test_disconnect
+from tests.http.server._base import disconnect_and_assert
 
 
 class CancellableReplicationEndpoint(ReplicationEndpoint):
@@ -52,8 +52,8 @@ class CancellableReplicationEndpoint(ReplicationEndpoint):
     @cancellable
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict
-    ) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+    ) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
 
@@ -73,8 +73,8 @@ class UncancellableReplicationEndpoint(ReplicationEndpoint):
 
     async def _handle_request(  # type: ignore[override]
         self, request: Request, content: JsonDict
-    ) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+    ) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
 
@@ -94,7 +94,7 @@ class ReplicationEndpointCancellationTestCase(unittest.HomeserverTestCase):
         """Test that handlers with the `@cancellable` flag can be cancelled."""
         path = f"{REPLICATION_PREFIX}/{CancellableReplicationEndpoint.NAME}/"
         channel = self.make_request("POST", path, await_result=False, content={})
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=True,
@@ -105,7 +105,7 @@ class ReplicationEndpointCancellationTestCase(unittest.HomeserverTestCase):
         """Test that handlers without the `@cancellable` flag cannot be cancelled."""
         path = f"{REPLICATION_PREFIX}/{UncancellableReplicationEndpoint.NAME}/"
         channel = self.make_request("POST", path, await_result=False, content={})
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=False,
diff --git a/tests/replication/storage/_base.py b/tests/replication/storage/_base.py
index 97e744127c..7b757e9e9e 100644
--- a/tests/replication/storage/_base.py
+++ b/tests/replication/storage/_base.py
@@ -19,13 +19,13 @@
 #
 #
 
-from typing import Any, Callable, Iterable, Optional
+from typing import Any, Callable, Iterable
 from unittest.mock import Mock
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseStreamTestCase
 
@@ -56,8 +56,8 @@ class BaseWorkerStoreTestCase(BaseStreamTestCase):
         self,
         method: str,
         args: Iterable[Any],
-        expected_result: Optional[Any] = None,
-        asserter: Optional[Callable[[Any, Any, Optional[Any]], None]] = None,
+        expected_result: Any | None = None,
+        asserter: Callable[[Any, Any, Any | None], None] | None = None,
     ) -> None:
         if asserter is None:
             asserter = self.assertEqual
diff --git a/tests/replication/storage/test_events.py b/tests/replication/storage/test_events.py
index b3ca204995..b7b94482ef 100644
--- a/tests/replication/storage/test_events.py
+++ b/tests/replication/storage/test_events.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import Any, Iterable, List, Optional, Tuple
+from typing import Any, Iterable
 
 from canonicaljson import encode_canonical_json
 from parameterized import parameterized
@@ -38,7 +38,7 @@ from synapse.storage.databases.main.event_push_actions import (
 from synapse.storage.databases.main.events_worker import EventsWorkerStore
 from synapse.storage.roommember import RoomsForUser
 from synapse.types import PersistedEventPosition
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from ._base import BaseWorkerStoreTestCase
 
@@ -66,7 +66,7 @@ class EventsWorkerStoreTestCase(BaseWorkerStoreTestCase):
         )
 
     def assertEventsEqual(
-        self, first: EventBase, second: EventBase, msg: Optional[Any] = None
+        self, first: EventBase, second: EventBase, msg: Any | None = None
     ) -> None:
         self.assertEqual(
             encode_canonical_json(first.get_pdu_json()),
@@ -101,11 +101,10 @@ class EventsWorkerStoreTestCase(BaseWorkerStoreTestCase):
 
         msg_dict = msg.get_dict()
         msg_dict["content"] = {}
-        msg_dict["unsigned"]["redacted_by"] = redaction.event_id
-        msg_dict["unsigned"]["redacted_because"] = redaction
         redacted = make_event_from_dict(
             msg_dict, internal_metadata_dict=msg.internal_metadata.get_dict()
         )
+        redacted.internal_metadata.redacted_by = redaction.event_id
         self.check(
             "get_event", [msg.event_id], redacted, asserter=self.assertEventsEqual
         )
@@ -125,11 +124,10 @@ class EventsWorkerStoreTestCase(BaseWorkerStoreTestCase):
 
         msg_dict = msg.get_dict()
         msg_dict["content"] = {}
-        msg_dict["unsigned"]["redacted_by"] = redaction.event_id
-        msg_dict["unsigned"]["redacted_because"] = redaction
         redacted = make_event_from_dict(
             msg_dict, internal_metadata_dict=msg.internal_metadata.get_dict()
         )
+        redacted.internal_metadata.redacted_by = redaction.event_id
         self.check(
             "get_event", [msg.event_id], redacted, asserter=self.assertEventsEqual
         )
@@ -241,16 +239,16 @@ class EventsWorkerStoreTestCase(BaseWorkerStoreTestCase):
         sender: str = USER_ID,
         room_id: str = ROOM_ID,
         type: str = "m.room.message",
-        key: Optional[str] = None,
-        internal: Optional[dict] = None,
-        depth: Optional[int] = None,
-        prev_events: Optional[List[Tuple[str, dict]]] = None,
-        auth_events: Optional[List[str]] = None,
-        prev_state: Optional[List[str]] = None,
-        redacts: Optional[str] = None,
+        key: str | None = None,
+        internal: dict | None = None,
+        depth: int | None = None,
+        prev_events: list[tuple[str, dict]] | None = None,
+        auth_events: list[str] | None = None,
+        prev_state: list[str] | None = None,
+        redacts: str | None = None,
         push_actions: Iterable = frozenset(),
         **content: object,
-    ) -> Tuple[EventBase, EventContext]:
+    ) -> tuple[EventBase, EventContext]:
         prev_events = prev_events or []
         auth_events = auth_events or []
         prev_state = prev_state or []
diff --git a/tests/replication/tcp/streams/test_account_data.py b/tests/replication/tcp/streams/test_account_data.py
index 6dea29ae15..d0c189230c 100644
--- a/tests/replication/tcp/streams/test_account_data.py
+++ b/tests/replication/tcp/streams/test_account_data.py
@@ -46,28 +46,39 @@ class AccountDataStreamTestCase(BaseStreamTestCase):
 
         # check we're testing what we think we are: no rows should yet have been
         # received
-        self.assertEqual([], self.test_handler.received_rdata_rows)
+        received_account_data_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == AccountDataStream.NAME
+        ]
+        self.assertEqual([], received_account_data_rows)
 
         # now reconnect to pull the updates
         self.reconnect()
         self.replicate()
 
-        # we should have received all the expected rows in the right order
-        received_rows = self.test_handler.received_rdata_rows
+        # We should have received all the expected rows in the right order
+        #
+        # Filter the updates to only include account data changes
+        received_account_data_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == AccountDataStream.NAME
+        ]
 
         for t in updates:
-            (stream_name, token, row) = received_rows.pop(0)
+            (stream_name, token, row) = received_account_data_rows.pop(0)
             self.assertEqual(stream_name, AccountDataStream.NAME)
             self.assertIsInstance(row, AccountDataStream.AccountDataStreamRow)
             self.assertEqual(row.data_type, t)
             self.assertEqual(row.room_id, "test_room")
 
-        (stream_name, token, row) = received_rows.pop(0)
+        (stream_name, token, row) = received_account_data_rows.pop(0)
         self.assertIsInstance(row, AccountDataStream.AccountDataStreamRow)
         self.assertEqual(row.data_type, "m.global")
         self.assertIsNone(row.room_id)
 
-        self.assertEqual([], received_rows)
+        self.assertEqual([], received_account_data_rows)
 
     def test_update_function_global_account_data_limit(self) -> None:
         """Test replication with many global account data updates"""
@@ -85,32 +96,38 @@ class AccountDataStreamTestCase(BaseStreamTestCase):
             store.add_account_data_to_room("test_user", "test_room", "m.per_room", {})
         )
 
-        # tell the notifier to catch up to avoid duplicate rows.
-        # workaround for https://github.com/matrix-org/synapse/issues/7360
-        # FIXME remove this when the above is fixed
-        self.replicate()
-
         # check we're testing what we think we are: no rows should yet have been
         # received
-        self.assertEqual([], self.test_handler.received_rdata_rows)
+        received_account_data_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == AccountDataStream.NAME
+        ]
+        self.assertEqual([], received_account_data_rows)
 
         # now reconnect to pull the updates
         self.reconnect()
         self.replicate()
 
         # we should have received all the expected rows in the right order
-        received_rows = self.test_handler.received_rdata_rows
+        #
+        # Filter the updates to only include typing changes
+        received_account_data_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == AccountDataStream.NAME
+        ]
 
         for t in updates:
-            (stream_name, token, row) = received_rows.pop(0)
+            (stream_name, token, row) = received_account_data_rows.pop(0)
             self.assertEqual(stream_name, AccountDataStream.NAME)
             self.assertIsInstance(row, AccountDataStream.AccountDataStreamRow)
             self.assertEqual(row.data_type, t)
             self.assertIsNone(row.room_id)
 
-        (stream_name, token, row) = received_rows.pop(0)
+        (stream_name, token, row) = received_account_data_rows.pop(0)
         self.assertIsInstance(row, AccountDataStream.AccountDataStreamRow)
         self.assertEqual(row.data_type, "m.per_room")
         self.assertEqual(row.room_id, "test_room")
 
-        self.assertEqual([], received_rows)
+        self.assertEqual([], received_account_data_rows)
diff --git a/tests/replication/tcp/streams/test_events.py b/tests/replication/tcp/streams/test_events.py
index cd6fe53a96..484fd6b6db 100644
--- a/tests/replication/tcp/streams/test_events.py
+++ b/tests/replication/tcp/streams/test_events.py
@@ -18,7 +18,7 @@
 #
 #
 
-from typing import Any, List, Optional
+from typing import Any
 
 from parameterized import parameterized
 
@@ -30,6 +30,7 @@ from synapse.replication.tcp.commands import RdataCommand
 from synapse.replication.tcp.streams._base import _STREAM_UPDATE_TARGET_ROW_COUNT
 from synapse.replication.tcp.streams.events import (
     _MAX_STATE_UPDATES_PER_ROOM,
+    EventsStream,
     EventsStreamAllStateRow,
     EventsStreamCurrentStateRow,
     EventsStreamEventRow,
@@ -38,7 +39,7 @@ from synapse.replication.tcp.streams.events import (
 from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseStreamTestCase
 from tests.test_utils.event_injection import inject_event, inject_member_event
@@ -82,7 +83,12 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         # check we're testing what we think we are: no rows should yet have been
         # received
-        self.assertEqual([], self.test_handler.received_rdata_rows)
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
+        ]
+        self.assertEqual([], received_event_rows)
 
         # now reconnect to pull the updates
         self.reconnect()
@@ -90,31 +96,34 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         # we should have received all the expected rows in the right order (as
         # well as various cache invalidation updates which we ignore)
-        received_rows = [
-            row for row in self.test_handler.received_rdata_rows if row[0] == "events"
+        #
+        # Filter the updates to only include event changes
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
         ]
-
         for event in events:
-            stream_name, token, row = received_rows.pop(0)
-            self.assertEqual("events", stream_name)
+            stream_name, token, row = received_event_rows.pop(0)
+            self.assertEqual(EventsStream.NAME, stream_name)
             self.assertIsInstance(row, EventsStreamRow)
             self.assertEqual(row.type, "ev")
             self.assertIsInstance(row.data, EventsStreamEventRow)
             self.assertEqual(row.data.event_id, event.event_id)
 
-        stream_name, token, row = received_rows.pop(0)
+        stream_name, token, row = received_event_rows.pop(0)
         self.assertIsInstance(row, EventsStreamRow)
         self.assertIsInstance(row.data, EventsStreamEventRow)
         self.assertEqual(row.data.event_id, state_event.event_id)
 
-        stream_name, token, row = received_rows.pop(0)
+        stream_name, token, row = received_event_rows.pop(0)
         self.assertEqual("events", stream_name)
         self.assertIsInstance(row, EventsStreamRow)
         self.assertEqual(row.type, "state")
         self.assertIsInstance(row.data, EventsStreamCurrentStateRow)
         self.assertEqual(row.data.event_id, state_event.event_id)
 
-        self.assertEqual([], received_rows)
+        self.assertEqual([], received_event_rows)
 
     @parameterized.expand(
         [(_STREAM_UPDATE_TARGET_ROW_COUNT, False), (_MAX_STATE_UPDATES_PER_ROOM, True)]
@@ -170,9 +179,12 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         self.replicate()
         # all those events and state changes should have landed
-        self.assertGreaterEqual(
-            len(self.test_handler.received_rdata_rows), 2 * len(events)
-        )
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
+        ]
+        self.assertGreaterEqual(len(received_event_rows), 2 * len(events))
 
         # disconnect, so that we can stack up the changes
         self.disconnect()
@@ -202,7 +214,12 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         # check we're testing what we think we are: no rows should yet have been
         # received
-        self.assertEqual([], self.test_handler.received_rdata_rows)
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
+        ]
+        self.assertEqual([], received_event_rows)
 
         # now reconnect to pull the updates
         self.reconnect()
@@ -218,33 +235,34 @@ class EventsStreamTestCase(BaseStreamTestCase):
         #       of the states that got reverted.
         # - two rows for state2
 
-        received_rows = [
-            row for row in self.test_handler.received_rdata_rows if row[0] == "events"
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
         ]
-
         # first check the first two rows, which should be the state1 event.
-        stream_name, token, row = received_rows.pop(0)
+        stream_name, token, row = received_event_rows.pop(0)
         self.assertEqual("events", stream_name)
         self.assertIsInstance(row, EventsStreamRow)
         self.assertEqual(row.type, "ev")
         self.assertIsInstance(row.data, EventsStreamEventRow)
         self.assertEqual(row.data.event_id, state1.event_id)
 
-        stream_name, token, row = received_rows.pop(0)
+        stream_name, token, row = received_event_rows.pop(0)
         self.assertIsInstance(row, EventsStreamRow)
         self.assertEqual(row.type, "state")
         self.assertIsInstance(row.data, EventsStreamCurrentStateRow)
         self.assertEqual(row.data.event_id, state1.event_id)
 
         # now the last two rows, which should be the state2 event.
-        stream_name, token, row = received_rows.pop(-2)
+        stream_name, token, row = received_event_rows.pop(-2)
         self.assertEqual("events", stream_name)
         self.assertIsInstance(row, EventsStreamRow)
         self.assertEqual(row.type, "ev")
         self.assertIsInstance(row.data, EventsStreamEventRow)
         self.assertEqual(row.data.event_id, state2.event_id)
 
-        stream_name, token, row = received_rows.pop(-1)
+        stream_name, token, row = received_event_rows.pop(-1)
         self.assertIsInstance(row, EventsStreamRow)
         self.assertEqual(row.type, "state")
         self.assertIsInstance(row.data, EventsStreamCurrentStateRow)
@@ -254,16 +272,16 @@ class EventsStreamTestCase(BaseStreamTestCase):
         if collapse_state_changes:
             # that should leave us with the rows for the PL event, the state changes
             # get collapsed into a single row.
-            self.assertEqual(len(received_rows), 2)
+            self.assertEqual(len(received_event_rows), 2)
 
-            stream_name, token, row = received_rows.pop(0)
+            stream_name, token, row = received_event_rows.pop(0)
             self.assertEqual("events", stream_name)
             self.assertIsInstance(row, EventsStreamRow)
             self.assertEqual(row.type, "ev")
             self.assertIsInstance(row.data, EventsStreamEventRow)
             self.assertEqual(row.data.event_id, pl_event.event_id)
 
-            stream_name, token, row = received_rows.pop(0)
+            stream_name, token, row = received_event_rows.pop(0)
             self.assertIsInstance(row, EventsStreamRow)
             self.assertEqual(row.type, "state-all")
             self.assertIsInstance(row.data, EventsStreamAllStateRow)
@@ -271,9 +289,9 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         else:
             # that should leave us with the rows for the PL event
-            self.assertEqual(len(received_rows), len(events) + 2)
+            self.assertEqual(len(received_event_rows), len(events) + 2)
 
-            stream_name, token, row = received_rows.pop(0)
+            stream_name, token, row = received_event_rows.pop(0)
             self.assertEqual("events", stream_name)
             self.assertIsInstance(row, EventsStreamRow)
             self.assertEqual(row.type, "ev")
@@ -281,8 +299,8 @@ class EventsStreamTestCase(BaseStreamTestCase):
             self.assertEqual(row.data.event_id, pl_event.event_id)
 
             # the state rows are unsorted
-            state_rows: List[EventsStreamCurrentStateRow] = []
-            for stream_name, _, row in received_rows:
+            state_rows: list[EventsStreamCurrentStateRow] = []
+            for stream_name, _, row in received_event_rows:
                 self.assertEqual("events", stream_name)
                 self.assertIsInstance(row, EventsStreamRow)
                 self.assertEqual(row.type, "state")
@@ -337,7 +355,7 @@ class EventsStreamTestCase(BaseStreamTestCase):
             self.hs.get_datastores().main.get_latest_event_ids_in_room(self.room_id)
         )
 
-        events: List[EventBase] = []
+        events: list[EventBase] = []
         for user in user_ids:
             events.extend(
                 self._inject_state_event(sender=user) for _ in range(STATES_PER_USER)
@@ -346,9 +364,12 @@ class EventsStreamTestCase(BaseStreamTestCase):
         self.replicate()
 
         # all those events and state changes should have landed
-        self.assertGreaterEqual(
-            len(self.test_handler.received_rdata_rows), 2 * len(events)
-        )
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
+        ]
+        self.assertGreaterEqual(len(received_event_rows), 2 * len(events))
 
         # disconnect, so that we can stack up the changes
         self.disconnect()
@@ -375,7 +396,12 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         # check we're testing what we think we are: no rows should yet have been
         # received
-        self.assertEqual([], self.test_handler.received_rdata_rows)
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
+        ]
+        self.assertEqual([], received_event_rows)
 
         # now reconnect to pull the updates
         self.reconnect()
@@ -383,14 +409,16 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         # we should have received all the expected rows in the right order (as
         # well as various cache invalidation updates which we ignore)
-        received_rows = [
-            row for row in self.test_handler.received_rdata_rows if row[0] == "events"
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
         ]
-        self.assertGreaterEqual(len(received_rows), len(events))
+        self.assertGreaterEqual(len(received_event_rows), len(events))
         for i in range(NUM_USERS):
             # for each user, we expect the PL event row, followed by state rows for
             # the PL event and each of the states that got reverted.
-            stream_name, token, row = received_rows.pop(0)
+            stream_name, token, row = received_event_rows.pop(0)
             self.assertEqual("events", stream_name)
             self.assertIsInstance(row, EventsStreamRow)
             self.assertEqual(row.type, "ev")
@@ -398,9 +426,9 @@ class EventsStreamTestCase(BaseStreamTestCase):
             self.assertEqual(row.data.event_id, pl_events[i].event_id)
 
             # the state rows are unsorted
-            state_rows: List[EventsStreamCurrentStateRow] = []
+            state_rows: list[EventsStreamCurrentStateRow] = []
             for _ in range(STATES_PER_USER + 1):
-                stream_name, token, row = received_rows.pop(0)
+                stream_name, token, row = received_event_rows.pop(0)
                 self.assertEqual("events", stream_name)
                 self.assertIsInstance(row, EventsStreamRow)
                 self.assertEqual(row.type, "state")
@@ -417,7 +445,7 @@ class EventsStreamTestCase(BaseStreamTestCase):
                 # "None" indicates the state has been deleted
                 self.assertIsNone(sr.event_id)
 
-        self.assertEqual([], received_rows)
+        self.assertEqual([], received_event_rows)
 
     def test_backwards_stream_id(self) -> None:
         """
@@ -432,7 +460,12 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         # check we're testing what we think we are: no rows should yet have been
         # received
-        self.assertEqual([], self.test_handler.received_rdata_rows)
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
+        ]
+        self.assertEqual([], received_event_rows)
 
         # now reconnect to pull the updates
         self.reconnect()
@@ -440,14 +473,16 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
         # We should have received the expected single row (as well as various
         # cache invalidation updates which we ignore).
-        received_rows = [
-            row for row in self.test_handler.received_rdata_rows if row[0] == "events"
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
         ]
 
         # There should be a single received row.
-        self.assertEqual(len(received_rows), 1)
+        self.assertEqual(len(received_event_rows), 1)
 
-        stream_name, token, row = received_rows[0]
+        stream_name, token, row = received_event_rows[0]
         self.assertEqual("events", stream_name)
         self.assertIsInstance(row, EventsStreamRow)
         self.assertEqual(row.type, "ev")
@@ -468,10 +503,12 @@ class EventsStreamTestCase(BaseStreamTestCase):
         )
 
         # No updates have been received (because it was discard as old).
-        received_rows = [
-            row for row in self.test_handler.received_rdata_rows if row[0] == "events"
+        received_event_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == EventsStream.NAME
         ]
-        self.assertEqual(len(received_rows), 0)
+        self.assertEqual(len(received_event_rows), 0)
 
         # Ensure the stream has not gone backwards.
         current_token = worker_events_stream.current_token("master")
@@ -480,7 +517,7 @@ class EventsStreamTestCase(BaseStreamTestCase):
     event_count = 0
 
     def _inject_test_event(
-        self, body: Optional[str] = None, sender: Optional[str] = None, **kwargs: Any
+        self, body: str | None = None, sender: str | None = None, **kwargs: Any
     ) -> EventBase:
         if sender is None:
             sender = self.user_id
@@ -502,9 +539,9 @@ class EventsStreamTestCase(BaseStreamTestCase):
 
     def _inject_state_event(
         self,
-        body: Optional[str] = None,
-        state_key: Optional[str] = None,
-        sender: Optional[str] = None,
+        body: str | None = None,
+        state_key: str | None = None,
+        sender: str | None = None,
     ) -> EventBase:
         if sender is None:
             sender = self.user_id
diff --git a/tests/replication/tcp/streams/test_federation.py b/tests/replication/tcp/streams/test_federation.py
index fd81e0dc17..172968c108 100644
--- a/tests/replication/tcp/streams/test_federation.py
+++ b/tests/replication/tcp/streams/test_federation.py
@@ -38,24 +38,45 @@ class FederationStreamTestCase(BaseStreamTestCase):
         Makes sure that updates sent while we are offline are received later.
         """
         fed_sender = self.hs.get_federation_sender()
-        received_rows = self.test_handler.received_rdata_rows
 
+        # Send an update before we connect
         fed_sender.build_and_send_edu("testdest", "m.test_edu", {"a": "b"})
 
+        # Now reconnect and pull the updates
         self.reconnect()
+        # FIXME: This seems odd, why aren't we calling `self.replicate()` here? but also
+        # doing so, causes other assumptions to fail (multiple HTTP replication attempts
+        # are made).
         self.reactor.advance(0)
 
-        # check we're testing what we think we are: no rows should yet have been
+        # Check we're testing what we think we are: no rows should yet have been
         # received
-        self.assertEqual(received_rows, [])
+        #
+        # Filter the updates to only include typing changes
+        received_federation_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == FederationStream.NAME
+        ]
+        self.assertEqual(received_federation_rows, [])
 
         # We should now see an attempt to connect to the master
         request = self.handle_http_replication_attempt()
-        self.assert_request_is_get_repl_stream_updates(request, "federation")
+        self.assert_request_is_get_repl_stream_updates(request, FederationStream.NAME)
 
         # we should have received an update row
-        stream_name, token, row = received_rows.pop()
-        self.assertEqual(stream_name, "federation")
+        received_federation_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == FederationStream.NAME
+        ]
+        self.assertEqual(
+            len(received_federation_rows),
+            1,
+            "Expected exactly one row for the federation stream",
+        )
+        (stream_name, token, row) = received_federation_rows[0]
+        self.assertEqual(stream_name, FederationStream.NAME)
         self.assertIsInstance(row, FederationStream.FederationStreamRow)
         self.assertEqual(row.type, EduRow.TypeId)
         edurow = EduRow.from_data(row.data)
@@ -63,19 +84,30 @@ class FederationStreamTestCase(BaseStreamTestCase):
         self.assertEqual(edurow.edu.origin, self.hs.hostname)
         self.assertEqual(edurow.edu.destination, "testdest")
         self.assertEqual(edurow.edu.content, {"a": "b"})
-
-        self.assertEqual(received_rows, [])
+        # Clear out the received rows that we've checked so we can check for new ones later
+        self.test_handler.received_rdata_rows.clear()
 
         # additional updates should be transferred without an HTTP hit
         fed_sender.build_and_send_edu("testdest", "m.test1", {"c": "d"})
-        self.reactor.advance(0)
+        # Pull in the updates
+        self.replicate()
+
         # there should be no http hit
         self.assertEqual(len(self.reactor.tcpClients), 0)
-        # ... but we should have a row
-        self.assertEqual(len(received_rows), 1)
 
-        stream_name, token, row = received_rows.pop()
-        self.assertEqual(stream_name, "federation")
+        # ... but we should have a row
+        received_federation_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == FederationStream.NAME
+        ]
+        self.assertEqual(
+            len(received_federation_rows),
+            1,
+            "Expected exactly one row for the federation stream",
+        )
+        (stream_name, token, row) = received_federation_rows[0]
+        self.assertEqual(stream_name, FederationStream.NAME)
         self.assertIsInstance(row, FederationStream.FederationStreamRow)
         self.assertEqual(row.type, EduRow.TypeId)
         edurow = EduRow.from_data(row.data)
diff --git a/tests/replication/tcp/streams/test_receipts.py b/tests/replication/tcp/streams/test_receipts.py
index c2f1f8dc4a..c5332f6b5f 100644
--- a/tests/replication/tcp/streams/test_receipts.py
+++ b/tests/replication/tcp/streams/test_receipts.py
@@ -20,7 +20,6 @@
 
 # type: ignore
 
-from unittest.mock import Mock
 
 from synapse.replication.tcp.streams._base import ReceiptsStream
 
@@ -30,9 +29,6 @@ USER_ID = "@feeling:blue"
 
 
 class ReceiptsStreamTestCase(BaseStreamTestCase):
-    def _build_replication_data_handler(self):
-        return Mock(wraps=super()._build_replication_data_handler())
-
     def test_receipt(self):
         self.reconnect()
 
@@ -50,23 +46,30 @@ class ReceiptsStreamTestCase(BaseStreamTestCase):
         self.replicate()
 
         # there should be one RDATA command
-        self.test_handler.on_rdata.assert_called_once()
-        stream_name, _, token, rdata_rows = self.test_handler.on_rdata.call_args[0]
-        self.assertEqual(stream_name, "receipts")
-        self.assertEqual(1, len(rdata_rows))
-        row: ReceiptsStream.ReceiptsStreamRow = rdata_rows[0]
+        received_receipt_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == ReceiptsStream.NAME
+        ]
+        self.assertEqual(
+            len(received_receipt_rows),
+            1,
+            "Expected exactly one row for the receipts stream",
+        )
+        (stream_name, token, row) = received_receipt_rows[0]
+        self.assertEqual(stream_name, ReceiptsStream.NAME)
         self.assertEqual("!room:blue", row.room_id)
         self.assertEqual("m.read", row.receipt_type)
         self.assertEqual(USER_ID, row.user_id)
         self.assertEqual("$event:blue", row.event_id)
         self.assertIsNone(row.thread_id)
         self.assertEqual({"a": 1}, row.data)
+        # Clear out the received rows that we've checked so we can check for new ones later
+        self.test_handler.received_rdata_rows.clear()
 
         # Now let's disconnect and insert some data.
         self.disconnect()
 
-        self.test_handler.on_rdata.reset_mock()
-
         self.get_success(
             self.hs.get_datastores().main.insert_receipt(
                 "!room2:blue",
@@ -79,20 +82,27 @@ class ReceiptsStreamTestCase(BaseStreamTestCase):
         )
         self.replicate()
 
-        # Nothing should have happened as we are disconnected
-        self.test_handler.on_rdata.assert_not_called()
+        # Not yet connected: no rows should yet have been received
+        self.assertEqual([], self.test_handler.received_rdata_rows)
 
+        # Now reconnect and pull the updates
         self.reconnect()
-        self.pump(0.1)
+        self.replicate()
 
         # We should now have caught up and get the missing data
-        self.test_handler.on_rdata.assert_called_once()
-        stream_name, _, token, rdata_rows = self.test_handler.on_rdata.call_args[0]
-        self.assertEqual(stream_name, "receipts")
+        received_receipt_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == ReceiptsStream.NAME
+        ]
+        self.assertEqual(
+            len(received_receipt_rows),
+            1,
+            "Expected exactly one row for the receipts stream",
+        )
+        (stream_name, token, row) = received_receipt_rows[0]
+        self.assertEqual(stream_name, ReceiptsStream.NAME)
         self.assertEqual(token, 3)
-        self.assertEqual(1, len(rdata_rows))
-
-        row: ReceiptsStream.ReceiptsStreamRow = rdata_rows[0]
         self.assertEqual("!room2:blue", row.room_id)
         self.assertEqual("m.read", row.receipt_type)
         self.assertEqual(USER_ID, row.user_id)
diff --git a/tests/replication/tcp/streams/test_thread_subscriptions.py b/tests/replication/tcp/streams/test_thread_subscriptions.py
index 7283aa851e..5405316048 100644
--- a/tests/replication/tcp/streams/test_thread_subscriptions.py
+++ b/tests/replication/tcp/streams/test_thread_subscriptions.py
@@ -20,7 +20,7 @@ from synapse.replication.tcp.streams._base import (
 )
 from synapse.server import HomeServer
 from synapse.storage.database import LoggingTransaction
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseStreamTestCase
 
@@ -88,15 +88,15 @@ class ThreadSubscriptionsStreamTestCase(BaseStreamTestCase):
 
         # We should have received all the expected rows in the right order
         # Filter the updates to only include thread subscription changes
-        received_rows = [
-            upd
-            for upd in self.test_handler.received_rdata_rows
-            if upd[0] == ThreadSubscriptionsStream.NAME
+        received_thread_subscription_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == ThreadSubscriptionsStream.NAME
         ]
 
         # Verify all the thread subscription updates
         for thread_id in updates:
-            (stream_name, token, row) = received_rows.pop(0)
+            (stream_name, token, row) = received_thread_subscription_rows.pop(0)
             self.assertEqual(stream_name, ThreadSubscriptionsStream.NAME)
             self.assertIsInstance(row, ThreadSubscriptionsStream.ROW_TYPE)
             self.assertEqual(row.user_id, "@test_user:example.org")
@@ -104,14 +104,14 @@ class ThreadSubscriptionsStreamTestCase(BaseStreamTestCase):
             self.assertEqual(row.event_id, thread_id)
 
         # Verify the last update in the different room
-        (stream_name, token, row) = received_rows.pop(0)
+        (stream_name, token, row) = received_thread_subscription_rows.pop(0)
         self.assertEqual(stream_name, ThreadSubscriptionsStream.NAME)
         self.assertIsInstance(row, ThreadSubscriptionsStream.ROW_TYPE)
         self.assertEqual(row.user_id, "@test_user:example.org")
         self.assertEqual(row.room_id, other_room_id)
         self.assertEqual(row.event_id, other_thread_root_id)
 
-        self.assertEqual([], received_rows)
+        self.assertEqual([], received_thread_subscription_rows)
 
     def test_multiple_users_thread_subscription_updates(self) -> None:
         """Test replication with thread subscription updates for multiple users"""
@@ -138,18 +138,18 @@ class ThreadSubscriptionsStreamTestCase(BaseStreamTestCase):
 
         # We should have received all the expected rows
         # Filter the updates to only include thread subscription changes
-        received_rows = [
-            upd
-            for upd in self.test_handler.received_rdata_rows
-            if upd[0] == ThreadSubscriptionsStream.NAME
+        received_thread_subscription_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == ThreadSubscriptionsStream.NAME
         ]
 
         # Should have one update per user
-        self.assertEqual(len(received_rows), len(users))
+        self.assertEqual(len(received_thread_subscription_rows), len(users))
 
         # Verify all updates
         for i, user_id in enumerate(users):
-            (stream_name, token, row) = received_rows[i]
+            (stream_name, token, row) = received_thread_subscription_rows[i]
             self.assertEqual(stream_name, ThreadSubscriptionsStream.NAME)
             self.assertIsInstance(row, ThreadSubscriptionsStream.ROW_TYPE)
             self.assertEqual(row.user_id, user_id)
diff --git a/tests/replication/tcp/streams/test_to_device.py b/tests/replication/tcp/streams/test_to_device.py
index cb07e93d6b..d6fd9f91ed 100644
--- a/tests/replication/tcp/streams/test_to_device.py
+++ b/tests/replication/tcp/streams/test_to_device.py
@@ -21,7 +21,10 @@
 import logging
 
 import synapse
-from synapse.replication.tcp.streams._base import _STREAM_UPDATE_TARGET_ROW_COUNT
+from synapse.replication.tcp.streams._base import (
+    _STREAM_UPDATE_TARGET_ROW_COUNT,
+    ToDeviceStream,
+)
 from synapse.types import JsonDict
 
 from tests.replication._base import BaseStreamTestCase
@@ -82,7 +85,12 @@ class ToDeviceStreamTestCase(BaseStreamTestCase):
         )
 
         # replication is disconnected so we shouldn't get any updates yet
-        self.assertEqual([], self.test_handler.received_rdata_rows)
+        received_to_device_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == ToDeviceStream.NAME
+        ]
+        self.assertEqual([], received_to_device_rows)
 
         # now reconnect to pull the updates
         self.reconnect()
@@ -90,7 +98,15 @@ class ToDeviceStreamTestCase(BaseStreamTestCase):
 
         # we should receive the fact that we have to_device updates
         # for user1 and user2
-        received_rows = self.test_handler.received_rdata_rows
-        self.assertEqual(len(received_rows), 2)
-        self.assertEqual(received_rows[0][2].entity, user1)
-        self.assertEqual(received_rows[1][2].entity, user2)
+        received_to_device_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == ToDeviceStream.NAME
+        ]
+        self.assertEqual(
+            len(received_to_device_rows),
+            2,
+            "Expected two rows in the to_device stream",
+        )
+        self.assertEqual(received_to_device_rows[0][2].entity, user1)
+        self.assertEqual(received_to_device_rows[1][2].entity, user2)
diff --git a/tests/replication/tcp/streams/test_typing.py b/tests/replication/tcp/streams/test_typing.py
index e2b2299106..df91416b9b 100644
--- a/tests/replication/tcp/streams/test_typing.py
+++ b/tests/replication/tcp/streams/test_typing.py
@@ -19,7 +19,6 @@
 #
 #
 import logging
-from unittest.mock import Mock
 
 from synapse.handlers.typing import RoomMember, TypingWriterHandler
 from synapse.replication.tcp.streams import TypingStream
@@ -27,6 +26,8 @@ from synapse.util.caches.stream_change_cache import StreamChangeCache
 
 from tests.replication._base import BaseStreamTestCase
 
+logger = logging.getLogger(__name__)
+
 USER_ID = "@feeling:blue"
 USER_ID_2 = "@da-ba-dee:blue"
 
@@ -35,10 +36,6 @@ ROOM_ID_2 = "!foo:blue"
 
 
 class TypingStreamTestCase(BaseStreamTestCase):
-    def _build_replication_data_handler(self) -> Mock:
-        self.mock_handler = Mock(wraps=super()._build_replication_data_handler())
-        return self.mock_handler
-
     def test_typing(self) -> None:
         typing = self.hs.get_typing_handler()
         assert isinstance(typing, TypingWriterHandler)
@@ -47,51 +44,74 @@ class TypingStreamTestCase(BaseStreamTestCase):
         # update to fetch.
         typing._push_update(member=RoomMember(ROOM_ID, USER_ID), typing=True)
 
+        # Not yet connected: no rows should yet have been received
+        self.assertEqual([], self.test_handler.received_rdata_rows)
+
+        # Reconnect
         self.reconnect()
 
         typing._push_update(member=RoomMember(ROOM_ID, USER_ID), typing=True)
-
-        self.reactor.advance(0)
+        # Pull in the updates
+        self.replicate()
 
         # We should now see an attempt to connect to the master
         request = self.handle_http_replication_attempt()
-        self.assert_request_is_get_repl_stream_updates(request, "typing")
+        self.assert_request_is_get_repl_stream_updates(request, TypingStream.NAME)
 
-        self.mock_handler.on_rdata.assert_called_once()
-        stream_name, _, token, rdata_rows = self.mock_handler.on_rdata.call_args[0]
-        self.assertEqual(stream_name, "typing")
-        self.assertEqual(1, len(rdata_rows))
-        row: TypingStream.TypingStreamRow = rdata_rows[0]
-        self.assertEqual(ROOM_ID, row.room_id)
-        self.assertEqual([USER_ID], row.user_ids)
+        # Filter the updates to only include typing changes
+        received_typing_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == TypingStream.NAME
+        ]
+        self.assertEqual(
+            len(received_typing_rows),
+            1,
+            "Expected exactly one row for the typing stream",
+        )
+        (stream_name, token, row) = received_typing_rows[0]
+        self.assertEqual(stream_name, TypingStream.NAME)
+        self.assertIsInstance(row, TypingStream.ROW_TYPE)
+        self.assertEqual(row.room_id, ROOM_ID)
+        self.assertEqual(row.user_ids, [USER_ID])
+        # Clear out the received rows that we've checked so we can check for new ones later
+        self.test_handler.received_rdata_rows.clear()
 
         # Now let's disconnect and insert some data.
         self.disconnect()
 
-        self.mock_handler.on_rdata.reset_mock()
-
         typing._push_update(member=RoomMember(ROOM_ID, USER_ID), typing=False)
 
-        self.mock_handler.on_rdata.assert_not_called()
+        # Not yet connected: no rows should yet have been received
+        self.assertEqual([], self.test_handler.received_rdata_rows)
 
+        # Now reconnect and pull the updates
         self.reconnect()
-        self.pump(0.1)
+        self.replicate()
 
         # We should now see an attempt to connect to the master
         request = self.handle_http_replication_attempt()
-        self.assert_request_is_get_repl_stream_updates(request, "typing")
+        self.assert_request_is_get_repl_stream_updates(request, TypingStream.NAME)
 
         # The from token should be the token from the last RDATA we got.
         assert request.args is not None
         self.assertEqual(int(request.args[b"from_token"][0]), token)
 
-        self.mock_handler.on_rdata.assert_called_once()
-        stream_name, _, token, rdata_rows = self.mock_handler.on_rdata.call_args[0]
-        self.assertEqual(stream_name, "typing")
-        self.assertEqual(1, len(rdata_rows))
-        row = rdata_rows[0]
-        self.assertEqual(ROOM_ID, row.room_id)
-        self.assertEqual([], row.user_ids)
+        received_typing_rows = [
+            row
+            for row in self.test_handler.received_rdata_rows
+            if row[0] == TypingStream.NAME
+        ]
+        self.assertEqual(
+            len(received_typing_rows),
+            1,
+            "Expected exactly one row for the typing stream",
+        )
+        (stream_name, token, row) = received_typing_rows[0]
+        self.assertEqual(stream_name, TypingStream.NAME)
+        self.assertIsInstance(row, TypingStream.ROW_TYPE)
+        self.assertEqual(row.room_id, ROOM_ID)
+        self.assertEqual(row.user_ids, [])
 
     def test_reset(self) -> None:
         """
@@ -116,33 +136,47 @@ class TypingStreamTestCase(BaseStreamTestCase):
             # update to fetch.
             typing._push_update(member=RoomMember(ROOM_ID, USER_ID), typing=True)
 
+            # Not yet connected: no rows should yet have been received
+            self.assertEqual([], self.test_handler.received_rdata_rows)
+
+            # Now reconnect to pull the updates
             self.reconnect()
 
             typing._push_update(member=RoomMember(ROOM_ID, USER_ID), typing=True)
-
-            self.reactor.advance(0)
+            # Pull in the updates
+            self.replicate()
 
             # We should now see an attempt to connect to the master
             request = self.handle_http_replication_attempt()
             self.assert_request_is_get_repl_stream_updates(request, "typing")
 
-            self.mock_handler.on_rdata.assert_called_once()
-            stream_name, _, token, rdata_rows = self.mock_handler.on_rdata.call_args[0]
-            self.assertEqual(stream_name, "typing")
-            self.assertEqual(1, len(rdata_rows))
-            row: TypingStream.TypingStreamRow = rdata_rows[0]
-            self.assertEqual(ROOM_ID, row.room_id)
-            self.assertEqual([USER_ID], row.user_ids)
+            received_typing_rows = [
+                row
+                for row in self.test_handler.received_rdata_rows
+                if row[0] == TypingStream.NAME
+            ]
+            self.assertEqual(
+                len(received_typing_rows),
+                1,
+                "Expected exactly one row for the typing stream",
+            )
+            (stream_name, token, row) = received_typing_rows[0]
+            self.assertEqual(stream_name, TypingStream.NAME)
+            self.assertIsInstance(row, TypingStream.ROW_TYPE)
+            self.assertEqual(row.room_id, ROOM_ID)
+            self.assertEqual(row.user_ids, [USER_ID])
 
             # Push the stream forward a bunch so it can be reset.
             for i in range(100):
                 typing._push_update(
                     member=RoomMember(ROOM_ID, "@test%s:blue" % i), typing=True
                 )
-            self.reactor.advance(0)
+            # Pull in the updates
+            self.replicate()
 
             # Disconnect.
             self.disconnect()
+            self.test_handler.received_rdata_rows.clear()
 
             # Reset the typing handler
             self.hs.get_replication_streams()["typing"].last_token = 0
@@ -155,30 +189,34 @@ class TypingStreamTestCase(BaseStreamTestCase):
             )
             typing._reset()
 
-            # Reconnect.
+            # Now reconnect and pull the updates
             self.reconnect()
-            self.pump(0.1)
+            self.replicate()
 
             # We should now see an attempt to connect to the master
             request = self.handle_http_replication_attempt()
             self.assert_request_is_get_repl_stream_updates(request, "typing")
 
-            # Reset the test code.
-            self.mock_handler.on_rdata.reset_mock()
-            self.mock_handler.on_rdata.assert_not_called()
-
             # Push additional data.
             typing._push_update(member=RoomMember(ROOM_ID_2, USER_ID_2), typing=False)
-            self.reactor.advance(0)
-
-            self.mock_handler.on_rdata.assert_called_once()
-            stream_name, _, token, rdata_rows = self.mock_handler.on_rdata.call_args[0]
-            self.assertEqual(stream_name, "typing")
-            self.assertEqual(1, len(rdata_rows))
-            row = rdata_rows[0]
-            self.assertEqual(ROOM_ID_2, row.room_id)
-            self.assertEqual([], row.user_ids)
+            # Pull the updates
+            self.replicate()
 
+            received_typing_rows = [
+                row
+                for row in self.test_handler.received_rdata_rows
+                if row[0] == TypingStream.NAME
+            ]
+            self.assertEqual(
+                len(received_typing_rows),
+                1,
+                "Expected exactly one row for the typing stream",
+            )
+            (stream_name, token, row) = received_typing_rows[0]
+            self.assertEqual(stream_name, TypingStream.NAME)
+            self.assertIsInstance(row, TypingStream.ROW_TYPE)
+            self.assertEqual(row.room_id, ROOM_ID_2)
+            self.assertEqual(row.user_ids, [])
             # The token should have been reset.
             self.assertEqual(token, 1)
         finally:
diff --git a/tests/replication/test_auth.py b/tests/replication/test_auth.py
index 640ed4e8f3..30f636b3f1 100644
--- a/tests/replication/test_auth.py
+++ b/tests/replication/test_auth.py
@@ -24,7 +24,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.rest.client import register
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
 from tests.server import FakeChannel, make_request
diff --git a/tests/replication/test_federation_ack.py b/tests/replication/test_federation_ack.py
index 440c1d45af..e6b9ea5383 100644
--- a/tests/replication/test_federation_ack.py
+++ b/tests/replication/test_federation_ack.py
@@ -28,7 +28,7 @@ from synapse.replication.tcp.commands import FederationAckCommand
 from synapse.replication.tcp.protocol import IReplicationConnection
 from synapse.replication.tcp.streams.federation import FederationStream
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/replication/test_federation_sender_shard.py b/tests/replication/test_federation_sender_shard.py
index 1fed4ec631..3896e0ce8a 100644
--- a/tests/replication/test_federation_sender_shard.py
+++ b/tests/replication/test_federation_sender_shard.py
@@ -41,7 +41,7 @@ from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.storage.keys import FetchKeyResult
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
 from tests.server import get_clock
@@ -66,10 +66,11 @@ class FederationSenderTestCase(BaseMultiWorkerStreamTestCase):
     def setUp(self) -> None:
         super().setUp()
 
-        reactor, _ = get_clock()
+        reactor, clock = get_clock()
         self.matrix_federation_agent = MatrixFederationAgent(
             server_name="OUR_STUB_HOMESERVER_NAME",
             reactor=reactor,
+            clock=clock,
             tls_client_options_factory=None,
             user_agent=b"SynapseInTrialTest/0.0.0",
             ip_allowlist=None,
diff --git a/tests/replication/test_module_cache_invalidation.py b/tests/replication/test_module_cache_invalidation.py
index 8d5d0cce9a..1cb898673b 100644
--- a/tests/replication/test_module_cache_invalidation.py
+++ b/tests/replication/test_module_cache_invalidation.py
@@ -24,6 +24,7 @@ import synapse
 from synapse.module_api import cached
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
+from tests.server import get_clock
 
 logger = logging.getLogger(__name__)
 
@@ -36,6 +37,7 @@ KEY = "mykey"
 class TestCache:
     current_value = FIRST_VALUE
     server_name = "test_server"  # nb must be called this for @cached
+    _, clock = get_clock()  # nb must be called this for @cached
 
     @cached()
     async def cached_function(self, user_id: str) -> str:
diff --git a/tests/replication/test_multi_media_repo.py b/tests/replication/test_multi_media_repo.py
index 228a803c1d..000dbb5594 100644
--- a/tests/replication/test_multi_media_repo.py
+++ b/tests/replication/test_multi_media_repo.py
@@ -20,7 +20,7 @@
 #
 import logging
 import os
-from typing import Any, Optional, Tuple
+from typing import Any
 
 from twisted.internet.protocol import Factory
 from twisted.internet.testing import MemoryReactor
@@ -30,7 +30,7 @@ from twisted.web.server import Request
 from synapse.rest import admin
 from synapse.rest.client import login, media
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.http import (
     TestServerTLSConnectionFactory,
@@ -44,7 +44,7 @@ from tests.unittest import override_config
 
 logger = logging.getLogger(__name__)
 
-test_server_connection_factory: Optional[TestServerTLSConnectionFactory] = None
+test_server_connection_factory: TestServerTLSConnectionFactory | None = None
 
 
 class MediaRepoShardTestCase(BaseMultiWorkerStreamTestCase):
@@ -67,7 +67,7 @@ class MediaRepoShardTestCase(BaseMultiWorkerStreamTestCase):
         return conf
 
     def make_worker_hs(
-        self, worker_app: str, extra_config: Optional[dict] = None, **kwargs: Any
+        self, worker_app: str, extra_config: dict | None = None, **kwargs: Any
     ) -> HomeServer:
         worker_hs = super().make_worker_hs(worker_app, extra_config, **kwargs)
         # Force the media paths onto the replication resource.
@@ -78,7 +78,7 @@ class MediaRepoShardTestCase(BaseMultiWorkerStreamTestCase):
 
     def _get_media_req(
         self, hs: HomeServer, target: str, media_id: str
-    ) -> Tuple[FakeChannel, Request]:
+    ) -> tuple[FakeChannel, Request]:
         """Request some remote media from the given HS by calling the download
         API.
 
@@ -206,6 +206,53 @@ class MediaRepoShardTestCase(BaseMultiWorkerStreamTestCase):
         # We expect only one new file to have been persisted.
         self.assertEqual(start_count + 1, self._count_remote_media())
 
+    @override_config(
+        {"enable_authenticated_media": False, "enable_local_media_storage": False}
+    )
+    def test_download_simple_file_race_no_local_storage(self) -> None:
+        """Test that fetching remote media works when local storage is disabled.
+
+        This test verifies that the system handles the case where local storage
+        is disabled. Without storage providers configured, the media cannot be
+        retrieved, but the important thing is that the race condition is still
+        handled correctly.
+        """
+        hs1 = self.make_worker_hs("synapse.app.generic_worker")
+        hs2 = self.make_worker_hs("synapse.app.generic_worker")
+
+        start_count = self._count_remote_media()
+
+        # Make two requests without responding to the outbound media requests.
+        channel1, request1 = self._get_media_req(hs1, "example.com:443", "ABC123")
+        channel2, request2 = self._get_media_req(hs2, "example.com:443", "ABC123")
+
+        # Respond to the first outbound media request and check that the client
+        # request is successful
+        request1.setResponseCode(200)
+        request1.responseHeaders.setRawHeaders(b"Content-Type", [b"text/plain"])
+        request1.write(b"Hello!")
+        request1.finish()
+
+        self.pump(0.1)
+
+        # With local storage disabled and no storage providers,
+        # we expect a 404 error
+        self.assertEqual(channel1.code, 404, channel1.result["body"])
+
+        # Now respond to the second with the same content.
+        request2.setResponseCode(200)
+        request2.responseHeaders.setRawHeaders(b"Content-Type", [b"text/plain"])
+        request2.write(b"Hello!")
+        request2.finish()
+
+        self.pump(0.1)
+
+        # Same for the second request
+        self.assertEqual(channel2.code, 404, channel2.result["body"])
+
+        # No files should be stored locally
+        self.assertEqual(start_count, self._count_remote_media())
+
     @override_config({"enable_authenticated_media": False})
     def test_download_image_race(self) -> None:
         """Test that fetching remote *images* from two different processes at
@@ -282,7 +329,7 @@ class AuthenticatedMediaRepoShardTestCase(BaseMultiWorkerStreamTestCase):
         return conf
 
     def make_worker_hs(
-        self, worker_app: str, extra_config: Optional[dict] = None, **kwargs: Any
+        self, worker_app: str, extra_config: dict | None = None, **kwargs: Any
     ) -> HomeServer:
         worker_hs = super().make_worker_hs(worker_app, extra_config, **kwargs)
         # Force the media paths onto the replication resource.
@@ -293,7 +340,7 @@ class AuthenticatedMediaRepoShardTestCase(BaseMultiWorkerStreamTestCase):
 
     def _get_media_req(
         self, hs: HomeServer, target: str, media_id: str
-    ) -> Tuple[FakeChannel, Request]:
+    ) -> tuple[FakeChannel, Request]:
         """Request some remote media from the given HS by calling the download
         API.
 
@@ -428,6 +475,53 @@ class AuthenticatedMediaRepoShardTestCase(BaseMultiWorkerStreamTestCase):
         # We expect only one new file to have been persisted.
         self.assertEqual(start_count + 1, self._count_remote_media())
 
+    @override_config({"enable_local_media_storage": False})
+    def test_download_simple_file_race_no_local_storage(self) -> None:
+        """Test that fetching remote media works when local storage is disabled.
+
+        When enable_local_media_storage is False, files should only be stored in
+        the storage providers and not in the local filesystem.
+        """
+        hs1 = self.make_worker_hs("synapse.app.generic_worker")
+        hs2 = self.make_worker_hs("synapse.app.generic_worker")
+
+        start_count = self._count_remote_media()
+
+        # Make two requests without responding to the outbound media requests.
+        channel1, request1 = self._get_media_req(hs1, "example.com:443", "ABC123")
+        channel2, request2 = self._get_media_req(hs2, "example.com:443", "ABC123")
+
+        # Respond to the first outbound media request and check that the client
+        # request is successful
+        request1.setResponseCode(200)
+        request1.responseHeaders.setRawHeaders(
+            b"Content-Type",
+            ["multipart/mixed; boundary=6067d4698f8d40a0a794ea7d7379d53a"],
+        )
+        request1.write(self.file_data)
+        request1.finish()
+
+        self.pump(0.1)
+        # With local storage disabled and no storage providers,
+        # we expect a 404 error
+        self.assertEqual(channel1.code, 404, channel1.result["body"])
+
+        # Now respond to the second with the same content.
+        request2.setResponseCode(200)
+        request2.responseHeaders.setRawHeaders(
+            b"Content-Type",
+            ["multipart/mixed; boundary=6067d4698f8d40a0a794ea7d7379d53a"],
+        )
+        request2.write(self.file_data)
+        request2.finish()
+
+        self.pump(0.1)
+
+        self.assertEqual(channel2.code, 404, channel2.result["body"])
+
+        # With local storage disabled, no files should be stored locally
+        self.assertEqual(start_count, self._count_remote_media())
+
     def test_download_image_race(self) -> None:
         """Test that fetching remote *images* from two different processes at
         the same time works.
diff --git a/tests/replication/test_pusher_shard.py b/tests/replication/test_pusher_shard.py
index d63054c631..033711b9b8 100644
--- a/tests/replication/test_pusher_shard.py
+++ b/tests/replication/test_pusher_shard.py
@@ -27,7 +27,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
 
diff --git a/tests/replication/test_sharded_event_persister.py b/tests/replication/test_sharded_event_persister.py
index 797ad003ef..f37394c1f5 100644
--- a/tests/replication/test_sharded_event_persister.py
+++ b/tests/replication/test_sharded_event_persister.py
@@ -27,7 +27,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
 from tests.server import make_request
diff --git a/tests/replication/test_sharded_receipts.py b/tests/replication/test_sharded_receipts.py
index 6b3ecdad78..b986f33542 100644
--- a/tests/replication/test_sharded_receipts.py
+++ b/tests/replication/test_sharded_receipts.py
@@ -28,7 +28,7 @@ from synapse.rest.client import login, receipts, room, sync
 from synapse.server import HomeServer
 from synapse.storage.util.id_generators import MultiWriterIdGenerator
 from synapse.types import StreamToken
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
 from tests.server import make_request
diff --git a/tests/rest/admin/test_admin.py b/tests/rest/admin/test_admin.py
index b74e8388e9..77d824dcd8 100644
--- a/tests/rest/admin/test_admin.py
+++ b/tests/rest/admin/test_admin.py
@@ -20,7 +20,7 @@
 #
 
 import urllib.parse
-from typing import Dict, cast
+from typing import cast
 
 from parameterized import parameterized
 
@@ -33,7 +33,7 @@ from synapse.rest.admin import VersionServlet
 from synapse.rest.client import login, media, room
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils import SMALL_PNG
@@ -65,20 +65,49 @@ class QuarantineMediaTestCase(unittest.HomeserverTestCase):
         room.register_servlets,
     ]
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
 
     def _ensure_quarantined(
-        self, admin_user_tok: str, server_and_media_id: str
+        self,
+        user_tok: str,
+        server_and_media_id: str,
+        include_bypass_param: bool = False,
     ) -> None:
-        """Ensure a piece of media is quarantined when trying to access it."""
+        """Ensure a piece of media is quarantined when trying to access it.
+
+        The include_bypass_param flag enables the presence of the
+        admin_unsafely_bypass_quarantine query parameter, but still expects that the
+        request will fail to download the media.
+        """
+        if include_bypass_param:
+            query_string = "?admin_unsafely_bypass_quarantine=true"
+            channel = self.make_request(
+                "GET",
+                f"/_matrix/client/v1/media/download/{server_and_media_id}{query_string}",
+                shorthand=False,
+                access_token=user_tok,
+            )
+
+            # Non-admins can't bypass, so this should fail regardless of whether the
+            # media is actually quarantined.
+            self.assertEqual(
+                400,
+                channel.code,
+                msg=(
+                    "Expected to receive a 400 when bypassing quarantined media: %s"
+                    % server_and_media_id
+                ),
+            )
+
+        # Repeat the request, this time without the bypass parameter.
         channel = self.make_request(
             "GET",
             f"/_matrix/client/v1/media/download/{server_and_media_id}",
             shorthand=False,
-            access_token=admin_user_tok,
+            access_token=user_tok,
         )
 
         # Should be quarantined
@@ -91,6 +120,62 @@ class QuarantineMediaTestCase(unittest.HomeserverTestCase):
             ),
         )
 
+    def test_admin_can_bypass_quarantine(self) -> None:
+        self.register_user("admin", "pass", admin=True)
+        admin_user_tok = self.login("admin", "pass")
+
+        # Upload some media
+        response = self.helper.upload_media(SMALL_PNG, tok=admin_user_tok)
+
+        # Extract media ID from the response
+        server_name_and_media_id = response["content_uri"][6:]  # Cut off 'mxc://'
+        server_name, media_id = server_name_and_media_id.split("/")
+
+        # Attempt to access the media
+        channel = self.make_request(
+            "GET",
+            f"/_matrix/client/v1/media/download/{server_name_and_media_id}",
+            shorthand=False,
+            access_token=admin_user_tok,
+        )
+
+        # Should be successful
+        self.assertEqual(200, channel.code)
+
+        # Quarantine the media
+        url = "/_synapse/admin/v1/media/quarantine/%s/%s" % (
+            urllib.parse.quote(server_name),
+            urllib.parse.quote(media_id),
+        )
+        channel = self.make_request(
+            "POST",
+            url,
+            access_token=admin_user_tok,
+        )
+        self.pump(1.0)
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+
+        # Now access it *without* the bypass parameter - this should fail (as expected).
+        self._ensure_quarantined(
+            admin_user_tok, server_name_and_media_id, include_bypass_param=False
+        )
+
+        # Now access it *with* the bypass parameter - this should work
+        channel = self.make_request(
+            "GET",
+            f"/_matrix/client/v1/media/download/{server_name_and_media_id}?admin_unsafely_bypass_quarantine=true",
+            shorthand=False,
+            access_token=admin_user_tok,
+        )
+        self.assertEqual(
+            200,
+            channel.code,
+            msg=(
+                "Expected to receive a 200 on accessing (with bypass) quarantined media: %s"
+                % server_name_and_media_id
+            ),
+        )
+
     @parameterized.expand(
         [
             # Attempt quarantine media APIs as non-admin
@@ -154,8 +239,14 @@ class QuarantineMediaTestCase(unittest.HomeserverTestCase):
         self.pump(1.0)
         self.assertEqual(200, channel.code, msg=channel.json_body)
 
-        # Attempt to access the media
-        self._ensure_quarantined(admin_user_tok, server_name_and_media_id)
+        # Attempt to access the media (and ensure non-admins can't download it, even
+        # with a bypass parameter). Admins cannot download it without the bypass param.
+        self._ensure_quarantined(
+            non_admin_user_tok, server_name_and_media_id, include_bypass_param=True
+        )
+        self._ensure_quarantined(
+            admin_user_tok, server_name_and_media_id, include_bypass_param=False
+        )
 
     @parameterized.expand(
         [
@@ -214,9 +305,21 @@ class QuarantineMediaTestCase(unittest.HomeserverTestCase):
         server_and_media_id_1 = mxc_1[6:]
         server_and_media_id_2 = mxc_2[6:]
 
-        # Test that we cannot download any of the media anymore
-        self._ensure_quarantined(admin_user_tok, server_and_media_id_1)
-        self._ensure_quarantined(admin_user_tok, server_and_media_id_2)
+        # Test that we cannot download any of the media anymore, especially with the
+        # bypass parameter set. Admins cannot download the media without supplying the
+        # bypass parameter, so we check that too.
+        self._ensure_quarantined(
+            non_admin_user_tok, server_and_media_id_1, include_bypass_param=True
+        )
+        self._ensure_quarantined(
+            non_admin_user_tok, server_and_media_id_2, include_bypass_param=True
+        )
+        self._ensure_quarantined(
+            admin_user_tok, server_and_media_id_1, include_bypass_param=False
+        )
+        self._ensure_quarantined(
+            admin_user_tok, server_and_media_id_2, include_bypass_param=False
+        )
 
     def test_quarantine_all_media_by_user(self) -> None:
         self.register_user("user_admin", "pass", admin=True)
@@ -263,10 +366,27 @@ class QuarantineMediaTestCase(unittest.HomeserverTestCase):
             channel.json_body, {"num_quarantined": 3}, "Expected 3 quarantined items"
         )
 
-        # Attempt to access each piece of media
-        self._ensure_quarantined(admin_user_tok, server_and_media_id_1)
-        self._ensure_quarantined(admin_user_tok, server_and_media_id_2)
-        self._ensure_quarantined(admin_user_tok, server_and_media_id_3)
+        # Attempt to access each piece of media, ensuring that it can't be downloaded
+        # even with a bypass parameter. Admins should not be able to download the media
+        # either when not supplying the bypass parameter, so we check that too.
+        self._ensure_quarantined(
+            non_admin_user_tok, server_and_media_id_1, include_bypass_param=True
+        )
+        self._ensure_quarantined(
+            non_admin_user_tok, server_and_media_id_2, include_bypass_param=True
+        )
+        self._ensure_quarantined(
+            non_admin_user_tok, server_and_media_id_3, include_bypass_param=True
+        )
+        self._ensure_quarantined(
+            admin_user_tok, server_and_media_id_1, include_bypass_param=False
+        )
+        self._ensure_quarantined(
+            admin_user_tok, server_and_media_id_2, include_bypass_param=False
+        )
+        self._ensure_quarantined(
+            admin_user_tok, server_and_media_id_3, include_bypass_param=False
+        )
 
     def test_cannot_quarantine_safe_media(self) -> None:
         self.register_user("user_admin", "pass", admin=True)
@@ -307,8 +427,14 @@ class QuarantineMediaTestCase(unittest.HomeserverTestCase):
         )
 
         # Attempt to access each piece of media, the first should fail, the
-        # second should succeed.
-        self._ensure_quarantined(admin_user_tok, server_and_media_id_1)
+        # second should succeed. We check both the non-admin user with a bypass
+        # parameter, and the admin user without.
+        self._ensure_quarantined(
+            non_admin_user_tok, server_and_media_id_1, include_bypass_param=True
+        )
+        self._ensure_quarantined(
+            admin_user_tok, server_and_media_id_1, include_bypass_param=False
+        )
 
         # Attempt to access each piece of media
         channel = self.make_request(
diff --git a/tests/rest/admin/test_background_updates.py b/tests/rest/admin/test_background_updates.py
index dd116e79f1..a4a3112e20 100644
--- a/tests/rest/admin/test_background_updates.py
+++ b/tests/rest/admin/test_background_updates.py
@@ -30,7 +30,8 @@ from synapse.rest.client import login
 from synapse.server import HomeServer
 from synapse.storage.background_updates import BackgroundUpdater
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 from tests import unittest
 
@@ -105,7 +106,7 @@ class BackgroundUpdatesTestCase(unittest.HomeserverTestCase):
         "Adds a bg update but doesn't start it"
 
         async def _fake_update(progress: JsonDict, batch_size: int) -> int:
-            await self.clock.sleep(0.2)
+            await self.clock.sleep(Duration(milliseconds=200))
             return batch_size
 
         self.store.db_pool.updates.register_background_update_handler(
diff --git a/tests/rest/admin/test_device.py b/tests/rest/admin/test_device.py
index c564e0c9a7..54918de3c8 100644
--- a/tests/rest/admin/test_device.py
+++ b/tests/rest/admin/test_device.py
@@ -26,10 +26,10 @@ from twisted.internet.testing import MemoryReactor
 
 import synapse.rest.admin
 from synapse.api.errors import Codes
-from synapse.handlers.device import DeviceWriterHandler
+from synapse.handlers.device import MAX_DEVICE_DISPLAY_NAME_LEN, DeviceWriterHandler
 from synapse.rest.client import devices, login
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -175,10 +175,7 @@ class DeviceRestTestCase(unittest.HomeserverTestCase):
         )
 
         # Request to update a device display name with a new value that is longer than allowed.
-        update = {
-            "display_name": "a"
-            * (synapse.handlers.device.MAX_DEVICE_DISPLAY_NAME_LEN + 1)
-        }
+        update = {"display_name": "a" * (MAX_DEVICE_DISPLAY_NAME_LEN + 1)}
 
         channel = self.make_request(
             "PUT",
@@ -391,9 +388,7 @@ class DevicesRestTestCase(unittest.HomeserverTestCase):
         self.assertEqual(0, channel.json_body["total"])
         self.assertEqual(0, len(channel.json_body["devices"]))
 
-    @unittest.override_config(
-        {"experimental_features": {"msc2697_enabled": False, "msc3814_enabled": True}}
-    )
+    @unittest.override_config({"experimental_features": {"msc3814_enabled": True}})
     def test_get_devices(self) -> None:
         """
         Tests that a normal lookup for devices is successfully
diff --git a/tests/rest/admin/test_event.py b/tests/rest/admin/test_event.py
new file mode 100644
index 0000000000..4494804210
--- /dev/null
+++ b/tests/rest/admin/test_event.py
@@ -0,0 +1,74 @@
+from twisted.internet.testing import MemoryReactor
+
+import synapse.rest.admin
+from synapse.api.errors import Codes
+from synapse.rest.client import login, room
+from synapse.server import HomeServer
+from synapse.util.clock import Clock
+
+from tests import unittest
+
+
+class FetchEventTestCase(unittest.HomeserverTestCase):
+    servlets = [
+        synapse.rest.admin.register_servlets,
+        login.register_servlets,
+        room.register_servlets,
+    ]
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        self.admin_user = self.register_user("admin", "pass", admin=True)
+        self.admin_user_tok = self.login("admin", "pass")
+
+        self.other_user = self.register_user("user", "pass")
+        self.other_user_tok = self.login("user", "pass")
+
+        self.room_id1 = self.helper.create_room_as(
+            self.other_user, tok=self.other_user_tok, is_public=True
+        )
+        resp = self.helper.send(self.room_id1, body="Hey now", tok=self.other_user_tok)
+        self.event_id = resp["event_id"]
+
+    def test_no_auth(self) -> None:
+        """
+        Try to get an event without authentication.
+        """
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/fetch_event/{self.event_id}",
+        )
+
+        self.assertEqual(401, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.MISSING_TOKEN, channel.json_body["errcode"])
+
+    def test_requester_is_not_admin(self) -> None:
+        """
+        If the user is not a server admin, an error 403 is returned.
+        """
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/fetch_event/{self.event_id}",
+            access_token=self.other_user_tok,
+        )
+
+        self.assertEqual(403, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
+
+    def test_fetch_event(self) -> None:
+        """
+        Test that we can successfully fetch an event
+        """
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/fetch_event/{self.event_id}",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        self.assertEqual(
+            channel.json_body["event"]["content"],
+            {"body": "Hey now", "msgtype": "m.text"},
+        )
+        self.assertEqual(channel.json_body["event"]["event_id"], self.event_id)
+        self.assertEqual(channel.json_body["event"]["type"], "m.room.message")
+        self.assertEqual(channel.json_body["event"]["sender"], self.other_user)
diff --git a/tests/rest/admin/test_event_reports.py b/tests/rest/admin/test_event_reports.py
index a6f958658f..19d945bb42 100644
--- a/tests/rest/admin/test_event_reports.py
+++ b/tests/rest/admin/test_event_reports.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List
 
 from twisted.internet.testing import MemoryReactor
 
@@ -27,7 +26,7 @@ from synapse.api.errors import Codes
 from synapse.rest.client import login, reporting, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -441,7 +440,7 @@ class EventReportsTestCase(unittest.HomeserverTestCase):
         )
         self.assertEqual(200, channel.code, msg=channel.json_body)
 
-    def _check_fields(self, content: List[JsonDict]) -> None:
+    def _check_fields(self, content: list[JsonDict]) -> None:
         """Checks that all attributes are present in an event report"""
         for c in content:
             self.assertIn("id", c)
diff --git a/tests/rest/admin/test_federation.py b/tests/rest/admin/test_federation.py
index cfea480bf0..561566de76 100644
--- a/tests/rest/admin/test_federation.py
+++ b/tests/rest/admin/test_federation.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional
 
 from parameterized import parameterized
 
@@ -29,7 +28,7 @@ from synapse.api.errors import Codes
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -272,9 +271,9 @@ class FederationTestCase(unittest.HomeserverTestCase):
         """Testing order list with parameter `order_by`"""
 
         def _order_test(
-            expected_destination_list: List[str],
-            order_by: Optional[str],
-            dir: Optional[str] = None,
+            expected_destination_list: list[str],
+            order_by: str | None,
+            dir: str | None = None,
         ) -> None:
             """Request the list of destinations in a certain order.
             Assert that order is what we expect
@@ -366,7 +365,7 @@ class FederationTestCase(unittest.HomeserverTestCase):
         """Test that searching for a destination works correctly"""
 
         def _search_test(
-            expected_destination: Optional[str],
+            expected_destination: str | None,
             search_term: str,
         ) -> None:
             """Search for a destination and check that the returned destinationis a match
@@ -484,10 +483,10 @@ class FederationTestCase(unittest.HomeserverTestCase):
     def _create_destination(
         self,
         destination: str,
-        failure_ts: Optional[int] = None,
+        failure_ts: int | None = None,
         retry_last_ts: int = 0,
         retry_interval: int = 0,
-        last_successful_stream_ordering: Optional[int] = None,
+        last_successful_stream_ordering: int | None = None,
     ) -> None:
         """Create one specific destination
 
@@ -521,7 +520,7 @@ class FederationTestCase(unittest.HomeserverTestCase):
             dest = f"sub{i}.example.com"
             self._create_destination(dest, 50, 50, 50, 100)
 
-    def _check_fields(self, content: List[JsonDict]) -> None:
+    def _check_fields(self, content: list[JsonDict]) -> None:
         """Checks that the expected destination attributes are present in content
 
         Args:
@@ -819,8 +818,8 @@ class DestinationMembershipTestCase(unittest.HomeserverTestCase):
     def _create_destination_rooms(
         self,
         number_rooms: int,
-        destination: Optional[str] = None,
-    ) -> List[str]:
+        destination: str | None = None,
+    ) -> list[str]:
         """
         Create the given number of rooms. The given `destination` homeserver will
         be recorded as a participant.
@@ -853,7 +852,7 @@ class DestinationMembershipTestCase(unittest.HomeserverTestCase):
 
         return room_ids
 
-    def _check_fields(self, content: List[JsonDict]) -> None:
+    def _check_fields(self, content: list[JsonDict]) -> None:
         """Checks that the expected room attributes are present in content
 
         Args:
diff --git a/tests/rest/admin/test_jwks.py b/tests/rest/admin/test_jwks.py
index 55b822c4d0..ee5588951b 100644
--- a/tests/rest/admin/test_jwks.py
+++ b/tests/rest/admin/test_jwks.py
@@ -19,7 +19,6 @@
 #
 #
 
-from typing import Dict
 
 from twisted.web.resource import Resource
 
@@ -33,7 +32,7 @@ from tests.utils import HAS_AUTHLIB
 class JWKSTestCase(HomeserverTestCase):
     """Test /_synapse/jwks JWKS data."""
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         d = super().create_resource_dict()
         d.update(build_synapse_client_resource_tree(self.hs))
         return d
diff --git a/tests/rest/admin/test_media.py b/tests/rest/admin/test_media.py
index f863b5f8e7..8cc54cc80c 100644
--- a/tests/rest/admin/test_media.py
+++ b/tests/rest/admin/test_media.py
@@ -20,7 +20,6 @@
 #
 #
 import os
-from typing import Dict
 
 from parameterized import parameterized
 
@@ -29,10 +28,11 @@ from twisted.web.resource import Resource
 
 import synapse.rest.admin
 from synapse.api.errors import Codes
+from synapse.media._base import FileInfo
 from synapse.media.filepath import MediaFilePaths
-from synapse.rest.client import login, profile, room
+from synapse.rest.client import login, media, profile, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils import SMALL_CMYK_JPEG, SMALL_PNG
@@ -47,14 +47,173 @@ class _AdminMediaTests(unittest.HomeserverTestCase):
         synapse.rest.admin.register_servlets,
         synapse.rest.admin.register_servlets_for_media_repo,
         login.register_servlets,
+        media.register_servlets,
     ]
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
 
 
+class QueryMediaByIDTestCase(_AdminMediaTests):
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        self.hs = hs
+        self.clock = clock
+        self.server_name = hs.hostname
+        self.store = hs.get_datastores().main
+
+        self.admin_user = self.register_user("admin", "pass", admin=True)
+        self.admin_user_tok = self.login("admin", "pass")
+
+    def _cache_remote_media(self, file_id: str) -> None:
+        file_info = FileInfo(server_name="remote.com", file_id=file_id)
+
+        media_storage = self.hs.get_media_repository().media_storage
+
+        ctx = media_storage.store_into_file(file_info)
+        (f, fname) = self.get_success(ctx.__aenter__())
+        f.write(SMALL_PNG)
+        self.get_success(ctx.__aexit__(None, None, None))
+
+        self.get_success(
+            self.store.store_cached_remote_media(
+                origin="remote.com",
+                media_id=file_id,
+                media_type="image/png",
+                media_length=len(SMALL_PNG),
+                time_now_ms=self.clock.time_msec(),
+                upload_name="test.png",
+                filesystem_id=file_id,
+                sha256=file_id,
+            )
+        )
+
+        channel = self.make_request(
+            "GET",
+            f"/_matrix/client/v1/media/download/remote.com/{file_id}",
+            shorthand=False,
+            access_token=self.admin_user_tok,
+        )
+
+        # Should be successful
+        self.assertEqual(
+            200,
+            channel.code,
+            msg=("Expected to receive a 200 on accessing media"),
+        )
+
+    def test_no_auth(self) -> None:
+        """
+        Try to query media without authentication.
+        """
+        url = f"/_synapse/admin/v1/media/{self.server_name}/12345"
+        channel = self.make_request("GET", url)
+
+        self.assertEqual(
+            401,
+            channel.code,
+            msg=channel.json_body,
+        )
+        self.assertEqual(Codes.MISSING_TOKEN, channel.json_body["errcode"])
+
+    def test_requester_is_no_admin(self) -> None:
+        """
+        If the user is not a server admin, an error is returned.
+        """
+        self.other_user = self.register_user("user", "pass")
+        self.other_user_token = self.login("user", "pass")
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/media/{self.server_name}/12345",
+            access_token=self.other_user_token,
+        )
+
+        self.assertEqual(403, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
+
+    def test_local_media_does_not_exist(self) -> None:
+        """
+        Tests that a lookup for local media that does not exist returns a 404
+        """
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/media/{self.server_name}/12345",
+            access_token=self.admin_user_tok,
+        )
+
+        self.assertEqual(404, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.NOT_FOUND, channel.json_body["errcode"])
+
+    def test_remote_media_does_not_exist(self) -> None:
+        """
+        Tests that a lookup for remote media that is not cached returns a 404
+        """
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/media/{self.server_name}/12345",
+            access_token=self.admin_user_tok,
+        )
+
+        self.assertEqual(404, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.NOT_FOUND, channel.json_body["errcode"])
+
+    def test_query_local_media(self) -> None:
+        """
+        Tests that querying an existing local media returns appropriate media info
+        """
+
+        # Upload some media into the room
+        response = self.helper.upload_media(
+            SMALL_PNG,
+            tok=self.admin_user_tok,
+            expect_code=200,
+        )
+        # Extract media ID from the response
+        server_and_media_id = response["content_uri"][6:]  # Cut off 'mxc://'
+        server_name, media_id = server_and_media_id.split("/")
+        self.assertEqual(server_name, self.server_name)
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/media/{self.server_name}/{media_id}",
+            access_token=self.admin_user_tok,
+        )
+
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        self.assertEqual(channel.json_body["media_info"]["authenticated"], True)
+        self.assertEqual(channel.json_body["media_info"]["media_id"], media_id)
+        self.assertEqual(
+            channel.json_body["media_info"]["media_length"], len(SMALL_PNG)
+        )
+        self.assertEqual(
+            channel.json_body["media_info"]["media_type"], "application/json"
+        )
+        self.assertEqual(channel.json_body["media_info"]["upload_name"], "test.png")
+        self.assertEqual(channel.json_body["media_info"]["user_id"], "@admin:test")
+
+    def test_query_remote_media(self) -> None:
+        file_id = "abcdefg12345"
+        self._cache_remote_media(file_id)
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/media/remote.com/{file_id}",
+            access_token=self.admin_user_tok,
+        )
+
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        self.assertEqual(channel.json_body["media_info"]["authenticated"], True)
+        self.assertEqual(channel.json_body["media_info"]["media_id"], file_id)
+        self.assertEqual(
+            channel.json_body["media_info"]["media_length"], len(SMALL_PNG)
+        )
+        self.assertEqual(channel.json_body["media_info"]["media_type"], "image/png")
+        self.assertEqual(channel.json_body["media_info"]["upload_name"], "test.png")
+        self.assertEqual(channel.json_body["media_info"]["media_origin"], "remote.com")
+
+
 class DeleteMediaByIDTestCase(_AdminMediaTests):
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.server_name = hs.hostname
@@ -710,8 +869,8 @@ class QuarantineMediaByIDTestCase(_AdminMediaTests):
         self.assertFalse(channel.json_body)
 
         # Test that ALL similar media was quarantined.
-        for media in [self.media_id, self.media_id_2, self.media_id_3]:
-            media_info = self.get_success(self.store.get_local_media(media))
+        for media_item in [self.media_id, self.media_id_2, self.media_id_3]:
+            media_info = self.get_success(self.store.get_local_media(media_item))
             assert media_info is not None
             self.assertTrue(media_info.quarantined_by)
 
@@ -731,8 +890,8 @@ class QuarantineMediaByIDTestCase(_AdminMediaTests):
         self.assertFalse(channel.json_body)
 
         # Test that ALL similar media is now reset.
-        for media in [self.media_id, self.media_id_2, self.media_id_3]:
-            media_info = self.get_success(self.store.get_local_media(media))
+        for media_item in [self.media_id, self.media_id_2, self.media_id_3]:
+            media_info = self.get_success(self.store.get_local_media(media_item))
             assert media_info is not None
             self.assertFalse(media_info.quarantined_by)
 
diff --git a/tests/rest/admin/test_registration_tokens.py b/tests/rest/admin/test_registration_tokens.py
index b8e111c804..447e1098e5 100644
--- a/tests/rest/admin/test_registration_tokens.py
+++ b/tests/rest/admin/test_registration_tokens.py
@@ -20,7 +20,6 @@
 #
 import random
 import string
-from typing import Optional
 
 from twisted.internet.testing import MemoryReactor
 
@@ -28,7 +27,7 @@ import synapse.rest.admin
 from synapse.api.errors import Codes
 from synapse.rest.client import login
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -51,11 +50,11 @@ class ManageRegistrationTokensTestCase(unittest.HomeserverTestCase):
 
     def _new_token(
         self,
-        token: Optional[str] = None,
-        uses_allowed: Optional[int] = None,
+        token: str | None = None,
+        uses_allowed: int | None = None,
         pending: int = 0,
         completed: int = 0,
-        expiry_time: Optional[int] = None,
+        expiry_time: int | None = None,
     ) -> str:
         """Helper function to create a token."""
         if token is None:
diff --git a/tests/rest/admin/test_room.py b/tests/rest/admin/test_room.py
index b98c53891c..b32665eb73 100644
--- a/tests/rest/admin/test_room.py
+++ b/tests/rest/admin/test_room.py
@@ -22,16 +22,14 @@ import json
 import time
 import urllib.parse
 from http import HTTPStatus
-from typing import List, Optional
 from unittest.mock import AsyncMock, Mock
 
 from parameterized import parameterized
 
-from twisted.internet.task import deferLater
 from twisted.internet.testing import MemoryReactor
 
 import synapse.rest.admin
-from synapse.api.constants import EventTypes, Membership, RoomTypes
+from synapse.api.constants import EventContentFields, EventTypes, Membership, RoomTypes
 from synapse.api.errors import Codes
 from synapse.api.room_versions import RoomVersions
 from synapse.handlers.pagination import (
@@ -45,7 +43,8 @@ from synapse.storage.databases.main.purge_events import (
     purge_room_tables_with_room_id_column,
 )
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.task_scheduler import TaskScheduler
 
 from tests import unittest
@@ -56,6 +55,308 @@ from tests import unittest
 ONE_HOUR_IN_S = 3600
 
 
+class AdminHierarchyTestCase(unittest.HomeserverTestCase):
+    servlets = [
+        synapse.rest.admin.register_servlets,
+        login.register_servlets,
+        room.register_servlets,
+    ]
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        # create some users
+        self.admin_user = self.register_user("admin", "pass", admin=True)
+        self.admin_user_tok = self.login("admin", "pass")
+
+        self.other_user = self.register_user("user", "pass")
+        self.other_user_tok = self.login("user", "pass")
+
+        self.third_user = self.register_user("third_user", "pass")
+        self.third_user_tok = self.login("third_user", "pass")
+
+        # mock out the function which pulls room information in over federation.
+        self._room_summary_handler = hs.get_room_summary_handler()
+        self._room_summary_handler._summarize_remote_room_hierarchy = Mock()  # type: ignore[method-assign]
+
+        # create some rooms with different options
+        self.room_id1 = self.helper.create_room_as(
+            self.other_user,
+            is_public=False,
+            tok=self.other_user_tok,
+            extra_content={"name": "nefarious", "topic": "being bad"},
+        )
+
+        self.room_id2 = self.helper.create_room_as(
+            self.third_user,
+            tok=self.third_user_tok,
+            extra_content={"name": "also nefarious"},
+        )
+
+        self.room_id3 = self.helper.create_room_as(
+            self.admin_user,
+            is_public=False,
+            tok=self.admin_user_tok,
+            extra_content={
+                "name": "not nefarious",
+                "topic": "happy things",
+                "creation_content": {
+                    "additional_creators": [self.other_user, self.third_user]
+                },
+            },
+            room_version="12",
+        )
+
+        self.not_in_space_room_id = self.helper.create_room_as(
+            self.other_user,
+            tok=self.other_user_tok,
+            extra_content={"name": "not related to other rooms"},
+        )
+
+        # create a space room
+        self.space_room_id = self.helper.create_room_as(
+            self.other_user,
+            is_public=True,
+            extra_content={
+                "visibility": "public",
+                "creation_content": {EventContentFields.ROOM_TYPE: RoomTypes.SPACE},
+                "name": "space_room",
+            },
+            tok=self.other_user_tok,
+        )
+
+        # and an unjoined remote room
+        self.remote_room_id = "!remote_room"
+
+        self.room_id_to_human_name_map = {
+            self.room_id1: "room1",
+            self.room_id2: "room2",
+            self.room_id3: "room3",
+            self.not_in_space_room_id: "room4",
+            self.space_room_id: "space_room",
+            self.remote_room_id: "remote_room",
+        }
+
+        # add three of the rooms to space
+        for state_key in [self.room_id1, self.room_id2, self.room_id3]:
+            self.helper.send_state(
+                self.space_room_id,
+                EventTypes.SpaceChild,
+                body={"via": ["local_test_server"]},
+                tok=self.other_user_tok,
+                state_key=state_key,
+            )
+
+        # and add remote room to space - ideally we'd add an actual remote
+        # space with rooms in it but the test framework doesn't currently
+        # support that. Instead we add a room which the server would have to
+        # reach out over federation to get details about and assert that the
+        # federation call was not made
+        self.helper.send_state(
+            self.space_room_id,
+            EventTypes.SpaceChild,
+            body={"via": ["remote_test_server"]},
+            tok=self.other_user_tok,
+            state_key=self.remote_room_id,
+        )
+
+    def test_no_auth(self) -> None:
+        """
+        If the requester does not provide authentication, a 401 is returned
+        """
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/rooms/{self.space_room_id}/hierarchy",
+        )
+
+        self.assertEqual(401, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.MISSING_TOKEN, channel.json_body["errcode"])
+
+    def test_requester_is_no_admin(self) -> None:
+        """
+        If the requester is not a server admin, an error 403 is returned.
+        """
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/rooms/{self.space_room_id}/hierarchy",
+            access_token=self.other_user_tok,
+        )
+
+        self.assertEqual(403, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
+
+    def test_bad_request(self) -> None:
+        """
+        Test that invalid param values raise an error
+        """
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/rooms/{self.space_room_id}/hierarchy?limit=ten",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(400, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.INVALID_PARAM, channel.json_body["errcode"])
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/rooms/{self.space_room_id}/hierarchy?max_depth=four",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(400, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.INVALID_PARAM, channel.json_body["errcode"])
+
+    def test_room_summary(self) -> None:
+        """
+        Test that details of room and details of children of room are
+        provided correctly
+        """
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/rooms/{self.space_room_id}/hierarchy",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(channel.code, 200, msg=channel.json_body)
+        rooms = channel.json_body["rooms"]
+        self.assertCountEqual(
+            {
+                self.room_id_to_human_name_map.get(
+                    room["room_id"], f"Unknown room: {room['room_id']}"
+                )
+                for room in rooms
+            },
+            {"space_room", "room1", "room2", "room3"},
+        )
+
+        for room_result in rooms:
+            room_id = room_result["room_id"]
+            if room_id == self.room_id1:
+                self.assertEqual(room_result["name"], "nefarious")
+                self.assertEqual(room_result["topic"], "being bad")
+                self.assertEqual(room_result["join_rule"], "invite")
+                self.assertEqual(len(room_result["children_state"]), 0)
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], True)
+                self.assertEqual(room_result["num_joined_members"], 1)
+            elif room_id == self.room_id2:
+                self.assertEqual(room_result["name"], "also nefarious")
+                self.assertEqual(room_result["join_rule"], "public")
+                self.assertEqual(len(room_result["children_state"]), 0)
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], False)
+                self.assertEqual(room_result["num_joined_members"], 1)
+            elif room_id == self.room_id3:
+                self.assertEqual(room_result["name"], "not nefarious")
+                self.assertEqual(room_result["join_rule"], "invite")
+                self.assertEqual(room_result["topic"], "happy things")
+                self.assertEqual(len(room_result["children_state"]), 0)
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], True)
+                self.assertEqual(room_result["num_joined_members"], 1)
+            elif room_id == self.not_in_space_room_id:
+                self.fail("this room should not have been returned")
+            elif room_id == self.space_room_id:
+                self.assertEqual(room_result["join_rule"], "public")
+                self.assertEqual(len(room_result["children_state"]), 4)
+                self.assertEqual(room_result["room_type"], "m.space")
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], False)
+                self.assertEqual(room_result["num_joined_members"], 1)
+                self.assertEqual(room_result["name"], "space_room")
+            else:
+                self.fail("unknown room returned")
+
+        # Assert that a federation function to look up details about
+        # this room has not been called. We never expect the admin
+        # hierarchy endpoint to reach out over federation.
+        self._room_summary_handler._summarize_remote_room_hierarchy.assert_not_called()  # type: ignore[attr-defined]
+
+    def test_room_summary_pagination(self) -> None:
+        """
+        Test that details of room and details of children of room are provided
+        correctly when paginating
+        """
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/rooms/{self.space_room_id}/hierarchy?limit=2",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(channel.code, 200, msg=channel.json_body)
+        rooms = channel.json_body["rooms"]
+        self.assertCountEqual(
+            {
+                self.room_id_to_human_name_map.get(
+                    room["room_id"], f"Unknown room: {room['room_id']}"
+                )
+                for room in rooms
+            },
+            {"space_room", "room1"},
+        )
+        next_batch = channel.json_body["next_batch"]
+
+        channel2 = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/rooms/{self.space_room_id}/hierarchy?from={next_batch}",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(channel2.code, 200, msg=channel2.json_body)
+        new_rooms = channel2.json_body["rooms"]
+        self.assertCountEqual(
+            {
+                self.room_id_to_human_name_map.get(
+                    room["room_id"], f"Unknown room: {room['room_id']}"
+                )
+                for room in new_rooms
+            },
+            {"room2", "room3"},
+        )
+
+        rooms_to_check = rooms + new_rooms
+        for room_result in rooms_to_check:
+            room_id = room_result["room_id"]
+            if room_id == self.room_id1:
+                self.assertEqual(room_result["name"], "nefarious")
+                self.assertEqual(room_result["topic"], "being bad")
+                self.assertEqual(room_result["join_rule"], "invite")
+                self.assertEqual(len(room_result["children_state"]), 0)
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], True)
+                self.assertEqual(room_result["num_joined_members"], 1)
+            elif room_id == self.room_id2:
+                self.assertEqual(room_result["name"], "also nefarious")
+                self.assertEqual(room_result["join_rule"], "public")
+                self.assertEqual(len(room_result["children_state"]), 0)
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], False)
+                self.assertEqual(room_result["num_joined_members"], 1)
+            elif room_id == self.room_id3:
+                self.assertEqual(room_result["name"], "not nefarious")
+                self.assertEqual(room_result["join_rule"], "invite")
+                self.assertEqual(room_result["topic"], "happy things")
+                self.assertEqual(len(room_result["children_state"]), 0)
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], True)
+                self.assertEqual(room_result["num_joined_members"], 1)
+            elif room_id == self.not_in_space_room_id:
+                self.fail("this room should not have been returned")
+            elif room_id == self.space_room_id:
+                self.assertEqual(room_result["join_rule"], "public")
+                self.assertEqual(len(room_result["children_state"]), 4)
+                self.assertEqual(room_result["room_type"], "m.space")
+                self.assertEqual(room_result["world_readable"], False)
+                self.assertEqual(room_result["guest_can_join"], False)
+                self.assertEqual(room_result["num_joined_members"], 1)
+                self.assertEqual(room_result["name"], "space_room")
+            else:
+                self.fail("unknown room returned")
+
+        # Assert that a federation function to look up details about
+        # this room has not been called. We never expect the admin
+        # hierarchy endpoint to reach out over federation.
+        self._room_summary_handler._summarize_remote_room_hierarchy.assert_not_called()  # type: ignore[attr-defined]
+
+
 class DeleteRoomTestCase(unittest.HomeserverTestCase):
     servlets = [
         synapse.rest.admin.register_servlets,
@@ -861,7 +1162,7 @@ class DeleteRoomV2TestCase(unittest.HomeserverTestCase):
         # Mock PaginationHandler.purge_room to sleep for 100s, so we have time to do a second call
         # before the purge is over. Note that it doesn't purge anymore, but we don't care.
         async def purge_room(room_id: str, force: bool) -> None:
-            await deferLater(self.hs.get_reactor(), 100, lambda: None)
+            await self.hs.get_clock().sleep(Duration(seconds=100))
 
         self.pagination_handler.purge_room = AsyncMock(side_effect=purge_room)  # type: ignore[method-assign]
 
@@ -1164,7 +1465,7 @@ class DeleteRoomV2TestCase(unittest.HomeserverTestCase):
             self._is_purged(room_id)
 
         # Wait for next scheduler run
-        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL_MS)
+        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL.as_secs())
 
         self._is_purged(room_id)
 
@@ -1201,7 +1502,7 @@ class DeleteRoomV2TestCase(unittest.HomeserverTestCase):
             self._is_purged(room_id)
 
         # Wait for next scheduler run
-        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL_MS)
+        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL.as_secs())
 
         # Test that all users has been kicked (room is shutdown)
         self._has_no_members(room_id)
@@ -1609,7 +1910,7 @@ class RoomTestCase(unittest.HomeserverTestCase):
 
         def _order_test(
             order_type: str,
-            expected_room_list: List[str],
+            expected_room_list: list[str],
             reverse: bool = False,
         ) -> None:
             """Request the list of rooms in a certain order. Assert that order is what
@@ -1773,7 +2074,7 @@ class RoomTestCase(unittest.HomeserverTestCase):
         self._set_canonical_alias(room_id_1, "#Room_Alias1:test", self.admin_user_tok)
 
         def _search_test(
-            expected_room_id: Optional[str],
+            expected_room_id: str | None,
             search_term: str,
             expected_http_code: int = 200,
         ) -> None:
@@ -2244,7 +2545,7 @@ class RoomMessagesTestCase(unittest.HomeserverTestCase):
 
     def test_topo_token_is_accepted(self) -> None:
         """Test Topo Token is accepted."""
-        token = "t1-0_0_0_0_0_0_0_0_0_0"
+        token = "t1-0_0_0_0_0_0_0_0_0_0_0_0"
         channel = self.make_request(
             "GET",
             "/_synapse/admin/v1/rooms/%s/messages?from=%s" % (self.room_id, token),
@@ -2258,7 +2559,7 @@ class RoomMessagesTestCase(unittest.HomeserverTestCase):
 
     def test_stream_token_is_accepted_for_fwd_pagianation(self) -> None:
         """Test that stream token is accepted for forward pagination."""
-        token = "s0_0_0_0_0_0_0_0_0_0"
+        token = "s0_0_0_0_0_0_0_0_0_0_0_0"
         channel = self.make_request(
             "GET",
             "/_synapse/admin/v1/rooms/%s/messages?from=%s" % (self.room_id, token),
@@ -2675,6 +2976,120 @@ class JoinAliasRoomTestCase(unittest.HomeserverTestCase):
         self.assertEqual(200, channel.code, msg=channel.json_body)
         self.assertEqual(private_room_id, channel.json_body["joined_rooms"][0])
 
+    def test_joined_rooms(self) -> None:
+        """
+        Test joined_rooms admin endpoint.
+        """
+
+        channel = self.make_request(
+            "POST",
+            f"/_matrix/client/v3/join/{self.public_room_id}",
+            content={"user_id": self.second_user_id},
+            access_token=self.second_tok,
+        )
+
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        self.assertEqual(self.public_room_id, channel.json_body["room_id"])
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/users/{self.second_user_id}/joined_rooms",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        self.assertEqual(self.public_room_id, channel.json_body["joined_rooms"][0])
+
+    def test_memberships(self) -> None:
+        """
+        Test user memberships admin endpoint.
+        """
+
+        channel = self.make_request(
+            "POST",
+            f"/_matrix/client/v3/join/{self.public_room_id}",
+            content={"user_id": self.second_user_id},
+            access_token=self.second_tok,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+
+        other_room_id = self.helper.create_room_as(
+            self.admin_user, tok=self.admin_user_tok
+        )
+
+        channel = self.make_request(
+            "POST",
+            f"/_matrix/client/v3/join/{other_room_id}",
+            content={"user_id": self.second_user_id},
+            access_token=self.second_tok,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/users/{self.second_user_id}/memberships",
+            access_token=self.admin_user_tok,
+        )
+
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        self.assertEqual(
+            {
+                "memberships": {
+                    self.public_room_id: Membership.JOIN,
+                    other_room_id: Membership.JOIN,
+                }
+            },
+            channel.json_body,
+        )
+
+        channel = self.make_request(
+            "POST",
+            f"/_matrix/client/v3/rooms/{other_room_id}/leave",
+            content={"user_id": self.second_user_id},
+            access_token=self.second_tok,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+
+        invited_room_id = self.helper.create_room_as(
+            self.admin_user, tok=self.admin_user_tok
+        )
+        channel = self.make_request(
+            "POST",
+            f"/_matrix/client/v3/rooms/{invited_room_id}/invite",
+            content={"user_id": self.second_user_id},
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+
+        banned_room_id = self.helper.create_room_as(
+            self.admin_user, tok=self.admin_user_tok
+        )
+        channel = self.make_request(
+            "POST",
+            f"/_matrix/client/v3/rooms/{banned_room_id}/ban",
+            content={"user_id": self.second_user_id},
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+
+        channel = self.make_request(
+            "GET",
+            f"/_synapse/admin/v1/users/{self.second_user_id}/memberships",
+            access_token=self.admin_user_tok,
+        )
+
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        self.assertEqual(
+            {
+                "memberships": {
+                    self.public_room_id: Membership.JOIN,
+                    other_room_id: Membership.LEAVE,
+                    invited_room_id: Membership.INVITE,
+                    banned_room_id: Membership.BAN,
+                }
+            },
+            channel.json_body,
+        )
+
     def test_context_as_non_admin(self) -> None:
         """
         Test that, without being admin, one cannot use the context admin API
@@ -2947,7 +3362,7 @@ class MakeRoomAdminTestCase(unittest.HomeserverTestCase):
         pl = self.helper.get_state(
             room_id, EventTypes.PowerLevels, tok=self.creator_tok
         )
-        self.assertEquals(pl["users"][self.admin_user], 100)
+        self.assertEqual(pl["users"][self.admin_user], 100)
 
     def test_v12_room_with_many_user_pls(self) -> None:
         """Test that you can be promoted to the admin user's PL in v12 rooms that contain a range of user PLs."""
@@ -2980,7 +3395,7 @@ class MakeRoomAdminTestCase(unittest.HomeserverTestCase):
         pl = self.helper.get_state(
             room_id, EventTypes.PowerLevels, tok=self.creator_tok
         )
-        self.assertEquals(pl["users"][self.admin_user], 100)
+        self.assertEqual(pl["users"][self.admin_user], 100)
 
 
 class BlockRoomTestCase(unittest.HomeserverTestCase):
diff --git a/tests/rest/admin/test_scheduled_tasks.py b/tests/rest/admin/test_scheduled_tasks.py
index ea7afc0101..4b7adb6b89 100644
--- a/tests/rest/admin/test_scheduled_tasks.py
+++ b/tests/rest/admin/test_scheduled_tasks.py
@@ -13,7 +13,7 @@
 #
 #
 #
-from typing import Mapping, Optional, Tuple
+from typing import Mapping
 
 from twisted.internet.testing import MemoryReactor
 
@@ -22,7 +22,7 @@ from synapse.api.errors import Codes
 from synapse.rest.client import login
 from synapse.server import HomeServer
 from synapse.types import JsonMapping, ScheduledTask, TaskStatus
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -42,17 +42,17 @@ class ScheduledTasksAdminApiTestCase(unittest.HomeserverTestCase):
         # create and schedule a few tasks
         async def _test_task(
             task: ScheduledTask,
-        ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+        ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
             return TaskStatus.ACTIVE, None, None
 
         async def _finished_test_task(
             task: ScheduledTask,
-        ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+        ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
             return TaskStatus.COMPLETE, None, None
 
         async def _failed_test_task(
             task: ScheduledTask,
-        ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+        ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
             return TaskStatus.FAILED, None, "Everything failed"
 
         self._task_scheduler.register_action(_test_task, "test_task")
@@ -135,7 +135,7 @@ class ScheduledTasksAdminApiTestCase(unittest.HomeserverTestCase):
         # filter via job_status
         channel = self.make_request(
             "GET",
-            "/_synapse/admin/v1/scheduled_tasks?job_status=active",
+            "/_synapse/admin/v1/scheduled_tasks?status=active",
             content={},
             access_token=self.admin_user_tok,
         )
diff --git a/tests/rest/admin/test_server_notice.py b/tests/rest/admin/test_server_notice.py
index 1f77e31d48..5053fea9c9 100644
--- a/tests/rest/admin/test_server_notice.py
+++ b/tests/rest/admin/test_server_notice.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Sequence
+from typing import Sequence
 
 from twisted.internet.testing import MemoryReactor
 
@@ -28,7 +28,7 @@ from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
 from synapse.storage.roommember import RoomsForUser
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 from tests import unittest
@@ -729,7 +729,7 @@ class ServerNoticeTestCase(unittest.HomeserverTestCase):
 
         return invited_rooms
 
-    def _sync_and_get_messages(self, room_id: str, token: str) -> List[JsonDict]:
+    def _sync_and_get_messages(self, room_id: str, token: str) -> list[JsonDict]:
         """
         Do a sync and get messages of a room.
 
diff --git a/tests/rest/admin/test_statistics.py b/tests/rest/admin/test_statistics.py
index 10efc4ef8b..3dc7e5dc97 100644
--- a/tests/rest/admin/test_statistics.py
+++ b/tests/rest/admin/test_statistics.py
@@ -19,7 +19,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict, List, Optional
 
 from twisted.internet.testing import MemoryReactor
 from twisted.web.resource import Resource
@@ -29,7 +28,7 @@ from synapse.api.errors import Codes
 from synapse.rest.client import login
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils import SMALL_PNG
@@ -50,7 +49,7 @@ class UserMediaStatisticsTestCase(unittest.HomeserverTestCase):
 
         self.url = "/_synapse/admin/v1/statistics/users/media"
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
@@ -485,7 +484,7 @@ class UserMediaStatisticsTestCase(unittest.HomeserverTestCase):
             # Upload some media into the room
             self.helper.upload_media(SMALL_PNG, tok=user_token, expect_code=200)
 
-    def _check_fields(self, content: List[JsonDict]) -> None:
+    def _check_fields(self, content: list[JsonDict]) -> None:
         """Checks that all attributes are present in content
         Args:
             content: List that is checked for content
@@ -497,7 +496,7 @@ class UserMediaStatisticsTestCase(unittest.HomeserverTestCase):
             self.assertIn("media_length", c)
 
     def _order_test(
-        self, order_type: str, expected_user_list: List[str], dir: Optional[str] = None
+        self, order_type: str, expected_user_list: list[str], dir: str | None = None
     ) -> None:
         """Request the list of users in a certain order. Assert that order is what
         we expect
diff --git a/tests/rest/admin/test_user.py b/tests/rest/admin/test_user.py
index 4432b6a7a0..72937df9a6 100644
--- a/tests/rest/admin/test_user.py
+++ b/tests/rest/admin/test_user.py
@@ -27,7 +27,6 @@ import time
 import urllib.parse
 from binascii import unhexlify
 from http import HTTPStatus
-from typing import Dict, List, Optional
 from unittest.mock import AsyncMock, Mock, patch
 
 from parameterized import parameterized, parameterized_class
@@ -61,7 +60,7 @@ from synapse.rest.client import (
 from synapse.server import HomeServer
 from synapse.storage.databases.main.client_ips import LAST_SEEN_GRANULARITY
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.replication._base import BaseMultiWorkerStreamTestCase
@@ -643,10 +642,10 @@ class UsersListTestCase(unittest.HomeserverTestCase):
         """Test that searching for a users works correctly"""
 
         def _search_test(
-            expected_user_id: Optional[str],
+            expected_user_id: str | None,
             search_term: str,
-            search_field: Optional[str] = "name",
-            expected_http_code: Optional[int] = 200,
+            search_field: str | None = "name",
+            expected_http_code: int | None = 200,
         ) -> None:
             """Search for a user and check that the returned user's id is a match
 
@@ -1185,7 +1184,7 @@ class UsersListTestCase(unittest.HomeserverTestCase):
         )
 
         def test_user_type(
-            expected_user_ids: List[str], not_user_types: Optional[List[str]] = None
+            expected_user_ids: list[str], not_user_types: list[str] | None = None
         ) -> None:
             """Runs a test for the not_user_types param
             Args:
@@ -1262,7 +1261,7 @@ class UsersListTestCase(unittest.HomeserverTestCase):
         )
 
         def test_user_type(
-            expected_user_ids: List[str], not_user_types: Optional[List[str]] = None
+            expected_user_ids: list[str], not_user_types: list[str] | None = None
         ) -> None:
             """Runs a test for the not_user_types param
             Args:
@@ -1373,9 +1372,9 @@ class UsersListTestCase(unittest.HomeserverTestCase):
 
     def _order_test(
         self,
-        expected_user_list: List[str],
-        order_by: Optional[str],
-        dir: Optional[str] = None,
+        expected_user_list: list[str],
+        order_by: str | None,
+        dir: str | None = None,
     ) -> None:
         """Request the list of users in a certain order. Assert that order is what
         we expect
@@ -1403,7 +1402,7 @@ class UsersListTestCase(unittest.HomeserverTestCase):
         self.assertEqual(expected_user_list, returned_order)
         self._check_fields(channel.json_body["users"])
 
-    def _check_fields(self, content: List[JsonDict]) -> None:
+    def _check_fields(self, content: list[JsonDict]) -> None:
         """Checks that the expected user attributes are present in content
         Args:
             content: List that is checked for content
@@ -3116,7 +3115,7 @@ class UserRestTestCase(unittest.HomeserverTestCase):
         self.assertEqual("@user:test", channel.json_body["name"])
         self.assertTrue(channel.json_body["admin"])
 
-    def set_user_type(self, user_type: Optional[str]) -> None:
+    def set_user_type(self, user_type: str | None) -> None:
         # Set to user_type
         channel = self.make_request(
             "PUT",
@@ -3690,7 +3689,7 @@ class UserMediaRestTestCase(unittest.HomeserverTestCase):
             self.other_user
         )
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
@@ -4138,7 +4137,7 @@ class UserMediaRestTestCase(unittest.HomeserverTestCase):
             [media2] + sorted([media1, media3]), "safe_from_quarantine", "b"
         )
 
-    def _create_media_for_user(self, user_token: str, number_media: int) -> List[str]:
+    def _create_media_for_user(self, user_token: str, number_media: int) -> list[str]:
         """
         Create a number of media for a specific user
         Args:
@@ -4195,7 +4194,7 @@ class UserMediaRestTestCase(unittest.HomeserverTestCase):
 
         return media_id
 
-    def _check_fields(self, content: List[JsonDict]) -> None:
+    def _check_fields(self, content: list[JsonDict]) -> None:
         """Checks that the expected user attributes are present in content
         Args:
             content: List that is checked for content
@@ -4212,9 +4211,9 @@ class UserMediaRestTestCase(unittest.HomeserverTestCase):
 
     def _order_test(
         self,
-        expected_media_list: List[str],
-        order_by: Optional[str],
-        dir: Optional[str] = None,
+        expected_media_list: list[str],
+        order_by: str | None,
+        dir: str | None = None,
     ) -> None:
         """Request the list of media in a certain order. Assert that order is what
         we expect
@@ -4289,6 +4288,17 @@ class UserTokenRestTestCase(unittest.HomeserverTestCase):
 
         self.assertEqual(403, channel.code, msg=channel.json_body)
 
+    def test_no_user(self) -> None:
+        """Try to log in as a user that doesn't exist."""
+        channel = self.make_request(
+            "POST",
+            "/_synapse/admin/v1/users/%s/login" % urllib.parse.quote("@ghost:test"),
+            b"{}",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(404, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.NOT_FOUND, channel.json_body["errcode"])
+
     def test_send_event(self) -> None:
         """Test that sending event as a user works."""
         # Create a room.
diff --git a/tests/rest/admin/test_username_available.py b/tests/rest/admin/test_username_available.py
index 9c3ab3e64c..c3091ce412 100644
--- a/tests/rest/admin/test_username_available.py
+++ b/tests/rest/admin/test_username_available.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Optional
 
 from twisted.internet.testing import MemoryReactor
 
@@ -26,7 +25,7 @@ import synapse.rest.admin
 from synapse.api.errors import Codes, SynapseError
 from synapse.rest.client import login
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -44,8 +43,8 @@ class UsernameAvailableTestCase(unittest.HomeserverTestCase):
 
         async def check_username(
             localpart: str,
-            guest_access_token: Optional[str] = None,
-            assigned_user_id: Optional[str] = None,
+            guest_access_token: str | None = None,
+            assigned_user_id: str | None = None,
             inhibit_user_in_use_error: bool = False,
         ) -> None:
             if localpart == "allowed":
diff --git a/tests/rest/client/sliding_sync/test_connection_tracking.py b/tests/rest/client/sliding_sync/test_connection_tracking.py
index f8ce1104a8..44e7fa4726 100644
--- a/tests/rest/client/sliding_sync/test_connection_tracking.py
+++ b/tests/rest/client/sliding_sync/test_connection_tracking.py
@@ -12,6 +12,7 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 import logging
+from unittest.mock import patch
 
 from parameterized import parameterized, parameterized_class
 
@@ -19,9 +20,12 @@ from twisted.internet.testing import MemoryReactor
 
 import synapse.rest.admin
 from synapse.api.constants import EventTypes
+from synapse.api.errors import Codes
+from synapse.handlers.sliding_sync import room_lists
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.storage.databases.main.sliding_sync import CONNECTION_EXPIRY
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 
@@ -395,3 +399,107 @@ class SlidingSyncConnectionTrackingTestCase(SlidingSyncBase):
         )
         self.assertEqual(response_body["rooms"][room_id1]["limited"], True)
         self.assertEqual(response_body["rooms"][room_id1]["initial"], True)
+
+    @patch("synapse.handlers.sliding_sync.room_lists.NUM_ROOMS_THRESHOLD", new=5)
+    def test_sliding_sync_connection_expires_with_too_much_data(self) -> None:
+        """
+        Test that if we have too much data to send down for incremental sync,
+        we expire the connection and ask the client to do a full resync.
+
+        Connections are only expired if they have not been used for a minimum
+        amount of time (MINIMUM_NOT_USED_AGE_EXPIRY) to avoid expiring
+        connections that are actively being used.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        # Create enough rooms that we can later trigger the too much data case
+        room_ids = []
+        for _ in range(room_lists.NUM_ROOMS_THRESHOLD + 2):
+            room_id = self.helper.create_room_as(user2_id, tok=user2_tok)
+            self.helper.join(room_id, user1_id, tok=user1_tok)
+            room_ids.append(room_id)
+
+            # Make sure we don't hit ratelimits
+            self.reactor.advance(60 * 1000)
+
+        # Make the Sliding Sync request
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1000]],
+                    "required_state": [],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # Check we got all the rooms down
+        for room_id in room_ids:
+            self.assertIn(room_id, response_body["rooms"])
+
+        # Send a lot of events to cause the connection to expire
+        for room_id in room_ids:
+            self.helper.send(room_id, "msg", tok=user2_tok)
+
+        # If we don't advance the clock then we won't expire the connection.
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # Send some more events.
+        for room_id in room_ids:
+            self.helper.send(room_id, "msg", tok=user2_tok)
+
+        # Advance the clock to ensure that the last_used_ts is old enough
+        self.reactor.advance(2 * room_lists.MINIMUM_NOT_USED_AGE_EXPIRY.as_secs())
+
+        # This sync should now raise SlidingSyncUnknownPosition
+        channel = self.make_sync_request(sync_body, since=from_token, tok=user1_tok)
+        self.assertEqual(channel.code, 400)
+        self.assertEqual(channel.json_body["errcode"], Codes.UNKNOWN_POS)
+
+    def test_sliding_sync_connection_expires_after_time(self) -> None:
+        """
+        Test that if we don't use a sliding sync connection for a long time,
+        we expire the connection and ask the client to do a full resync.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        room_id = self.helper.create_room_as(user2_id, tok=user2_tok)
+        self.helper.join(room_id, user1_id, tok=user1_tok)
+
+        # Make the Sliding Sync request
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1000]],
+                    "required_state": [],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+
+        _, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # We can keep syncing so long as the interval between requests is less
+        # than CONNECTION_EXPIRY
+        for _ in range(5):
+            self.reactor.advance(0.5 * CONNECTION_EXPIRY.as_secs())
+
+            _, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # ... but if we wait too long, the connection expires
+        self.reactor.advance(1 + CONNECTION_EXPIRY.as_secs())
+
+        # This sync should now raise SlidingSyncUnknownPosition
+        channel = self.make_sync_request(sync_body, since=from_token, tok=user1_tok)
+        self.assertEqual(channel.code, 400)
+        self.assertEqual(channel.json_body["errcode"], Codes.UNKNOWN_POS)
diff --git a/tests/rest/client/sliding_sync/test_extension_account_data.py b/tests/rest/client/sliding_sync/test_extension_account_data.py
index 5949065722..8e08b4a2ac 100644
--- a/tests/rest/client/sliding_sync/test_extension_account_data.py
+++ b/tests/rest/client/sliding_sync/test_extension_account_data.py
@@ -24,7 +24,7 @@ from synapse.api.constants import AccountDataTypes
 from synapse.rest.client import login, room, sendtodevice, sync
 from synapse.server import HomeServer
 from synapse.types import StreamKeyType
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.server import TimedOutException
diff --git a/tests/rest/client/sliding_sync/test_extension_e2ee.py b/tests/rest/client/sliding_sync/test_extension_e2ee.py
index baf6a5882e..4a5e407038 100644
--- a/tests/rest/client/sliding_sync/test_extension_e2ee.py
+++ b/tests/rest/client/sliding_sync/test_extension_e2ee.py
@@ -21,7 +21,7 @@ import synapse.rest.admin
 from synapse.rest.client import devices, login, room, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict, StreamKeyType
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.server import TimedOutException
diff --git a/tests/rest/client/sliding_sync/test_extension_receipts.py b/tests/rest/client/sliding_sync/test_extension_receipts.py
index 1bba3038db..8c02217cde 100644
--- a/tests/rest/client/sliding_sync/test_extension_receipts.py
+++ b/tests/rest/client/sliding_sync/test_extension_receipts.py
@@ -22,7 +22,7 @@ from synapse.api.constants import EduTypes, ReceiptTypes
 from synapse.rest.client import login, receipts, room, sync
 from synapse.server import HomeServer
 from synapse.types import StreamKeyType
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.server import TimedOutException
diff --git a/tests/rest/client/sliding_sync/test_extension_thread_subscriptions.py b/tests/rest/client/sliding_sync/test_extension_thread_subscriptions.py
new file mode 100644
index 0000000000..aa251bd78b
--- /dev/null
+++ b/tests/rest/client/sliding_sync/test_extension_thread_subscriptions.py
@@ -0,0 +1,497 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+import logging
+from http import HTTPStatus
+from typing import cast
+
+from twisted.test.proto_helpers import MemoryReactor
+
+import synapse.rest.admin
+from synapse.rest.client import login, room, sync, thread_subscriptions
+from synapse.server import HomeServer
+from synapse.types import JsonDict
+from synapse.util.clock import Clock
+
+from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
+
+logger = logging.getLogger(__name__)
+
+
+# The name of the extension. Currently unstable-prefixed.
+EXT_NAME = "io.element.msc4308.thread_subscriptions"
+
+
+class SlidingSyncThreadSubscriptionsExtensionTestCase(SlidingSyncBase):
+    """
+    Test the thread subscriptions extension in the Sliding Sync API.
+    """
+
+    maxDiff = None
+
+    servlets = [
+        synapse.rest.admin.register_servlets,
+        login.register_servlets,
+        room.register_servlets,
+        sync.register_servlets,
+        thread_subscriptions.register_servlets,
+    ]
+
+    def default_config(self) -> JsonDict:
+        config = super().default_config()
+        config["experimental_features"] = {"msc4306_enabled": True}
+        return config
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        self.store = hs.get_datastores().main
+        self.storage_controllers = hs.get_storage_controllers()
+        super().prepare(reactor, clock, hs)
+
+    def test_no_data_initial_sync(self) -> None:
+        """
+        Test enabling thread subscriptions extension during initial sync with no data.
+        """
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        sync_body = {
+            "lists": {},
+            "extensions": {
+                EXT_NAME: {
+                    "enabled": True,
+                }
+            },
+        }
+
+        # Sync
+        response_body, _ = self.do_sync(sync_body, tok=user1_tok)
+
+        # Assert
+        self.assertNotIn(EXT_NAME, response_body["extensions"])
+
+    def test_no_data_incremental_sync(self) -> None:
+        """
+        Test enabling thread subscriptions extension during incremental sync with no data.
+        """
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        initial_sync_body: JsonDict = {
+            "lists": {},
+        }
+
+        # Initial sync
+        response_body, sync_pos = self.do_sync(initial_sync_body, tok=user1_tok)
+
+        # Incremental sync with extension enabled
+        sync_body = {
+            "lists": {},
+            "extensions": {
+                EXT_NAME: {
+                    "enabled": True,
+                }
+            },
+        }
+        response_body, _ = self.do_sync(sync_body, tok=user1_tok, since=sync_pos)
+
+        # Assert
+        self.assertNotIn(
+            EXT_NAME,
+            response_body["extensions"],
+            response_body,
+        )
+
+    def test_thread_subscription_initial_sync(self) -> None:
+        """
+        Test thread subscriptions appear in initial sync response.
+        """
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok)
+        thread_root_resp = self.helper.send(room_id, body="Thread root", tok=user1_tok)
+        thread_root_id = thread_root_resp["event_id"]
+
+        # get the baseline stream_id of the thread_subscriptions stream
+        # before we write any data.
+        # Required because the initial value differs between SQLite and Postgres.
+        base = self.store.get_max_thread_subscriptions_stream_id()
+
+        self._subscribe_to_thread(user1_id, room_id, thread_root_id)
+        sync_body = {
+            "lists": {},
+            "extensions": {
+                EXT_NAME: {
+                    "enabled": True,
+                }
+            },
+        }
+
+        # Sync
+        response_body, _ = self.do_sync(sync_body, tok=user1_tok)
+
+        # Assert
+        self.assertEqual(
+            response_body["extensions"][EXT_NAME],
+            {
+                "subscribed": {
+                    room_id: {
+                        thread_root_id: {
+                            "automatic": False,
+                            "bump_stamp": base + 1,
+                        }
+                    }
+                }
+            },
+        )
+
+    def test_thread_subscription_incremental_sync(self) -> None:
+        """
+        Test new thread subscriptions appear in incremental sync response.
+        """
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok)
+        sync_body = {
+            "lists": {},
+            "extensions": {
+                EXT_NAME: {
+                    "enabled": True,
+                }
+            },
+        }
+        thread_root_resp = self.helper.send(room_id, body="Thread root", tok=user1_tok)
+        thread_root_id = thread_root_resp["event_id"]
+
+        # get the baseline stream_id of the thread_subscriptions stream
+        # before we write any data.
+        # Required because the initial value differs between SQLite and Postgres.
+        base = self.store.get_max_thread_subscriptions_stream_id()
+
+        # Initial sync
+        _, sync_pos = self.do_sync(sync_body, tok=user1_tok)
+        logger.info("Synced to: %r, now subscribing to thread", sync_pos)
+
+        # Subscribe
+        self._subscribe_to_thread(user1_id, room_id, thread_root_id)
+
+        # Incremental sync
+        response_body, sync_pos = self.do_sync(sync_body, tok=user1_tok, since=sync_pos)
+        logger.info("Synced to: %r", sync_pos)
+
+        # Assert
+        self.assertEqual(
+            response_body["extensions"][EXT_NAME],
+            {
+                "subscribed": {
+                    room_id: {
+                        thread_root_id: {
+                            "automatic": False,
+                            "bump_stamp": base + 1,
+                        }
+                    }
+                }
+            },
+        )
+
+    def test_unsubscribe_from_thread(self) -> None:
+        """
+        Test unsubscribing from a thread.
+        """
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok)
+        thread_root_resp = self.helper.send(room_id, body="Thread root", tok=user1_tok)
+        thread_root_id = thread_root_resp["event_id"]
+
+        # get the baseline stream_id of the thread_subscriptions stream
+        # before we write any data.
+        # Required because the initial value differs between SQLite and Postgres.
+        base = self.store.get_max_thread_subscriptions_stream_id()
+
+        self._subscribe_to_thread(user1_id, room_id, thread_root_id)
+        sync_body = {
+            "lists": {},
+            "extensions": {
+                EXT_NAME: {
+                    "enabled": True,
+                }
+            },
+        }
+
+        response_body, sync_pos = self.do_sync(sync_body, tok=user1_tok)
+
+        # Assert: Subscription present
+        self.assertIn(EXT_NAME, response_body["extensions"])
+        self.assertEqual(
+            response_body["extensions"][EXT_NAME],
+            {
+                "subscribed": {
+                    room_id: {
+                        thread_root_id: {"automatic": False, "bump_stamp": base + 1}
+                    }
+                }
+            },
+        )
+
+        # Unsubscribe
+        self._unsubscribe_from_thread(user1_id, room_id, thread_root_id)
+
+        # Incremental sync
+        response_body, sync_pos = self.do_sync(sync_body, tok=user1_tok, since=sync_pos)
+
+        # Assert: Unsubscription present
+        self.assertEqual(
+            response_body["extensions"][EXT_NAME],
+            {"unsubscribed": {room_id: {thread_root_id: {"bump_stamp": base + 2}}}},
+        )
+
+    def test_multiple_thread_subscriptions(self) -> None:
+        """
+        Test handling of multiple thread subscriptions.
+        """
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok)
+
+        # Create thread roots
+        thread_root_resp1 = self.helper.send(
+            room_id, body="Thread root 1", tok=user1_tok
+        )
+        thread_root_id1 = thread_root_resp1["event_id"]
+        thread_root_resp2 = self.helper.send(
+            room_id, body="Thread root 2", tok=user1_tok
+        )
+        thread_root_id2 = thread_root_resp2["event_id"]
+        thread_root_resp3 = self.helper.send(
+            room_id, body="Thread root 3", tok=user1_tok
+        )
+        thread_root_id3 = thread_root_resp3["event_id"]
+
+        # get the baseline stream_id of the thread_subscriptions stream
+        # before we write any data.
+        # Required because the initial value differs between SQLite and Postgres.
+        base = self.store.get_max_thread_subscriptions_stream_id()
+
+        # Subscribe to threads
+        self._subscribe_to_thread(user1_id, room_id, thread_root_id1)
+        self._subscribe_to_thread(user1_id, room_id, thread_root_id2)
+        self._subscribe_to_thread(user1_id, room_id, thread_root_id3)
+
+        sync_body = {
+            "lists": {},
+            "extensions": {
+                EXT_NAME: {
+                    "enabled": True,
+                }
+            },
+        }
+
+        # Sync
+        response_body, _ = self.do_sync(sync_body, tok=user1_tok)
+
+        # Assert
+        self.assertEqual(
+            response_body["extensions"][EXT_NAME],
+            {
+                "subscribed": {
+                    room_id: {
+                        thread_root_id1: {
+                            "automatic": False,
+                            "bump_stamp": base + 1,
+                        },
+                        thread_root_id2: {
+                            "automatic": False,
+                            "bump_stamp": base + 2,
+                        },
+                        thread_root_id3: {
+                            "automatic": False,
+                            "bump_stamp": base + 3,
+                        },
+                    }
+                }
+            },
+        )
+
+    def test_limit_parameter(self) -> None:
+        """
+        Test limit parameter in thread subscriptions extension.
+        """
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok)
+
+        # Create 5 thread roots and subscribe to each
+        thread_root_ids = []
+        for i in range(5):
+            thread_root_resp = self.helper.send(
+                room_id, body=f"Thread root {i}", tok=user1_tok
+            )
+            thread_root_ids.append(thread_root_resp["event_id"])
+            self._subscribe_to_thread(user1_id, room_id, thread_root_ids[-1])
+
+        sync_body = {
+            "lists": {},
+            "extensions": {EXT_NAME: {"enabled": True, "limit": 3}},
+        }
+
+        # Sync
+        response_body, _ = self.do_sync(sync_body, tok=user1_tok)
+
+        # Assert
+        thread_subscriptions = response_body["extensions"][EXT_NAME]
+        self.assertEqual(
+            len(thread_subscriptions["subscribed"][room_id]), 3, thread_subscriptions
+        )
+
+    def test_limit_and_companion_backpagination(self) -> None:
+        """
+        Create 1 thread subscription, do a sync, create 4 more,
+        then sync with a limit of 2 and fill in the gap
+        using the companion /thread_subscriptions endpoint.
+        """
+
+        thread_root_ids: list[str] = []
+
+        def make_subscription() -> None:
+            thread_root_resp = self.helper.send(
+                room_id, body="Some thread root", tok=user1_tok
+            )
+            thread_root_ids.append(thread_root_resp["event_id"])
+            self._subscribe_to_thread(user1_id, room_id, thread_root_ids[-1])
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok)
+
+        # get the baseline stream_id of the thread_subscriptions stream
+        # before we write any data.
+        # Required because the initial value differs between SQLite and Postgres.
+        base = self.store.get_max_thread_subscriptions_stream_id()
+
+        # Make our first subscription
+        make_subscription()
+
+        # Sync for the first time
+        sync_body = {
+            "lists": {},
+            "extensions": {EXT_NAME: {"enabled": True, "limit": 2}},
+        }
+
+        sync_resp, first_sync_pos = self.do_sync(sync_body, tok=user1_tok)
+
+        thread_subscriptions = sync_resp["extensions"][EXT_NAME]
+        self.assertEqual(
+            thread_subscriptions["subscribed"],
+            {
+                room_id: {
+                    thread_root_ids[0]: {"automatic": False, "bump_stamp": base + 1},
+                }
+            },
+        )
+
+        # Get our pos for the next sync
+        first_sync_pos = sync_resp["pos"]
+
+        # Create 5 more thread subscriptions and subscribe to each
+        for _ in range(5):
+            make_subscription()
+
+        # Now sync again. Our limit is 2,
+        # so we should get the latest 2 subscriptions,
+        # with a gap of 3 more subscriptions in the middle
+        sync_resp, _pos = self.do_sync(sync_body, tok=user1_tok, since=first_sync_pos)
+
+        thread_subscriptions = sync_resp["extensions"][EXT_NAME]
+        self.assertEqual(
+            thread_subscriptions["subscribed"],
+            {
+                room_id: {
+                    thread_root_ids[4]: {"automatic": False, "bump_stamp": base + 5},
+                    thread_root_ids[5]: {"automatic": False, "bump_stamp": base + 6},
+                }
+            },
+        )
+        # 1st backpagination: expecting a page with 2 subscriptions
+        page, end_tok = self._do_backpaginate(
+            from_tok=thread_subscriptions["prev_batch"],
+            to_tok=first_sync_pos,
+            limit=2,
+            access_token=user1_tok,
+        )
+        self.assertIsNotNone(end_tok, "backpagination should continue")
+        self.assertEqual(
+            page["subscribed"],
+            {
+                room_id: {
+                    thread_root_ids[2]: {"automatic": False, "bump_stamp": base + 3},
+                    thread_root_ids[3]: {"automatic": False, "bump_stamp": base + 4},
+                }
+            },
+        )
+
+        # 2nd backpagination: expecting a page with only 1 subscription
+        # and no other token for further backpagination
+        assert end_tok is not None
+        page, end_tok = self._do_backpaginate(
+            from_tok=end_tok, to_tok=first_sync_pos, limit=2, access_token=user1_tok
+        )
+        self.assertIsNone(end_tok, "backpagination should have finished")
+        self.assertEqual(
+            page["subscribed"],
+            {
+                room_id: {
+                    thread_root_ids[1]: {"automatic": False, "bump_stamp": base + 2},
+                }
+            },
+        )
+
+    def _do_backpaginate(
+        self, *, from_tok: str, to_tok: str, limit: int, access_token: str
+    ) -> tuple[JsonDict, str | None]:
+        channel = self.make_request(
+            "GET",
+            "/_matrix/client/unstable/io.element.msc4308/thread_subscriptions"
+            f"?from={from_tok}&to={to_tok}&limit={limit}&dir=b",
+            access_token=access_token,
+        )
+
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        body = channel.json_body
+        return body, cast(str | None, body.get("end"))
+
+    def _subscribe_to_thread(
+        self, user_id: str, room_id: str, thread_root_id: str
+    ) -> None:
+        """
+        Helper method to subscribe a user to a thread.
+        """
+        self.get_success(
+            self.store.subscribe_user_to_thread(
+                user_id=user_id,
+                room_id=room_id,
+                thread_root_event_id=thread_root_id,
+                automatic_event_orderings=None,
+            )
+        )
+
+    def _unsubscribe_from_thread(
+        self, user_id: str, room_id: str, thread_root_id: str
+    ) -> None:
+        """
+        Helper method to unsubscribe a user from a thread.
+        """
+        self.get_success(
+            self.store.unsubscribe_user_from_thread(
+                user_id=user_id,
+                room_id=room_id,
+                thread_root_event_id=thread_root_id,
+            )
+        )
diff --git a/tests/rest/client/sliding_sync/test_extension_to_device.py b/tests/rest/client/sliding_sync/test_extension_to_device.py
index 151a5be665..0b0a65babf 100644
--- a/tests/rest/client/sliding_sync/test_extension_to_device.py
+++ b/tests/rest/client/sliding_sync/test_extension_to_device.py
@@ -12,7 +12,6 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 import logging
-from typing import List
 
 from parameterized import parameterized_class
 
@@ -22,7 +21,7 @@ import synapse.rest.admin
 from synapse.rest.client import login, sendtodevice, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict, StreamKeyType
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.server import TimedOutException
@@ -59,7 +58,7 @@ class SlidingSyncToDeviceExtensionTestCase(SlidingSyncBase):
         super().prepare(reactor, clock, hs)
 
     def _assert_to_device_response(
-        self, response_body: JsonDict, expected_messages: List[JsonDict]
+        self, response_body: JsonDict, expected_messages: list[JsonDict]
     ) -> str:
         """Assert the sliding sync response was successful and has the expected
         to-device messages.
diff --git a/tests/rest/client/sliding_sync/test_extension_typing.py b/tests/rest/client/sliding_sync/test_extension_typing.py
index 37c90d6ec2..68b935aaf9 100644
--- a/tests/rest/client/sliding_sync/test_extension_typing.py
+++ b/tests/rest/client/sliding_sync/test_extension_typing.py
@@ -22,7 +22,7 @@ from synapse.api.constants import EduTypes
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
 from synapse.types import StreamKeyType
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.server import TimedOutException
diff --git a/tests/rest/client/sliding_sync/test_extensions.py b/tests/rest/client/sliding_sync/test_extensions.py
index 0643596e59..1c167b0414 100644
--- a/tests/rest/client/sliding_sync/test_extensions.py
+++ b/tests/rest/client/sliding_sync/test_extensions.py
@@ -23,7 +23,7 @@ import synapse.rest.admin
 from synapse.api.constants import ReceiptTypes
 from synapse.rest.client import login, receipts, room, sync
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 
diff --git a/tests/rest/client/sliding_sync/test_lists_filters.py b/tests/rest/client/sliding_sync/test_lists_filters.py
index 57d00a2a7a..59facea1e0 100644
--- a/tests/rest/client/sliding_sync/test_lists_filters.py
+++ b/tests/rest/client/sliding_sync/test_lists_filters.py
@@ -28,7 +28,7 @@ from synapse.events import StrippedStateEvent
 from synapse.rest.client import login, room, sync, tags
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 
@@ -690,7 +690,7 @@ class SlidingSyncFiltersTestCase(SlidingSyncBase):
         user1_tok = self.login(user1_id, "pass")
 
         # Create a remote invite room without any `unsigned.invite_room_state`
-        _remote_invite_room_id = self._create_remote_invite_room_for_user(
+        _remote_invite_room_id, _ = self._create_remote_invite_room_for_user(
             user1_id, None
         )
 
@@ -760,7 +760,7 @@ class SlidingSyncFiltersTestCase(SlidingSyncBase):
 
         # Create a remote invite room with some `unsigned.invite_room_state`
         # indicating that the room is encrypted.
-        remote_invite_room_id = self._create_remote_invite_room_for_user(
+        remote_invite_room_id, _ = self._create_remote_invite_room_for_user(
             user1_id,
             [
                 StrippedStateEvent(
@@ -849,7 +849,7 @@ class SlidingSyncFiltersTestCase(SlidingSyncBase):
 
         # Create a remote invite room with some `unsigned.invite_room_state`
         # but don't set any room encryption event.
-        remote_invite_room_id = self._create_remote_invite_room_for_user(
+        remote_invite_room_id, _ = self._create_remote_invite_room_for_user(
             user1_id,
             [
                 StrippedStateEvent(
@@ -1484,7 +1484,7 @@ class SlidingSyncFiltersTestCase(SlidingSyncBase):
         user1_tok = self.login(user1_id, "pass")
 
         # Create a remote invite room without any `unsigned.invite_room_state`
-        _remote_invite_room_id = self._create_remote_invite_room_for_user(
+        _remote_invite_room_id, _ = self._create_remote_invite_room_for_user(
             user1_id, None
         )
 
@@ -1554,7 +1554,7 @@ class SlidingSyncFiltersTestCase(SlidingSyncBase):
 
         # Create a remote invite room with some `unsigned.invite_room_state` indicating
         # that it is a space room
-        remote_invite_room_id = self._create_remote_invite_room_for_user(
+        remote_invite_room_id, _ = self._create_remote_invite_room_for_user(
             user1_id,
             [
                 StrippedStateEvent(
@@ -1637,7 +1637,7 @@ class SlidingSyncFiltersTestCase(SlidingSyncBase):
 
         # Create a remote invite room with some `unsigned.invite_room_state`
         # but the create event does not specify a room type (normal room)
-        remote_invite_room_id = self._create_remote_invite_room_for_user(
+        remote_invite_room_id, _ = self._create_remote_invite_room_for_user(
             user1_id,
             [
                 StrippedStateEvent(
diff --git a/tests/rest/client/sliding_sync/test_room_subscriptions.py b/tests/rest/client/sliding_sync/test_room_subscriptions.py
index b78e4f2045..811478f1ba 100644
--- a/tests/rest/client/sliding_sync/test_room_subscriptions.py
+++ b/tests/rest/client/sliding_sync/test_room_subscriptions.py
@@ -22,7 +22,7 @@ import synapse.rest.admin
 from synapse.api.constants import EventTypes, HistoryVisibility
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 
diff --git a/tests/rest/client/sliding_sync/test_rooms_invites.py b/tests/rest/client/sliding_sync/test_rooms_invites.py
index a0f4ccd2cc..5a463303dd 100644
--- a/tests/rest/client/sliding_sync/test_rooms_invites.py
+++ b/tests/rest/client/sliding_sync/test_rooms_invites.py
@@ -22,7 +22,7 @@ from synapse.api.constants import EventTypes, HistoryVisibility
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 
diff --git a/tests/rest/client/sliding_sync/test_rooms_meta.py b/tests/rest/client/sliding_sync/test_rooms_meta.py
index 4559bc7646..9e3f8aaf94 100644
--- a/tests/rest/client/sliding_sync/test_rooms_meta.py
+++ b/tests/rest/client/sliding_sync/test_rooms_meta.py
@@ -22,7 +22,7 @@ from synapse.api.constants import EventContentFields, EventTypes, Membership
 from synapse.api.room_versions import RoomVersions
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.test_utils.event_injection import create_event
diff --git a/tests/rest/client/sliding_sync/test_rooms_required_state.py b/tests/rest/client/sliding_sync/test_rooms_required_state.py
index cfff167c6e..586b127f8a 100644
--- a/tests/rest/client/sliding_sync/test_rooms_required_state.py
+++ b/tests/rest/client/sliding_sync/test_rooms_required_state.py
@@ -23,7 +23,8 @@ from synapse.api.constants import EventContentFields, EventTypes, JoinRules, Mem
 from synapse.handlers.sliding_sync import StateValues
 from synapse.rest.client import knock, login, room, sync
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.storage.databases.main.events import DeltaState, SlidingSyncTableChanges
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.test_utils.event_injection import mark_event_as_partial_state
@@ -642,11 +643,6 @@ class SlidingSyncRoomsRequiredStateTestCase(SlidingSyncBase):
         self._assertRequiredStateIncludes(
             response_body["rooms"][room_id1]["required_state"],
             {
-                # This appears because *some* membership in the room changed and the
-                # heroes are recalculated and is thrown in because we have it. But this
-                # is technically optional and not needed because we've already seen user2
-                # in the last sync (and their membership hasn't changed).
-                state_map[(EventTypes.Member, user2_id)],
                 # Appears because there is a message in the timeline from this user
                 state_map[(EventTypes.Member, user4_id)],
                 # Appears because there is a membership event in the timeline from this user
@@ -841,6 +837,437 @@ class SlidingSyncRoomsRequiredStateTestCase(SlidingSyncBase):
             exact=True,
         )
 
+    def test_lazy_loading_room_members_limited_sync(self) -> None:
+        """Test that when using lazy loading for room members and a limited sync
+        missing a membership change, we include the membership change next time
+        said user says something.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        room_id1 = self.helper.create_room_as(user2_id, tok=user2_tok)
+        self.helper.join(room_id1, user1_id, tok=user1_tok)
+
+        # Send a message from each user to the room so that both memberships are sent down.
+        self.helper.send(room_id1, "1", tok=user1_tok)
+        self.helper.send(room_id1, "2", tok=user2_tok)
+
+        # Make a first sync with lazy loading for the room members to establish
+        # a position
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 2,
+                }
+            }
+        }
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # We should see both membership events in required_state
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+                state_map[(EventTypes.Member, user2_id)],
+            },
+            exact=True,
+        )
+
+        # User2 changes their display name (causing a membership change)
+        self.helper.send_state(
+            room_id1,
+            event_type=EventTypes.Member,
+            state_key=user2_id,
+            body={
+                EventContentFields.MEMBERSHIP: Membership.JOIN,
+                EventContentFields.MEMBERSHIP_DISPLAYNAME: "New Name",
+            },
+            tok=user2_tok,
+        )
+
+        # Send a couple of messages to the room to push out the membership change
+        self.helper.send(room_id1, "3", tok=user1_tok)
+        self.helper.send(room_id1, "4", tok=user1_tok)
+
+        # Make an incremental Sliding Sync request
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        # The membership change should *not* be included yet as user2 doesn't
+        # have any events in the timeline.
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1].get("required_state", []),
+            set(),
+            exact=True,
+        )
+
+        # Now user2 sends a message to the room
+        self.helper.send(room_id1, "5", tok=user2_tok)
+
+        # Make another incremental Sliding Sync request
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        # The membership change should now be included as user2 has an event
+        # in the timeline.
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1].get("required_state", []),
+            {
+                state_map[(EventTypes.Member, user2_id)],
+            },
+            exact=True,
+        )
+
+    def test_lazy_loading_room_members_across_multiple_rooms(self) -> None:
+        """Test that lazy loading room members are tracked per-room correctly."""
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        # Create two rooms with both users in them and send a message in each
+        room_id1 = self.helper.create_room_as(user2_id, tok=user2_tok)
+        self.helper.join(room_id1, user1_id, tok=user1_tok)
+        self.helper.send(room_id1, "room1-msg1", tok=user2_tok)
+
+        room_id2 = self.helper.create_room_as(user2_id, tok=user2_tok)
+        self.helper.join(room_id2, user1_id, tok=user1_tok)
+        self.helper.send(room_id2, "room2-msg1", tok=user2_tok)
+
+        # Make a sync with lazy loading for the room members to establish
+        # a position
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # We expect to see only user2's membership in both rooms
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user2_id)],
+            },
+            exact=True,
+        )
+
+        # Send a message in room1 from user1
+        self.helper.send(room_id1, "room1-msg2", tok=user1_tok)
+
+        # Make an incremental Sliding Sync request and check that we get user1's
+        # membership.
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+        # Send a message in room2 from user1
+        self.helper.send(room_id2, "room2-msg2", tok=user1_tok)
+
+        # Make an incremental Sliding Sync request and check that we get user1's
+        # membership.
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id2)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id2]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+    def test_lazy_loading_room_members_across_multiple_connections(self) -> None:
+        """Test that lazy loading room members are tracked per-connection
+        correctly.
+
+        This catches bugs where if a membership got sent down one connection,
+        it would incorrectly assume it was sent down another connection.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        room_id1 = self.helper.create_room_as(user2_id, tok=user2_tok)
+        self.helper.join(room_id1, user1_id, tok=user1_tok)
+
+        self.helper.send(room_id1, "1", tok=user2_tok)
+
+        # Make a sync with lazy loading for the room members to establish
+        # a position
+        sync_body1 = {
+            "conn_id": "first-connection",
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            },
+        }
+        response_body, from_token1 = self.do_sync(sync_body1, tok=user1_tok)
+
+        # We expect to see only user2's membership in the room
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user2_id)],
+            },
+            exact=True,
+        )
+
+        # Now make a new connection
+        sync_body2 = {
+            "conn_id": "second-connection",
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            },
+        }
+        response_body, from_token2 = self.do_sync(sync_body2, tok=user1_tok)
+
+        # We should see user2's membership as this is a new connection
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user2_id)],
+            },
+            exact=True,
+        )
+
+        # If we send a message from user1 and sync again on the first connection,
+        # we should get user1's membership
+        self.helper.send(room_id1, "2", tok=user1_tok)
+        response_body, from_token1 = self.do_sync(
+            sync_body1, since=from_token1, tok=user1_tok
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+        # We sync again on the first connection to "ack" the position. This
+        # triggers the `sliding_sync_connection_lazy_members` to set its
+        # connection_position to null.
+        self.do_sync(sync_body1, since=from_token1, tok=user1_tok)
+
+        # If we sync again on the second connection, we should also get user1's
+        # membership
+        response_body, _ = self.do_sync(sync_body2, since=from_token2, tok=user1_tok)
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+    def test_lazy_loading_room_members_forked_position(self) -> None:
+        """Test that lazy loading room members are tracked correctly when a
+        connection position is reused"""
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        room_id1 = self.helper.create_room_as(user2_id, tok=user2_tok)
+        self.helper.join(room_id1, user1_id, tok=user1_tok)
+
+        self.helper.send(room_id1, "1", tok=user2_tok)
+
+        # Make a sync with lazy loading for the room members to establish
+        # a position
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # We expect to see only user2's membership in the room
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user2_id)],
+            },
+            exact=True,
+        )
+
+        # Send a message in room1 from user1
+        self.helper.send(room_id1, "2", tok=user1_tok)
+
+        # Make an incremental Sliding Sync request and check that we get user1's
+        # membership.
+        response_body, _ = self.do_sync(sync_body, since=from_token, tok=user1_tok)
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+        # Now, reuse the original position and check we still get user1's
+        # membership.
+        response_body, _ = self.do_sync(sync_body, since=from_token, tok=user1_tok)
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+    def test_lazy_loading_room_members_explicit_membership_removed(self) -> None:
+        """Test the case where we requested explicit memberships and then later
+        changed to lazy loading."""
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        room_id1 = self.helper.create_room_as(user2_id, tok=user2_tok)
+        self.helper.join(room_id1, user1_id, tok=user1_tok)
+
+        self.helper.send(room_id1, "1", tok=user2_tok)
+
+        # Make a sync with lazy loading for the room members to establish
+        # a position
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.ME],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # We expect to see only user1's membership in the room
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+        # Now change to lazy loading...
+        sync_body["lists"]["foo-list"]["required_state"] = [
+            [EventTypes.Member, StateValues.LAZY],
+        ]
+
+        # Send a message in room1 from user2
+        self.helper.send(room_id1, "2", tok=user2_tok)
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        # We should see user2's membership as it's in the timeline
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1]["required_state"],
+            {
+                state_map[(EventTypes.Member, user2_id)],
+            },
+            exact=True,
+        )
+
+        # Now send a message in room1 from user1
+        self.helper.send(room_id1, "3", tok=user1_tok)
+
+        response_body, _ = self.do_sync(sync_body, since=from_token, tok=user1_tok)
+
+        # We should not see any memberships as we've already seen user1's
+        # membership.
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id1)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id1].get("required_state", []),
+            [],
+            exact=True,
+        )
+
     def test_rooms_required_state_me(self) -> None:
         """
         Test `rooms.required_state` correctly handles $ME.
@@ -1686,3 +2113,135 @@ class SlidingSyncRoomsRequiredStateTestCase(SlidingSyncBase):
         # We should not see the room name again, as we have already sent that
         # down.
         self.assertIsNone(response_body["rooms"][room_id1].get("required_state"))
+
+    def test_lazy_loading_room_members_state_reset_non_limited_timeline(self) -> None:
+        """Test that when using lazy-loaded members, if a membership state is
+        reset to a previous state and the sync is not limited, then we send down
+        the state reset.
+
+        Regression test as previously we only returned membership relevant to
+        the timeline and so did not tell clients about state resets for
+        users who did not send any timeline events.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        room_id = self.helper.create_room_as(user2_id, tok=user2_tok, is_public=True)
+        content = self.helper.join(room_id, user1_id, tok=user1_tok)
+        first_event_id = content["event_id"]
+
+        # Send a message so that the user1 membership comes down sync (because we're lazy-loading room members)
+        self.helper.send(room_id, "msg", tok=user1_tok)
+
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # Check that user1 is returned
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+        # user1 changes their display name
+        content = self.helper.send_state(
+            room_id,
+            EventTypes.Member,
+            body={"membership": "join", "displayname": "New display name"},
+            state_key=user1_id,
+            tok=user1_tok,
+        )
+        second_event_id = content["event_id"]
+
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        # We should see the updated membership state
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+        self.assertEqual(
+            response_body["rooms"][room_id]["required_state"][0]["event_id"],
+            second_event_id,
+        )
+
+        # Now, fake a reset the membership state to the first event
+        persist_event_store = self.hs.get_datastores().persist_events
+        assert persist_event_store is not None
+
+        self.get_success(
+            persist_event_store.update_current_state(
+                room_id,
+                DeltaState(
+                    to_insert={(EventTypes.Member, user1_id): first_event_id},
+                    to_delete=[],
+                ),
+                # We don't need to worry about sliding sync changes for this test
+                SlidingSyncTableChanges(
+                    room_id=room_id,
+                    joined_room_bump_stamp_to_fully_insert=None,
+                    joined_room_updates={},
+                    membership_snapshot_shared_insert_values={},
+                    to_insert_membership_snapshots=[],
+                    to_delete_membership_snapshots=[],
+                ),
+            )
+        )
+
+        # Send a message from *user2* so that user1 wouldn't normally get
+        # synced.
+        self.helper.send(room_id, "msg2", tok=user2_tok)
+
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        # This should be a non-limited sync as there is only one timeline event
+        # (<= `timeline_limit). This is important as we're specifically testing the non-`limited`
+        # timeline scenario. And for reference, we don't send down state resets
+        # on limited timelines when using lazy loaded memberships.
+        self.assertFalse(
+            response_body["rooms"][room_id].get("limited", False),
+            "Expected a non-limited timeline",
+        )
+
+        # We should see the reset membership state of user1
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+        )
+        self.assertEqual(
+            response_body["rooms"][room_id]["required_state"][0]["event_id"],
+            first_event_id,
+        )
diff --git a/tests/rest/client/sliding_sync/test_rooms_timeline.py b/tests/rest/client/sliding_sync/test_rooms_timeline.py
index 3d950eb20b..bc23776326 100644
--- a/tests/rest/client/sliding_sync/test_rooms_timeline.py
+++ b/tests/rest/client/sliding_sync/test_rooms_timeline.py
@@ -12,7 +12,6 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 import logging
-from typing import List, Optional
 
 from parameterized import parameterized_class
 
@@ -23,7 +22,7 @@ from synapse.api.constants import EventTypes
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
 from synapse.types import StrSequence
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 
@@ -66,7 +65,7 @@ class SlidingSyncRoomsTimelineTestCase(SlidingSyncBase):
         self,
         actual_items: StrSequence,
         expected_items: StrSequence,
-        message: Optional[str] = None,
+        message: str | None = None,
     ) -> None:
         """
         Like `self.assertListEqual(...)` but with an actually understandable diff message.
@@ -75,14 +74,14 @@ class SlidingSyncRoomsTimelineTestCase(SlidingSyncBase):
         if actual_items == expected_items:
             return
 
-        expected_lines: List[str] = []
+        expected_lines: list[str] = []
         for expected_item in expected_items:
             is_expected_in_actual = expected_item in actual_items
             expected_lines.append(
                 "{}  {}".format(" " if is_expected_in_actual else "?", expected_item)
             )
 
-        actual_lines: List[str] = []
+        actual_lines: list[str] = []
         for actual_item in actual_items:
             is_actual_in_expected = actual_item in expected_items
             actual_lines.append(
@@ -101,9 +100,9 @@ class SlidingSyncRoomsTimelineTestCase(SlidingSyncBase):
         self,
         *,
         room_id: str,
-        actual_event_ids: List[str],
-        expected_event_ids: List[str],
-        message: Optional[str] = None,
+        actual_event_ids: list[str],
+        expected_event_ids: list[str],
+        message: str | None = None,
     ) -> None:
         """
         Like `self.assertListEqual(...)` for event IDs in a room but will give a nicer
diff --git a/tests/rest/client/sliding_sync/test_sliding_sync.py b/tests/rest/client/sliding_sync/test_sliding_sync.py
index ea4ee16359..ac8dfd37d8 100644
--- a/tests/rest/client/sliding_sync/test_sliding_sync.py
+++ b/tests/rest/client/sliding_sync/test_sliding_sync.py
@@ -12,7 +12,7 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 import logging
-from typing import Any, Dict, Iterable, List, Literal, Optional, Tuple
+from typing import Any, Iterable, Literal
 from unittest.mock import AsyncMock
 
 from parameterized import parameterized, parameterized_class
@@ -42,11 +42,11 @@ from synapse.types import (
     StreamKeyType,
     StreamToken,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 from tests import unittest
-from tests.server import TimedOutException
+from tests.server import FakeChannel, TimedOutException
 from tests.test_utils.event_injection import create_event
 
 logger = logging.getLogger(__name__)
@@ -80,12 +80,10 @@ class SlidingSyncBase(unittest.HomeserverTestCase):
         config["experimental_features"] = {"msc3575_enabled": True}
         return config
 
-    def do_sync(
-        self, sync_body: JsonDict, *, since: Optional[str] = None, tok: str
-    ) -> Tuple[JsonDict, str]:
-        """Do a sliding sync request with given body.
-
-        Asserts the request was successful.
+    def make_sync_request(
+        self, sync_body: JsonDict, *, since: str | None = None, tok: str
+    ) -> FakeChannel:
+        """Make a sliding sync request with given body.
 
         Attributes:
             sync_body: The full request body to use
@@ -106,6 +104,24 @@ class SlidingSyncBase(unittest.HomeserverTestCase):
             content=sync_body,
             access_token=tok,
         )
+        return channel
+
+    def do_sync(
+        self, sync_body: JsonDict, *, since: str | None = None, tok: str
+    ) -> tuple[JsonDict, str]:
+        """Do a sliding sync request with given body.
+
+        Asserts the request was successful.
+
+        Attributes:
+            sync_body: The full request body to use
+            since: Optional since token
+            tok: Access token to use
+
+        Returns:
+            A tuple of the response body and the `pos` field.
+        """
+        channel = self.make_sync_request(sync_body, since=since, tok=tok)
         self.assertEqual(channel.code, 200, channel.json_body)
 
         return channel.json_body, channel.json_body["pos"]
@@ -170,7 +186,7 @@ class SlidingSyncBase(unittest.HomeserverTestCase):
         # Scrutinize the account data since it has no concrete type. We're just copying
         # everything into a known type. It should be a mapping from user ID to a list of
         # room IDs. Ignore anything else.
-        new_dm_map: Dict[str, List[str]] = {}
+        new_dm_map: dict[str, list[str]] = {}
         if isinstance(existing_dm_map, dict):
             for user_id, room_ids in existing_dm_map.items():
                 if isinstance(user_id, str) and isinstance(room_ids, list):
@@ -239,9 +255,9 @@ class SlidingSyncBase(unittest.HomeserverTestCase):
     def _create_remote_invite_room_for_user(
         self,
         invitee_user_id: str,
-        unsigned_invite_room_state: Optional[List[StrippedStateEvent]],
-        invite_room_id: Optional[str] = None,
-    ) -> str:
+        unsigned_invite_room_state: list[StrippedStateEvent] | None,
+        invite_room_id: str | None = None,
+    ) -> tuple[str, EventBase]:
         """
         Create a fake invite for a remote room and persist it.
 
@@ -307,11 +323,13 @@ class SlidingSyncBase(unittest.HomeserverTestCase):
         context = EventContext.for_outlier(self.hs.get_storage_controllers())
         persist_controller = self.hs.get_storage_controllers().persistence
         assert persist_controller is not None
-        self.get_success(persist_controller.persist_event(invite_event, context))
+        persisted_event, _, _ = self.get_success(
+            persist_controller.persist_event(invite_event, context)
+        )
 
         self._remote_invite_count += 1
 
-        return invite_room_id
+        return invite_room_id, persisted_event
 
     def _bump_notifier_wait_for_events(
         self,
@@ -747,7 +765,7 @@ class SlidingSyncTestCase(SlidingSyncBase):
         user1_tok = self.login(user1_id, "pass")
 
         # Create a remote room invite (out-of-band membership)
-        room_id = self._create_remote_invite_room_for_user(user1_id, None)
+        room_id, _ = self._create_remote_invite_room_for_user(user1_id, None)
 
         # Make the Sliding Sync request
         sync_body = {
diff --git a/tests/rest/client/test_account.py b/tests/rest/client/test_account.py
index 02d02ae78e..ffa96c7840 100644
--- a/tests/rest/client/test_account.py
+++ b/tests/rest/client/test_account.py
@@ -18,15 +18,14 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
+import importlib.resources as importlib_resources
 import os
 import re
 from email.parser import Parser
 from http import HTTPStatus
-from typing import Any, Dict, List, Optional, Union
+from typing import Any
 from unittest.mock import Mock
 
-import pkg_resources
-
 from twisted.internet.interfaces import IReactorTCP
 from twisted.internet.testing import MemoryReactor
 
@@ -40,7 +39,7 @@ from synapse.rest.synapse.client.password_reset import PasswordResetSubmitTokenR
 from synapse.server import HomeServer
 from synapse.storage._base import db_to_json
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeSite, make_request
@@ -59,11 +58,12 @@ class PasswordResetTestCase(unittest.HomeserverTestCase):
         config = self.default_config()
 
         # Email config.
+        templates = (
+            importlib_resources.files("synapse").joinpath("res").joinpath("templates")
+        )
         config["email"] = {
             "enable_notifs": False,
-            "template_dir": os.path.abspath(
-                pkg_resources.resource_filename("synapse", "res/templates")
-            ),
+            "template_dir": os.path.abspath(str(templates)),
             "smtp_host": "127.0.0.1",
             "smtp_port": 20,
             "require_transport_security": False,
@@ -87,7 +87,7 @@ class PasswordResetTestCase(unittest.HomeserverTestCase):
         ) -> None:
             self.email_attempts.append(msg_bytes)
 
-        self.email_attempts: List[bytes] = []
+        self.email_attempts: list[bytes] = []
         hs.get_send_email_handler()._sendmail = sendmail
 
         return hs
@@ -363,7 +363,7 @@ class PasswordResetTestCase(unittest.HomeserverTestCase):
         email: str,
         client_secret: str,
         ip: str = "127.0.0.1",
-        next_link: Optional[str] = None,
+        next_link: str | None = None,
     ) -> str:
         body = {"client_secret": client_secret, "email": email, "send_attempt": 1}
         if next_link is not None:
@@ -384,7 +384,7 @@ class PasswordResetTestCase(unittest.HomeserverTestCase):
 
         return channel.json_body["sid"]
 
-    def _validate_token(self, link: str, next_link: Optional[str] = None) -> None:
+    def _validate_token(self, link: str, next_link: str | None = None) -> None:
         # Remove the host
         path = link.replace("https://example.com", "")
 
@@ -721,7 +721,7 @@ class WhoamiTestCase(unittest.HomeserverTestCase):
         register.register_servlets,
     ]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["allow_guest_access"] = True
         return config
@@ -798,11 +798,12 @@ class ThreepidEmailRestTestCase(unittest.HomeserverTestCase):
         config = self.default_config()
 
         # Email config.
+        templates = (
+            importlib_resources.files("synapse").joinpath("res").joinpath("templates")
+        )
         config["email"] = {
             "enable_notifs": False,
-            "template_dir": os.path.abspath(
-                pkg_resources.resource_filename("synapse", "res/templates")
-            ),
+            "template_dir": os.path.abspath(str(templates)),
             "smtp_host": "127.0.0.1",
             "smtp_port": 20,
             "require_transport_security": False,
@@ -826,7 +827,7 @@ class ThreepidEmailRestTestCase(unittest.HomeserverTestCase):
         ) -> None:
             self.email_attempts.append(msg_bytes)
 
-        self.email_attempts: List[bytes] = []
+        self.email_attempts: list[bytes] = []
         self.hs.get_send_email_handler()._sendmail = sendmail
 
         return self.hs
@@ -1151,9 +1152,9 @@ class ThreepidEmailRestTestCase(unittest.HomeserverTestCase):
         self,
         email: str,
         client_secret: str,
-        next_link: Optional[str] = None,
+        next_link: str | None = None,
         expect_code: int = HTTPStatus.OK,
-    ) -> Optional[str]:
+    ) -> str | None:
         """Request a validation token to add an email address to a user's account
 
         Args:
@@ -1200,7 +1201,9 @@ class ThreepidEmailRestTestCase(unittest.HomeserverTestCase):
         self.assertEqual(
             HTTPStatus.BAD_REQUEST, channel.code, msg=channel.result["body"]
         )
-        self.assertEqual(expected_errcode, channel.json_body["errcode"])
+        self.assertEqual(
+            expected_errcode, channel.json_body["errcode"], msg=channel.result["body"]
+        )
         self.assertIn(expected_error, channel.json_body["error"])
 
     def _validate_token(self, link: str) -> None:
@@ -1391,10 +1394,10 @@ class AccountStatusTestCase(unittest.HomeserverTestCase):
         async def post_json(
             destination: str,
             path: str,
-            data: Optional[JsonDict] = None,
+            data: JsonDict | None = None,
             *a: Any,
             **kwa: Any,
-        ) -> Union[JsonDict, list]:
+        ) -> JsonDict | list:
             if destination == "remote":
                 return {
                     "account_statuses": {
@@ -1500,11 +1503,11 @@ class AccountStatusTestCase(unittest.HomeserverTestCase):
 
     def _test_status(
         self,
-        users: Optional[List[str]],
+        users: list[str] | None,
         expected_status_code: int = HTTPStatus.OK,
-        expected_statuses: Optional[Dict[str, Dict[str, bool]]] = None,
-        expected_failures: Optional[List[str]] = None,
-        expected_errcode: Optional[str] = None,
+        expected_statuses: dict[str, dict[str, bool]] | None = None,
+        expected_failures: list[str] | None = None,
+        expected_errcode: str | None = None,
     ) -> None:
         """Send a request to the account status endpoint and check that the response
         matches with what's expected.
diff --git a/tests/rest/client/test_auth.py b/tests/rest/client/test_auth.py
index 4fe506845c..ffaf0e5a32 100644
--- a/tests/rest/client/test_auth.py
+++ b/tests/rest/client/test_auth.py
@@ -20,7 +20,7 @@
 #
 import re
 from http import HTTPStatus
-from typing import Any, Dict, List, Optional, Tuple, Union
+from typing import Any
 
 from twisted.internet.defer import succeed
 from twisted.internet.testing import MemoryReactor
@@ -35,7 +35,7 @@ from synapse.rest.synapse.client import build_synapse_client_resource_tree
 from synapse.server import HomeServer
 from synapse.storage.database import LoggingTransaction
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.handlers.test_oidc import HAS_OIDC
@@ -47,7 +47,7 @@ from tests.unittest import override_config, skip_unless
 class DummyRecaptchaChecker(UserInteractiveAuthChecker):
     def __init__(self, hs: HomeServer) -> None:
         super().__init__(hs)
-        self.recaptcha_attempts: List[Tuple[dict, str]] = []
+        self.recaptcha_attempts: list[tuple[dict, str]] = []
 
     def is_enabled(self) -> bool:
         return True
@@ -90,7 +90,7 @@ class FallbackAuthTests(unittest.HomeserverTestCase):
         self,
         session: str,
         expected_post_response: int,
-        post_session: Optional[str] = None,
+        post_session: str | None = None,
     ) -> None:
         """Get and respond to a fallback recaptcha. Returns the second request."""
         if post_session is None:
@@ -178,7 +178,7 @@ class UIAuthTests(unittest.HomeserverTestCase):
         register.register_servlets,
     ]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         # public_baseurl uses an http:// scheme because FakeChannel.isSecure() returns
@@ -195,7 +195,7 @@ class UIAuthTests(unittest.HomeserverTestCase):
 
         return config
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resource_dict = super().create_resource_dict()
         resource_dict.update(build_synapse_client_resource_tree(self.hs))
         return resource_dict
@@ -220,7 +220,7 @@ class UIAuthTests(unittest.HomeserverTestCase):
         access_token: str,
         device: str,
         expected_response: int,
-        body: Union[bytes, JsonDict] = b"",
+        body: bytes | JsonDict = b"",
     ) -> FakeChannel:
         """Delete an individual device."""
         channel = self.make_request(
@@ -1091,7 +1091,7 @@ class RefreshAuthTests(unittest.HomeserverTestCase):
         was very slow if a lot of refreshes had been performed for the session.
         """
 
-        def _refresh(refresh_token: str) -> Tuple[str, str]:
+        def _refresh(refresh_token: str) -> tuple[str, str]:
             """
             Performs one refresh, returning the next refresh token and access token.
             """
@@ -1172,7 +1172,7 @@ class RefreshAuthTests(unittest.HomeserverTestCase):
 
 def oidc_config(
     id: str, with_localpart_template: bool, **kwargs: Any
-) -> Dict[str, Any]:
+) -> dict[str, Any]:
     """Sample OIDC provider config used in backchannel logout tests.
 
     Args:
@@ -1185,7 +1185,7 @@ def oidc_config(
         A dict suitable for the `oidc_config` or the `oidc_providers[]` parts of
         the HS config
     """
-    config: Dict[str, Any] = {
+    config: dict[str, Any] = {
         "idp_id": id,
         "idp_name": id,
         "issuer": TEST_OIDC_ISSUER,
@@ -1213,7 +1213,7 @@ class OidcBackchannelLogoutTests(unittest.HomeserverTestCase):
         login.register_servlets,
     ]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         # public_baseurl uses an http:// scheme because FakeChannel.isSecure() returns
@@ -1223,7 +1223,7 @@ class OidcBackchannelLogoutTests(unittest.HomeserverTestCase):
 
         return config
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resource_dict = super().create_resource_dict()
         resource_dict.update(build_synapse_client_resource_tree(self.hs))
         return resource_dict
@@ -1363,7 +1363,7 @@ class OidcBackchannelLogoutTests(unittest.HomeserverTestCase):
         # We should have a user_mapping_session cookie
         cookie_headers = channel.headers.getRawHeaders("Set-Cookie")
         assert cookie_headers
-        cookies: Dict[str, str] = {}
+        cookies: dict[str, str] = {}
         for h in cookie_headers:
             key, value = h.split(";")[0].split("=", maxsplit=1)
             cookies[key] = value
diff --git a/tests/rest/client/test_capabilities.py b/tests/rest/client/test_capabilities.py
index 8ae1cc935a..2567fee2a4 100644
--- a/tests/rest/client/test_capabilities.py
+++ b/tests/rest/client/test_capabilities.py
@@ -25,7 +25,7 @@ import synapse.rest.admin
 from synapse.api.room_versions import KNOWN_ROOM_VERSIONS
 from synapse.rest.client import capabilities, login
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -209,46 +209,6 @@ class CapabilitiesTestCase(unittest.HomeserverTestCase):
         self.assertEqual(channel.code, HTTPStatus.OK)
         self.assertFalse(capabilities["m.3pid_changes"]["enabled"])
 
-    @override_config({"experimental_features": {"msc3244_enabled": False}})
-    def test_get_does_not_include_msc3244_fields_when_disabled(self) -> None:
-        access_token = self.get_success(
-            self.auth_handler.create_access_token_for_user_id(
-                self.user, device_id=None, valid_until_ms=None
-            )
-        )
-
-        channel = self.make_request("GET", self.url, access_token=access_token)
-        capabilities = channel.json_body["capabilities"]
-
-        self.assertEqual(channel.code, 200)
-        self.assertNotIn(
-            "org.matrix.msc3244.room_capabilities", capabilities["m.room_versions"]
-        )
-
-    def test_get_does_include_msc3244_fields_when_enabled(self) -> None:
-        access_token = self.get_success(
-            self.auth_handler.create_access_token_for_user_id(
-                self.user, device_id=None, valid_until_ms=None
-            )
-        )
-
-        channel = self.make_request("GET", self.url, access_token=access_token)
-        capabilities = channel.json_body["capabilities"]
-
-        self.assertEqual(channel.code, 200)
-        for details in capabilities["m.room_versions"][
-            "org.matrix.msc3244.room_capabilities"
-        ].values():
-            if details["preferred"] is not None:
-                self.assertTrue(
-                    details["preferred"] in KNOWN_ROOM_VERSIONS,
-                    str(details["preferred"]),
-                )
-
-            self.assertGreater(len(details["support"]), 0)
-            for room_version in details["support"]:
-                self.assertTrue(room_version in KNOWN_ROOM_VERSIONS, str(room_version))
-
     def test_get_get_token_login_fields_when_disabled(self) -> None:
         """By default login via an existing session is disabled."""
         access_token = self.get_success(
diff --git a/tests/rest/client/test_consent.py b/tests/rest/client/test_consent.py
index 1a64b3984f..d127f3abd2 100644
--- a/tests/rest/client/test_consent.py
+++ b/tests/rest/client/test_consent.py
@@ -28,7 +28,7 @@ from synapse.api.urls import ConsentURIBuilder
 from synapse.rest.client import login, room
 from synapse.rest.consent import consent_resource
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeSite, make_request
diff --git a/tests/rest/client/test_delayed_events.py b/tests/rest/client/test_delayed_events.py
index 4b338d333f..da904ce1f5 100644
--- a/tests/rest/client/test_delayed_events.py
+++ b/tests/rest/client/test_delayed_events.py
@@ -15,7 +15,6 @@
 """Tests REST events for /delayed_events paths."""
 
 from http import HTTPStatus
-from typing import List
 
 from parameterized import parameterized
 
@@ -23,12 +22,13 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.api.errors import Codes
 from synapse.rest import admin
-from synapse.rest.client import delayed_events, login, room, versions
+from synapse.rest.client import delayed_events, login, room, sync, versions
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
+from tests.server import FakeChannel
 from tests.unittest import HomeserverTestCase
 
 PATH_PREFIX = "/_matrix/client/unstable/org.matrix.msc4140/delayed_events"
@@ -59,6 +59,7 @@ class DelayedEventsTestCase(HomeserverTestCase):
         delayed_events.register_servlets,
         login.register_servlets,
         room.register_servlets,
+        sync.register_servlets,
     ]
 
     def default_config(self) -> JsonDict:
@@ -106,6 +107,9 @@ class DelayedEventsTestCase(HomeserverTestCase):
             self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
+        delay_id = channel.json_body.get("delay_id")
+        assert delay_id is not None
+
         events = self._get_delayed_events()
         self.assertEqual(1, len(events), events)
         content = self._get_delayed_event_content(events[0])
@@ -128,6 +132,60 @@ class DelayedEventsTestCase(HomeserverTestCase):
         )
         self.assertEqual(setter_expected, content.get(setter_key), content)
 
+        self._find_sent_delayed_event(self.user1_access_token, delay_id, True)
+        self._find_sent_delayed_event(self.user2_access_token, delay_id, False)
+
+    def test_delayed_member_events_are_sent_on_timeout(self) -> None:
+        channel = self.make_request(
+            "PUT",
+            _get_path_for_delayed_state(
+                self.room_id,
+                "m.room.member",
+                self.user2_user_id,
+                900,
+            ),
+            {
+                "membership": "leave",
+                "reason": "Delayed kick",
+            },
+            self.user1_access_token,
+        )
+        self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
+        delay_id = channel.json_body.get("delay_id")
+        assert delay_id is not None
+
+        events = self._get_delayed_events()
+        self.assertEqual(1, len(events), events)
+        content = self._get_delayed_event_content(events[0])
+        self.assertEqual("leave", content.get("membership"), content)
+        self.assertEqual("Delayed kick", content.get("reason"), content)
+
+        content = self.helper.get_state(
+            self.room_id,
+            "m.room.member",
+            self.user1_access_token,
+            state_key=self.user2_user_id,
+        )
+        self.assertEqual("join", content.get("membership"), content)
+
+        self.reactor.advance(1)
+        self.assertListEqual([], self._get_delayed_events())
+        content = self.helper.get_state(
+            self.room_id,
+            "m.room.member",
+            self.user1_access_token,
+            state_key=self.user2_user_id,
+        )
+        self.assertEqual("leave", content.get("membership"), content)
+        self.assertEqual("Delayed kick", content.get("reason"), content)
+
+        self._find_sent_delayed_event(self.user1_access_token, delay_id, True)
+        self._find_sent_delayed_event(self.user2_access_token, delay_id, False)
+
+    def test_get_delayed_events_auth(self) -> None:
+        channel = self.make_request("GET", PATH_PREFIX)
+        self.assertEqual(HTTPStatus.UNAUTHORIZED, channel.code, channel.result)
+
     @unittest.override_config(
         {"rc_delayed_event_mgmt": {"per_second": 0.5, "burst_count": 1}}
     )
@@ -155,7 +213,6 @@ class DelayedEventsTestCase(HomeserverTestCase):
         channel = self.make_request(
             "POST",
             f"{PATH_PREFIX}/",
-            access_token=self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.NOT_FOUND, channel.code, channel.result)
 
@@ -163,7 +220,6 @@ class DelayedEventsTestCase(HomeserverTestCase):
         channel = self.make_request(
             "POST",
             f"{PATH_PREFIX}/abc",
-            access_token=self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.BAD_REQUEST, channel.code, channel.result)
         self.assertEqual(
@@ -176,7 +232,6 @@ class DelayedEventsTestCase(HomeserverTestCase):
             "POST",
             f"{PATH_PREFIX}/abc",
             {},
-            self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.BAD_REQUEST, channel.code, channel.result)
         self.assertEqual(
@@ -189,7 +244,6 @@ class DelayedEventsTestCase(HomeserverTestCase):
             "POST",
             f"{PATH_PREFIX}/abc",
             {"action": "oops"},
-            self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.BAD_REQUEST, channel.code, channel.result)
         self.assertEqual(
@@ -197,17 +251,21 @@ class DelayedEventsTestCase(HomeserverTestCase):
             channel.json_body["errcode"],
         )
 
-    @parameterized.expand(["cancel", "restart", "send"])
-    def test_update_delayed_event_without_match(self, action: str) -> None:
-        channel = self.make_request(
-            "POST",
-            f"{PATH_PREFIX}/abc",
-            {"action": action},
-            self.user1_access_token,
+    @parameterized.expand(
+        (
+            (action, action_in_path)
+            for action in ("cancel", "restart", "send")
+            for action_in_path in (True, False)
         )
+    )
+    def test_update_delayed_event_without_match(
+        self, action: str, action_in_path: bool
+    ) -> None:
+        channel = self._update_delayed_event("abc", action, action_in_path)
         self.assertEqual(HTTPStatus.NOT_FOUND, channel.code, channel.result)
 
-    def test_cancel_delayed_state_event(self) -> None:
+    @parameterized.expand((True, False))
+    def test_cancel_delayed_state_event(self, action_in_path: bool) -> None:
         state_key = "to_never_send"
 
         setter_key = "setter"
@@ -222,7 +280,7 @@ class DelayedEventsTestCase(HomeserverTestCase):
         )
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
         delay_id = channel.json_body.get("delay_id")
-        self.assertIsNotNone(delay_id)
+        assert delay_id is not None
 
         self.reactor.advance(1)
         events = self._get_delayed_events()
@@ -237,12 +295,7 @@ class DelayedEventsTestCase(HomeserverTestCase):
             expect_code=HTTPStatus.NOT_FOUND,
         )
 
-        channel = self.make_request(
-            "POST",
-            f"{PATH_PREFIX}/{delay_id}",
-            {"action": "cancel"},
-            self.user1_access_token,
-        )
+        channel = self._update_delayed_event(delay_id, "cancel", action_in_path)
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
         self.assertListEqual([], self._get_delayed_events())
 
@@ -255,10 +308,14 @@ class DelayedEventsTestCase(HomeserverTestCase):
             expect_code=HTTPStatus.NOT_FOUND,
         )
 
+        self._find_sent_delayed_event(self.user1_access_token, delay_id, False)
+        self._find_sent_delayed_event(self.user2_access_token, delay_id, False)
+
+    @parameterized.expand((True, False))
     @unittest.override_config(
         {"rc_delayed_event_mgmt": {"per_second": 0.5, "burst_count": 1}}
     )
-    def test_cancel_delayed_event_ratelimit(self) -> None:
+    def test_cancel_delayed_event_ratelimit(self, action_in_path: bool) -> None:
         delay_ids = []
         for _ in range(2):
             channel = self.make_request(
@@ -269,59 +326,45 @@ class DelayedEventsTestCase(HomeserverTestCase):
             )
             self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
             delay_id = channel.json_body.get("delay_id")
-            self.assertIsNotNone(delay_id)
+            assert delay_id is not None
             delay_ids.append(delay_id)
 
-        channel = self.make_request(
-            "POST",
-            f"{PATH_PREFIX}/{delay_ids.pop(0)}",
-            {"action": "cancel"},
-            self.user1_access_token,
-        )
+        channel = self._update_delayed_event(delay_ids.pop(0), "cancel", action_in_path)
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
 
-        args = (
-            "POST",
-            f"{PATH_PREFIX}/{delay_ids.pop(0)}",
-            {"action": "cancel"},
-            self.user1_access_token,
-        )
-        channel = self.make_request(*args)
+        channel = self._update_delayed_event(delay_ids.pop(0), "cancel", action_in_path)
         self.assertEqual(HTTPStatus.TOO_MANY_REQUESTS, channel.code, channel.result)
 
-        # Add the current user to the ratelimit overrides, allowing them no ratelimiting.
-        self.get_success(
-            self.hs.get_datastores().main.set_ratelimit_for_user(
-                self.user1_user_id, 0, 0
-            )
+    @parameterized.expand(
+        (
+            (content_property_value, action_in_path)
+            for content_property_value in ("test", "tест")
+            for action_in_path in (True, False)
         )
-
-        # Test that the request isn't ratelimited anymore.
-        channel = self.make_request(*args)
-        self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
-
-    def test_send_delayed_state_event(self) -> None:
+    )
+    def test_send_delayed_state_event(
+        self, content_value: str, action_in_path: bool
+    ) -> None:
         state_key = "to_send_on_request"
 
-        setter_key = "setter"
-        setter_expected = "on_send"
+        content_property_name = "key"
         channel = self.make_request(
             "PUT",
             _get_path_for_delayed_state(self.room_id, _EVENT_TYPE, state_key, 100000),
             {
-                setter_key: setter_expected,
+                content_property_name: content_value,
             },
             self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
         delay_id = channel.json_body.get("delay_id")
-        self.assertIsNotNone(delay_id)
+        assert delay_id is not None
 
         self.reactor.advance(1)
         events = self._get_delayed_events()
         self.assertEqual(1, len(events), events)
         content = self._get_delayed_event_content(events[0])
-        self.assertEqual(setter_expected, content.get(setter_key), content)
+        self.assertEqual(content_value, content.get(content_property_name), content)
         self.helper.get_state(
             self.room_id,
             _EVENT_TYPE,
@@ -330,12 +373,7 @@ class DelayedEventsTestCase(HomeserverTestCase):
             expect_code=HTTPStatus.NOT_FOUND,
         )
 
-        channel = self.make_request(
-            "POST",
-            f"{PATH_PREFIX}/{delay_id}",
-            {"action": "send"},
-            self.user1_access_token,
-        )
+        channel = self._update_delayed_event(delay_id, "send", action_in_path)
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
         self.assertListEqual([], self._get_delayed_events())
         content = self.helper.get_state(
@@ -344,10 +382,14 @@ class DelayedEventsTestCase(HomeserverTestCase):
             self.user1_access_token,
             state_key=state_key,
         )
-        self.assertEqual(setter_expected, content.get(setter_key), content)
+        self.assertEqual(content_value, content.get(content_property_name), content)
 
-    @unittest.override_config({"rc_message": {"per_second": 3.5, "burst_count": 4}})
-    def test_send_delayed_event_ratelimit(self) -> None:
+        self._find_sent_delayed_event(self.user1_access_token, delay_id, True)
+        self._find_sent_delayed_event(self.user2_access_token, delay_id, False)
+
+    @parameterized.expand((True, False))
+    @unittest.override_config({"rc_message": {"per_second": 2.5, "burst_count": 3}})
+    def test_send_delayed_event_ratelimit(self, action_in_path: bool) -> None:
         delay_ids = []
         for _ in range(2):
             channel = self.make_request(
@@ -358,38 +400,17 @@ class DelayedEventsTestCase(HomeserverTestCase):
             )
             self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
             delay_id = channel.json_body.get("delay_id")
-            self.assertIsNotNone(delay_id)
+            assert delay_id is not None
             delay_ids.append(delay_id)
 
-        channel = self.make_request(
-            "POST",
-            f"{PATH_PREFIX}/{delay_ids.pop(0)}",
-            {"action": "send"},
-            self.user1_access_token,
-        )
+        channel = self._update_delayed_event(delay_ids.pop(0), "send", action_in_path)
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
 
-        args = (
-            "POST",
-            f"{PATH_PREFIX}/{delay_ids.pop(0)}",
-            {"action": "send"},
-            self.user1_access_token,
-        )
-        channel = self.make_request(*args)
+        channel = self._update_delayed_event(delay_ids.pop(0), "send", action_in_path)
         self.assertEqual(HTTPStatus.TOO_MANY_REQUESTS, channel.code, channel.result)
 
-        # Add the current user to the ratelimit overrides, allowing them no ratelimiting.
-        self.get_success(
-            self.hs.get_datastores().main.set_ratelimit_for_user(
-                self.user1_user_id, 0, 0
-            )
-        )
-
-        # Test that the request isn't ratelimited anymore.
-        channel = self.make_request(*args)
-        self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
-
-    def test_restart_delayed_state_event(self) -> None:
+    @parameterized.expand((True, False))
+    def test_restart_delayed_state_event(self, action_in_path: bool) -> None:
         state_key = "to_send_on_restarted_timeout"
 
         setter_key = "setter"
@@ -404,7 +425,7 @@ class DelayedEventsTestCase(HomeserverTestCase):
         )
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
         delay_id = channel.json_body.get("delay_id")
-        self.assertIsNotNone(delay_id)
+        assert delay_id is not None
 
         self.reactor.advance(1)
         events = self._get_delayed_events()
@@ -419,12 +440,7 @@ class DelayedEventsTestCase(HomeserverTestCase):
             expect_code=HTTPStatus.NOT_FOUND,
         )
 
-        channel = self.make_request(
-            "POST",
-            f"{PATH_PREFIX}/{delay_id}",
-            {"action": "restart"},
-            self.user1_access_token,
-        )
+        channel = self._update_delayed_event(delay_id, "restart", action_in_path)
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
 
         self.reactor.advance(1)
@@ -450,10 +466,14 @@ class DelayedEventsTestCase(HomeserverTestCase):
         )
         self.assertEqual(setter_expected, content.get(setter_key), content)
 
+        self._find_sent_delayed_event(self.user1_access_token, delay_id, True)
+        self._find_sent_delayed_event(self.user2_access_token, delay_id, False)
+
+    @parameterized.expand((True, False))
     @unittest.override_config(
         {"rc_delayed_event_mgmt": {"per_second": 0.5, "burst_count": 1}}
     )
-    def test_restart_delayed_event_ratelimit(self) -> None:
+    def test_restart_delayed_event_ratelimit(self, action_in_path: bool) -> None:
         delay_ids = []
         for _ in range(2):
             channel = self.make_request(
@@ -464,37 +484,19 @@ class DelayedEventsTestCase(HomeserverTestCase):
             )
             self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
             delay_id = channel.json_body.get("delay_id")
-            self.assertIsNotNone(delay_id)
+            assert delay_id is not None
             delay_ids.append(delay_id)
 
-        channel = self.make_request(
-            "POST",
-            f"{PATH_PREFIX}/{delay_ids.pop(0)}",
-            {"action": "restart"},
-            self.user1_access_token,
+        channel = self._update_delayed_event(
+            delay_ids.pop(0), "restart", action_in_path
         )
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
 
-        args = (
-            "POST",
-            f"{PATH_PREFIX}/{delay_ids.pop(0)}",
-            {"action": "restart"},
-            self.user1_access_token,
+        channel = self._update_delayed_event(
+            delay_ids.pop(0), "restart", action_in_path
         )
-        channel = self.make_request(*args)
         self.assertEqual(HTTPStatus.TOO_MANY_REQUESTS, channel.code, channel.result)
 
-        # Add the current user to the ratelimit overrides, allowing them no ratelimiting.
-        self.get_success(
-            self.hs.get_datastores().main.set_ratelimit_for_user(
-                self.user1_user_id, 0, 0
-            )
-        )
-
-        # Test that the request isn't ratelimited anymore.
-        channel = self.make_request(*args)
-        self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
-
     def test_delayed_state_is_not_cancelled_by_new_state_from_same_user(
         self,
     ) -> None:
@@ -511,6 +513,8 @@ class DelayedEventsTestCase(HomeserverTestCase):
             self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
+        delay_id = channel.json_body.get("delay_id")
+        assert delay_id is not None
         events = self._get_delayed_events()
         self.assertEqual(1, len(events), events)
 
@@ -535,6 +539,9 @@ class DelayedEventsTestCase(HomeserverTestCase):
         )
         self.assertEqual(setter_expected, content.get(setter_key), content)
 
+        self._find_sent_delayed_event(self.user1_access_token, delay_id, True)
+        self._find_sent_delayed_event(self.user2_access_token, delay_id, False)
+
     def test_delayed_state_is_cancelled_by_new_state_from_other_user(
         self,
     ) -> None:
@@ -550,6 +557,8 @@ class DelayedEventsTestCase(HomeserverTestCase):
             self.user1_access_token,
         )
         self.assertEqual(HTTPStatus.OK, channel.code, channel.result)
+        delay_id = channel.json_body.get("delay_id")
+        assert delay_id is not None
         events = self._get_delayed_events()
         self.assertEqual(1, len(events), events)
 
@@ -574,7 +583,10 @@ class DelayedEventsTestCase(HomeserverTestCase):
         )
         self.assertEqual(setter_expected, content.get(setter_key), content)
 
-    def _get_delayed_events(self) -> List[JsonDict]:
+        self._find_sent_delayed_event(self.user1_access_token, delay_id, False)
+        self._find_sent_delayed_event(self.user2_access_token, delay_id, False)
+
+    def _get_delayed_events(self) -> list[JsonDict]:
         channel = self.make_request(
             "GET",
             PATH_PREFIX,
@@ -599,6 +611,50 @@ class DelayedEventsTestCase(HomeserverTestCase):
 
         return content
 
+    def _update_delayed_event(
+        self, delay_id: str, action: str, action_in_path: bool
+    ) -> FakeChannel:
+        path = f"{PATH_PREFIX}/{delay_id}"
+        body = {}
+        if action_in_path:
+            path += f"/{action}"
+        else:
+            body["action"] = action
+        return self.make_request("POST", path, body)
+
+    def _find_sent_delayed_event(
+        self, access_token: str, delay_id: str, should_find: bool
+    ) -> None:
+        """Call /sync and look for a synced event with a specified delay_id.
+        At most one event will ever have a matching delay_id.
+
+        Args:
+            access_token: The access token of the user to call /sync for.
+            delay_id: The delay_id to search for in synced events.
+            should_find: Whether /sync should include an event with a matching delay_id.
+        """
+        channel = self.make_request("GET", "/sync", access_token=access_token)
+        self.assertEqual(HTTPStatus.OK, channel.code)
+
+        rooms = channel.json_body["rooms"]
+        events = []
+        for membership in "join", "leave":
+            if membership in rooms:
+                events += rooms[membership][self.room_id]["timeline"]["events"]
+
+        found = False
+        for event in events:
+            if event["unsigned"].get("org.matrix.msc4140.delay_id") == delay_id:
+                if not should_find:
+                    self.fail(
+                        "Found event with matching delay_id, but expected to not find one"
+                    )
+                if found:
+                    self.fail("Found multiple events with matching delay_id")
+                found = True
+        if should_find and not found:
+            self.fail("Did not find event with matching delay_id")
+
 
 def _get_path_for_delayed_state(
     room_id: str, event_type: str, state_key: str, delay_ms: int
diff --git a/tests/rest/client/test_devices.py b/tests/rest/client/test_devices.py
index 2c498e97e1..2cf293a962 100644
--- a/tests/rest/client/test_devices.py
+++ b/tests/rest/client/test_devices.py
@@ -18,8 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from http import HTTPStatus
-
 from twisted.internet.defer import ensureDeferred
 from twisted.internet.testing import MemoryReactor
 
@@ -29,7 +27,7 @@ from synapse.rest import admin, devices, sync
 from synapse.rest.client import keys, login, register
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -85,48 +83,7 @@ class DehydratedDeviceTestCase(unittest.HomeserverTestCase):
         self.registration = hs.get_registration_handler()
         self.message_handler = hs.get_device_message_handler()
 
-    def test_PUT(self) -> None:
-        """Sanity-check that we can PUT a dehydrated device.
-
-        Detects https://github.com/matrix-org/synapse/issues/14334.
-        """
-        alice = self.register_user("alice", "correcthorse")
-        token = self.login(alice, "correcthorse")
-
-        # Have alice update their device list
-        channel = self.make_request(
-            "PUT",
-            "_matrix/client/unstable/org.matrix.msc2697.v2/dehydrated_device",
-            {
-                "device_data": {
-                    "algorithm": "org.matrix.msc2697.v1.dehydration.v1.olm",
-                    "account": "dehydrated_device",
-                },
-                "device_keys": {
-                    "user_id": "@alice:test",
-                    "device_id": "device1",
-                    "valid_until_ts": "80",
-                    "algorithms": [
-                        "m.olm.curve25519-aes-sha2",
-                    ],
-                    "keys": {
-                        "<algorithm>:<device_id>": "<key_base64>",
-                    },
-                    "signatures": {
-                        "<user_id>": {"<algorithm>:<device_id>": "<signature_base64>"}
-                    },
-                },
-            },
-            access_token=token,
-            shorthand=False,
-        )
-        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
-        device_id = channel.json_body.get("device_id")
-        self.assertIsInstance(device_id, str)
-
-    @unittest.override_config(
-        {"experimental_features": {"msc2697_enabled": False, "msc3814_enabled": True}}
-    )
+    @unittest.override_config({"experimental_features": {"msc3814_enabled": True}})
     def test_dehydrate_msc3814(self) -> None:
         user = self.register_user("mikey", "pass")
         token = self.login(user, "pass", device_id="device1")
@@ -320,9 +277,7 @@ class DehydratedDeviceTestCase(unittest.HomeserverTestCase):
         )
         self.assertEqual(channel.code, 401)
 
-    @unittest.override_config(
-        {"experimental_features": {"msc2697_enabled": False, "msc3814_enabled": True}}
-    )
+    @unittest.override_config({"experimental_features": {"msc3814_enabled": True}})
     def test_msc3814_dehydrated_device_delete_works(self) -> None:
         user = self.register_user("mikey", "pass")
         token = self.login(user, "pass", device_id="device1")
@@ -494,7 +449,9 @@ class MSC4190AppserviceDevicesTestCase(unittest.HomeserverTestCase):
         return self.hs
 
     def test_PUT_device(self) -> None:
-        self.register_appservice_user("alice", self.msc4190_service.token)
+        self.register_appservice_user(
+            "alice", self.msc4190_service.token, inhibit_login=True
+        )
         self.register_appservice_user("bob", self.pre_msc_service.token)
 
         channel = self.make_request(
@@ -531,18 +488,10 @@ class MSC4190AppserviceDevicesTestCase(unittest.HomeserverTestCase):
         )
         self.assertEqual(channel.code, 200, channel.json_body)
 
-        # On the regular service, that API should not allow for the
-        # creation of new devices.
-        channel = self.make_request(
-            "PUT",
-            "/_matrix/client/v3/devices/AABBCCDD?user_id=@bob:test",
-            content={"display_name": "Bob's device"},
-            access_token=self.pre_msc_service.token,
-        )
-        self.assertEqual(channel.code, 404, channel.json_body)
-
     def test_DELETE_device(self) -> None:
-        self.register_appservice_user("alice", self.msc4190_service.token)
+        self.register_appservice_user(
+            "alice", self.msc4190_service.token, inhibit_login=True
+        )
 
         # There should be no device
         channel = self.make_request(
@@ -589,7 +538,9 @@ class MSC4190AppserviceDevicesTestCase(unittest.HomeserverTestCase):
         self.assertEqual(channel.json_body, {"devices": []})
 
     def test_POST_delete_devices(self) -> None:
-        self.register_appservice_user("alice", self.msc4190_service.token)
+        self.register_appservice_user(
+            "alice", self.msc4190_service.token, inhibit_login=True
+        )
 
         # There should be no device
         channel = self.make_request(
diff --git a/tests/rest/client/test_directory.py b/tests/rest/client/test_directory.py
index 6548ac6fa8..f67f495dd2 100644
--- a/tests/rest/client/test_directory.py
+++ b/tests/rest/client/test_directory.py
@@ -26,7 +26,7 @@ from synapse.rest import admin
 from synapse.rest.client import directory, login, room
 from synapse.server import HomeServer
 from synapse.types import RoomAlias, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 from tests import unittest
diff --git a/tests/rest/client/test_ephemeral_message.py b/tests/rest/client/test_ephemeral_message.py
index 5b5c220825..6d806c630d 100644
--- a/tests/rest/client/test_ephemeral_message.py
+++ b/tests/rest/client/test_ephemeral_message.py
@@ -26,7 +26,7 @@ from synapse.rest import admin
 from synapse.rest.client import room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_events.py b/tests/rest/client/test_events.py
index 142509bbf7..65371f4c7e 100644
--- a/tests/rest/client/test_events.py
+++ b/tests/rest/client/test_events.py
@@ -29,7 +29,7 @@ import synapse.rest.admin
 from synapse.api.constants import EduTypes
 from synapse.rest.client import events, login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_filter.py b/tests/rest/client/test_filter.py
index 4153fb322d..0897c67ac3 100644
--- a/tests/rest/client/test_filter.py
+++ b/tests/rest/client/test_filter.py
@@ -25,7 +25,7 @@ from synapse.api.errors import Codes
 from synapse.rest.client import filter
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_identity.py b/tests/rest/client/test_identity.py
index 87af18f473..cc29d0c01d 100644
--- a/tests/rest/client/test_identity.py
+++ b/tests/rest/client/test_identity.py
@@ -25,7 +25,7 @@ from twisted.internet.testing import MemoryReactor
 import synapse.rest.admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_keys.py b/tests/rest/client/test_keys.py
index d9a210b616..9c83a284d7 100644
--- a/tests/rest/client/test_keys.py
+++ b/tests/rest/client/test_keys.py
@@ -40,6 +40,147 @@ from tests.unittest import override_config
 from tests.utils import HAS_AUTHLIB
 
 
+class KeyUploadTestCase(unittest.HomeserverTestCase):
+    servlets = [
+        keys.register_servlets,
+        admin.register_servlets_for_client_rest_resource,
+        login.register_servlets,
+    ]
+
+    def test_upload_keys_fails_on_invalid_structure(self) -> None:
+        """Check that we validate the structure of keys upon upload.
+
+        Regression test for https://github.com/element-hq/synapse/pull/17097
+        """
+        self.register_user("alice", "wonderland")
+        alice_token = self.login("alice", "wonderland")
+
+        channel = self.make_request(
+            "POST",
+            "/_matrix/client/v3/keys/upload",
+            {
+                # Error: device_keys must be a dict
+                "device_keys": ["some", "stuff", "weewoo"]
+            },
+            alice_token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
+        self.assertEqual(
+            channel.json_body["errcode"],
+            Codes.BAD_JSON,
+            channel.result,
+        )
+
+        channel = self.make_request(
+            "POST",
+            "/_matrix/client/v3/keys/upload",
+            {
+                # Error: properties of fallback_keys must be in the form `<algorithm>:<device_id>`
+                "fallback_keys": {"invalid_key": "signature_base64"}
+            },
+            alice_token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
+        self.assertEqual(
+            channel.json_body["errcode"],
+            Codes.BAD_JSON,
+            channel.result,
+        )
+
+        channel = self.make_request(
+            "POST",
+            "/_matrix/client/v3/keys/upload",
+            {
+                # Same as above, but for one_time_keys
+                "one_time_keys": {"invalid_key": "signature_base64"}
+            },
+            alice_token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
+        self.assertEqual(
+            channel.json_body["errcode"],
+            Codes.BAD_JSON,
+            channel.result,
+        )
+
+    def test_upload_keys_fails_on_invalid_user_id_or_device_id(self) -> None:
+        """
+        Validate that the requesting user is uploading their own keys and nobody
+        else's.
+        """
+        device_id = "DEVICE_ID"
+        alice_user_id = self.register_user("alice", "wonderland")
+        alice_token = self.login("alice", "wonderland", device_id=device_id)
+
+        channel = self.make_request(
+            "POST",
+            "/_matrix/client/v3/keys/upload",
+            {
+                "device_keys": {
+                    # Included `user_id` does not match requesting user.
+                    "user_id": "@unknown_user:test",
+                    "device_id": device_id,
+                    "algorithms": ["m.olm.curve25519-aes-sha2"],
+                    "keys": {
+                        f"ed25519:{device_id}": "publickey",
+                    },
+                    "signatures": {},
+                }
+            },
+            alice_token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
+        self.assertEqual(
+            channel.json_body["errcode"],
+            Codes.BAD_JSON,
+            channel.result,
+        )
+
+        channel = self.make_request(
+            "POST",
+            "/_matrix/client/v3/keys/upload",
+            {
+                "device_keys": {
+                    "user_id": alice_user_id,
+                    # Included `device_id` does not match requesting user's.
+                    "device_id": "UNKNOWN_DEVICE_ID",
+                    "algorithms": ["m.olm.curve25519-aes-sha2"],
+                    "keys": {
+                        f"ed25519:{device_id}": "publickey",
+                    },
+                    "signatures": {},
+                }
+            },
+            alice_token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.result)
+        self.assertEqual(
+            channel.json_body["errcode"],
+            Codes.BAD_JSON,
+            channel.result,
+        )
+
+    def test_upload_keys_succeeds_when_fields_are_explicitly_set_to_null(self) -> None:
+        """
+        This is a regression test for https://github.com/element-hq/synapse/pull/19023.
+        """
+        device_id = "DEVICE_ID"
+        self.register_user("alice", "wonderland")
+        alice_token = self.login("alice", "wonderland", device_id=device_id)
+
+        channel = self.make_request(
+            "POST",
+            "/_matrix/client/v3/keys/upload",
+            {
+                "device_keys": None,
+                "one_time_keys": None,
+                "fallback_keys": None,
+            },
+            alice_token,
+        )
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.result)
+
+
 class KeyQueryTestCase(unittest.HomeserverTestCase):
     servlets = [
         keys.register_servlets,
@@ -212,6 +353,7 @@ class SigningKeyUploadServletTestCase(unittest.HomeserverTestCase):
     ]
 
     OIDC_ADMIN_TOKEN = "_oidc_admin_token"
+    ACCOUNT_MANAGEMENT_URL = "https://my-account.issuer"
 
     @unittest.skip_unless(HAS_AUTHLIB, "requires authlib")
     @override_config(
@@ -221,7 +363,7 @@ class SigningKeyUploadServletTestCase(unittest.HomeserverTestCase):
                 "msc3861": {
                     "enabled": True,
                     "issuer": "https://issuer",
-                    "account_management_url": "https://my-account.issuer",
+                    "account_management_url": ACCOUNT_MANAGEMENT_URL,
                     "client_id": "id",
                     "client_auth_method": "client_secret_post",
                     "client_secret": "secret",
@@ -316,6 +458,33 @@ class SigningKeyUploadServletTestCase(unittest.HomeserverTestCase):
                 },
             )
             self.assertEqual(channel.code, HTTPStatus.UNAUTHORIZED, channel.json_body)
+            # Ensure that the response contains the expected UIA flows from https://spec.matrix.org/v1.17/client-server-api/#oauth-authentication
+            self.assertIn(
+                {"stages": ["m.oauth"]},
+                channel.json_body["flows"],
+                "m.oauth flow not found",
+            )
+            self.assertSubstring(
+                self.ACCOUNT_MANAGEMENT_URL,
+                channel.json_body["params"]["m.oauth"]["url"],
+                "m.oauth url does not match account management URL",
+            )
+            self.assertSubstring(
+                "action=org.matrix.cross_signing_reset",
+                channel.json_body["params"]["m.oauth"]["url"],
+                "m.oauth url does not include expected action",
+            )
+            # Unstable version of the flow
+            self.assertIn(
+                {"stages": ["org.matrix.cross_signing_reset"]},
+                channel.json_body["flows"],
+                "unstable org.matrix.cross_signing_reset flow not found",
+            )
+            self.assertEqual(
+                channel.json_body["params"]["org.matrix.cross_signing_reset"]["url"],
+                channel.json_body["params"]["m.oauth"]["url"],
+                "unstable org.matrix.cross_signing_reset url does not match m.oauth url",
+            )
 
         # Pretend that MAS did UIA and allowed us to replace the master key.
         channel = self.make_request(
diff --git a/tests/rest/client/test_login.py b/tests/rest/client/test_login.py
index d3a7905ef2..d83604a696 100644
--- a/tests/rest/client/test_login.py
+++ b/tests/rest/client/test_login.py
@@ -25,12 +25,7 @@ from typing import (
     BinaryIO,
     Callable,
     Collection,
-    Dict,
-    List,
     Literal,
-    Optional,
-    Tuple,
-    Union,
 )
 from unittest.mock import Mock
 from urllib.parse import urlencode
@@ -52,7 +47,7 @@ from synapse.rest.client.account import WhoamiRestServlet
 from synapse.rest.synapse.client import build_synapse_client_resource_tree
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.handlers.test_oidc import HAS_OIDC
@@ -144,14 +139,11 @@ class TestSpamChecker:
     async def check_login_for_spam(
         self,
         user_id: str,
-        device_id: Optional[str],
-        initial_display_name: Optional[str],
-        request_info: Collection[Tuple[Optional[str], str]],
-        auth_provider_id: Optional[str] = None,
-    ) -> Union[
-        Literal["NOT_SPAM"],
-        Tuple["synapse.module_api.errors.Codes", JsonDict],
-    ]:
+        device_id: str | None,
+        initial_display_name: str | None,
+        request_info: Collection[tuple[str | None, str]],
+        auth_provider_id: str | None = None,
+    ) -> Literal["NOT_SPAM"] | tuple["synapse.module_api.errors.Codes", JsonDict]:
         return "NOT_SPAM"
 
 
@@ -168,14 +160,11 @@ class DenyAllSpamChecker:
     async def check_login_for_spam(
         self,
         user_id: str,
-        device_id: Optional[str],
-        initial_display_name: Optional[str],
-        request_info: Collection[Tuple[Optional[str], str]],
-        auth_provider_id: Optional[str] = None,
-    ) -> Union[
-        Literal["NOT_SPAM"],
-        Tuple["synapse.module_api.errors.Codes", JsonDict],
-    ]:
+        device_id: str | None,
+        initial_display_name: str | None,
+        request_info: Collection[tuple[str | None, str]],
+        auth_provider_id: str | None = None,
+    ) -> Literal["NOT_SPAM"] | tuple["synapse.module_api.errors.Codes", JsonDict]:
         # Return an odd set of values to ensure that they get correctly passed
         # to the client.
         return Codes.LIMIT_EXCEEDED, {"extra": "value"}
@@ -633,7 +622,7 @@ class MultiSSOTestCase(unittest.HomeserverTestCase):
         login.register_servlets,
     ]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         config["public_baseurl"] = PUBLIC_BASEURL
@@ -678,7 +667,7 @@ class MultiSSOTestCase(unittest.HomeserverTestCase):
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.login_sso_redirect_url_builder = LoginSSORedirectURIBuilder(hs.config)
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         d = super().create_resource_dict()
         d.update(build_synapse_client_resource_tree(self.hs))
         return d
@@ -730,7 +719,7 @@ class MultiSSOTestCase(unittest.HomeserverTestCase):
         p.close()
 
         # there should be a link for each href
-        returned_idps: List[str] = []
+        returned_idps: list[str] = []
         for link in p.links:
             path, query = link.split("?", 1)
             self.assertEqual(path, "pick_idp")
@@ -891,7 +880,7 @@ class MultiSSOTestCase(unittest.HomeserverTestCase):
         # ... and should have set a cookie including the redirect url
         cookie_headers = channel.headers.getRawHeaders("Set-Cookie")
         assert cookie_headers
-        cookies: Dict[str, str] = {}
+        cookies: dict[str, str] = {}
         for h in cookie_headers:
             key, value = h.split(";")[0].split("=", maxsplit=1)
             cookies[key] = value
@@ -939,39 +928,32 @@ class MultiSSOTestCase(unittest.HomeserverTestCase):
         self.assertEqual(chan.code, 200, chan.result)
         self.assertEqual(chan.json_body["user_id"], "@user1:test")
 
-    def test_multi_sso_redirect_to_unknown(self) -> None:
-        """An unknown IdP should cause a 404"""
+    def test_multi_sso_redirect_unknown_idp(self) -> None:
+        """An unknown IdP should cause a 400 bad request error"""
         channel = self.make_request(
             "GET",
             "/_synapse/client/pick_idp?redirectUrl=http://x&idp=xyz",
         )
-        self.assertEqual(channel.code, 302, channel.result)
-        location_headers = channel.headers.getRawHeaders("Location")
-        assert location_headers
-        sso_login_redirect_uri = location_headers[0]
+        self.assertEqual(channel.code, 400, channel.result)
 
-        # it should redirect us to the standard login SSO redirect flow
-        self.assertEqual(
-            sso_login_redirect_uri,
-            self.login_sso_redirect_url_builder.build_login_sso_redirect_uri(
-                idp_id="xyz", client_redirect_url="http://x"
-            ),
-        )
+    def test_multi_sso_redirect_unknown_idp_as_url(self) -> None:
+        """
+        An unknown IdP that looks like a URL should cause a 400 bad request error (to
+        avoid open redirects).
 
-        # follow the redirect
+        Ideally, we'd have another test for a known IdP with a URL as the `idp_id`, but
+        we can't configure that in our tests because the config validation on
+        `oidc_providers` only allows a subset of characters. If we could configure
+        `oidc_providers` with a URL as the `idp_id`, it should still be URL-encoded
+        properly to avoid open redirections. We do have `test_url_as_idp_id_is_escaped`
+        in the URL building tests to cover this case but is only a unit test vs
+        something at the REST layer here that covers things end-to-end.
+        """
         channel = self.make_request(
             "GET",
-            # We have to make this relative to be compatible with `make_request(...)`
-            get_relative_uri_from_absolute_uri(sso_login_redirect_uri),
-            # We have to set the Host header to match the `public_baseurl` to avoid
-            # the extra redirect in the `SsoRedirectServlet` in order for the
-            # cookies to be visible.
-            custom_headers=[
-                ("Host", SYNAPSE_SERVER_PUBLIC_HOSTNAME),
-            ],
+            "/_synapse/client/pick_idp?redirectUrl=something&idp=https://element.io/",
         )
-
-        self.assertEqual(channel.code, 404, channel.result)
+        self.assertEqual(channel.code, 400, channel.result)
 
     def test_client_idp_redirect_to_unknown(self) -> None:
         """If the client tries to pick an unknown IdP, return a 404"""
@@ -994,7 +976,7 @@ class MultiSSOTestCase(unittest.HomeserverTestCase):
         # it should redirect us to the auth page of the OIDC server
         self.assertEqual(oidc_uri_path, fake_oidc_server.authorization_endpoint)
 
-    def _make_sso_redirect_request(self, idp_prov: Optional[str] = None) -> FakeChannel:
+    def _make_sso_redirect_request(self, idp_prov: str | None = None) -> FakeChannel:
         """Send a request to /_matrix/client/r0/login/sso/redirect
 
         ... possibly specifying an IDP provider
@@ -1186,7 +1168,7 @@ class JWTTestCase(unittest.HomeserverTestCase):
         "algorithm": jwt_algorithm,
     }
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         # If jwt_config has been defined (eg via @override_config), don't replace it.
@@ -1195,7 +1177,7 @@ class JWTTestCase(unittest.HomeserverTestCase):
 
         return config
 
-    def jwt_encode(self, payload: Dict[str, Any], secret: str = jwt_secret) -> str:
+    def jwt_encode(self, payload: dict[str, Any], secret: str = jwt_secret) -> str:
         header = {"alg": self.jwt_algorithm}
         result: bytes = jwt.encode(header, payload, secret)
         return result.decode("ascii")
@@ -1433,7 +1415,7 @@ class JWTPubKeyTestCase(unittest.HomeserverTestCase):
         ]
     )
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["jwt_config"] = {
             "enabled": True,
@@ -1442,7 +1424,7 @@ class JWTPubKeyTestCase(unittest.HomeserverTestCase):
         }
         return config
 
-    def jwt_encode(self, payload: Dict[str, Any], secret: str = jwt_privatekey) -> str:
+    def jwt_encode(self, payload: dict[str, Any], secret: str = jwt_privatekey) -> str:
         header = {"alg": "RS256"}
         if secret.startswith("-----BEGIN RSA PRIVATE KEY-----"):
             secret = JsonWebKey.import_key(secret, {"kty": "RSA"})
@@ -1505,9 +1487,23 @@ class AppserviceLoginRestServletTestCase(unittest.HomeserverTestCase):
                 ApplicationService.NS_ALIASES: [],
             },
         )
+        self.msc4190_service = ApplicationService(
+            id="third__identifier",
+            token="third_token",
+            sender=UserID.from_string("@as3bot:example.com"),
+            namespaces={
+                ApplicationService.NS_USERS: [
+                    {"regex": r"@as3_user.*", "exclusive": False}
+                ],
+                ApplicationService.NS_ROOMS: [],
+                ApplicationService.NS_ALIASES: [],
+            },
+            msc4190_device_management=True,
+        )
 
         self.hs.get_datastores().main.services_cache.append(self.service)
         self.hs.get_datastores().main.services_cache.append(self.another_service)
+        self.hs.get_datastores().main.services_cache.append(self.msc4190_service)
         return self.hs
 
     def test_login_appservice_user(self) -> None:
@@ -1524,6 +1520,27 @@ class AppserviceLoginRestServletTestCase(unittest.HomeserverTestCase):
 
         self.assertEqual(channel.code, 200, msg=channel.result)
 
+    def test_login_appservice_msc4190_fail(self) -> None:
+        """Test that an appservice user can use /login"""
+        self.register_appservice_user(
+            "as3_user_alice", self.msc4190_service.token, inhibit_login=True
+        )
+
+        params = {
+            "type": login.LoginRestServlet.APPSERVICE_TYPE,
+            "identifier": {"type": "m.id.user", "user": "as3_user_alice"},
+        }
+        channel = self.make_request(
+            b"POST", LOGIN_URL, params, access_token=self.msc4190_service.token
+        )
+
+        self.assertEqual(channel.code, 400, msg=channel.result)
+        self.assertEqual(
+            channel.json_body.get("errcode"),
+            Codes.APPSERVICE_LOGIN_UNSUPPORTED,
+            channel.json_body,
+        )
+
     def test_login_appservice_user_bot(self) -> None:
         """Test that the appservice bot can use /login"""
         self.register_appservice_user(AS_USER, self.service.token)
@@ -1602,7 +1619,7 @@ class UsernamePickerTestCase(HomeserverTestCase):
         )
         return hs
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["public_baseurl"] = PUBLIC_BASEURL
 
@@ -1621,7 +1638,7 @@ class UsernamePickerTestCase(HomeserverTestCase):
         config["sso"] = {"client_whitelist": ["https://x"]}
         return config
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         d = super().create_resource_dict()
         d.update(build_synapse_client_resource_tree(self.hs))
         return d
@@ -1632,7 +1649,7 @@ class UsernamePickerTestCase(HomeserverTestCase):
         displayname: str,
         email: str,
         picture: str,
-    ) -> Tuple[str, str]:
+    ) -> tuple[str, str]:
         # do the start of the login flow
         channel, _ = self.helper.auth_via_oidc(
             fake_oidc_server,
@@ -1653,7 +1670,7 @@ class UsernamePickerTestCase(HomeserverTestCase):
         self.assertEqual(picker_url, "/_synapse/client/pick_username/account_details")
 
         # ... with a username_mapping_session cookie
-        cookies: Dict[str, str] = {}
+        cookies: dict[str, str] = {}
         channel.extract_cookies(cookies)
         self.assertIn("username_mapping_session", cookies)
         session_id = cookies["username_mapping_session"]
@@ -1711,9 +1728,6 @@ class UsernamePickerTestCase(HomeserverTestCase):
             content_is_form=True,
             custom_headers=[
                 ("Cookie", "username_mapping_session=" + session_id),
-                # old versions of twisted don't do form-parsing without a valid
-                # content-length header.
-                ("Content-Length", str(len(content))),
             ],
         )
         self.assertEqual(chan.code, 302, chan.result)
@@ -1801,9 +1815,6 @@ class UsernamePickerTestCase(HomeserverTestCase):
             content_is_form=True,
             custom_headers=[
                 ("Cookie", "username_mapping_session=" + session_id),
-                # old versions of twisted don't do form-parsing without a valid
-                # content-length header.
-                ("Content-Length", str(len(content))),
             ],
         )
         self.assertEqual(chan.code, 302, chan.result)
@@ -1863,8 +1874,8 @@ class UsernamePickerTestCase(HomeserverTestCase):
 async def mock_get_file(
     url: str,
     output_stream: BinaryIO,
-    max_size: Optional[int] = None,
-    headers: Optional[RawHeaders] = None,
-    is_allowed_content_type: Optional[Callable[[str], bool]] = None,
-) -> Tuple[int, Dict[bytes, List[bytes]], str, int]:
+    max_size: int | None = None,
+    headers: RawHeaders | None = None,
+    is_allowed_content_type: Callable[[str], bool] | None = None,
+) -> tuple[int, dict[bytes, list[bytes]], str, int]:
     return 0, {b"Content-Type": [b"image/png"]}, "", 200
diff --git a/tests/rest/client/test_login_token_request.py b/tests/rest/client/test_login_token_request.py
index 202d2cf351..835336f3d9 100644
--- a/tests/rest/client/test_login_token_request.py
+++ b/tests/rest/client/test_login_token_request.py
@@ -24,7 +24,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.rest import admin
 from synapse.rest.client import login, login_token_request, versions
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
diff --git a/tests/rest/client/test_matrixrtc.py b/tests/rest/client/test_matrixrtc.py
new file mode 100644
index 0000000000..b5216c7adc
--- /dev/null
+++ b/tests/rest/client/test_matrixrtc.py
@@ -0,0 +1,105 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+# [This file includes modifications made by New Vector Limited]
+#
+#
+
+"""Tests REST events for /rtc/endpoints path."""
+
+from twisted.internet.testing import MemoryReactor
+
+from synapse.rest import admin
+from synapse.rest.client import login, matrixrtc, register, room
+from synapse.server import HomeServer
+from synapse.util.clock import Clock
+
+from tests.unittest import HomeserverTestCase, override_config
+
+PATH_PREFIX = "/_matrix/client/unstable/org.matrix.msc4143"
+RTC_ENDPOINT = {"type": "focusA", "required_field": "theField"}
+LIVEKIT_ENDPOINT = {
+    "type": "livekit",
+    "livekit_service_url": "https://livekit.example.com",
+}
+
+
+class MatrixRtcTestCase(HomeserverTestCase):
+    """Tests /rtc/transports Client-Server REST API."""
+
+    servlets = [
+        admin.register_servlets,
+        room.register_servlets,
+        login.register_servlets,
+        register.register_servlets,
+        matrixrtc.register_servlets,
+    ]
+
+    def prepare(
+        self, reactor: MemoryReactor, clock: Clock, homeserver: HomeServer
+    ) -> None:
+        self.register_user("alice", "password")
+        self._alice_tok = self.login("alice", "password")
+
+    def test_matrixrtc_endpoint_not_enabled(self) -> None:
+        channel = self.make_request(
+            "GET", f"{PATH_PREFIX}/rtc/transports", access_token=self._alice_tok
+        )
+        self.assertEqual(404, channel.code, channel.json_body)
+        self.assertEqual(
+            "M_UNRECOGNIZED", channel.json_body["errcode"], channel.json_body
+        )
+
+    @override_config({"experimental_features": {"msc4143_enabled": True}})
+    def test_matrixrtc_endpoint_requires_authentication(self) -> None:
+        channel = self.make_request("GET", f"{PATH_PREFIX}/rtc/transports")
+        self.assertEqual(401, channel.code, channel.json_body)
+
+    @override_config(
+        {
+            "experimental_features": {"msc4143_enabled": True},
+            "matrix_rtc": {"transports": [RTC_ENDPOINT]},
+        }
+    )
+    def test_matrixrtc_endpoint_contains_expected_transport(self) -> None:
+        channel = self.make_request(
+            "GET", f"{PATH_PREFIX}/rtc/transports", access_token=self._alice_tok
+        )
+        self.assertEqual(200, channel.code, channel.json_body)
+        self.assert_dict({"rtc_transports": [RTC_ENDPOINT]}, channel.json_body)
+
+    @override_config(
+        {
+            "experimental_features": {"msc4143_enabled": True},
+            "matrix_rtc": {"transports": []},
+        }
+    )
+    def test_matrixrtc_endpoint_no_transports_configured(self) -> None:
+        channel = self.make_request(
+            "GET", f"{PATH_PREFIX}/rtc/transports", access_token=self._alice_tok
+        )
+        self.assertEqual(200, channel.code, channel.json_body)
+        self.assert_dict({}, channel.json_body)
+
+    @override_config(
+        {
+            "experimental_features": {"msc4143_enabled": True},
+            "matrix_rtc": {"transports": [LIVEKIT_ENDPOINT]},
+        }
+    )
+    def test_matrixrtc_endpoint_livekit_transport(self) -> None:
+        channel = self.make_request(
+            "GET", f"{PATH_PREFIX}/rtc/transports", access_token=self._alice_tok
+        )
+        self.assertEqual(200, channel.code, channel.json_body)
+        self.assert_dict({"rtc_transports": [LIVEKIT_ENDPOINT]}, channel.json_body)
diff --git a/tests/rest/client/test_media.py b/tests/rest/client/test_media.py
index e6ed47f83a..ec81b1413c 100644
--- a/tests/rest/client/test_media.py
+++ b/tests/rest/client/test_media.py
@@ -24,7 +24,7 @@ import json
 import os
 import re
 import shutil
-from typing import Any, BinaryIO, ClassVar, Dict, List, Optional, Sequence, Tuple, Type
+from typing import Any, BinaryIO, ClassVar, Sequence
 from unittest.mock import MagicMock, Mock, patch
 from urllib import parse
 from urllib.parse import quote, urlencode
@@ -46,6 +46,7 @@ from twisted.web.resource import Resource
 
 from synapse.api.errors import HttpResponseException
 from synapse.api.ratelimiting import Ratelimiter
+from synapse.config._base import Config
 from synapse.config.oembed import OEmbedEndpointConfig
 from synapse.http.client import MultipartResponse
 from synapse.http.types import QueryParams
@@ -53,11 +54,12 @@ from synapse.logging.context import make_deferred_yieldable
 from synapse.media._base import FileInfo, ThumbnailInfo
 from synapse.media.thumbnailer import ThumbnailProvider
 from synapse.media.url_previewer import IMAGE_CACHE_EXPIRY_MS
+from synapse.module_api import MediaUploadLimit
 from synapse.rest import admin
 from synapse.rest.client import login, media
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import parse_and_validate_mxc_uri
 
 from tests import unittest
@@ -263,7 +265,7 @@ class URLPreviewTests(unittest.HomeserverTestCase):
         assert self.media_repo.url_previewer is not None
         self.url_previewer = self.media_repo.url_previewer
 
-        self.lookups: Dict[str, Any] = {}
+        self.lookups: dict[str, Any] = {}
 
         class Resolver:
             def resolveHostName(
@@ -271,7 +273,7 @@ class URLPreviewTests(unittest.HomeserverTestCase):
                 resolutionReceiver: IResolutionReceiver,
                 hostName: str,
                 portNumber: int = 0,
-                addressTypes: Optional[Sequence[Type[IAddress]]] = None,
+                addressTypes: Sequence[type[IAddress]] | None = None,
                 transportSemantics: str = "TCP",
             ) -> IResolutionReceiver:
                 resolution = HostResolution(hostName)
@@ -1355,7 +1357,7 @@ class URLPreviewTests(unittest.HomeserverTestCase):
         self.assertEqual(body["og:title"], "Test")
         self.assertNotIn("og:image", body)
 
-    def _download_image(self) -> Tuple[str, str]:
+    def _download_image(self) -> tuple[str, str]:
         """Downloads an image into the URL cache.
         Returns:
             A (host, media_id) tuple representing the MXC URI of the image.
@@ -1659,7 +1661,7 @@ class MediaConfigModuleCallbackTestCase(unittest.HomeserverTestCase):
     async def get_media_config_for_user(
         self,
         user_id: str,
-    ) -> Optional[JsonDict]:
+    ) -> JsonDict | None:
         # We echo back the user_id and set a custom upload size.
         return {"m.upload.size": 1024, "user_id": user_id}
 
@@ -1992,12 +1994,12 @@ class DownloadAndThumbnailTestCase(unittest.HomeserverTestCase):
     ]
 
     def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
-        self.fetches: List[
-            Tuple[
+        self.fetches: list[
+            tuple[
                 "Deferred[Any]",
                 str,
                 str,
-                Optional[QueryParams],
+                QueryParams | None,
             ]
         ] = []
 
@@ -2008,16 +2010,16 @@ class DownloadAndThumbnailTestCase(unittest.HomeserverTestCase):
             download_ratelimiter: Ratelimiter,
             ip_address: Any,
             max_size: int,
-            args: Optional[QueryParams] = None,
+            args: QueryParams | None = None,
             retry_on_dns_fail: bool = True,
             ignore_backoff: bool = False,
             follow_redirects: bool = False,
-        ) -> "Deferred[Tuple[int, Dict[bytes, List[bytes]], bytes]]":
+        ) -> "Deferred[tuple[int, dict[bytes, list[bytes]], bytes]]":
             """A mock for MatrixFederationHttpClient.federation_get_file."""
 
             def write_to(
-                r: Tuple[bytes, Tuple[int, Dict[bytes, List[bytes]], bytes]],
-            ) -> Tuple[int, Dict[bytes, List[bytes]], bytes]:
+                r: tuple[bytes, tuple[int, dict[bytes, list[bytes]], bytes]],
+            ) -> tuple[int, dict[bytes, list[bytes]], bytes]:
                 data, response = r
                 output_stream.write(data)
                 return response
@@ -2027,7 +2029,7 @@ class DownloadAndThumbnailTestCase(unittest.HomeserverTestCase):
                 output_stream.write(f.value.response)
                 return f
 
-            d: Deferred[Tuple[bytes, Tuple[int, Dict[bytes, List[bytes]], bytes]]] = (
+            d: Deferred[tuple[bytes, tuple[int, dict[bytes, list[bytes]], bytes]]] = (
                 Deferred()
             )
             self.fetches.append((d, destination, path, args))
@@ -2042,16 +2044,16 @@ class DownloadAndThumbnailTestCase(unittest.HomeserverTestCase):
             download_ratelimiter: Ratelimiter,
             ip_address: Any,
             max_size: int,
-            args: Optional[QueryParams] = None,
+            args: QueryParams | None = None,
             retry_on_dns_fail: bool = True,
             ignore_backoff: bool = False,
             follow_redirects: bool = False,
-        ) -> "Deferred[Tuple[int, Dict[bytes, List[bytes]]]]":
+        ) -> "Deferred[tuple[int, dict[bytes, list[bytes]]]]":
             """A mock for MatrixFederationHttpClient.get_file."""
 
             def write_to(
-                r: Tuple[bytes, Tuple[int, Dict[bytes, List[bytes]]]],
-            ) -> Tuple[int, Dict[bytes, List[bytes]]]:
+                r: tuple[bytes, tuple[int, dict[bytes, list[bytes]]]],
+            ) -> tuple[int, dict[bytes, list[bytes]]]:
                 data, response = r
                 output_stream.write(data)
                 return response
@@ -2061,7 +2063,7 @@ class DownloadAndThumbnailTestCase(unittest.HomeserverTestCase):
                 output_stream.write(f.value.response)
                 return f
 
-            d: Deferred[Tuple[bytes, Tuple[int, Dict[bytes, List[bytes]]]]] = Deferred()
+            d: Deferred[tuple[bytes, tuple[int, dict[bytes, list[bytes]]]]] = Deferred()
             self.fetches.append((d, destination, path, args))
             # Note that this callback changes the value held by d.
             d_after_callback = d.addCallbacks(write_to, write_err)
@@ -2105,7 +2107,7 @@ class DownloadAndThumbnailTestCase(unittest.HomeserverTestCase):
         self.tok = self.login("user", "pass")
 
     def _req(
-        self, content_disposition: Optional[bytes], include_content_type: bool = True
+        self, content_disposition: bytes | None, include_content_type: bool = True
     ) -> FakeChannel:
         channel = self.make_request(
             "GET",
@@ -2416,7 +2418,7 @@ class DownloadAndThumbnailTestCase(unittest.HomeserverTestCase):
     def _test_thumbnail(
         self,
         method: str,
-        expected_body: Optional[bytes],
+        expected_body: bytes | None,
         expected_found: bool,
         unable_to_thumbnail: bool = False,
     ) -> None:
@@ -2536,7 +2538,7 @@ configs = [
 
 @parameterized_class(configs)
 class AuthenticatedMediaTestCase(unittest.HomeserverTestCase):
-    extra_config: Dict[str, Any]
+    extra_config: dict[str, Any]
     servlets = [
         media.register_servlets,
         login.register_servlets,
@@ -2574,7 +2576,7 @@ class AuthenticatedMediaTestCase(unittest.HomeserverTestCase):
         self.user = self.register_user("user", "pass")
         self.tok = self.login("user", "pass")
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
@@ -2588,7 +2590,6 @@ class AuthenticatedMediaTestCase(unittest.HomeserverTestCase):
             self.tok,
             shorthand=False,
             content_type=b"image/png",
-            custom_headers=[("Content-Length", str(67))],
         )
         self.assertEqual(channel.code, 200)
         res = channel.json_body.get("content_uri")
@@ -2748,7 +2749,6 @@ class AuthenticatedMediaTestCase(unittest.HomeserverTestCase):
             self.tok,
             shorthand=False,
             content_type=b"image/png",
-            custom_headers=[("Content-Length", str(67))],
         )
         self.assertEqual(channel.code, 200)
         res = channel.json_body.get("content_uri")
@@ -2893,7 +2893,7 @@ class MediaUploadLimits(unittest.HomeserverTestCase):
         self.user = self.register_user("user", "pass")
         self.tok = self.login("user", "pass")
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         resources = super().create_resource_dict()
         resources["/_matrix/media"] = self.hs.get_media_repository_resource()
         return resources
@@ -2907,7 +2907,6 @@ class MediaUploadLimits(unittest.HomeserverTestCase):
             access_token=self.tok,
             shorthand=False,
             content_type=b"text/plain",
-            custom_headers=[("Content-Length", str(size))],
         )
 
     def test_upload_under_limit(self) -> None:
@@ -2967,3 +2966,191 @@ class MediaUploadLimits(unittest.HomeserverTestCase):
         # This will succeed as the weekly limit has reset
         channel = self.upload_media(900)
         self.assertEqual(channel.code, 200)
+
+
+class MediaUploadLimitsModuleOverrides(unittest.HomeserverTestCase):
+    """
+    This test case simulates a homeserver with media upload limits being overridden by the module API.
+    """
+
+    servlets = [
+        media.register_servlets,
+        login.register_servlets,
+        admin.register_servlets,
+    ]
+
+    def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
+        config = self.default_config()
+
+        self.storage_path = self.mktemp()
+        self.media_store_path = self.mktemp()
+        os.mkdir(self.storage_path)
+        os.mkdir(self.media_store_path)
+        config["media_store_path"] = self.media_store_path
+
+        provider_config = {
+            "module": "synapse.media.storage_provider.FileStorageProviderBackend",
+            "store_local": True,
+            "store_synchronous": False,
+            "store_remote": True,
+            "config": {"directory": self.storage_path},
+        }
+
+        config["media_storage_providers"] = [provider_config]
+
+        # default limits to use
+        config["media_upload_limits"] = [
+            {"time_period": "1d", "max_size": "1K"},
+            {"time_period": "1w", "max_size": "3K"},
+        ]
+
+        return self.setup_test_homeserver(config=config)
+
+    async def _get_media_upload_limits_for_user(
+        self,
+        user_id: str,
+    ) -> list[MediaUploadLimit] | None:
+        # user1 has custom limits
+        if user_id == self.user1:
+            # n.b. we return these in increasing duration order and Synapse will need to sort them correctly
+            return [
+                MediaUploadLimit(
+                    time_period_ms=Config.parse_duration("1d"), max_bytes=5000
+                ),
+                MediaUploadLimit(
+                    time_period_ms=Config.parse_duration("1w"), max_bytes=15000
+                ),
+            ]
+        # user2 has no limits
+        if user_id == self.user2:
+            return []
+        # otherwise use default
+        return None
+
+    async def _on_media_upload_limit_exceeded(
+        self,
+        user_id: str,
+        limit: MediaUploadLimit,
+        sent_bytes: int,
+        attempted_bytes: int,
+    ) -> None:
+        self.last_media_upload_limit_exceeded: dict[str, object] | None = {
+            "user_id": user_id,
+            "limit": limit,
+            "sent_bytes": sent_bytes,
+            "attempted_bytes": attempted_bytes,
+        }
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        self.repo = hs.get_media_repository()
+        self.client = hs.get_federation_http_client()
+        self.store = hs.get_datastores().main
+        self.user1 = self.register_user("user1", "pass")
+        self.tok1 = self.login("user1", "pass")
+        self.user2 = self.register_user("user2", "pass")
+        self.tok2 = self.login("user2", "pass")
+        self.user3 = self.register_user("user3", "pass")
+        self.tok3 = self.login("user3", "pass")
+        self.last_media_upload_limit_exceeded = None
+        self.hs.get_module_api().register_media_repository_callbacks(
+            get_media_upload_limits_for_user=self._get_media_upload_limits_for_user,
+            on_media_upload_limit_exceeded=self._on_media_upload_limit_exceeded,
+        )
+
+    def create_resource_dict(self) -> dict[str, Resource]:
+        resources = super().create_resource_dict()
+        resources["/_matrix/media"] = self.hs.get_media_repository_resource()
+        return resources
+
+    def upload_media(self, size: int, tok: str) -> FakeChannel:
+        """Helper to upload media of a given size with a given token."""
+        return self.make_request(
+            "POST",
+            "/_matrix/media/v3/upload",
+            content=b"0" * size,
+            access_token=tok,
+            shorthand=False,
+            content_type=b"text/plain",
+        )
+
+    def test_upload_under_limit(self) -> None:
+        """Test that uploading media under the limit works."""
+
+        # User 1 uploads 100 bytes
+        channel = self.upload_media(100, self.tok1)
+        self.assertEqual(channel.code, 200)
+
+        # User 2 (unlimited) uploads 100 bytes
+        channel = self.upload_media(100, self.tok2)
+        self.assertEqual(channel.code, 200)
+
+        # User 3 (default) uploads 100 bytes
+        channel = self.upload_media(100, self.tok3)
+        self.assertEqual(channel.code, 200)
+
+        self.assertEqual(self.last_media_upload_limit_exceeded, None)
+
+    def test_uses_custom_limit(self) -> None:
+        """Test that uploading media over the module provided daily limit fails."""
+
+        # User 1 uploads 3000 bytes
+        channel = self.upload_media(3000, self.tok1)
+        self.assertEqual(channel.code, 200)
+
+        # User 1 attempts to upload 4000 bytes taking it over the limit
+        channel = self.upload_media(4000, self.tok1)
+        self.assertEqual(channel.code, 400)
+        assert self.last_media_upload_limit_exceeded is not None
+        self.assertEqual(self.last_media_upload_limit_exceeded["user_id"], self.user1)
+        self.assertEqual(
+            self.last_media_upload_limit_exceeded["limit"],
+            MediaUploadLimit(
+                max_bytes=5000, time_period_ms=Config.parse_duration("1d")
+            ),
+        )
+        self.assertEqual(self.last_media_upload_limit_exceeded["sent_bytes"], 3000)
+        self.assertEqual(self.last_media_upload_limit_exceeded["attempted_bytes"], 4000)
+
+        # User 1 attempts to upload 20000 bytes which is over the weekly limit
+        # This tests that the limits have been sorted as expected
+        channel = self.upload_media(20000, self.tok1)
+        self.assertEqual(channel.code, 400)
+        assert self.last_media_upload_limit_exceeded is not None
+        self.assertEqual(self.last_media_upload_limit_exceeded["user_id"], self.user1)
+        self.assertEqual(
+            self.last_media_upload_limit_exceeded["limit"],
+            MediaUploadLimit(
+                max_bytes=15000, time_period_ms=Config.parse_duration("1w")
+            ),
+        )
+        self.assertEqual(self.last_media_upload_limit_exceeded["sent_bytes"], 3000)
+        self.assertEqual(
+            self.last_media_upload_limit_exceeded["attempted_bytes"], 20000
+        )
+
+    def test_uses_unlimited(self) -> None:
+        """Test that unlimited user is not limited when module returns []."""
+        # User 2 uploads 10000 bytes which is over the default limit
+        channel = self.upload_media(10000, self.tok2)
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(self.last_media_upload_limit_exceeded, None)
+
+    def test_uses_defaults(self) -> None:
+        """Test that the default limits are applied when module returned None."""
+        # User 3 uploads 500 bytes
+        channel = self.upload_media(500, self.tok3)
+        self.assertEqual(channel.code, 200)
+
+        # User 3 uploads 800 bytes which is over the limit
+        channel = self.upload_media(800, self.tok3)
+        self.assertEqual(channel.code, 400)
+        assert self.last_media_upload_limit_exceeded is not None
+        self.assertEqual(self.last_media_upload_limit_exceeded["user_id"], self.user3)
+        self.assertEqual(
+            self.last_media_upload_limit_exceeded["limit"],
+            MediaUploadLimit(
+                max_bytes=1024, time_period_ms=Config.parse_duration("1d")
+            ),
+        )
+        self.assertEqual(self.last_media_upload_limit_exceeded["sent_bytes"], 500)
+        self.assertEqual(self.last_media_upload_limit_exceeded["attempted_bytes"], 800)
diff --git a/tests/rest/client/test_models.py b/tests/rest/client/test_models.py
index 75479e6235..f297856830 100644
--- a/tests/rest/client/test_models.py
+++ b/tests/rest/client/test_models.py
@@ -21,7 +21,8 @@
 import unittest as stdlib_unittest
 from typing import Literal
 
-from synapse._pydantic_compat import BaseModel, ValidationError
+from pydantic import BaseModel, ValidationError
+
 from synapse.types.rest.client import EmailRequestTokenBody
 
 
@@ -35,16 +36,16 @@ class ThreepidMediumEnumTestCase(stdlib_unittest.TestCase):
         This is arguably more of a test of a class that inherits from str and Enum
         simultaneously.
         """
-        model = self.Model.parse_obj({"medium": "email"})
+        model = self.Model.model_validate({"medium": "email"})
         self.assertEqual(model.medium, "email")
 
     def test_rejects_invalid_medium_value(self) -> None:
         with self.assertRaises(ValidationError):
-            self.Model.parse_obj({"medium": "interpretive_dance"})
+            self.Model.model_validate({"medium": "interpretive_dance"})
 
     def test_rejects_invalid_medium_type(self) -> None:
         with self.assertRaises(ValidationError):
-            self.Model.parse_obj({"medium": 123})
+            self.Model.model_validate({"medium": 123})
 
 
 class EmailRequestTokenBodyTestCase(stdlib_unittest.TestCase):
@@ -56,14 +57,14 @@ class EmailRequestTokenBodyTestCase(stdlib_unittest.TestCase):
 
     def test_token_required_if_id_server_provided(self) -> None:
         with self.assertRaises(ValidationError):
-            EmailRequestTokenBody.parse_obj(
+            EmailRequestTokenBody.model_validate(
                 {
                     **self.base_request,
                     "id_server": "identity.wonderland.com",
                 }
             )
         with self.assertRaises(ValidationError):
-            EmailRequestTokenBody.parse_obj(
+            EmailRequestTokenBody.model_validate(
                 {
                     **self.base_request,
                     "id_server": "identity.wonderland.com",
@@ -73,7 +74,7 @@ class EmailRequestTokenBodyTestCase(stdlib_unittest.TestCase):
 
     def test_token_typechecked_when_id_server_provided(self) -> None:
         with self.assertRaises(ValidationError):
-            EmailRequestTokenBody.parse_obj(
+            EmailRequestTokenBody.model_validate(
                 {
                     **self.base_request,
                     "id_server": "identity.wonderland.com",
diff --git a/tests/rest/client/test_msc4388_rendezvous.py b/tests/rest/client/test_msc4388_rendezvous.py
new file mode 100644
index 0000000000..913a41dedb
--- /dev/null
+++ b/tests/rest/client/test_msc4388_rendezvous.py
@@ -0,0 +1,761 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 Element Creations Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+
+import json
+import urllib.parse
+from typing import Any, Mapping
+from unittest.mock import Mock
+
+from parameterized import parameterized
+
+from twisted.internet.testing import MemoryReactor
+
+from synapse.api.auth.mas import MasDelegatedAuth
+from synapse.rest import admin
+from synapse.rest.client import login, rendezvous
+from synapse.server import HomeServer
+from synapse.types import UserID
+from synapse.util.clock import Clock
+
+from tests import unittest
+from tests.unittest import checked_cast, override_config
+
+rz_endpoint = "/_matrix/client/unstable/io.element.msc4388/rendezvous"
+
+
+class RendezvousServletTestCase(unittest.HomeserverTestCase):
+    """
+    Test the experimental MSC4388 rendezvous endpoint.
+    """
+
+    servlets = [
+        admin.register_servlets,
+        login.register_servlets,
+        rendezvous.register_servlets,
+    ]
+
+    def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
+        self.hs = self.setup_test_homeserver()
+        return self.hs
+
+    def setup_mock_oauth(self) -> None:
+        """
+        This isn't a very elegant way to mock the OAuth API, but it works for our purposes.
+        """
+
+        self.auth = checked_cast(MasDelegatedAuth, self.hs.get_auth())
+
+        self._rust_client = Mock(spec=["post"])
+        self._rust_client.post = self._mock_oauth_response
+        self.auth._rust_http_client = self._rust_client
+
+    async def _mock_oauth_response(
+        self,
+        url: str,
+        response_limit: int,
+        headers: Mapping[str, str],
+        request_body: str,
+    ) -> bytes:
+        # get the token from the request body which is form encoded
+        parsed_body = urllib.parse.parse_qs(request_body)
+        token = parsed_body.get("token", [""])[0]
+
+        if not token.startswith("mock_token_"):
+            return bytes(json.dumps({"active": False}).encode("utf-8"))
+        token = token.replace("mock_token_", "")
+
+        username, device_id = token.split("_", 1)
+        user_id = UserID(username, self.hs.hostname)
+        store = self.hs.get_datastores().main
+
+        # Check th user exists in the store
+        user_info = await store.get_user_by_id(user_id=user_id.to_string())
+        if user_info is None:
+            return bytes(json.dumps({"active": False}).encode("utf-8"))
+
+        # Check the device exists in the store
+        device = await store.get_device(
+            user_id=user_id.to_string(), device_id=device_id
+        )
+        if device is None:
+            return bytes(json.dumps({"active": False}).encode("utf-8"))
+
+        return bytes(
+            json.dumps(
+                {
+                    "active": True,
+                    "scope": "urn:matrix:client:device:"
+                    + device_id
+                    + " urn:matrix:client:api:*",
+                    "username": username,
+                }
+            ).encode("utf-8")
+        )
+
+    def register_oauth_user(self, username: str, device_id: str) -> str:
+        # Provision the user and the device
+        store = self.hs.get_datastores().main
+        user_id = UserID(username, self.hs.hostname)
+
+        self.get_success(store.register_user(user_id=user_id.to_string()))
+        self.get_success(
+            store.store_device(
+                user_id=user_id.to_string(),
+                device_id=device_id,
+                initial_device_display_name=None,
+            )
+        )
+        # Generate an access token for the device
+        return "mock_token_" + username + "_" + device_id
+
+    def test_disabled(self) -> None:
+        channel = self.make_request("POST", rz_endpoint, {}, access_token=None)
+        self.assertEqual(channel.code, 404)
+
+    @override_config(
+        {
+            "experimental_features": {
+                "msc4388_mode": "off",
+            },
+        }
+    )
+    def test_off(self) -> None:
+        # Discovery endpoint should return 404
+        channel = self.make_request("GET", rz_endpoint, {}, access_token=None)
+        self.assertEqual(channel.code, 404)
+        # Create session should also fail
+        channel = self.make_request("POST", rz_endpoint, {}, access_token=None)
+        self.assertEqual(channel.code, 404)
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_rendezvous_public(self) -> None:
+        """
+        Test the MSC4108 rendezvous endpoint, including:
+            - Creating a session
+            - Getting the data back
+            - Updating the data
+            - Deleting the data
+            - Sequence token handling
+        """
+        # Discovery should return 200
+        channel = self.make_request("GET", rz_endpoint, {}, access_token=None)
+        self.assertEqual(channel.code, 200)
+        self.assertTrue(channel.json_body.get("create_available"))
+
+        # We can post arbitrary data to the endpoint
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        rendezvous_id = channel.json_body["id"]
+        sequence_token = channel.json_body["sequence_token"]
+        expires_in_ms = channel.json_body["expires_in_ms"]
+        self.assertGreater(expires_in_ms, 0)
+
+        session_endpoint = rz_endpoint + f"/{rendezvous_id}"
+
+        # We can get the data back
+        # Advances clock by 100ms
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(channel.json_body["data"], "foo=bar")
+        self.assertEqual(channel.json_body["sequence_token"], sequence_token)
+        self.assertEqual(channel.json_body["expires_in_ms"], expires_in_ms - 100)
+
+        # We can update the data
+        # Advances clock by 100ms
+        channel = self.make_request(
+            "PUT",
+            session_endpoint,
+            {"sequence_token": sequence_token, "data": "foo=baz"},
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+        old_sequence_token = sequence_token
+        new_sequence_token = channel.json_body["sequence_token"]
+
+        # If we try to update it again with the old etag, it should fail
+        # Advances clock by 100ms
+        channel = self.make_request(
+            "PUT",
+            session_endpoint,
+            {"sequence_token": old_sequence_token, "data": "bar=baz"},
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 409)
+        self.assertEqual(
+            channel.json_body["errcode"], "IO_ELEMENT_MSC4388_CONCURRENT_WRITE"
+        )
+
+        # We should get the updated data
+        # Advances clock by 100ms
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(channel.json_body["data"], "foo=baz")
+        self.assertEqual(channel.json_body["sequence_token"], new_sequence_token)
+        self.assertEqual(channel.json_body["expires_in_ms"], expires_in_ms - 400)
+
+        # We can delete the data
+        channel = self.make_request(
+            "DELETE",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+
+        # If we try to get the data again, it should fail
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 404)
+        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND")
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "authenticated",
+            },
+        }
+    )
+    def test_rendezvous_requires_authentication(self) -> None:
+        """
+        Test the MSC4108 rendezvous endpoint when configured with the mode authenticated, including:
+            - Creating a session
+            - Getting the data back
+            - Updating the data
+            - Deleting the data
+            - Sequence token handling
+        """
+        self.setup_mock_oauth()
+        alice_token = self.register_oauth_user("alice", "device1")
+
+        # Discovery should fail due to lack of authentication
+        channel = self.make_request("GET", rz_endpoint, {}, access_token=None)
+        self.assertEqual(channel.code, 401)
+
+        # Creating a session should fail without authentication:
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 401)
+
+        # Discovery should succeed with authentication
+        channel = self.make_request("GET", rz_endpoint, {}, access_token=alice_token)
+        self.assertEqual(channel.code, 200)
+        self.assertTrue(channel.json_body.get("create_available"))
+
+        # This should work as we are now authenticated
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=alice_token,
+        )
+        self.assertEqual(channel.code, 200)
+        rendezvous_id = channel.json_body["id"]
+        sequence_token = channel.json_body["sequence_token"]
+        expires_in_ms = channel.json_body["expires_in_ms"]
+        self.assertEqual(expires_in_ms, 120000)
+
+        session_endpoint = rz_endpoint + f"/{rendezvous_id}"
+
+        # We can get the data back without authentication
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(channel.json_body["data"], "foo=bar")
+        self.assertEqual(channel.json_body["sequence_token"], sequence_token)
+        self.assertEqual(channel.json_body["expires_in_ms"], expires_in_ms - 100)
+
+        # We can update the data without authentication
+        channel = self.make_request(
+            "PUT",
+            session_endpoint,
+            {"sequence_token": sequence_token, "data": "foo=baz"},
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+        new_sequence_token = channel.json_body["sequence_token"]
+
+        # We should get the updated data without authentication
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(channel.json_body["data"], "foo=baz")
+        self.assertEqual(channel.json_body["sequence_token"], new_sequence_token)
+        self.assertEqual(channel.json_body["expires_in_ms"], expires_in_ms - 300)
+
+        # We can delete the data without authentication
+        channel = self.make_request(
+            "DELETE",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+
+        # If we try to get the data again, it should fail
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 404)
+        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND")
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_expiration(self) -> None:
+        """
+        Test that entries are evicted after a TTL.
+        """
+        # Start a new session
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        session_endpoint = rz_endpoint + "/" + channel.json_body["id"]
+
+        # Sanity check that we can get the data back
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(channel.json_body["data"], "foo=bar")
+
+        # Advance the clock, TTL of entries is 2 minutes
+        self.reactor.advance(120)
+
+        # Get the data back, it should be gone
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 404)
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_capacity(self) -> None:
+        """
+        Test that the soft capacity limit is enforced on the rendezvous sessions, as old
+        entries are evicted at an interval when the limit is reached.
+        """
+        # Start a new session
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        session_endpoint = rz_endpoint + "/" + channel.json_body["id"]
+
+        # Sanity check that we can get the data back
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(channel.json_body["data"], "foo=bar")
+
+        # We advance the clock to make sure that this entry is the "lowest" in the session list
+        self.reactor.advance(1)
+
+        # Start a lot of new sessions
+        for _ in range(100):
+            channel = self.make_request(
+                "POST",
+                rz_endpoint,
+                {"data": "foo=bar"},
+                access_token=None,
+            )
+            self.assertEqual(channel.code, 200)
+
+        # Get the data back, it should still be there, as the eviction hasn't run yet
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+
+        # Advance the clock, as it will trigger the eviction
+        self.reactor.advance(59)
+
+        # Get the data back, it should be gone
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 404)
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_hard_capacity(self) -> None:
+        """
+        Test that the hard capacity limit is enforced on the rendezvous sessions, as old
+        entries are evicted immediately when the limit is reached.
+        """
+        # Start a new session
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        session_endpoint = rz_endpoint + "/" + channel.json_body["id"]
+        # We advance the clock to make sure that this entry is the "lowest" in the session list
+        self.reactor.advance(1)
+
+        # Sanity check that we can get the data back
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        self.assertEqual(channel.json_body["data"], "foo=bar")
+
+        # Start a lot of new sessions
+        for _ in range(200):
+            channel = self.make_request(
+                "POST",
+                rz_endpoint,
+                {"data": "foo=bar"},
+                access_token=None,
+            )
+            self.assertEqual(channel.code, 200)
+
+        # Get the data back, it should already be gone as we hit the hard limit
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 404)
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_data_type(self) -> None:
+        """
+        Test that the data field is restricted to string.
+        """
+        invalid_datas: list[Any] = [123214, ["asd"], {"asd": "asdsad"}, None]
+
+        # We cannot post invalid non-string data field values to the endpoint
+        for invalid_data in invalid_datas:
+            channel = self.make_request(
+                "POST",
+                rz_endpoint,
+                {"data": invalid_data},
+                access_token=None,
+            )
+            self.assertEqual(channel.code, 400)
+            self.assertEqual(channel.json_body["errcode"], "M_INVALID_PARAM")
+
+        # Make a valid request
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "test"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        rendezvous_id = channel.json_body["id"]
+        sequence_token = channel.json_body["sequence_token"]
+
+        session_endpoint = rz_endpoint + f"/{rendezvous_id}"
+
+        # We can't update the data with invalid data
+        for invalid_data in invalid_datas:
+            channel = self.make_request(
+                "PUT",
+                session_endpoint,
+                {"sequence_token": sequence_token, "data": invalid_data},
+                access_token=None,
+            )
+            self.assertEqual(channel.code, 400)
+            self.assertEqual(channel.json_body["errcode"], "M_INVALID_PARAM")
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_max_length(self) -> None:
+        """
+        Test that the data max length is restricted.
+        """
+        too_long_data = "a" * 5000  # MSC4108 specifies 4KB max length
+
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": too_long_data},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 413)
+        self.assertEqual(channel.json_body["errcode"], "M_TOO_LARGE")
+
+        # Make a valid request
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "test"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        rendezvous_id = channel.json_body["id"]
+        sequence_token = channel.json_body["sequence_token"]
+
+        session_endpoint = rz_endpoint + f"/{rendezvous_id}"
+
+        # We can't update the data with invalid data
+        channel = self.make_request(
+            "PUT",
+            session_endpoint,
+            {"sequence_token": sequence_token, "data": too_long_data},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 413)
+        self.assertEqual(channel.json_body["errcode"], "M_TOO_LARGE")
+
+    @parameterized.expand(
+        [
+            ("Sec-Fetch-Dest", "document"),
+            ("Sec-Fetch-Dest", "image"),
+            ("Sec-Fetch-Dest", "iframe"),
+            ("Sec-Fetch-Dest", "embed"),
+            ("Sec-Fetch-Dest", "video"),
+            ("Sec-Fetch-Mode", "navigate"),
+            ("Sec-Fetch-User", "?1"),
+            ("Sec-Fetch-Site", "none"),
+        ]
+    )
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_rendezvous_rejects_unsafe_get_requests(
+        self, header_name: str, header_value: str
+    ) -> None:
+        """
+        Tests that GET requests have the appropriate Sec-Fetch-* controls applied as per the MSC.
+        The mode is set to `public` but this doesn't actually matter.
+        """
+        # We can post arbitrary data to the endpoint
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        rendezvous_id = channel.json_body["id"]
+
+        session_endpoint = rz_endpoint + f"/{rendezvous_id}"
+
+        # We can get the data back
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+            custom_headers=[(header_name, header_value)],
+        )
+        self.assertEqual(channel.code, 403)
+        self.assertEqual(channel.json_body["errcode"], "M_FORBIDDEN")
+
+    @override_config(
+        {
+            "disable_registration": True,
+            "matrix_authentication_service": {
+                "enabled": True,
+                "secret": "secret_value",
+                "endpoint": "https://issuer",
+            },
+            "experimental_features": {
+                "msc4388_mode": "open",
+            },
+        }
+    )
+    def test_rendezvous_allows_from_browser_fetch(self) -> None:
+        """
+        We check that the GET policy does allow for an expected browser fetch
+        The mode is set to `public` but this doesn't actually matter.
+        """
+        # We can post arbitrary data to the endpoint
+        channel = self.make_request(
+            "POST",
+            rz_endpoint,
+            {"data": "foo=bar"},
+            access_token=None,
+        )
+        self.assertEqual(channel.code, 200)
+        rendezvous_id = channel.json_body["id"]
+
+        session_endpoint = rz_endpoint + f"/{rendezvous_id}"
+
+        # We can get the data back
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+        )
+
+        self.assertEqual(channel.code, 200)
+
+        # Test for a typical browser fetch from a client hosted on a different origin
+        channel = self.make_request(
+            "GET",
+            session_endpoint,
+            access_token=None,
+            custom_headers=[
+                ("Sec-Fetch-Dest", "empty"),
+                ("Sec-Fetch-Mode", "cors"),
+                ("Sec-Fetch-Site", "cross-site"),
+            ],
+        )
+
+        self.assertEqual(channel.code, 200)
diff --git a/tests/rest/client/test_mutual_rooms.py b/tests/rest/client/test_mutual_rooms.py
index 2e37284680..cbaca17cdd 100644
--- a/tests/rest/client/test_mutual_rooms.py
+++ b/tests/rest/client/test_mutual_rooms.py
@@ -25,7 +25,7 @@ from twisted.internet.testing import MemoryReactor
 import synapse.rest.admin
 from synapse.rest.client import login, mutual_rooms, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeChannel
@@ -49,12 +49,16 @@ class UserMutualRoomsTest(unittest.HomeserverTestCase):
 
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.store = hs.get_datastores().main
+        mutual_rooms.MUTUAL_ROOMS_BATCH_LIMIT = 10
 
-    def _get_mutual_rooms(self, token: str, other_user: str) -> FakeChannel:
+    def _get_mutual_rooms(
+        self, token: str, other_user: str, since_token: str | None = None
+    ) -> FakeChannel:
         return self.make_request(
             "GET",
-            "/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms"
-            f"?user_id={quote(other_user)}",
+            "/_matrix/client/v1/mutual_rooms"
+            f"?user_id={quote(other_user)}"
+            + (f"&from={quote(since_token)}" if since_token else ""),
             access_token=token,
         )
 
@@ -104,6 +108,7 @@ class UserMutualRoomsTest(unittest.HomeserverTestCase):
         channel = self._get_mutual_rooms(u1_token, u2)
         self.assertEqual(200, channel.code, channel.result)
         self.assertEqual(len(channel.json_body["joined"]), 1)
+        self.assertEqual(channel.json_body["count"], 1)
         self.assertEqual(channel.json_body["joined"][0], room_id_one)
 
         # Create another room and invite user2 to it
@@ -117,9 +122,59 @@ class UserMutualRoomsTest(unittest.HomeserverTestCase):
         channel = self._get_mutual_rooms(u1_token, u2)
         self.assertEqual(200, channel.code, channel.result)
         self.assertEqual(len(channel.json_body["joined"]), 2)
+        self.assertEqual(channel.json_body["count"], 2)
         for room_id_id in channel.json_body["joined"]:
             self.assertIn(room_id_id, [room_id_one, room_id_two])
 
+    def _create_rooms_for_pagination_test(
+        self, count: int
+    ) -> tuple[str, str, list[str]]:
+        u1 = self.register_user("user1", "pass")
+        u1_token = self.login(u1, "pass")
+        u2 = self.register_user("user2", "pass")
+        u2_token = self.login(u2, "pass")
+        room_ids = []
+        for i in range(count):
+            room_id = self.helper.create_room_as(u1, is_public=i % 2 == 0, tok=u1_token)
+            self.helper.invite(room_id, src=u1, targ=u2, tok=u1_token)
+            self.helper.join(room_id, user=u2, tok=u2_token)
+            room_ids.append(room_id)
+        room_ids.sort()
+        return u1_token, u2, room_ids
+
+    def test_shared_room_list_pagination_two_pages(self) -> None:
+        u1_token, u2, room_ids = self._create_rooms_for_pagination_test(15)
+
+        channel = self._get_mutual_rooms(u1_token, u2)
+        self.assertEqual(200, channel.code, channel.result)
+        self.assertEqual(channel.json_body["joined"], room_ids[0:10])
+        self.assertEqual(channel.json_body["count"], 15)
+        self.assertIn("next_batch", channel.json_body)
+
+        channel = self._get_mutual_rooms(u1_token, u2, channel.json_body["next_batch"])
+        self.assertEqual(200, channel.code, channel.result)
+        self.assertEqual(channel.json_body["joined"], room_ids[10:20])
+        self.assertEqual(channel.json_body["count"], 15)
+        self.assertNotIn("next_batch", channel.json_body)
+
+    def test_shared_room_list_pagination_one_page(self) -> None:
+        u1_token, u2, room_ids = self._create_rooms_for_pagination_test(10)
+
+        channel = self._get_mutual_rooms(u1_token, u2)
+        self.assertEqual(200, channel.code, channel.result)
+        self.assertEqual(channel.json_body["joined"], room_ids)
+        self.assertEqual(channel.json_body["count"], 10)
+        self.assertNotIn("next_batch", channel.json_body)
+
+    def test_shared_room_list_pagination_invalid_token(self) -> None:
+        u1_token, u2, room_ids = self._create_rooms_for_pagination_test(10)
+
+        channel = self._get_mutual_rooms(u1_token, u2, "!<>##faketoken")
+        self.assertEqual(400, channel.code, channel.result)
+        self.assertEqual(
+            "M_INVALID_PARAM", channel.json_body["errcode"], channel.result
+        )
+
     def test_shared_room_list_after_leave(self) -> None:
         """
         A room should no longer be considered shared if the other
@@ -138,6 +193,7 @@ class UserMutualRoomsTest(unittest.HomeserverTestCase):
         channel = self._get_mutual_rooms(u1_token, u2)
         self.assertEqual(200, channel.code, channel.result)
         self.assertEqual(len(channel.json_body["joined"]), 1)
+        self.assertEqual(channel.json_body["count"], 1)
         self.assertEqual(channel.json_body["joined"][0], room)
 
         self.helper.leave(room, user=u1, tok=u1_token)
@@ -146,8 +202,44 @@ class UserMutualRoomsTest(unittest.HomeserverTestCase):
         channel = self._get_mutual_rooms(u1_token, u2)
         self.assertEqual(200, channel.code, channel.result)
         self.assertEqual(len(channel.json_body["joined"]), 0)
+        self.assertEqual(channel.json_body["count"], 0)
 
         # Check user2's view of shared rooms with user1
         channel = self._get_mutual_rooms(u2_token, u1)
         self.assertEqual(200, channel.code, channel.result)
         self.assertEqual(len(channel.json_body["joined"]), 0)
+        self.assertEqual(channel.json_body["count"], 0)
+
+    def test_shared_room_list_nonexistent_user(self) -> None:
+        u1 = self.register_user("user1", "pass")
+        u1_token = self.login(u1, "pass")
+
+        # Check shared rooms from user1's perspective.
+        # We should see the one room in common
+        channel = self._get_mutual_rooms(u1_token, "@meow:example.com")
+        self.assertEqual(200, channel.code, channel.result)
+        self.assertEqual(len(channel.json_body["joined"]), 0)
+        self.assertEqual(channel.json_body["count"], 0)
+        self.assertNotIn("next_batch", channel.json_body)
+
+    def test_shared_room_list_invalid_user(self) -> None:
+        u1 = self.register_user("user1", "pass")
+        u1_token = self.login(u1, "pass")
+
+        channel = self._get_mutual_rooms(u1_token, "@:example.com")
+        self.assertEqual(400, channel.code, channel.result)
+        self.assertEqual(
+            "M_INVALID_PARAM", channel.json_body["errcode"], channel.result
+        )
+
+        channel = self._get_mutual_rooms(u1_token, "@" + "a" * 255 + ":example.com")
+        self.assertEqual(400, channel.code, channel.result)
+        self.assertEqual(
+            "M_INVALID_PARAM", channel.json_body["errcode"], channel.result
+        )
+
+        channel = self._get_mutual_rooms(u1_token, "@🐈️:example.com")
+        self.assertEqual(400, channel.code, channel.result)
+        self.assertEqual(
+            "M_INVALID_PARAM", channel.json_body["errcode"], channel.result
+        )
diff --git a/tests/rest/client/test_notifications.py b/tests/rest/client/test_notifications.py
index ec66567817..17f8da3e8b 100644
--- a/tests/rest/client/test_notifications.py
+++ b/tests/rest/client/test_notifications.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional, Tuple
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -26,7 +25,7 @@ from twisted.internet.testing import MemoryReactor
 import synapse.rest.admin
 from synapse.rest.client import login, notifications, receipts, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -155,8 +154,8 @@ class HTTPPusherTests(HomeserverTestCase):
         self.assertEqual(notification_event_ids, sent_event_ids[2:])
 
     def _request_notifications(
-        self, from_token: Optional[str], limit: int, expected_count: int
-    ) -> Tuple[List[str], str]:
+        self, from_token: str | None, limit: int, expected_count: int
+    ) -> tuple[list[str], str]:
         """
         Make a request to /notifications to get the latest events to be notified about.
 
diff --git a/tests/rest/client/test_owned_state.py b/tests/rest/client/test_owned_state.py
index 386b95d616..f927d74c37 100644
--- a/tests/rest/client/test_owned_state.py
+++ b/tests/rest/client/test_owned_state.py
@@ -10,7 +10,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/rest/client/test_password_policy.py b/tests/rest/client/test_password_policy.py
index 33bab684e3..5e98d8f1fd 100644
--- a/tests/rest/client/test_password_policy.py
+++ b/tests/rest/client/test_password_policy.py
@@ -28,7 +28,7 @@ from synapse.api.errors import Codes
 from synapse.rest import admin
 from synapse.rest.client import account, login, password_policy, register
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_power_levels.py b/tests/rest/client/test_power_levels.py
index 39ea9acef6..41610891fc 100644
--- a/tests/rest/client/test_power_levels.py
+++ b/tests/rest/client/test_power_levels.py
@@ -27,7 +27,7 @@ from synapse.events.utils import CANONICALJSON_MAX_INT, CANONICALJSON_MIN_INT
 from synapse.rest import admin
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/rest/client/test_presence.py b/tests/rest/client/test_presence.py
index 7138cc92c2..5256c933e0 100644
--- a/tests/rest/client/test_presence.py
+++ b/tests/rest/client/test_presence.py
@@ -26,7 +26,7 @@ from synapse.handlers.presence import PresenceHandler
 from synapse.rest.client import presence
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
diff --git a/tests/rest/client/test_profile.py b/tests/rest/client/test_profile.py
index 936e573bcd..023a376ed1 100644
--- a/tests/rest/client/test_profile.py
+++ b/tests/rest/client/test_profile.py
@@ -24,7 +24,7 @@
 import logging
 import urllib.parse
 from http import HTTPStatus
-from typing import Any, Dict, Optional
+from typing import Any
 
 from canonicaljson import encode_canonical_json
 
@@ -36,7 +36,7 @@ from synapse.rest.client import login, profile, room
 from synapse.server import HomeServer
 from synapse.storage.databases.main.profile import MAX_PROFILE_SIZE
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.utils import USE_POSTGRES_FOR_TESTS
@@ -177,7 +177,7 @@ class ProfileTestCase(unittest.HomeserverTestCase):
         )
         self.assertEqual(channel.code, 400, channel.result)
 
-    def _get_displayname(self, name: Optional[str] = None) -> Optional[str]:
+    def _get_displayname(self, name: str | None = None) -> str | None:
         channel = self.make_request(
             "GET", "/profile/%s/displayname" % (name or self.owner,)
         )
@@ -187,7 +187,7 @@ class ProfileTestCase(unittest.HomeserverTestCase):
         # https://github.com/matrix-org/synapse/issues/13137.
         return channel.json_body.get("displayname")
 
-    def _get_avatar_url(self, name: Optional[str] = None) -> Optional[str]:
+    def _get_avatar_url(self, name: str | None = None) -> str | None:
         channel = self.make_request(
             "GET", "/profile/%s/avatar_url" % (name or self.owner,)
         )
@@ -778,7 +778,7 @@ class ProfileTestCase(unittest.HomeserverTestCase):
         self.assertEqual(channel.code, 403, channel.result)
         self.assertEqual(channel.json_body["errcode"], Codes.FORBIDDEN)
 
-    def _setup_local_files(self, names_and_props: Dict[str, Dict[str, Any]]) -> None:
+    def _setup_local_files(self, names_and_props: dict[str, dict[str, Any]]) -> None:
         """Stores metadata about files in the database.
 
         Args:
@@ -846,7 +846,7 @@ class ProfilesRestrictedTestCase(unittest.HomeserverTestCase):
         self.try_fetch_profile(200, self.requester_tok)
 
     def try_fetch_profile(
-        self, expected_code: int, access_token: Optional[str] = None
+        self, expected_code: int, access_token: str | None = None
     ) -> None:
         self.request_profile(expected_code, access_token=access_token)
 
@@ -862,7 +862,7 @@ class ProfilesRestrictedTestCase(unittest.HomeserverTestCase):
         self,
         expected_code: int,
         url_suffix: str = "",
-        access_token: Optional[str] = None,
+        access_token: str | None = None,
     ) -> None:
         channel = self.make_request(
             "GET", self.profile_url + url_suffix, access_token=access_token
diff --git a/tests/rest/client/test_push_rule_attrs.py b/tests/rest/client/test_push_rule_attrs.py
index 9da0e7982f..53c36b7a9c 100644
--- a/tests/rest/client/test_push_rule_attrs.py
+++ b/tests/rest/client/test_push_rule_attrs.py
@@ -18,6 +18,8 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
+from http import HTTPStatus
+
 import synapse
 from synapse.api.errors import Codes
 from synapse.rest.client import login, push_rule, room
@@ -486,3 +488,23 @@ class PushRuleAttributesTestCase(HomeserverTestCase):
             },
             channel.json_body,
         )
+
+    def test_no_user_defined_postcontent_rules(self) -> None:
+        """
+        Tests that clients are not permitted to create MSC4306 `postcontent` rules.
+        """
+        self.register_user("bob", "pass")
+        token = self.login("bob", "pass")
+
+        channel = self.make_request(
+            "PUT",
+            "/pushrules/global/postcontent/some.user.rule",
+            {},
+            access_token=token,
+        )
+
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST)
+        self.assertEqual(
+            Codes.INVALID_PARAM,
+            channel.json_body["errcode"],
+        )
diff --git a/tests/rest/client/test_read_marker.py b/tests/rest/client/test_read_marker.py
index a27eb9453b..c8bb0da5e6 100644
--- a/tests/rest/client/test_read_marker.py
+++ b/tests/rest/client/test_read_marker.py
@@ -25,7 +25,7 @@ from synapse.api.constants import EventTypes
 from synapse.rest import admin
 from synapse.rest.client import login, read_marker, register, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_receipts.py b/tests/rest/client/test_receipts.py
index ae4818c412..3a6a869c54 100644
--- a/tests/rest/client/test_receipts.py
+++ b/tests/rest/client/test_receipts.py
@@ -19,7 +19,6 @@
 #
 #
 from http import HTTPStatus
-from typing import Optional
 
 from twisted.internet.testing import MemoryReactor
 
@@ -28,7 +27,7 @@ from synapse.api.constants import EduTypes, EventTypes, HistoryVisibility, Recei
 from synapse.rest.client import login, receipts, room, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -259,7 +258,7 @@ class ReceiptsTestCase(unittest.HomeserverTestCase):
         self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST)
         self.assertEqual(channel.json_body["errcode"], "M_NOT_JSON", channel.json_body)
 
-    def _get_read_receipt(self) -> Optional[JsonDict]:
+    def _get_read_receipt(self) -> JsonDict | None:
         """Syncs and returns the read receipt."""
 
         # Checks if event is a read receipt
diff --git a/tests/rest/client/test_redactions.py b/tests/rest/client/test_redactions.py
index d435a9e393..997ca5f9ca 100644
--- a/tests/rest/client/test_redactions.py
+++ b/tests/rest/client/test_redactions.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional
 
 from parameterized import parameterized
 
@@ -32,7 +31,7 @@ from synapse.server import HomeServer
 from synapse.storage._base import db_to_json
 from synapse.storage.database import LoggingTransaction
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase, override_config
 
@@ -85,8 +84,8 @@ class RedactionsTestCase(HomeserverTestCase):
         room_id: str,
         event_id: str,
         expect_code: int = 200,
-        with_relations: Optional[List[str]] = None,
-        content: Optional[JsonDict] = None,
+        with_relations: list[str] | None = None,
+        content: JsonDict | None = None,
     ) -> JsonDict:
         """Helper function to send a redaction event.
 
@@ -104,7 +103,7 @@ class RedactionsTestCase(HomeserverTestCase):
         self.assertEqual(channel.code, expect_code)
         return channel.json_body
 
-    def _sync_room_timeline(self, access_token: str, room_id: str) -> List[JsonDict]:
+    def _sync_room_timeline(self, access_token: str, room_id: str) -> list[JsonDict]:
         channel = self.make_request("GET", "sync", access_token=access_token)
         self.assertEqual(channel.code, 200)
         room_sync = channel.json_body["rooms"]["join"][room_id]
diff --git a/tests/rest/client/test_register.py b/tests/rest/client/test_register.py
index f0745cf298..f66c56a6b1 100644
--- a/tests/rest/client/test_register.py
+++ b/tests/rest/client/test_register.py
@@ -20,12 +20,11 @@
 #
 #
 import datetime
+import importlib.resources as importlib_resources
 import os
-from typing import Any, Dict, List, Tuple
+from typing import Any, cast
 from unittest.mock import AsyncMock
 
-import pkg_resources
-
 from twisted.internet.testing import MemoryReactor
 
 import synapse.rest.admin
@@ -40,7 +39,7 @@ from synapse.rest.client import account, account_validity, login, logout, regist
 from synapse.server import HomeServer
 from synapse.storage._base import db_to_json
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import ThreadedMemoryReactorClock
@@ -55,7 +54,7 @@ class RegisterRestServletTestCase(unittest.HomeserverTestCase):
     ]
     url = b"/_matrix/client/r0/register"
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["allow_guest_access"] = True
         return config
@@ -67,6 +66,17 @@ class RegisterRestServletTestCase(unittest.HomeserverTestCase):
         hs.get_send_email_handler()._sendmail = AsyncMock()
         return hs
 
+    def _get_sendmail_mock(self) -> AsyncMock:
+        """
+        Cast the homeserver's `_sendmail` object as an `AsyncMock`.
+
+        `_sendmail` is an `AsyncMock` (see `make_homeserver`) but this type
+        information doesn't make it through the test harness. Thus we need to
+        cast the object again.
+        """
+        sendmail = self.hs.get_send_email_handler()._sendmail
+        return cast(AsyncMock, sendmail)
+
     def test_POST_appservice_registration_valid(self) -> None:
         user_id = "@as_user_kermit:test"
         as_token = "i_am_an_app_service"
@@ -137,6 +147,7 @@ class RegisterRestServletTestCase(unittest.HomeserverTestCase):
         request_data = {
             "username": "as_user_kermit",
             "type": APP_SERVICE_REGISTRATION_TYPE,
+            "inhibit_login": True,
         }
 
         channel = self.make_request(
@@ -148,6 +159,34 @@ class RegisterRestServletTestCase(unittest.HomeserverTestCase):
         self.assertLessEqual(det_data.items(), channel.json_body.items())
         self.assertNotIn("access_token", channel.json_body)
 
+    def test_POST_appservice_msc4190_enabled_fail(self) -> None:
+        # With MSC4190 enabled, the registration should fail unless inhibit_login is set
+        as_token = "i_am_an_app_service"
+
+        appservice = ApplicationService(
+            as_token,
+            id="1234",
+            namespaces={"users": [{"regex": r"@as_user.*", "exclusive": True}]},
+            sender=UserID.from_string("@as:test"),
+            msc4190_device_management=True,
+        )
+
+        self.hs.get_datastores().main.services_cache.append(appservice)
+        request_data = {
+            "username": "as_user_kermit",
+            "type": APP_SERVICE_REGISTRATION_TYPE,
+        }
+
+        channel = self.make_request(
+            b"POST", self.url + b"?access_token=i_am_an_app_service", request_data
+        )
+        self.assertEqual(channel.code, 400, channel.json_body)
+        self.assertEqual(
+            channel.json_body.get("errcode"),
+            Codes.APPSERVICE_LOGIN_UNSUPPORTED,
+            channel.json_body,
+        )
+
     def test_POST_bad_password(self) -> None:
         request_data = {"username": "kermit", "password": 666}
         channel = self.make_request(b"POST", self.url, request_data)
@@ -719,6 +758,33 @@ class RegisterRestServletTestCase(unittest.HomeserverTestCase):
 
         self.assertIsNotNone(channel.json_body.get("sid"))
 
+    @unittest.override_config(
+        {
+            "public_baseurl": "https://test_server",
+            "email": {
+                "smtp_host": "mail_server",
+                "smtp_port": 2525,
+                "notif_from": "sender@host",
+            },
+        }
+    )
+    def test_request_token_allowed_when_email_flow_is_advertised(self) -> None:
+        sendmail = self._get_sendmail_mock()
+        sendmail.reset_mock()
+
+        channel = self.make_request(
+            "POST",
+            b"register/email/requestToken",
+            {
+                "client_secret": "foobar",
+                "email": "test@example.com",
+                "send_attempt": 1,
+            },
+        )
+        self.assertEqual(200, channel.code, channel.result)
+        self.assertIsNotNone(channel.json_body.get("sid"))
+        sendmail.assert_awaited_once()
+
     @unittest.override_config(
         {
             "public_baseurl": "https://test_server",
@@ -981,11 +1047,12 @@ class AccountValidityRenewalByEmailTestCase(unittest.HomeserverTestCase):
 
         # Email config.
 
+        templates = (
+            importlib_resources.files("synapse").joinpath("res").joinpath("templates")
+        )
         config["email"] = {
             "enable_notifs": True,
-            "template_dir": os.path.abspath(
-                pkg_resources.resource_filename("synapse", "res/templates")
-            ),
+            "template_dir": os.path.abspath(str(templates)),
             "expiry_template_html": "notice_expiry.html",
             "expiry_template_text": "notice_expiry.txt",
             "notif_template_html": "notif_mail.html",
@@ -1003,7 +1070,7 @@ class AccountValidityRenewalByEmailTestCase(unittest.HomeserverTestCase):
         async def sendmail(*args: Any, **kwargs: Any) -> None:
             self.email_attempts.append((args, kwargs))
 
-        self.email_attempts: List[Tuple[Any, Any]] = []
+        self.email_attempts: list[tuple[Any, Any]] = []
         self.hs.get_send_email_handler()._sendmail = sendmail
 
         self.store = self.hs.get_datastores().main
@@ -1117,7 +1184,7 @@ class AccountValidityRenewalByEmailTestCase(unittest.HomeserverTestCase):
 
         self.assertEqual(len(self.email_attempts), 0)
 
-    def create_user(self) -> Tuple[str, str]:
+    def create_user(self) -> tuple[str, str]:
         user_id = self.register_user("kermit", "monkey")
         tok = self.login("kermit", "monkey")
         # We need to manually add an email address otherwise the handler will do
@@ -1221,7 +1288,7 @@ class RegistrationTokenValidityRestServletTestCase(unittest.HomeserverTestCase):
     servlets = [register.register_servlets]
     url = "/_matrix/client/v1/register/m.login.registration_token/validity"
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
         config["registration_requires_token"] = True
         return config
diff --git a/tests/rest/client/test_relations.py b/tests/rest/client/test_relations.py
index fd1e87296c..2d8ba77a77 100644
--- a/tests/rest/client/test_relations.py
+++ b/tests/rest/client/test_relations.py
@@ -20,7 +20,7 @@
 #
 
 import urllib.parse
-from typing import Any, Callable, Dict, List, Optional, Tuple
+from typing import Any, Callable
 from unittest.mock import AsyncMock, patch
 
 from twisted.internet.testing import MemoryReactor
@@ -30,7 +30,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, register, relations, room, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeChannel
@@ -48,7 +48,7 @@ class BaseRelationsTestCase(unittest.HomeserverTestCase):
     ]
     hijack_auth = False
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         # We need to enable msc1849 support for aggregations
         config = super().default_config()
 
@@ -69,7 +69,7 @@ class BaseRelationsTestCase(unittest.HomeserverTestCase):
         res = self.helper.send(self.room, body="Hi!", tok=self.user_token)
         self.parent_id = res["event_id"]
 
-    def _create_user(self, localpart: str) -> Tuple[str, str]:
+    def _create_user(self, localpart: str) -> tuple[str, str]:
         user_id = self.register_user(localpart, "abc123")
         access_token = self.login(localpart, "abc123")
 
@@ -79,10 +79,10 @@ class BaseRelationsTestCase(unittest.HomeserverTestCase):
         self,
         relation_type: str,
         event_type: str,
-        key: Optional[str] = None,
-        content: Optional[dict] = None,
-        access_token: Optional[str] = None,
-        parent_id: Optional[str] = None,
+        key: str | None = None,
+        content: dict | None = None,
+        access_token: str | None = None,
+        parent_id: str | None = None,
         expected_response_code: int = 200,
     ) -> FakeChannel:
         """Helper function to send a relation pointing at `self.parent_id`
@@ -123,7 +123,7 @@ class BaseRelationsTestCase(unittest.HomeserverTestCase):
         self.assertEqual(expected_response_code, channel.code, channel.json_body)
         return channel
 
-    def _get_related_events(self) -> List[str]:
+    def _get_related_events(self) -> list[str]:
         """
         Requests /relations on the parent ID and returns a list of event IDs.
         """
@@ -149,7 +149,7 @@ class BaseRelationsTestCase(unittest.HomeserverTestCase):
         self.assertEqual(200, channel.code, channel.json_body)
         return channel.json_body["unsigned"].get("m.relations", {})
 
-    def _find_event_in_chunk(self, events: List[JsonDict]) -> JsonDict:
+    def _find_event_in_chunk(self, events: list[JsonDict]) -> JsonDict:
         """
         Find the parent event in a chunk of events and assert that it has the proper bundled aggregations.
         """
@@ -845,8 +845,8 @@ class RelationPaginationTestCase(BaseRelationsTestCase):
             )
             expected_event_ids.append(channel.json_body["event_id"])
 
-        prev_token: Optional[str] = ""
-        found_event_ids: List[str] = []
+        prev_token: str | None = ""
+        found_event_ids: list[str] = []
         for _ in range(20):
             from_token = ""
             if prev_token:
@@ -1085,7 +1085,7 @@ class BundledAggregationsTestCase(BaseRelationsTestCase):
         relation_type: str,
         assertion_callable: Callable[[JsonDict], None],
         expected_db_txn_for_event: int,
-        access_token: Optional[str] = None,
+        access_token: str | None = None,
     ) -> None:
         """
         Makes requests to various endpoints which should include bundled aggregations
@@ -1484,9 +1484,9 @@ class RelationIgnoredUserTestCase(BaseRelationsTestCase):
     def _test_ignored_user(
         self,
         relation_type: str,
-        allowed_event_ids: List[str],
-        ignored_event_ids: List[str],
-    ) -> Tuple[JsonDict, JsonDict]:
+        allowed_event_ids: list[str],
+        ignored_event_ids: list[str],
+    ) -> tuple[JsonDict, JsonDict]:
         """
         Fetch the relations and ensure they're all there, then ignore user2, and
         repeat.
@@ -1600,7 +1600,7 @@ class RelationRedactionTestCase(BaseRelationsTestCase):
         )
         self.assertEqual(200, channel.code, channel.json_body)
 
-    def _get_threads(self) -> List[Tuple[str, str]]:
+    def _get_threads(self) -> list[tuple[str, str]]:
         """Request the threads in the room and returns a list of thread ID and latest event ID."""
         # Request the threads in the room.
         channel = self.make_request(
@@ -1793,7 +1793,7 @@ class RelationRedactionTestCase(BaseRelationsTestCase):
 
 
 class ThreadsTestCase(BaseRelationsTestCase):
-    def _get_threads(self, body: JsonDict) -> List[Tuple[str, str]]:
+    def _get_threads(self, body: JsonDict) -> list[tuple[str, str]]:
         return [
             (
                 ev["event_id"],
diff --git a/tests/rest/client/test_rendezvous.py b/tests/rest/client/test_rendezvous.py
index 01401f73da..dc4f833fa2 100644
--- a/tests/rest/client/test_rendezvous.py
+++ b/tests/rest/client/test_rendezvous.py
@@ -19,7 +19,6 @@
 #
 #
 
-from typing import Dict
 from urllib.parse import urlparse
 
 from twisted.internet.testing import MemoryReactor
@@ -28,7 +27,7 @@ from twisted.web.resource import Resource
 from synapse.rest.client import rendezvous
 from synapse.rest.synapse.client.rendezvous import MSC4108RendezvousSessionResource
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -46,7 +45,7 @@ class RendezvousServletTestCase(unittest.HomeserverTestCase):
         self.hs = self.setup_test_homeserver()
         return self.hs
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         return {
             **super().create_resource_dict(),
             "/_synapse/client/rendezvous": MSC4108RendezvousSessionResource(self.hs),
diff --git a/tests/rest/client/test_reporting.py b/tests/rest/client/test_reporting.py
index 5e5af34b42..96697b96d5 100644
--- a/tests/rest/client/test_reporting.py
+++ b/tests/rest/client/test_reporting.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Optional
 
 from twisted.internet.testing import MemoryReactor
 
@@ -26,7 +25,7 @@ import synapse.rest.admin
 from synapse.rest.client import login, reporting, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -311,7 +310,7 @@ class ReportUserTestCase(unittest.HomeserverTestCase):
         self.assertEqual(len(rows), 0)
 
     def _assert_status(
-        self, response_status: int, data: JsonDict, user_id: Optional[str] = None
+        self, response_status: int, data: JsonDict, user_id: str | None = None
     ) -> None:
         if user_id is None:
             user_id = self.target_user_id
diff --git a/tests/rest/client/test_retention.py b/tests/rest/client/test_retention.py
index 24b007f779..82a3b5b337 100644
--- a/tests/rest/client/test_retention.py
+++ b/tests/rest/client/test_retention.py
@@ -17,7 +17,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict
+from typing import Any
 from unittest.mock import Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -27,8 +27,8 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, create_requester
-from synapse.util import Clock
-from synapse.visibility import filter_events_for_client
+from synapse.util.clock import Clock
+from synapse.visibility import filter_and_transform_events_for_client
 
 from tests import unittest
 from tests.unittest import override_config
@@ -163,7 +163,7 @@ class RetentionTestCase(unittest.HomeserverTestCase):
         )
         self.assertEqual(2, len(events), "events retrieved from database")
         filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 storage_controllers,
                 self.user_id,
                 events,
@@ -265,7 +265,7 @@ class RetentionNoDefaultPolicyTestCase(unittest.HomeserverTestCase):
         room.register_servlets,
     ]
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         retention_config = {
diff --git a/tests/rest/client/test_rooms.py b/tests/rest/client/test_rooms.py
index 24a28fbdd2..221121007d 100644
--- a/tests/rest/client/test_rooms.py
+++ b/tests/rest/client/test_rooms.py
@@ -25,7 +25,7 @@
 
 import json
 from http import HTTPStatus
-from typing import Any, Dict, Iterable, List, Literal, Optional, Tuple, Union
+from typing import Any, Iterable, Literal
 from unittest.mock import AsyncMock, Mock, call, patch
 from urllib import parse as urlparse
 
@@ -60,7 +60,7 @@ from synapse.rest.client import (
 )
 from synapse.server import HomeServer
 from synapse.types import JsonDict, RoomAlias, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 from tests import unittest
@@ -74,7 +74,7 @@ PATH_PREFIX = b"/_matrix/client/api/v1"
 
 
 class RoomBase(unittest.HomeserverTestCase):
-    rmcreator_id: Optional[str] = None
+    rmcreator_id: str | None = None
 
     servlets = [room.register_servlets, room.register_deprecated_servlets]
 
@@ -959,7 +959,7 @@ class RoomsCreateTestCase(RoomBase):
         """Tests that the user_may_join_room spam checker callback is correctly bypassed
         when creating a new room.
 
-        In this test, we use the more recent API in which callbacks return a `Union[Codes, Literal["NOT_SPAM"]]`.
+        In this test, we use the more recent API in which callbacks return a `Codes | Literal["NOT_SPAM"]`.
         """
 
         async def user_may_join_room_codes(
@@ -989,7 +989,7 @@ class RoomsCreateTestCase(RoomBase):
             mxid: str,
             room_id: str,
             is_invite: bool,
-        ) -> Tuple[Codes, dict]:
+        ) -> tuple[Codes, dict]:
             return Codes.INCOMPATIBLE_ROOM_VERSION, {}
 
         join_mock.side_effect = user_may_join_room_tuple
@@ -1002,7 +1002,7 @@ class RoomsCreateTestCase(RoomBase):
         self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
         self.assertEqual(join_mock.call_count, 0)
 
-    def _create_basic_room(self) -> Tuple[int, object]:
+    def _create_basic_room(self) -> tuple[int, object]:
         """
         Tries to create a basic room and returns the response code.
         """
@@ -1351,7 +1351,7 @@ class RoomJoinTestCase(RoomBase):
         """
 
         # Register a dummy callback. Make it allow all room joins for now.
-        return_value: Union[Literal["NOT_SPAM"], Tuple[Codes, dict], Codes] = (
+        return_value: Literal["NOT_SPAM"] | tuple[Codes, dict] | Codes = (
             synapse.module_api.NOT_SPAM
         )
 
@@ -1359,7 +1359,7 @@ class RoomJoinTestCase(RoomBase):
             userid: str,
             room_id: str,
             is_invited: bool,
-        ) -> Union[Literal["NOT_SPAM"], Tuple[Codes, dict], Codes]:
+        ) -> Literal["NOT_SPAM"] | tuple[Codes, dict] | Codes:
             return return_value
 
         # `spec` argument is needed for this function mock to have `__qualname__`, which
@@ -1848,20 +1848,20 @@ class RoomMessagesTestCase(RoomBase):
     def test_spam_checker_check_event_for_spam(
         self,
         name: str,
-        value: Union[str, bool, Codes, Tuple[Codes, JsonDict]],
+        value: str | bool | Codes | tuple[Codes, JsonDict],
         expected_code: int,
         expected_fields: dict,
     ) -> None:
         class SpamCheck:
-            mock_return_value: Union[str, bool, Codes, Tuple[Codes, JsonDict], bool] = (
+            mock_return_value: str | bool | Codes | tuple[Codes, JsonDict] | bool = (
                 "NOT_SPAM"
             )
-            mock_content: Optional[JsonDict] = None
+            mock_content: JsonDict | None = None
 
             async def check_event_for_spam(
                 self,
                 event: synapse.events.EventBase,
-            ) -> Union[str, Codes, Tuple[Codes, JsonDict], bool]:
+            ) -> str | Codes | tuple[Codes, JsonDict] | bool:
                 self.mock_content = event.content
                 return self.mock_return_value
 
@@ -1915,7 +1915,7 @@ class RoomPowerLevelOverridesTestCase(RoomBase):
         self.admin_user_id = self.register_user("admin", "pass")
         self.admin_access_token = self.login("admin", "pass")
 
-    def power_levels(self, room_id: str) -> Dict[str, Any]:
+    def power_levels(self, room_id: str) -> dict[str, Any]:
         return self.helper.get_state(
             room_id, "m.room.power_levels", self.admin_access_token
         )
@@ -2076,7 +2076,7 @@ class RoomPowerLevelOverridesInPracticeTestCase(RoomBase):
         # Given the server has config allowing normal users to post my event type
         # And I am a normal member of a room
         # But the room was created with special permissions
-        extra_content: Dict[str, Any] = {
+        extra_content: dict[str, Any] = {
             "power_level_content_override": {"events": {}},
         }
         room_id = self.helper.create_room_as(
@@ -2245,7 +2245,7 @@ class RoomMessageListTestCase(RoomBase):
         self.room_id = self.helper.create_room_as(self.user_id)
 
     def test_topo_token_is_accepted(self) -> None:
-        token = "t1-0_0_0_0_0_0_0_0_0_0"
+        token = "t1-0_0_0_0_0_0_0_0_0_0_0_0"
         channel = self.make_request(
             "GET", "/rooms/%s/messages?access_token=x&from=%s" % (self.room_id, token)
         )
@@ -2256,7 +2256,7 @@ class RoomMessageListTestCase(RoomBase):
         self.assertTrue("end" in channel.json_body)
 
     def test_stream_token_is_accepted_for_fwd_pagianation(self) -> None:
-        token = "s0_0_0_0_0_0_0_0_0_0"
+        token = "s0_0_0_0_0_0_0_0_0_0_0_0"
         channel = self.make_request(
             "GET", "/rooms/%s/messages?access_token=x&from=%s" % (self.room_id, token)
         )
@@ -2707,9 +2707,9 @@ class PublicRoomsRoomTypeFilterTestCase(unittest.HomeserverTestCase):
 
     def make_public_rooms_request(
         self,
-        room_types: Optional[List[Union[str, None]]],
-        instance_id: Optional[str] = None,
-    ) -> Tuple[List[Dict[str, Any]], int]:
+        room_types: list[str | None] | None,
+        instance_id: str | None = None,
+    ) -> tuple[list[dict[str, Any]], int]:
         body: JsonDict = {"filter": {PublicRoomsFilterFields.ROOM_TYPES: room_types}}
         if instance_id:
             body["third_party_instance_id"] = "test|test"
@@ -3470,7 +3470,7 @@ class LabelsTestCase(unittest.HomeserverTestCase):
 
 
 class RelationsTestCase(PaginationTestCase):
-    def _filter_messages(self, filter: JsonDict) -> List[str]:
+    def _filter_messages(self, filter: JsonDict) -> list[str]:
         """Make a request to /messages with a filter, returns the chunk of events."""
         from_token = self.get_success(
             self.from_token.to_string(self.hs.get_datastores().main)
@@ -3880,9 +3880,11 @@ class RoomCanonicalAliasTestCase(unittest.HomeserverTestCase):
         self._set_canonical_alias({"alt_aliases": False}, expected_code=400)
         self._set_canonical_alias({"alt_aliases": True}, expected_code=400)
         self._set_canonical_alias({"alt_aliases": {}}, expected_code=400)
+        self._set_canonical_alias({"alt_aliases": [0]}, expected_code=400)
 
     def test_bad_alias(self) -> None:
         """An alias which does not point to the room raises a SynapseError."""
+        self._set_canonical_alias({"alias": {"@unknown:test": "a"}}, expected_code=400)
         self._set_canonical_alias({"alias": "@unknown:test"}, expected_code=400)
         self._set_canonical_alias({"alt_aliases": ["@unknown:test"]}, expected_code=400)
 
@@ -3968,7 +3970,7 @@ class ThreepidInviteTestCase(unittest.HomeserverTestCase):
         """
         Test allowing/blocking threepid invites with a spam-check module.
 
-        In this test, we use the more recent API in which callbacks return a `Union[Codes, Literal["NOT_SPAM"]]`.
+        In this test, we use the more recent API in which callbacks return a `Codes | Literal["NOT_SPAM"]`.
         """
         # Mock a few functions to prevent the test from failing due to failing to talk to
         # a remote IS. We keep the mock for make_and_store_3pid_invite around so we
@@ -4529,10 +4531,10 @@ class MSC4293RedactOnBanKickTestCase(unittest.FederatingHomeserverTestCase):
 
     def _check_redactions(
         self,
-        original_events: List[EventBase],
-        pulled_events: List[JsonDict],
+        original_events: list[EventBase],
+        pulled_events: list[JsonDict],
         expect_redaction: bool,
-        reason: Optional[str] = None,
+        reason: str | None = None,
     ) -> None:
         """
         Checks a set of original events against a second set of the same events, pulled
@@ -4744,10 +4746,10 @@ class MSC4293RedactOnBanKickTestCase(unittest.FederatingHomeserverTestCase):
             original = self.get_success(self.store.get_event(message.event_id))
             if not original:
                 self.fail("Expected to find remote message in DB")
-            redacted_because = original.unsigned.get("redacted_because")
-            if not redacted_because:
-                self.fail("Did not find redacted_because field")
-            self.assertEqual(redacted_because.event_id, ban_event_id)
+            redacted_by = original.internal_metadata.redacted_by
+            if not redacted_by:
+                self.fail("Did not find redacted_by field")
+            self.assertEqual(redacted_by, ban_event_id)
 
     def test_unbanning_remote_user_stops_redaction_action(self) -> None:
         bad_user = "@remote_bad_user:" + self.OTHER_SERVER_NAME
@@ -5109,7 +5111,7 @@ class MSC4293RedactOnBanKickTestCase(unittest.FederatingHomeserverTestCase):
             original = self.get_success(self.store.get_event(message.event_id))
             if not original:
                 self.fail("Expected to find remote message in DB")
-            self.assertEqual(original.unsigned["redacted_by"], ban_event_id)
+            self.assertEqual(original.internal_metadata.redacted_by, ban_event_id)
 
     def test_rejoining_kicked_remote_user_stops_redaction_action(self) -> None:
         bad_user = "@remote_bad_user:" + self.OTHER_SERVER_NAME
diff --git a/tests/rest/client/test_sendtodevice.py b/tests/rest/client/test_sendtodevice.py
index 5ef501c6d5..56533d85f5 100644
--- a/tests/rest/client/test_sendtodevice.py
+++ b/tests/rest/client/test_sendtodevice.py
@@ -18,27 +18,13 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from parameterized import parameterized_class
-
 from synapse.api.constants import EduTypes
 from synapse.rest import admin
 from synapse.rest.client import login, sendtodevice, sync
-from synapse.types import JsonDict
 
 from tests.unittest import HomeserverTestCase, override_config
 
 
-@parameterized_class(
-    ("sync_endpoint", "experimental_features"),
-    [
-        ("/sync", {}),
-        (
-            "/_matrix/client/unstable/org.matrix.msc3575/sync/e2ee",
-            # Enable sliding sync
-            {"msc3575_enabled": True},
-        ),
-    ],
-)
 class SendToDeviceTestCase(HomeserverTestCase):
     """
     Test `/sendToDevice` will deliver messages across to people receiving them over `/sync`.
@@ -48,9 +34,6 @@ class SendToDeviceTestCase(HomeserverTestCase):
         experimental_features: The experimental features homeserver config to use.
     """
 
-    sync_endpoint: str
-    experimental_features: JsonDict
-
     servlets = [
         admin.register_servlets,
         login.register_servlets,
@@ -58,11 +41,6 @@ class SendToDeviceTestCase(HomeserverTestCase):
         sync.register_servlets,
     ]
 
-    def default_config(self) -> JsonDict:
-        config = super().default_config()
-        config["experimental_features"] = self.experimental_features
-        return config
-
     def test_user_to_user(self) -> None:
         """A to-device message from one user to another should get delivered"""
 
@@ -83,7 +61,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
         self.assertEqual(chan.code, 200, chan.result)
 
         # check it appears
-        channel = self.make_request("GET", self.sync_endpoint, access_token=user2_tok)
+        channel = self.make_request("GET", "/sync", access_token=user2_tok)
         self.assertEqual(channel.code, 200, channel.result)
         expected_result = {
             "events": [
@@ -99,7 +77,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
         # it should re-appear if we do another sync because the to-device message is not
         # deleted until we acknowledge it by sending a `?since=...` parameter in the
         # next sync request corresponding to the `next_batch` value from the response.
-        channel = self.make_request("GET", self.sync_endpoint, access_token=user2_tok)
+        channel = self.make_request("GET", "/sync", access_token=user2_tok)
         self.assertEqual(channel.code, 200, channel.result)
         self.assertEqual(channel.json_body["to_device"], expected_result)
 
@@ -107,7 +85,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
         sync_token = channel.json_body["next_batch"]
         channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={sync_token}",
+            f"/sync?since={sync_token}",
             access_token=user2_tok,
         )
         self.assertEqual(channel.code, 200, channel.result)
@@ -133,7 +111,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
             self.assertEqual(chan.code, 200, chan.result)
 
         # now sync: we should get two of the three (because burst_count=2)
-        channel = self.make_request("GET", self.sync_endpoint, access_token=user2_tok)
+        channel = self.make_request("GET", "/sync", access_token=user2_tok)
         self.assertEqual(channel.code, 200, channel.result)
         msgs = channel.json_body["to_device"]["events"]
         self.assertEqual(len(msgs), 2)
@@ -163,7 +141,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
         # ... which should arrive
         channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={sync_token}",
+            f"/sync?since={sync_token}",
             access_token=user2_tok,
         )
         self.assertEqual(channel.code, 200, channel.result)
@@ -198,7 +176,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
             )
 
         # now sync: we should get two of the three
-        channel = self.make_request("GET", self.sync_endpoint, access_token=user2_tok)
+        channel = self.make_request("GET", "/sync", access_token=user2_tok)
         self.assertEqual(channel.code, 200, channel.result)
         msgs = channel.json_body["to_device"]["events"]
         self.assertEqual(len(msgs), 2)
@@ -233,7 +211,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
         # ... which should arrive
         channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={sync_token}",
+            f"/sync?since={sync_token}",
             access_token=user2_tok,
         )
         self.assertEqual(channel.code, 200, channel.result)
@@ -258,7 +236,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
         user2_tok = self.login("u2", "pass", "d2")
 
         # Do an initial sync
-        channel = self.make_request("GET", self.sync_endpoint, access_token=user2_tok)
+        channel = self.make_request("GET", "/sync", access_token=user2_tok)
         self.assertEqual(channel.code, 200, channel.result)
         sync_token = channel.json_body["next_batch"]
 
@@ -275,7 +253,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
 
         channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={sync_token}&timeout=300000",
+            f"/sync?since={sync_token}&timeout=300000",
             access_token=user2_tok,
         )
         self.assertEqual(channel.code, 200, channel.result)
@@ -285,7 +263,7 @@ class SendToDeviceTestCase(HomeserverTestCase):
 
         channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={sync_token}&timeout=300000",
+            f"/sync?since={sync_token}&timeout=300000",
             access_token=user2_tok,
         )
         self.assertEqual(channel.code, 200, channel.result)
diff --git a/tests/rest/client/test_shadow_banned.py b/tests/rest/client/test_shadow_banned.py
index b990a8600b..bb240b943e 100644
--- a/tests/rest/client/test_shadow_banned.py
+++ b/tests/rest/client/test_shadow_banned.py
@@ -34,7 +34,7 @@ from synapse.rest.client import (
 )
 from synapse.server import HomeServer
 from synapse.types import UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_sticky_events.py b/tests/rest/client/test_sticky_events.py
new file mode 100644
index 0000000000..a6e704fe8c
--- /dev/null
+++ b/tests/rest/client/test_sticky_events.py
@@ -0,0 +1,179 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+#
+
+import sqlite3
+
+from twisted.internet.testing import MemoryReactor
+
+from synapse.api.constants import EventTypes, EventUnsignedContentFields
+from synapse.rest import admin
+from synapse.rest.client import login, register, room
+from synapse.server import HomeServer
+from synapse.types import JsonDict
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+
+from tests import unittest
+from tests.utils import USE_POSTGRES_FOR_TESTS
+
+
+class StickyEventsClientTestCase(unittest.HomeserverTestCase):
+    """
+    Tests for the client-server API parts of MSC4354: Sticky Events
+    """
+
+    if not USE_POSTGRES_FOR_TESTS and sqlite3.sqlite_version_info < (3, 40, 0):
+        # We need the JSON functionality in SQLite
+        skip = f"SQLite version is too old to support sticky events: {sqlite3.sqlite_version_info} (See https://github.com/element-hq/synapse/issues/19428)"
+
+    servlets = [
+        room.register_servlets,
+        login.register_servlets,
+        register.register_servlets,
+        admin.register_servlets,
+    ]
+
+    def default_config(self) -> JsonDict:
+        config = super().default_config()
+        config["experimental_features"] = {"msc4354_enabled": True}
+        return config
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        # Register an account
+        self.user_id = self.register_user("user1", "pass")
+        self.token = self.login(self.user_id, "pass")
+
+        # Create a room
+        self.room_id = self.helper.create_room_as(self.user_id, tok=self.token)
+
+    def _assert_event_sticky_for(self, event_id: str, sticky_ttl: int) -> None:
+        channel = self.make_request(
+            "GET",
+            f"/rooms/{self.room_id}/event/{event_id}",
+            access_token=self.token,
+        )
+
+        self.assertEqual(
+            channel.code, 200, f"could not retrieve event {event_id}: {channel.result}"
+        )
+        event = channel.json_body
+
+        self.assertIn(
+            EventUnsignedContentFields.STICKY_TTL,
+            event["unsigned"],
+            f"No {EventUnsignedContentFields.STICKY_TTL} field in {event_id}; event not sticky: {event}",
+        )
+        self.assertEqual(
+            event["unsigned"][EventUnsignedContentFields.STICKY_TTL],
+            sticky_ttl,
+            f"{event_id} had an unexpected sticky TTL: {event}",
+        )
+
+    def _assert_event_not_sticky(self, event_id: str) -> None:
+        channel = self.make_request(
+            "GET",
+            f"/rooms/{self.room_id}/event/{event_id}",
+            access_token=self.token,
+        )
+
+        self.assertEqual(
+            channel.code, 200, f"could not retrieve event {event_id}: {channel.result}"
+        )
+        event = channel.json_body
+
+        self.assertNotIn(
+            EventUnsignedContentFields.STICKY_TTL,
+            event["unsigned"],
+            f"{EventUnsignedContentFields.STICKY_TTL} field unexpectedly found in {event_id}: {event}",
+        )
+
+    def test_sticky_event_via_event_endpoint(self) -> None:
+        # Arrange: Send a sticky event with a specific duration
+        sticky_event_response = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "sticky message", "msgtype": "m.text"},
+            tok=self.token,
+        )
+        event_id = sticky_event_response["event_id"]
+
+        # If we request the event immediately, it will still have
+        # 1 minute of stickiness
+        # The other 100 ms is advanced in FakeChannel.await_result.
+        self._assert_event_sticky_for(event_id, 59_900)
+
+        # But if we advance time by 59.799 seconds...
+        # we will get the event on its last millisecond of stickiness
+        # The other 100 ms is advanced in FakeChannel.await_result.
+        self.reactor.advance(59.799)
+        self._assert_event_sticky_for(event_id, 1)
+
+        # Advancing time any more, the event is no longer sticky
+        self.reactor.advance(0.001)
+        self._assert_event_not_sticky(event_id)
+
+
+class StickyEventsDisabledClientTestCase(unittest.HomeserverTestCase):
+    """
+    Tests client-facing behaviour of MSC4354: Sticky Events when the feature is
+    disabled.
+    """
+
+    servlets = [
+        room.register_servlets,
+        login.register_servlets,
+        register.register_servlets,
+        admin.register_servlets,
+    ]
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        # Register an account
+        self.user_id = self.register_user("user1", "pass")
+        self.token = self.login(self.user_id, "pass")
+
+        # Create a room
+        self.room_id = self.helper.create_room_as(self.user_id, tok=self.token)
+
+    def _assert_event_not_sticky(self, event_id: str) -> None:
+        channel = self.make_request(
+            "GET",
+            f"/rooms/{self.room_id}/event/{event_id}",
+            access_token=self.token,
+        )
+
+        self.assertEqual(
+            channel.code, 200, f"could not retrieve event {event_id}: {channel.result}"
+        )
+        event = channel.json_body
+
+        self.assertNotIn(
+            EventUnsignedContentFields.STICKY_TTL,
+            event["unsigned"],
+            f"{EventUnsignedContentFields.STICKY_TTL} field unexpectedly found in {event_id}: {event}",
+        )
+
+    def test_sticky_event_via_event_endpoint(self) -> None:
+        sticky_event_response = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "sticky message", "msgtype": "m.text"},
+            tok=self.token,
+        )
+        event_id = sticky_event_response["event_id"]
+
+        # Since the feature is disabled, the event isn't sticky
+        self._assert_event_not_sticky(event_id)
diff --git a/tests/rest/client/test_sync.py b/tests/rest/client/test_sync.py
index e612df3be9..e6ada1adb2 100644
--- a/tests/rest/client/test_sync.py
+++ b/tests/rest/client/test_sync.py
@@ -20,9 +20,8 @@
 #
 import json
 import logging
-from typing import List
 
-from parameterized import parameterized, parameterized_class
+from parameterized import parameterized
 
 from twisted.internet.testing import MemoryReactor
 
@@ -36,12 +35,13 @@ from synapse.api.constants import (
 from synapse.rest.client import devices, knock, login, read_marker, receipts, room, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.federation.transport.test_knocking import (
     KnockingStrippedStateEventHelperMixin,
 )
+from tests.rest.client.test_rooms import make_request_with_cancellation_test
 from tests.server import TimedOutException
 
 logger = logging.getLogger(__name__)
@@ -131,7 +131,7 @@ class SyncFilterTestCase(unittest.HomeserverTestCase):
         self.assertEqual(len(events), 1, [event["content"] for event in events])
         self.assertEqual(events[0]["content"]["body"], "with wrong label", events[0])
 
-    def _test_sync_filter_labels(self, sync_filter: str) -> List[JsonDict]:
+    def _test_sync_filter_labels(self, sync_filter: str) -> list[JsonDict]:
         user_id = self.register_user("kermit", "test")
         tok = self.login("kermit", "test")
 
@@ -702,29 +702,11 @@ class SyncCacheTestCase(unittest.HomeserverTestCase):
         self.assertEqual(channel.code, 200, channel.json_body)
 
 
-@parameterized_class(
-    ("sync_endpoint", "experimental_features"),
-    [
-        ("/sync", {}),
-        (
-            "/_matrix/client/unstable/org.matrix.msc3575/sync/e2ee",
-            # Enable sliding sync
-            {"msc3575_enabled": True},
-        ),
-    ],
-)
 class DeviceListSyncTestCase(unittest.HomeserverTestCase):
     """
     Tests regarding device list (`device_lists`) changes.
-
-    Attributes:
-        sync_endpoint: The endpoint under test to use for syncing.
-        experimental_features: The experimental features homeserver config to use.
     """
 
-    sync_endpoint: str
-    experimental_features: JsonDict
-
     servlets = [
         synapse.rest.admin.register_servlets,
         login.register_servlets,
@@ -733,11 +715,6 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         devices.register_servlets,
     ]
 
-    def default_config(self) -> JsonDict:
-        config = super().default_config()
-        config["experimental_features"] = self.experimental_features
-        return config
-
     def test_receiving_local_device_list_changes(self) -> None:
         """Tests that a local users that share a room receive each other's device list
         changes.
@@ -767,7 +744,7 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         # Now have Bob initiate an initial sync (in order to get a since token)
         channel = self.make_request(
             "GET",
-            self.sync_endpoint,
+            "/sync",
             access_token=bob_access_token,
         )
         self.assertEqual(channel.code, 200, channel.json_body)
@@ -777,7 +754,7 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         # which we hope will happen as a result of Alice updating their device list.
         bob_sync_channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={next_batch_token}&timeout=30000",
+            f"/sync?since={next_batch_token}&timeout=30000",
             access_token=bob_access_token,
             # Start the request, then continue on.
             await_result=False,
@@ -824,7 +801,7 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         # Have Bob initiate an initial sync (in order to get a since token)
         channel = self.make_request(
             "GET",
-            self.sync_endpoint,
+            "/sync",
             access_token=bob_access_token,
         )
         self.assertEqual(channel.code, 200, channel.json_body)
@@ -834,7 +811,7 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         # which we hope will happen as a result of Alice updating their device list.
         bob_sync_channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={next_batch_token}&timeout=1000",
+            f"/sync?since={next_batch_token}&timeout=1000",
             access_token=bob_access_token,
             # Start the request, then continue on.
             await_result=False,
@@ -873,9 +850,7 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         )
 
         # Request an initial sync
-        channel = self.make_request(
-            "GET", self.sync_endpoint, access_token=alice_access_token
-        )
+        channel = self.make_request("GET", "/sync", access_token=alice_access_token)
         self.assertEqual(channel.code, 200, channel.json_body)
         next_batch = channel.json_body["next_batch"]
 
@@ -883,7 +858,7 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         # It won't return until something has happened
         incremental_sync_channel = self.make_request(
             "GET",
-            f"{self.sync_endpoint}?since={next_batch}&timeout=30000",
+            f"/sync?since={next_batch}&timeout=30000",
             access_token=alice_access_token,
             await_result=False,
         )
@@ -913,17 +888,6 @@ class DeviceListSyncTestCase(unittest.HomeserverTestCase):
         )
 
 
-@parameterized_class(
-    ("sync_endpoint", "experimental_features"),
-    [
-        ("/sync", {}),
-        (
-            "/_matrix/client/unstable/org.matrix.msc3575/sync/e2ee",
-            # Enable sliding sync
-            {"msc3575_enabled": True},
-        ),
-    ],
-)
 class DeviceOneTimeKeysSyncTestCase(unittest.HomeserverTestCase):
     """
     Tests regarding device one time keys (`device_one_time_keys_count`) changes.
@@ -933,9 +897,6 @@ class DeviceOneTimeKeysSyncTestCase(unittest.HomeserverTestCase):
         experimental_features: The experimental features homeserver config to use.
     """
 
-    sync_endpoint: str
-    experimental_features: JsonDict
-
     servlets = [
         synapse.rest.admin.register_servlets,
         login.register_servlets,
@@ -943,11 +904,6 @@ class DeviceOneTimeKeysSyncTestCase(unittest.HomeserverTestCase):
         devices.register_servlets,
     ]
 
-    def default_config(self) -> JsonDict:
-        config = super().default_config()
-        config["experimental_features"] = self.experimental_features
-        return config
-
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.e2e_keys_handler = hs.get_e2e_keys_handler()
 
@@ -964,9 +920,7 @@ class DeviceOneTimeKeysSyncTestCase(unittest.HomeserverTestCase):
         )
 
         # Request an initial sync
-        channel = self.make_request(
-            "GET", self.sync_endpoint, access_token=alice_access_token
-        )
+        channel = self.make_request("GET", "/sync", access_token=alice_access_token)
         self.assertEqual(channel.code, 200, channel.json_body)
 
         # Check for those one time key counts
@@ -1011,9 +965,7 @@ class DeviceOneTimeKeysSyncTestCase(unittest.HomeserverTestCase):
         )
 
         # Request an initial sync
-        channel = self.make_request(
-            "GET", self.sync_endpoint, access_token=alice_access_token
-        )
+        channel = self.make_request("GET", "/sync", access_token=alice_access_token)
         self.assertEqual(channel.code, 200, channel.json_body)
 
         # Check for those one time key counts
@@ -1024,17 +976,6 @@ class DeviceOneTimeKeysSyncTestCase(unittest.HomeserverTestCase):
         )
 
 
-@parameterized_class(
-    ("sync_endpoint", "experimental_features"),
-    [
-        ("/sync", {}),
-        (
-            "/_matrix/client/unstable/org.matrix.msc3575/sync/e2ee",
-            # Enable sliding sync
-            {"msc3575_enabled": True},
-        ),
-    ],
-)
 class DeviceUnusedFallbackKeySyncTestCase(unittest.HomeserverTestCase):
     """
     Tests regarding device one time keys (`device_unused_fallback_key_types`) changes.
@@ -1044,9 +985,6 @@ class DeviceUnusedFallbackKeySyncTestCase(unittest.HomeserverTestCase):
         experimental_features: The experimental features homeserver config to use.
     """
 
-    sync_endpoint: str
-    experimental_features: JsonDict
-
     servlets = [
         synapse.rest.admin.register_servlets,
         login.register_servlets,
@@ -1054,11 +992,6 @@ class DeviceUnusedFallbackKeySyncTestCase(unittest.HomeserverTestCase):
         devices.register_servlets,
     ]
 
-    def default_config(self) -> JsonDict:
-        config = super().default_config()
-        config["experimental_features"] = self.experimental_features
-        return config
-
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.store = self.hs.get_datastores().main
         self.e2e_keys_handler = hs.get_e2e_keys_handler()
@@ -1078,9 +1011,7 @@ class DeviceUnusedFallbackKeySyncTestCase(unittest.HomeserverTestCase):
         )
 
         # Request an initial sync
-        channel = self.make_request(
-            "GET", self.sync_endpoint, access_token=alice_access_token
-        )
+        channel = self.make_request("GET", "/sync", access_token=alice_access_token)
         self.assertEqual(channel.code, 200, channel.json_body)
 
         # Check for those one time key counts
@@ -1122,9 +1053,7 @@ class DeviceUnusedFallbackKeySyncTestCase(unittest.HomeserverTestCase):
         self.assertEqual(fallback_res, ["alg1"], fallback_res)
 
         # Request an initial sync
-        channel = self.make_request(
-            "GET", self.sync_endpoint, access_token=alice_access_token
-        )
+        channel = self.make_request("GET", "/sync", access_token=alice_access_token)
         self.assertEqual(channel.code, 200, channel.json_body)
 
         # Check for the unused fallback key types
@@ -1217,3 +1146,65 @@ class ExcludeRoomTestCase(unittest.HomeserverTestCase):
 
         self.assertNotIn(self.excluded_room_id, channel.json_body["rooms"]["join"])
         self.assertIn(self.included_room_id, channel.json_body["rooms"]["join"])
+
+
+class SyncCancellationTestCase(unittest.HomeserverTestCase):
+    servlets = [
+        synapse.rest.admin.register_servlets,
+        login.register_servlets,
+        sync.register_servlets,
+        room.register_servlets,
+    ]
+
+    def test_initial_sync(self) -> None:
+        """Tests that an initial sync request can be cancelled."""
+        user_id = self.register_user("user", "password")
+        tok = self.login("user", "password")
+
+        # Populate the account with a few rooms
+        for _ in range(5):
+            room_id = self.helper.create_room_as(user_id, tok=tok)
+            self.helper.send(room_id, tok=tok)
+
+        channel = make_request_with_cancellation_test(
+            "test_initial_sync",
+            self.reactor,
+            self.site,
+            "GET",
+            "/_matrix/client/v3/sync",
+            token=tok,
+        )
+
+        self.assertEqual(200, channel.code, msg=channel.result["body"])
+
+    def test_incremental_sync(self) -> None:
+        """Tests that an incremental sync request can be cancelled."""
+        user_id = self.register_user("user", "password")
+        tok = self.login("user", "password")
+
+        # Populate the account with a few rooms
+        room_ids = []
+        for _ in range(5):
+            room_id = self.helper.create_room_as(user_id, tok=tok)
+            self.helper.send(room_id, tok=tok)
+            room_ids.append(room_id)
+
+        # Do an initial sync to get a since token.
+        channel = self.make_request("GET", "/sync", access_token=tok)
+        self.assertEqual(200, channel.code, msg=channel.result)
+        since = channel.json_body["next_batch"]
+
+        # Send some more messages to generate activity in the rooms.
+        for room_id in room_ids:
+            self.helper.send(room_id, tok=tok)
+
+        channel = make_request_with_cancellation_test(
+            "test_incremental_sync",
+            self.reactor,
+            self.site,
+            "GET",
+            f"/_matrix/client/v3/sync?since={since}&timeout=10000",
+            token=tok,
+        )
+
+        self.assertEqual(200, channel.code, msg=channel.result["body"])
diff --git a/tests/rest/client/test_sync_sticky_events.py b/tests/rest/client/test_sync_sticky_events.py
new file mode 100644
index 0000000000..7a38debdb9
--- /dev/null
+++ b/tests/rest/client/test_sync_sticky_events.py
@@ -0,0 +1,529 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026, Element Creations Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+import json
+import sqlite3
+from dataclasses import dataclass
+from unittest.mock import patch
+from urllib.parse import quote
+
+from twisted.internet.testing import MemoryReactor
+
+from synapse.api.constants import EventTypes, EventUnsignedContentFields, StickyEvent
+from synapse.rest import admin
+from synapse.rest.client import account_data, login, register, room, sync
+from synapse.server import HomeServer
+from synapse.types import JsonDict
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+
+from tests import unittest
+from tests.utils import USE_POSTGRES_FOR_TESTS
+
+
+class SyncStickyEventsTestCase(unittest.HomeserverTestCase):
+    """
+    Tests for oldschool (v3) /sync with sticky events (MSC4354)
+    """
+
+    if not USE_POSTGRES_FOR_TESTS and sqlite3.sqlite_version_info < (3, 40, 0):
+        # We need the JSON functionality in SQLite
+        skip = f"SQLite version is too old to support sticky events: {sqlite3.sqlite_version_info} (See https://github.com/element-hq/synapse/issues/19428)"
+
+    servlets = [
+        room.register_servlets,
+        login.register_servlets,
+        register.register_servlets,
+        admin.register_servlets,
+        sync.register_servlets,
+        account_data.register_servlets,
+    ]
+
+    def default_config(self) -> JsonDict:
+        config = super().default_config()
+        config["experimental_features"] = {"msc4354_enabled": True}
+        return config
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        # Register an account
+        self.user_id = self.register_user("user1", "pass")
+        self.token = self.login(self.user_id, "pass")
+
+        # Create a room
+        self.room_id = self.helper.create_room_as(self.user_id, tok=self.token)
+
+    def test_single_sticky_event_appears_in_initial_sync(self) -> None:
+        """
+        Test sending a single sticky event and then doing an initial /sync.
+        """
+
+        # Send a sticky event
+        sticky_event_response = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "sticky message", "msgtype": "m.text"},
+            tok=self.token,
+        )
+        sticky_event_id = sticky_event_response["event_id"]
+
+        # Perform initial sync
+        channel = self.make_request(
+            "GET",
+            "/sync",
+            access_token=self.token,
+        )
+
+        self.assertEqual(channel.code, 200, channel.result)
+
+        # Get timeline events from the sync response
+        timeline_events = channel.json_body["rooms"]["join"][self.room_id]["timeline"][
+            "events"
+        ]
+
+        # Verify the sticky event is present and has the sticky TTL field
+        self.assertEqual(
+            timeline_events[-1]["event_id"],
+            sticky_event_id,
+            f"Sticky event {sticky_event_id} not found in sync timeline",
+        )
+        self.assertEqual(
+            timeline_events[-1]["unsigned"][EventUnsignedContentFields.STICKY_TTL],
+            # The other 100 ms is advanced in FakeChannel.await_result.
+            59_900,
+        )
+
+        self.assertNotIn(
+            "sticky",
+            channel.json_body["rooms"]["join"][self.room_id],
+            "Unexpected sticky section of sync response (sticky event should be deduplicated)",
+        )
+
+    def test_sticky_event_beyond_timeline_in_initial_sync(self) -> None:
+        """
+        Test that when sending a sticky event which is subsequently
+        pushed out of the timeline window by other messages,
+        the sticky event comes down the dedicated sticky section of the sync response.
+        """
+        # Send the first sticky event
+        first_sticky_response = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "first sticky", "msgtype": "m.text"},
+            tok=self.token,
+        )
+        first_sticky_event_id = first_sticky_response["event_id"]
+
+        # Send 10 regular timeline events,
+        # in order to push the sticky event out of the timeline window
+        # that the /sync will get.
+        regular_event_ids = []
+        for i in range(10):
+            # (Note: each one advances time by 100ms)
+            response = self.helper.send(
+                room_id=self.room_id,
+                body=f"regular message {i}",
+                tok=self.token,
+            )
+            regular_event_ids.append(response["event_id"])
+
+        # Send another sticky event
+        # (Note: this advances time by 100ms)
+        second_sticky_response = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "second sticky", "msgtype": "m.text"},
+            tok=self.token,
+        )
+        second_sticky_event_id = second_sticky_response["event_id"]
+
+        # Perform initial sync
+        channel = self.make_request(
+            "GET",
+            "/sync",
+            access_token=self.token,
+        )
+        self.assertEqual(channel.code, 200, channel.result)
+
+        # Get timeline events from the sync response
+        timeline_events = channel.json_body["rooms"]["join"][self.room_id]["timeline"][
+            "events"
+        ]
+        timeline_event_ids = [event["event_id"] for event in timeline_events]
+        sticky_events = channel.json_body["rooms"]["join"][self.room_id][
+            "msc4354_sticky"
+        ]["events"]
+
+        # This is canary to check the test setup is valid and that we're actually excluding the sticky event
+        # because it's outside the timeline window, not for some other potential reason.
+        self.assertNotIn(
+            regular_event_ids[0],
+            timeline_event_ids,
+            f"First regular event {regular_event_ids[0]} unexpectedly found in sync timeline (this means our test is invalid)",
+        )
+
+        # Assertions for the first sticky event: should be only in sticky section
+        self.assertNotIn(
+            first_sticky_event_id,
+            timeline_event_ids,
+            f"First sticky event {first_sticky_event_id} unexpectedly found in sync timeline (expected it to be outside the timeline window)",
+        )
+        self.assertEqual(
+            len(sticky_events),
+            1,
+            f"Expected exactly 1 item in sticky events section, got {sticky_events}",
+        )
+        self.assertEqual(sticky_events[0]["event_id"], first_sticky_event_id)
+        self.assertEqual(
+            # The 'missing' 1100 ms were elapsed when sending events
+            sticky_events[0]["unsigned"][EventUnsignedContentFields.STICKY_TTL],
+            58_800,
+        )
+
+        # Assertions for the second sticky event: should be only in timeline section
+        self.assertEqual(
+            timeline_events[-1]["event_id"],
+            second_sticky_event_id,
+            f"Second sticky event {second_sticky_event_id} not found in sync timeline",
+        )
+        self.assertEqual(
+            timeline_events[-1]["unsigned"][EventUnsignedContentFields.STICKY_TTL],
+            # The other 100 ms is advanced in FakeChannel.await_result.
+            59_900,
+        )
+        # (sticky section: we already checked it only has 1 item and
+        # that item was the first above)
+
+    def test_sticky_event_filtered_from_timeline_appears_in_sticky_section(
+        self,
+    ) -> None:
+        """
+        Test that a sticky event which is excluded from the timeline by a timeline filter
+        still appears in the sticky section of the sync response.
+
+        > Interaction with RoomFilter: The RoomFilter does not apply to the sticky.events section,
+        > as it is neither timeline nor state. However, the timeline filter MUST be applied before
+        > applying the deduplication logic above. In other words, if a sticky event would normally
+        > appear in both the timeline.events section and the sticky.events section, but is filtered
+        > out by the timeline filter, the sticky event MUST appear in sticky.events.
+        > — https://github.com/matrix-org/matrix-spec-proposals/blob/4340903c15e9eab1bfb2f6a31cfa08fd535f7e7c/proposals/4354-sticky-events.md#sync-api-changes
+        """
+        # A filter that excludes message events
+        filter_json = json.dumps(
+            {
+                "room": {
+                    # We only want these io.element.example events
+                    "timeline": {"types": ["io.element.example"]},
+                }
+            }
+        )
+
+        # Send a sticky message event (will be filtered by our filter)
+        sticky_event_id = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "sticky message", "msgtype": "m.text"},
+            tok=self.token,
+        )["event_id"]
+
+        # Send a non-message event (will pass the filter)
+        nonmessage_event_id = self.helper.send_event(
+            room_id=self.room_id,
+            type="io.element.example",
+            content={"membership": "join"},
+            tok=self.token,
+        )["event_id"]
+
+        # Perform initial sync with our filter
+        channel = self.make_request(
+            "GET",
+            f"/sync?filter={quote(filter_json)}",
+            access_token=self.token,
+        )
+        self.assertEqual(channel.code, 200, channel.result)
+
+        # Get timeline and sticky events from the sync response
+        timeline_events = channel.json_body["rooms"]["join"][self.room_id]["timeline"][
+            "events"
+        ]
+        sticky_events = channel.json_body["rooms"]["join"][self.room_id][
+            "msc4354_sticky"
+        ]["events"]
+
+        # Extract event IDs from the timeline
+        timeline_event_ids = [event["event_id"] for event in timeline_events]
+
+        # The sticky message event should NOT be in the timeline (filtered out)
+        self.assertNotIn(
+            sticky_event_id,
+            timeline_event_ids,
+            f"Sticky message event {sticky_event_id} should be filtered from timeline",
+        )
+
+        # The member event should be in the timeline
+        self.assertIn(
+            nonmessage_event_id,
+            timeline_event_ids,
+            f"Non-message event {nonmessage_event_id} should be in timeline",
+        )
+
+        # The sticky message event MUST appear in the sticky section
+        # because it was filtered from the timeline
+        received_sticky_event_ids = [e["event_id"] for e in sticky_events]
+        self.assertEqual(
+            received_sticky_event_ids,
+            [sticky_event_id],
+        )
+
+    def test_ignored_users_sticky_events(self) -> None:
+        """
+        Test that sticky events from ignored users are not delivered to clients.
+
+        > As with normal events, sticky events sent by ignored users MUST NOT be
+        > delivered to clients.
+        > — https://github.com/matrix-org/matrix-spec-proposals/blob/4340903c15e9eab1bfb2f6a31cfa08fd535f7e7c/proposals/4354-sticky-events.md#sync-api-changes
+        """
+        # Register a second user who will be ignored
+        user2_id = self.register_user("user2", "pass")
+        user2_token = self.login(user2_id, "pass")
+
+        # Join user2 to the room
+        self.helper.join(self.room_id, user2_id, tok=user2_token)
+
+        # User1 ignores user2
+        channel = self.make_request(
+            "PUT",
+            f"/_matrix/client/v3/user/{self.user_id}/account_data/m.ignored_user_list",
+            {"ignored_users": {user2_id: {}}},
+            access_token=self.token,
+        )
+        self.assertEqual(channel.code, 200, channel.result)
+
+        # User2 sends a sticky event
+        sticky_response = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "sticky from ignored user", "msgtype": "m.text"},
+            tok=user2_token,
+        )
+        sticky_event_id = sticky_response["event_id"]
+
+        # User1 syncs
+        channel = self.make_request(
+            "GET",
+            "/sync",
+            access_token=self.token,
+        )
+        self.assertEqual(channel.code, 200, channel.result)
+
+        # Check timeline events - should not include the sticky event from ignored user
+        timeline_events = channel.json_body["rooms"]["join"][self.room_id]["timeline"][
+            "events"
+        ]
+        timeline_event_ids = [event["event_id"] for event in timeline_events]
+
+        self.assertNotIn(
+            sticky_event_id,
+            timeline_event_ids,
+            f"Sticky event from ignored user {sticky_event_id} should not be in timeline",
+        )
+
+        # Check sticky events section - should also not include the event
+        sticky_events = (
+            channel.json_body["rooms"]["join"][self.room_id]
+            .get("msc4354_sticky", {})
+            .get("events", [])
+        )
+
+        sticky_event_ids = [event["event_id"] for event in sticky_events]
+
+        self.assertNotIn(
+            sticky_event_id,
+            sticky_event_ids,
+            f"Sticky event from ignored user {sticky_event_id} should not be in sticky section",
+        )
+
+    def test_history_visibility_bypass_for_sticky_events(self) -> None:
+        """
+        Test that joined users can see sticky events even when history visibility
+        is set to "joined" and they joined after the event was sent.
+        This is required by MSC4354: "History visibility checks MUST NOT
+        be applied to sticky events. Any joined user is authorised to see
+        sticky events for the duration they remain sticky."
+        """
+        # Create a new room with restricted history visibility
+        room_id = self.helper.create_room_as(
+            self.user_id,
+            tok=self.token,
+            extra_content={
+                # Anyone can join
+                "preset": "public_chat",
+                # But you can't see history before you joined
+                "initial_state": [
+                    {
+                        "type": EventTypes.RoomHistoryVisibility,
+                        "state_key": "",
+                        "content": {"history_visibility": "joined"},
+                    }
+                ],
+            },
+            is_public=False,
+        )
+
+        # User1 sends a sticky event
+        sticky_event_id = self.helper.send_sticky_event(
+            room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=5),
+            content={"body": "sticky message", "msgtype": "m.text"},
+            tok=self.token,
+        )["event_id"]
+
+        # User1 also sends a regular event, to verify our test setup
+        regular_event_id = self.helper.send(
+            room_id=room_id,
+            body="regular message",
+            tok=self.token,
+        )["event_id"]
+
+        # Register and join a second user after the sticky event was sent
+        user2_id = self.register_user("user2", "pass")
+        user2_token = self.login(user2_id, "pass")
+        self.helper.join(room_id, user2_id, tok=user2_token)
+
+        # User2 syncs - they should see the sticky event even though
+        # history visibility is "joined" and they joined after it was sent
+        channel = self.make_request(
+            "GET",
+            "/sync",
+            access_token=user2_token,
+        )
+        self.assertEqual(channel.code, 200, channel.result)
+
+        # Get sticky events from the sync response
+        sticky_events = channel.json_body["rooms"]["join"][room_id]["msc4354_sticky"][
+            "events"
+        ]
+        sticky_event_ids = [event["event_id"] for event in sticky_events]
+
+        # The sticky event should be visible to user2
+        self.assertEqual(
+            [sticky_event_id],
+            sticky_event_ids,
+            f"Sticky event {sticky_event_id} should be visible despite history visibility",
+        )
+
+        # Also check that the regular (non-sticky) event sent at the same time
+        # is NOT visible. This is to verify our test setup.
+        timeline_events = channel.json_body["rooms"]["join"][room_id]["timeline"][
+            "events"
+        ]
+        timeline_event_ids = [event["event_id"] for event in timeline_events]
+
+        # The regular message should NOT be visible (history visibility = joined)
+        self.assertNotIn(
+            regular_event_id,
+            timeline_event_ids,
+            f"Expecting to not see regular event ({regular_event_id}) before user1 joined.",
+        )
+
+    @patch.object(StickyEvent, "MAX_EVENTS_IN_SYNC", 3)
+    def test_pagination_with_many_sticky_events(self) -> None:
+        """
+        Test that pagination works correctly when there are more sticky events than
+        the intended limit.
+
+        The MSC doesn't define a limit or how to set one.
+        See thread: https://github.com/matrix-org/matrix-spec-proposals/pull/4354#discussion_r2885670008
+
+        But Synapse currently emits 100 at a time, controlled by `MAX_EVENTS_IN_SYNC`.
+        In this test we patch it to 3 (as sending 100 events is not very efficient).
+        """
+
+        # A filter that excludes message events
+        # This is needed so that the sticky events come down the sticky section
+        # and not the timeline section, which would hamper our test.
+        filter_json = json.dumps(
+            {
+                "room": {
+                    # We only want these io.element.example events
+                    "timeline": {"types": ["io.element.example"]},
+                }
+            }
+        )
+
+        # Send 8 sticky events: enough for 2 full pages and then a partial page with 2.
+        sent_sticky_event_ids = []
+        for i in range(8):
+            response = self.helper.send_sticky_event(
+                self.room_id,
+                EventTypes.Message,
+                duration=Duration(minutes=1),
+                content={"body": f"sticky message {i}", "msgtype": "m.text"},
+                tok=self.token,
+            )
+            sent_sticky_event_ids.append(response["event_id"])
+
+        @dataclass
+        class SyncHelperResponse:
+            sticky_event_ids: list[str]
+            """Event IDs of events returned from the sticky section, in-order."""
+
+            next_batch: str
+            """Sync token to pass to `?since=` in order to do an incremental sync."""
+
+        def _do_sync(*, since: str | None) -> SyncHelperResponse:
+            """Small helper to do a sync and get the sticky events out."""
+            and_since_param = "" if since is None else f"&since={since}"
+            channel = self.make_request(
+                "GET",
+                f"/sync?filter={quote(filter_json)}{and_since_param}",
+                access_token=self.token,
+            )
+            self.assertEqual(channel.code, 200, channel.result)
+
+            # Get sticky events from the sync response
+            sticky_events = []
+            # In this test, when no sticky events are in the response,
+            # we don't have a rooms section at all
+            if "rooms" in channel.json_body:
+                sticky_events = channel.json_body["rooms"]["join"][self.room_id][
+                    "msc4354_sticky"
+                ]["events"]
+
+            return SyncHelperResponse(
+                sticky_event_ids=[
+                    sticky_event["event_id"] for sticky_event in sticky_events
+                ],
+                next_batch=channel.json_body["next_batch"],
+            )
+
+        # Perform initial sync, we should get the first 3 sticky events,
+        # in order.
+        sync1 = _do_sync(since=None)
+        self.assertEqual(sync1.sticky_event_ids, sent_sticky_event_ids[0:3])
+
+        # Now do an incremental sync and expect the next page of 3
+        sync2 = _do_sync(since=sync1.next_batch)
+        self.assertEqual(sync2.sticky_event_ids, sent_sticky_event_ids[3:6])
+
+        # Now do another incremental sync and expect the last 2
+        sync3 = _do_sync(since=sync2.next_batch)
+        self.assertEqual(sync3.sticky_event_ids, sent_sticky_event_ids[6:8])
+
+        # Finally, expect an empty incremental sync at the end
+        sync4 = _do_sync(since=sync3.next_batch)
+        self.assertEqual(sync4.sticky_event_ids, [])
diff --git a/tests/rest/client/test_third_party_rules.py b/tests/rest/client/test_third_party_rules.py
index f14ca8237a..1709b27f67 100644
--- a/tests/rest/client/test_third_party_rules.py
+++ b/tests/rest/client/test_third_party_rules.py
@@ -19,7 +19,7 @@
 #
 #
 import threading
-from typing import TYPE_CHECKING, Any, Dict, Optional, Tuple, Union
+from typing import TYPE_CHECKING, Any
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -36,7 +36,7 @@ from synapse.rest import admin
 from synapse.rest.client import account, login, profile, room
 from synapse.server import HomeServer
 from synapse.types import JsonDict, Requester, StateMap
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.frozenutils import unfreeze
 
 from tests import unittest
@@ -48,7 +48,7 @@ thread_local = threading.local()
 
 
 class LegacyThirdPartyRulesTestModule:
-    def __init__(self, config: Dict, module_api: "ModuleApi") -> None:
+    def __init__(self, config: dict, module_api: "ModuleApi") -> None:
         # keep a record of the "current" rules module, so that the test can patch
         # it if desired.
         thread_local.rules_module = self
@@ -61,16 +61,16 @@ class LegacyThirdPartyRulesTestModule:
 
     async def check_event_allowed(
         self, event: EventBase, state: StateMap[EventBase]
-    ) -> Union[bool, dict]:
+    ) -> bool | dict:
         return True
 
     @staticmethod
-    def parse_config(config: Dict[str, Any]) -> Dict[str, Any]:
+    def parse_config(config: dict[str, Any]) -> dict[str, Any]:
         return config
 
 
 class LegacyDenyNewRooms(LegacyThirdPartyRulesTestModule):
-    def __init__(self, config: Dict, module_api: "ModuleApi") -> None:
+    def __init__(self, config: dict, module_api: "ModuleApi") -> None:
         super().__init__(config, module_api)
 
     async def on_create_room(
@@ -80,7 +80,7 @@ class LegacyDenyNewRooms(LegacyThirdPartyRulesTestModule):
 
 
 class LegacyChangeEvents(LegacyThirdPartyRulesTestModule):
-    def __init__(self, config: Dict, module_api: "ModuleApi") -> None:
+    def __init__(self, config: dict, module_api: "ModuleApi") -> None:
         super().__init__(config, module_api)
 
     async def check_event_allowed(
@@ -150,7 +150,7 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         # types
         async def check(
             ev: EventBase, state: StateMap[EventBase]
-        ) -> Tuple[bool, Optional[JsonDict]]:
+        ) -> tuple[bool, JsonDict | None]:
             return ev.type != "foo.bar.forbidden", None
 
         callback = Mock(spec=[], side_effect=check)
@@ -195,7 +195,7 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         """
 
         class NastyHackException(SynapseError):
-            def error_dict(self, config: Optional[HomeServerConfig]) -> JsonDict:
+            def error_dict(self, config: HomeServerConfig | None) -> JsonDict:
                 """
                 This overrides SynapseError's `error_dict` to nastily inject
                 JSON into the error response.
@@ -207,7 +207,7 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         # add a callback that will raise our hacky exception
         async def check(
             ev: EventBase, state: StateMap[EventBase]
-        ) -> Tuple[bool, Optional[JsonDict]]:
+        ) -> tuple[bool, JsonDict | None]:
             raise NastyHackException(429, "message")
 
         self.hs.get_module_api_callbacks().third_party_event_rules._check_event_allowed_callbacks = [
@@ -235,7 +235,7 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         # first patch the event checker so that it will try to modify the event
         async def check(
             ev: EventBase, state: StateMap[EventBase]
-        ) -> Tuple[bool, Optional[JsonDict]]:
+        ) -> tuple[bool, JsonDict | None]:
             ev.content = {"x": "y"}
             return True, None
 
@@ -260,7 +260,7 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         # first patch the event checker so that it will modify the event
         async def check(
             ev: EventBase, state: StateMap[EventBase]
-        ) -> Tuple[bool, Optional[JsonDict]]:
+        ) -> tuple[bool, JsonDict | None]:
             d = ev.get_dict()
             d["content"] = {"x": "y"}
             return True, d
@@ -295,7 +295,7 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         # first patch the event checker so that it will modify the event
         async def check(
             ev: EventBase, state: StateMap[EventBase]
-        ) -> Tuple[bool, Optional[JsonDict]]:
+        ) -> tuple[bool, JsonDict | None]:
             d = ev.get_dict()
             d["content"] = {
                 "msgtype": "m.text",
@@ -443,7 +443,7 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         # Define a callback that sends a custom event on power levels update.
         async def test_fn(
             event: EventBase, state_events: StateMap[EventBase]
-        ) -> Tuple[bool, Optional[JsonDict]]:
+        ) -> tuple[bool, JsonDict | None]:
             if event.is_state() and event.type == EventTypes.PowerLevels:
                 await api.create_and_send_event_into_room(
                     {
@@ -734,9 +734,9 @@ class ThirdPartyRulesTestCase(unittest.FederatingHomeserverTestCase):
         self.assertTrue(args[1])
         self.assertFalse(args[2])
 
-        # Check that the profile update callback was called twice (once for the display
-        # name and once for the avatar URL), and that the "deactivation" boolean is true.
-        self.assertEqual(profile_mock.call_count, 2)
+        # Check that the profile update callback was called once
+        # and that the "deactivation" boolean is true.
+        self.assertEqual(profile_mock.call_count, 1)
         args = profile_mock.call_args[0]
         self.assertTrue(args[3])
 
diff --git a/tests/rest/client/test_thread_subscriptions.py b/tests/rest/client/test_thread_subscriptions.py
index 3fbf3c5bfa..87c477cbb5 100644
--- a/tests/rest/client/test_thread_subscriptions.py
+++ b/tests/rest/client/test_thread_subscriptions.py
@@ -20,7 +20,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, profile, room, thread_subscriptions
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -111,7 +111,7 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             {},
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
 
         # Assert the subscription was saved
         channel = self.make_request(
@@ -119,8 +119,8 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             f"{PREFIX}/{self.room_id}/thread/{self.root_event_id}/subscription",
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
-        self.assertEqual(channel.json_body, {"automatic": False})
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        self.assertEqual(channel.json_body, {"automatic": False}, channel.json_body)
 
         # Now also register an automatic subscription; it should not
         # override the manual subscription
@@ -130,7 +130,7 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             {"automatic": self.threaded_events[0]},
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
 
         # Assert the manual subscription was not overridden
         channel = self.make_request(
@@ -138,8 +138,8 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             f"{PREFIX}/{self.room_id}/thread/{self.root_event_id}/subscription",
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
-        self.assertEqual(channel.json_body, {"automatic": False})
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        self.assertEqual(channel.json_body, {"automatic": False}, channel.json_body)
 
     def test_subscribe_automatic_then_manual(self) -> None:
         """Test subscribing to a thread, first an automatic subscription then a manual subscription.
@@ -160,8 +160,8 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             f"{PREFIX}/{self.room_id}/thread/{self.root_event_id}/subscription",
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
-        self.assertEqual(channel.json_body, {"automatic": True})
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        self.assertEqual(channel.json_body, {"automatic": True}, channel.json_body)
 
         # Now also register a manual subscription
         channel = self.make_request(
@@ -170,7 +170,7 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             {},
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
 
         # Assert the manual subscription was not overridden
         channel = self.make_request(
@@ -178,8 +178,8 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             f"{PREFIX}/{self.room_id}/thread/{self.root_event_id}/subscription",
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
-        self.assertEqual(channel.json_body, {"automatic": False})
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        self.assertEqual(channel.json_body, {"automatic": False}, channel.json_body)
 
     def test_unsubscribe(self) -> None:
         """Test subscribing to a thread, then unsubscribing."""
@@ -191,7 +191,7 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             },
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
 
         # Assert the subscription was saved
         channel = self.make_request(
@@ -199,23 +199,23 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             f"{PREFIX}/{self.room_id}/thread/{self.root_event_id}/subscription",
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
-        self.assertEqual(channel.json_body, {"automatic": True})
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        self.assertEqual(channel.json_body, {"automatic": True}, channel.json_body)
 
         channel = self.make_request(
             "DELETE",
             f"{PREFIX}/{self.room_id}/thread/{self.root_event_id}/subscription",
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.OK)
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
 
         channel = self.make_request(
             "GET",
             f"{PREFIX}/{self.room_id}/thread/{self.root_event_id}/subscription",
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND)
-        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND")
+        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND, channel.json_body)
+        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND", channel.json_body)
 
     def test_set_thread_subscription_nonexistent_thread(self) -> None:
         """Test setting subscription settings for a nonexistent thread."""
@@ -225,8 +225,8 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             {},
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND)
-        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND")
+        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND, channel.json_body)
+        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND", channel.json_body)
 
     def test_set_thread_subscription_no_access(self) -> None:
         """Test that a user can't set thread subscription for a thread they can't access."""
@@ -239,8 +239,8 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             {},
             access_token=no_access_token,
         )
-        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND)
-        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND")
+        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND, channel.json_body)
+        self.assertEqual(channel.json_body["errcode"], "M_NOT_FOUND", channel.json_body)
 
     def test_invalid_body(self) -> None:
         """Test that sending invalid subscription settings is rejected."""
@@ -251,7 +251,7 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             {"automatic": True},
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST)
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.json_body)
 
         channel = self.make_request(
             "PUT",
@@ -260,7 +260,7 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
             {"automatic": "$malformedEventId"},
             access_token=self.token,
         )
-        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST)
+        self.assertEqual(channel.code, HTTPStatus.BAD_REQUEST, channel.json_body)
 
     def test_auto_subscribe_cause_event_not_in_thread(self) -> None:
         """
diff --git a/tests/rest/client/test_transactions.py b/tests/rest/client/test_transactions.py
index 5f42acb391..31586a451f 100644
--- a/tests/rest/client/test_transactions.py
+++ b/tests/rest/client/test_transactions.py
@@ -20,25 +20,26 @@
 #
 
 from http import HTTPStatus
-from typing import Any, Generator, Tuple, cast
+from typing import Any, Generator, cast
 from unittest.mock import AsyncMock, Mock, call
 
 from twisted.internet import defer, reactor as _reactor
 
 from synapse.logging.context import SENTINEL_CONTEXT, LoggingContext, current_context
-from synapse.rest.client.transactions import CLEANUP_PERIOD_MS, HttpTransactionCache
+from synapse.rest.client.transactions import CLEANUP_PERIOD, HttpTransactionCache
 from synapse.types import ISynapseReactor, JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 from tests import unittest
-from tests.utils import MockClock
+from tests.server import get_clock
 
 reactor = cast(ISynapseReactor, _reactor)
 
 
 class HttpTransactionCacheTestCase(unittest.TestCase):
     def setUp(self) -> None:
-        self.clock = MockClock()
+        self.reactor, self.clock = get_clock()
         self.hs = Mock()
         self.hs.get_clock = Mock(return_value=self.clock)
         self.hs.get_auth = Mock()
@@ -89,13 +90,17 @@ class HttpTransactionCacheTestCase(unittest.TestCase):
         self,
     ) -> Generator["defer.Deferred[Any]", object, None]:
         @defer.inlineCallbacks
-        def cb() -> Generator["defer.Deferred[object]", object, Tuple[int, JsonDict]]:
-            yield defer.ensureDeferred(Clock(reactor).sleep(0))
+        def cb() -> Generator["defer.Deferred[object]", object, tuple[int, JsonDict]]:
+            # Ignore `multiple-internal-clocks` linter error here since we are creating a `Clock`
+            # for testing purposes.
+            yield defer.ensureDeferred(
+                Clock(reactor, server_name="test_server").sleep(Duration(seconds=0))  # type: ignore[multiple-internal-clocks]
+            )
             return 1, {}
 
         @defer.inlineCallbacks
         def test() -> Generator["defer.Deferred[Any]", object, None]:
-            with LoggingContext("c") as c1:
+            with LoggingContext(name="c", server_name="test_server") as c1:
                 res = yield self.cache.fetch_or_execute_request(
                     self.mock_request, self.mock_requester, cb
                 )
@@ -117,7 +122,7 @@ class HttpTransactionCacheTestCase(unittest.TestCase):
         """
         called = [False]
 
-        def cb() -> "defer.Deferred[Tuple[int, JsonDict]]":
+        def cb() -> "defer.Deferred[tuple[int, JsonDict]]":
             if called[0]:
                 # return a valid result the second time
                 return defer.succeed(self.mock_http_response)
@@ -125,7 +130,7 @@ class HttpTransactionCacheTestCase(unittest.TestCase):
             called[0] = True
             raise Exception("boo")
 
-        with LoggingContext("test") as test_context:
+        with LoggingContext(name="test", server_name="test_server") as test_context:
             try:
                 yield self.cache.fetch_or_execute_request(
                     self.mock_request, self.mock_requester, cb
@@ -149,7 +154,7 @@ class HttpTransactionCacheTestCase(unittest.TestCase):
         """
         called = [False]
 
-        def cb() -> "defer.Deferred[Tuple[int, JsonDict]]":
+        def cb() -> "defer.Deferred[tuple[int, JsonDict]]":
             if called[0]:
                 # return a valid result the second time
                 return defer.succeed(self.mock_http_response)
@@ -157,7 +162,7 @@ class HttpTransactionCacheTestCase(unittest.TestCase):
             called[0] = True
             return defer.fail(Exception("boo"))
 
-        with LoggingContext("test") as test_context:
+        with LoggingContext(name="test", server_name="test_server") as test_context:
             try:
                 yield self.cache.fetch_or_execute_request(
                     self.mock_request, self.mock_requester, cb
@@ -178,8 +183,9 @@ class HttpTransactionCacheTestCase(unittest.TestCase):
         yield self.cache.fetch_or_execute_request(
             self.mock_request, self.mock_requester, cb, "an arg"
         )
-        # should NOT have cleaned up yet
-        self.clock.advance_time_msec(CLEANUP_PERIOD_MS / 2)
+        # Advance time just under the cleanup period.
+        # Should NOT have cleaned up yet
+        self.reactor.advance(CLEANUP_PERIOD.as_secs() - 1)
 
         yield self.cache.fetch_or_execute_request(
             self.mock_request, self.mock_requester, cb, "an arg"
@@ -187,7 +193,8 @@ class HttpTransactionCacheTestCase(unittest.TestCase):
         # still using cache
         cb.assert_called_once_with("an arg")
 
-        self.clock.advance_time_msec(CLEANUP_PERIOD_MS)
+        # Advance time just after the cleanup period.
+        self.reactor.advance(2)
 
         yield self.cache.fetch_or_execute_request(
             self.mock_request, self.mock_requester, cb, "an arg"
diff --git a/tests/rest/client/test_typing.py b/tests/rest/client/test_typing.py
index ce2504156c..19817d0321 100644
--- a/tests/rest/client/test_typing.py
+++ b/tests/rest/client/test_typing.py
@@ -27,7 +27,7 @@ from synapse.api.constants import EduTypes
 from synapse.rest.client import room
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/rest/client/test_upgrade_room.py b/tests/rest/client/test_upgrade_room.py
index 66fddc5475..ee26492909 100644
--- a/tests/rest/client/test_upgrade_room.py
+++ b/tests/rest/client/test_upgrade_room.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Optional
 from unittest.mock import patch
 
 from twisted.internet.testing import MemoryReactor
@@ -28,7 +27,7 @@ from synapse.config.server import DEFAULT_ROOM_VERSION
 from synapse.rest import admin
 from synapse.rest.client import login, room, room_upgrade_rest_servlet
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import FakeChannel
@@ -56,8 +55,8 @@ class UpgradeRoomTest(unittest.HomeserverTestCase):
 
     def _upgrade_room(
         self,
-        token: Optional[str] = None,
-        room_id: Optional[str] = None,
+        token: str | None = None,
+        room_id: str | None = None,
         expire_cache: bool = True,
     ) -> FakeChannel:
         if expire_cache:
diff --git a/tests/rest/client/utils.py b/tests/rest/client/utils.py
index bb214759d9..bfa8e6f3d8 100644
--- a/tests/rest/client/utils.py
+++ b/tests/rest/client/utils.py
@@ -30,14 +30,11 @@ from typing import (
     Any,
     AnyStr,
     Callable,
-    Dict,
     Iterable,
     Literal,
     Mapping,
     MutableMapping,
-    Optional,
     Sequence,
-    Tuple,
     overload,
 )
 from urllib.parse import urlencode
@@ -51,6 +48,7 @@ from synapse.api.constants import EventTypes, Membership, ReceiptTypes
 from synapse.api.errors import Codes
 from synapse.server import HomeServer
 from synapse.types import JsonDict
+from synapse.util.duration import Duration
 
 from tests.server import FakeChannel, make_request
 from tests.test_utils.html_parsers import TestHtmlParser
@@ -77,42 +75,42 @@ class RestHelper:
     hs: HomeServer
     reactor: MemoryReactorClock
     site: Site
-    auth_user_id: Optional[str]
+    auth_user_id: str | None
 
     @overload
     def create_room_as(
         self,
-        room_creator: Optional[str] = ...,
-        is_public: Optional[bool] = ...,
-        room_version: Optional[str] = ...,
-        tok: Optional[str] = ...,
+        room_creator: str | None = ...,
+        is_public: bool | None = ...,
+        room_version: str | None = ...,
+        tok: str | None = ...,
         expect_code: Literal[200] = ...,
-        extra_content: Optional[Dict] = ...,
-        custom_headers: Optional[Iterable[Tuple[AnyStr, AnyStr]]] = ...,
+        extra_content: dict | None = ...,
+        custom_headers: Iterable[tuple[AnyStr, AnyStr]] | None = ...,
     ) -> str: ...
 
     @overload
     def create_room_as(
         self,
-        room_creator: Optional[str] = ...,
-        is_public: Optional[bool] = ...,
-        room_version: Optional[str] = ...,
-        tok: Optional[str] = ...,
+        room_creator: str | None = ...,
+        is_public: bool | None = ...,
+        room_version: str | None = ...,
+        tok: str | None = ...,
         expect_code: int = ...,
-        extra_content: Optional[Dict] = ...,
-        custom_headers: Optional[Iterable[Tuple[AnyStr, AnyStr]]] = ...,
-    ) -> Optional[str]: ...
+        extra_content: dict | None = ...,
+        custom_headers: Iterable[tuple[AnyStr, AnyStr]] | None = ...,
+    ) -> str | None: ...
 
     def create_room_as(
         self,
-        room_creator: Optional[str] = None,
-        is_public: Optional[bool] = True,
-        room_version: Optional[str] = None,
-        tok: Optional[str] = None,
+        room_creator: str | None = None,
+        is_public: bool | None = True,
+        room_version: str | None = None,
+        tok: str | None = None,
         expect_code: int = HTTPStatus.OK,
-        extra_content: Optional[Dict] = None,
-        custom_headers: Optional[Iterable[Tuple[AnyStr, AnyStr]]] = None,
-    ) -> Optional[str]:
+        extra_content: dict | None = None,
+        custom_headers: Iterable[tuple[AnyStr, AnyStr]] | None = None,
+    ) -> str | None:
         """
         Create a room.
 
@@ -168,11 +166,11 @@ class RestHelper:
     def invite(
         self,
         room: str,
-        src: Optional[str] = None,
-        targ: Optional[str] = None,
+        src: str | None = None,
+        targ: str | None = None,
         expect_code: int = HTTPStatus.OK,
-        tok: Optional[str] = None,
-        extra_data: Optional[dict] = None,
+        tok: str | None = None,
+        extra_data: dict | None = None,
     ) -> JsonDict:
         return self.change_membership(
             room=room,
@@ -189,10 +187,10 @@ class RestHelper:
         room: str,
         user: str,
         expect_code: int = HTTPStatus.OK,
-        tok: Optional[str] = None,
-        appservice_user_id: Optional[str] = None,
-        expect_errcode: Optional[Codes] = None,
-        expect_additional_fields: Optional[dict] = None,
+        tok: str | None = None,
+        appservice_user_id: str | None = None,
+        expect_errcode: Codes | None = None,
+        expect_additional_fields: dict | None = None,
     ) -> JsonDict:
         return self.change_membership(
             room=room,
@@ -208,11 +206,11 @@ class RestHelper:
 
     def knock(
         self,
-        room: Optional[str] = None,
-        user: Optional[str] = None,
-        reason: Optional[str] = None,
+        room: str | None = None,
+        user: str | None = None,
+        reason: str | None = None,
         expect_code: int = HTTPStatus.OK,
-        tok: Optional[str] = None,
+        tok: str | None = None,
     ) -> None:
         temp_id = self.auth_user_id
         self.auth_user_id = user
@@ -243,9 +241,9 @@ class RestHelper:
     def leave(
         self,
         room: str,
-        user: Optional[str] = None,
+        user: str | None = None,
         expect_code: int = HTTPStatus.OK,
-        tok: Optional[str] = None,
+        tok: str | None = None,
     ) -> JsonDict:
         return self.change_membership(
             room=room,
@@ -262,7 +260,7 @@ class RestHelper:
         src: str,
         targ: str,
         expect_code: int = HTTPStatus.OK,
-        tok: Optional[str] = None,
+        tok: str | None = None,
     ) -> JsonDict:
         """A convenience helper: `change_membership` with `membership` preset to "ban"."""
         return self.change_membership(
@@ -277,15 +275,15 @@ class RestHelper:
     def change_membership(
         self,
         room: str,
-        src: Optional[str],
-        targ: Optional[str],
+        src: str | None,
+        targ: str | None,
         membership: str,
-        extra_data: Optional[dict] = None,
-        tok: Optional[str] = None,
-        appservice_user_id: Optional[str] = None,
+        extra_data: dict | None = None,
+        tok: str | None = None,
+        appservice_user_id: str | None = None,
         expect_code: int = HTTPStatus.OK,
-        expect_errcode: Optional[str] = None,
-        expect_additional_fields: Optional[dict] = None,
+        expect_errcode: str | None = None,
+        expect_additional_fields: dict | None = None,
     ) -> JsonDict:
         """
         Send a membership state event into a room.
@@ -310,7 +308,7 @@ class RestHelper:
         self.auth_user_id = src
 
         path = f"/_matrix/client/r0/rooms/{room}/state/m.room.member/{targ}"
-        url_params: Dict[str, str] = {}
+        url_params: dict[str, str] = {}
 
         if tok:
             url_params["access_token"] = tok
@@ -374,11 +372,11 @@ class RestHelper:
     def send(
         self,
         room_id: str,
-        body: Optional[str] = None,
-        txn_id: Optional[str] = None,
-        tok: Optional[str] = None,
+        body: str | None = None,
+        txn_id: str | None = None,
+        tok: str | None = None,
         expect_code: int = HTTPStatus.OK,
-        custom_headers: Optional[Iterable[Tuple[AnyStr, AnyStr]]] = None,
+        custom_headers: Iterable[tuple[AnyStr, AnyStr]] | None = None,
         type: str = "m.room.message",
     ) -> JsonDict:
         if body is None:
@@ -404,7 +402,7 @@ class RestHelper:
             "msgtype": "m.text",
             "body": f"Test event {idx}",
         },
-        tok: Optional[str] = None,
+        tok: str | None = None,
     ) -> Sequence[str]:
         """
         Helper to send a handful of sequential events and return their event IDs as a sequence.
@@ -426,11 +424,11 @@ class RestHelper:
         self,
         room_id: str,
         type: str,
-        content: Optional[dict] = None,
-        txn_id: Optional[str] = None,
-        tok: Optional[str] = None,
+        content: dict | None = None,
+        txn_id: str | None = None,
+        tok: str | None = None,
         expect_code: int = HTTPStatus.OK,
-        custom_headers: Optional[Iterable[Tuple[AnyStr, AnyStr]]] = None,
+        custom_headers: Iterable[tuple[AnyStr, AnyStr]] | None = None,
     ) -> JsonDict:
         if txn_id is None:
             txn_id = "m%s" % (str(time.time()))
@@ -456,11 +454,49 @@ class RestHelper:
 
         return channel.json_body
 
+    def send_sticky_event(
+        self,
+        room_id: str,
+        type: str,
+        *,
+        duration: Duration,
+        content: dict | None = None,
+        txn_id: str | None = None,
+        tok: str | None = None,
+        expect_code: int = HTTPStatus.OK,
+        custom_headers: Iterable[tuple[AnyStr, AnyStr]] | None = None,
+    ) -> JsonDict:
+        """
+        Send an event that has a sticky duration according to MSC4354.
+        """
+
+        if txn_id is None:
+            txn_id = f"m{time.time()}"
+
+        path = f"/_matrix/client/r0/rooms/{room_id}/send/{type}/{txn_id}?org.matrix.msc4354.sticky_duration_ms={duration.as_millis()}"
+        if tok:
+            path = path + f"&access_token={tok}"
+
+        channel = make_request(
+            self.reactor,
+            self.site,
+            "PUT",
+            path,
+            content or {},
+            custom_headers=custom_headers,
+        )
+
+        assert channel.code == expect_code, (
+            f"Expected: {expect_code}, got: {channel.code}, resp: {channel.result['body']!r}"
+        )
+
+        return channel.json_body
+
     def get_event(
         self,
         room_id: str,
         event_id: str,
-        tok: Optional[str] = None,
+        tok: str | None = None,
         expect_code: int = HTTPStatus.OK,
     ) -> JsonDict:
         """Request a specific event from the server.
@@ -497,8 +533,8 @@ class RestHelper:
         self,
         room_id: str,
         event_type: str,
-        body: Optional[Dict[str, Any]],
-        tok: Optional[str],
+        body: dict[str, Any] | None,
+        tok: str | None,
         expect_code: int = HTTPStatus.OK,
         state_key: str = "",
         method: str = "GET",
@@ -575,8 +611,8 @@ class RestHelper:
         self,
         room_id: str,
         event_type: str,
-        body: Dict[str, Any],
-        tok: Optional[str] = None,
+        body: dict[str, Any],
+        tok: str | None = None,
         expect_code: int = HTTPStatus.OK,
         state_key: str = "",
     ) -> JsonDict:
@@ -615,7 +651,6 @@ class RestHelper:
             filename: The filename of the media to be uploaded
             expect_code: The return code to expect from attempting to upload the media
         """
-        image_length = len(image_data)
         path = "/_matrix/media/r0/upload?filename=%s" % (filename,)
         channel = make_request(
             self.reactor,
@@ -624,7 +659,6 @@ class RestHelper:
             path,
             content=image_data,
             access_token=tok,
-            custom_headers=[("Content-Length", str(image_length))],
         )
 
         assert channel.code == expect_code, "Expected: %d, got: %d, resp: %r" % (
@@ -682,9 +716,9 @@ class RestHelper:
         fake_server: FakeOidcServer,
         remote_user_id: str,
         with_sid: bool = False,
-        idp_id: Optional[str] = None,
+        idp_id: str | None = None,
         expected_status: int = 200,
-    ) -> Tuple[JsonDict, FakeAuthorizationGrant]:
+    ) -> tuple[JsonDict, FakeAuthorizationGrant]:
         """Log in (as a new user) via OIDC
 
         Returns the result of the final token login and the fake authorization grant.
@@ -753,11 +787,11 @@ class RestHelper:
         self,
         fake_server: FakeOidcServer,
         user_info_dict: JsonDict,
-        client_redirect_url: Optional[str] = None,
-        ui_auth_session_id: Optional[str] = None,
+        client_redirect_url: str | None = None,
+        ui_auth_session_id: str | None = None,
         with_sid: bool = False,
-        idp_id: Optional[str] = None,
-    ) -> Tuple[FakeChannel, FakeAuthorizationGrant]:
+        idp_id: str | None = None,
+    ) -> tuple[FakeChannel, FakeAuthorizationGrant]:
         """Perform an OIDC authentication flow via a mock OIDC provider.
 
         This can be used for either login or user-interactive auth.
@@ -790,7 +824,7 @@ class RestHelper:
             went.
         """
 
-        cookies: Dict[str, str] = {}
+        cookies: dict[str, str] = {}
 
         with fake_server.patch_homeserver(hs=self.hs):
             # if we're doing a ui auth, hit the ui auth redirect endpoint
@@ -824,7 +858,7 @@ class RestHelper:
         cookies: Mapping[str, str],
         user_info_dict: JsonDict,
         with_sid: bool = False,
-    ) -> Tuple[FakeChannel, FakeAuthorizationGrant]:
+    ) -> tuple[FakeChannel, FakeAuthorizationGrant]:
         """Mock out an OIDC authentication flow
 
         Assumes that an OIDC auth has been initiated by one of initiate_sso_login or
@@ -880,9 +914,9 @@ class RestHelper:
 
     def initiate_sso_login(
         self,
-        client_redirect_url: Optional[str],
+        client_redirect_url: str | None,
         cookies: MutableMapping[str, str],
-        idp_id: Optional[str] = None,
+        idp_id: str | None = None,
     ) -> str:
         """Make a request to the login-via-sso redirect endpoint, and return the target
 
diff --git a/tests/rest/key/v2/test_remote_key_resource.py b/tests/rest/key/v2/test_remote_key_resource.py
index 3717d70b6b..aaf39e70e4 100644
--- a/tests/rest/key/v2/test_remote_key_resource.py
+++ b/tests/rest/key/v2/test_remote_key_resource.py
@@ -19,7 +19,7 @@
 #
 #
 from io import BytesIO, StringIO
-from typing import Any, Dict, Optional, Union
+from typing import Any
 from unittest.mock import Mock
 
 import signedjson.key
@@ -36,7 +36,7 @@ from synapse.rest.key.v2 import KeyResource
 from synapse.server import HomeServer
 from synapse.storage.keys import FetchKeyResult
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.httpresourcetree import create_resource_tree
 from synapse.util.stringutils import random_string
 
@@ -67,7 +67,7 @@ class BaseRemoteKeyResourceTestCase(unittest.HomeserverTestCase):
             path: str,
             ignore_backoff: bool = False,
             **kwargs: Any,
-        ) -> Union[JsonDict, list]:
+        ) -> JsonDict | list:
             self.assertTrue(ignore_backoff)
             self.assertEqual(destination, server_name)
             key_id = "%s:%s" % (signing_key.alg, signing_key.version)
@@ -156,7 +156,7 @@ class EndToEndPerspectivesTests(BaseRemoteKeyResourceTestCase):
     endpoint, to check that the two implementations are compatible.
     """
 
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = super().default_config()
 
         # replace the signing key with our own
@@ -170,7 +170,7 @@ class EndToEndPerspectivesTests(BaseRemoteKeyResourceTestCase):
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         # make a second homeserver, configured to use the first one as a key notary
         self.http_client2 = Mock()
-        config = default_config(name="keyclient")
+        config = default_config(server_name="keyclient")
         config["trusted_key_servers"] = [
             {
                 "server_name": self.hs.hostname,
@@ -191,8 +191,8 @@ class EndToEndPerspectivesTests(BaseRemoteKeyResourceTestCase):
         # wire up outbound POST /key/v2/query requests from hs2 so that they
         # will be forwarded to hs1
         async def post_json(
-            destination: str, path: str, data: Optional[JsonDict] = None
-        ) -> Union[JsonDict, list]:
+            destination: str, path: str, data: JsonDict | None = None
+        ) -> JsonDict | list:
             self.assertEqual(destination, self.hs.hostname)
             self.assertEqual(
                 path,
diff --git a/tests/rest/media/test_domain_blocking.py b/tests/rest/media/test_domain_blocking.py
index 3feade4a4b..0bdbaa676d 100644
--- a/tests/rest/media/test_domain_blocking.py
+++ b/tests/rest/media/test_domain_blocking.py
@@ -18,14 +18,13 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict
 
 from twisted.internet.testing import MemoryReactor
 from twisted.web.resource import Resource
 
 from synapse.media._base import FileInfo
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils import SMALL_PNG
@@ -65,7 +64,7 @@ class MediaDomainBlockingTests(unittest.HomeserverTestCase):
             )
         )
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         # We need to manually set the resource tree to include media, the
         # default only does `/_matrix/client` APIs.
         return {"/_matrix/media": self.hs.get_media_repository_resource()}
diff --git a/tests/rest/media/test_url_preview.py b/tests/rest/media/test_url_preview.py
index e096780ce2..32e78fc12a 100644
--- a/tests/rest/media/test_url_preview.py
+++ b/tests/rest/media/test_url_preview.py
@@ -22,7 +22,7 @@ import base64
 import json
 import os
 import re
-from typing import Any, Dict, Optional, Sequence, Tuple, Type
+from typing import Any, Sequence
 from urllib.parse import quote, urlencode
 
 from twisted.internet._resolver import HostResolution
@@ -36,7 +36,7 @@ from synapse.config.oembed import OEmbedEndpointConfig
 from synapse.media.url_previewer import IMAGE_CACHE_EXPIRY_MS
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import parse_and_validate_mxc_uri
 
 from tests import unittest
@@ -127,7 +127,7 @@ class URLPreviewTests(unittest.HomeserverTestCase):
         assert self.media_repo.url_previewer is not None
         self.url_previewer = self.media_repo.url_previewer
 
-        self.lookups: Dict[str, Any] = {}
+        self.lookups: dict[str, Any] = {}
 
         class Resolver:
             def resolveHostName(
@@ -135,7 +135,7 @@ class URLPreviewTests(unittest.HomeserverTestCase):
                 resolutionReceiver: IResolutionReceiver,
                 hostName: str,
                 portNumber: int = 0,
-                addressTypes: Optional[Sequence[Type[IAddress]]] = None,
+                addressTypes: Sequence[type[IAddress]] | None = None,
                 transportSemantics: str = "TCP",
             ) -> IResolutionReceiver:
                 resolution = HostResolution(hostName)
@@ -150,7 +150,7 @@ class URLPreviewTests(unittest.HomeserverTestCase):
 
         self.reactor.nameResolver = Resolver()  # type: ignore[assignment]
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         """Create a resource tree for the test server
 
         A resource tree is a mapping from path to twisted.web.resource.
@@ -1227,7 +1227,7 @@ class URLPreviewTests(unittest.HomeserverTestCase):
         self.assertEqual(body["og:title"], "Test")
         self.assertNotIn("og:image", body)
 
-    def _download_image(self) -> Tuple[str, str]:
+    def _download_image(self) -> tuple[str, str]:
         """Downloads an image into the URL cache.
         Returns:
             A (host, media_id) tuple representing the MXC URI of the image.
diff --git a/tests/rest/synapse/client/test_federation_whitelist.py b/tests/rest/synapse/client/test_federation_whitelist.py
index f0067a8f2b..c4a990e32c 100644
--- a/tests/rest/synapse/client/test_federation_whitelist.py
+++ b/tests/rest/synapse/client/test_federation_whitelist.py
@@ -11,7 +11,6 @@
 # See the GNU Affero General Public License for more details:
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 
-from typing import Dict
 
 from twisted.web.resource import Resource
 
@@ -28,7 +27,7 @@ class FederationWhitelistTests(unittest.HomeserverTestCase):
         login.register_servlets,
     ]
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         base = super().create_resource_dict()
         base.update(build_synapse_client_resource_tree(self.hs))
         return base
diff --git a/tests/rest/synapse/mas/test_devices.py b/tests/rest/synapse/mas/test_devices.py
index 458878c13c..6b7596f1c6 100644
--- a/tests/rest/synapse/mas/test_devices.py
+++ b/tests/rest/synapse/mas/test_devices.py
@@ -15,7 +15,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import skip_unless
 from tests.utils import HAS_AUTHLIB
diff --git a/tests/rest/synapse/mas/test_users.py b/tests/rest/synapse/mas/test_users.py
index b236aceaf2..6f44761bb8 100644
--- a/tests/rest/synapse/mas/test_users.py
+++ b/tests/rest/synapse/mas/test_users.py
@@ -10,15 +10,18 @@
 #
 # See the GNU Affero General Public License for more details:
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
-
+from http import HTTPStatus
 from urllib.parse import urlencode
 
+from parameterized import parameterized
+
 from twisted.internet.testing import MemoryReactor
 
+from synapse.api.errors import StoreError
 from synapse.appservice import ApplicationService
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import skip_unless
 from tests.utils import HAS_AUTHLIB
@@ -359,6 +362,64 @@ class MasProvisionUserResource(BaseTestCase):
             )
             self.assertEqual(channel.code, 400, f"Should fail for content: {content}")
 
+    def test_lock_and_unlock(self) -> None:
+        store = self.hs.get_datastores().main
+
+        # Create a user in the locked state
+        alice = UserID("alice", "test")
+        channel = self.make_request(
+            "POST",
+            "/_synapse/mas/provision_user",
+            shorthand=False,
+            access_token=self.SHARED_SECRET,
+            content={
+                "localpart": alice.localpart,
+                "locked": True,
+            },
+        )
+        # This created the user, hence the 201 status code
+        self.assertEqual(channel.code, 201, channel.json_body)
+        self.assertEqual(channel.json_body, {})
+        self.assertTrue(
+            self.get_success(store.get_user_locked_status(alice.to_string()))
+        )
+
+        # Then transition from locked to unlocked
+        channel = self.make_request(
+            "POST",
+            "/_synapse/mas/provision_user",
+            shorthand=False,
+            access_token=self.SHARED_SECRET,
+            content={
+                "localpart": alice.localpart,
+                "locked": False,
+            },
+        )
+        # This updated the user, hence the 200 status code
+        self.assertEqual(channel.code, 200, channel.json_body)
+        self.assertEqual(channel.json_body, {})
+        self.assertFalse(
+            self.get_success(store.get_user_locked_status(alice.to_string()))
+        )
+
+        # And back from unlocked to locked
+        channel = self.make_request(
+            "POST",
+            "/_synapse/mas/provision_user",
+            shorthand=False,
+            access_token=self.SHARED_SECRET,
+            content={
+                "localpart": alice.localpart,
+                "locked": True,
+            },
+        )
+        # This updated the user, hence the 200 status code
+        self.assertEqual(channel.code, 200, channel.json_body)
+        self.assertEqual(channel.json_body, {})
+        self.assertTrue(
+            self.get_success(store.get_user_locked_status(alice.to_string()))
+        )
+
 
 @skip_unless(HAS_AUTHLIB, "requires authlib")
 class MasIsLocalpartAvailableResource(BaseTestCase):
@@ -621,6 +682,78 @@ class MasDeleteUserResource(BaseTestCase):
         # And erased
         self.assertTrue(self.get_success(store.is_user_erased(user_id=str(alice))))
 
+    @parameterized.expand([(False,), (True,)])
+    def test_user_deactivation_removes_user_from_user_directory(
+        self, erase: bool
+    ) -> None:
+        """
+        Test that when `/delete_user` deactivates a user, they get removed from the user directory.
+
+        This is applicable regardless of whether the `erase` flag is set.
+
+        Regression test for:
+            'Users are not removed from user directory upon deactivation if erase flag is true'
+            https://github.com/element-hq/synapse/issues/19540
+        """
+        alice = UserID("alice", "test")
+        store = self.hs.get_datastores().main
+
+        # Ensure we're testing what we think we are:
+        # check the user is IN the directory at the start of the test
+        self.assertEqual(
+            self.get_success(store._get_user_in_directory(alice.to_string())),
+            ("Alice", None),
+        )
+
+        channel = self.make_request(
+            "POST",
+            "/_synapse/mas/delete_user",
+            shorthand=False,
+            access_token=self.SHARED_SECRET,
+            content={"localpart": "alice", "erase": erase},
+        )
+        self.assertEqual(channel.code, 200, channel.json_body)
+        self.assertEqual(channel.json_body, {})
+
+        self.assertIsNone(
+            self.get_success(store._get_user_in_directory(alice.to_string())),
+            "User still present in user directory after deactivation!",
+        )
+
+    def test_user_deactivation_removes_custom_profile_fields(self) -> None:
+        """
+        Test that when `/delete_user` deactivates a user with the `erase` flag,
+        their custom profile fields get removed.
+        """
+        alice = UserID("alice", "test")
+        store = self.hs.get_datastores().main
+
+        # Add custom profile field
+        self.get_success(store.set_profile_field(alice, "io.element.example", "hello"))
+
+        # Ensure we're testing what we think we are:
+        # check the user has profile data at the start of the test
+        self.assertEqual(
+            self.get_success(store.get_profile_fields(alice)),
+            {"io.element.example": "hello"},
+        )
+
+        channel = self.make_request(
+            "POST",
+            "/_synapse/mas/delete_user",
+            shorthand=False,
+            access_token=self.SHARED_SECRET,
+            content={"localpart": "alice", "erase": True},
+        )
+        self.assertEqual(channel.code, 200, channel.json_body)
+        self.assertEqual(channel.json_body, {})
+
+        # With no profile, we expect a 404 (Not Found) StoreError
+        with self.assertRaises(StoreError) as raised:
+            self.get_success_or_raise(store.get_profile_fields(alice))
+
+        self.assertEqual(raised.exception.code, HTTPStatus.NOT_FOUND)
+
     def test_delete_user_missing_localpart(self) -> None:
         channel = self.make_request(
             "POST",
diff --git a/tests/rest/test_health.py b/tests/rest/test_health.py
index bdbfce796a..17249b4eae 100644
--- a/tests/rest/test_health.py
+++ b/tests/rest/test_health.py
@@ -33,3 +33,16 @@ class HealthCheckTests(unittest.HomeserverTestCase):
 
         self.assertEqual(channel.code, 200)
         self.assertEqual(channel.result["body"], b"OK")
+
+    def test_health_path_traversal(self) -> None:
+        """
+        Test that the health endpoint does not allow extra path segments,
+        which could be used to access other resources.
+
+        Regression test for: https://github.com/element-hq/synapse/issues/19395
+        """
+        channel = self.make_request("GET", "/health/extra/path", shorthand=False)
+
+        self.assertEqual(channel.code, 404)
+        self.assertEqual(channel.json_body["errcode"], "M_UNRECOGNIZED")
+        self.assertIn("error", channel.json_body)
diff --git a/tests/scripts/test_new_matrix_user.py b/tests/scripts/test_new_matrix_user.py
index cae096e72b..0e697427bb 100644
--- a/tests/scripts/test_new_matrix_user.py
+++ b/tests/scripts/test_new_matrix_user.py
@@ -18,7 +18,6 @@
 #
 #
 
-from typing import List, Optional
 from unittest.mock import Mock, patch
 
 from synapse._scripts.register_new_matrix_user import request_registration
@@ -34,14 +33,14 @@ class RegisterTestCase(TestCase):
         post that MAC.
         """
 
-        def get(url: str, verify: Optional[bool] = None) -> Mock:
+        def get(url: str, verify: bool | None = None) -> Mock:
             r = Mock()
             r.status_code = 200
             r.json = lambda: {"nonce": "a"}
             return r
 
         def post(
-            url: str, json: Optional[JsonDict] = None, verify: Optional[bool] = None
+            url: str, json: JsonDict | None = None, verify: bool | None = None
         ) -> Mock:
             # Make sure we are sent the correct info
             assert json is not None
@@ -60,8 +59,8 @@ class RegisterTestCase(TestCase):
         requests.post = post
 
         # The fake stdout will be written here
-        out: List[str] = []
-        err_code: List[int] = []
+        out: list[str] = []
+        err_code: list[int] = []
 
         with patch("synapse._scripts.register_new_matrix_user.requests", requests):
             request_registration(
@@ -85,7 +84,7 @@ class RegisterTestCase(TestCase):
         If the script fails to fetch a nonce, it throws an error and quits.
         """
 
-        def get(url: str, verify: Optional[bool] = None) -> Mock:
+        def get(url: str, verify: bool | None = None) -> Mock:
             r = Mock()
             r.status_code = 404
             r.reason = "Not Found"
@@ -96,8 +95,8 @@ class RegisterTestCase(TestCase):
         requests.get = get
 
         # The fake stdout will be written here
-        out: List[str] = []
-        err_code: List[int] = []
+        out: list[str] = []
+        err_code: list[int] = []
 
         with patch("synapse._scripts.register_new_matrix_user.requests", requests):
             request_registration(
@@ -123,14 +122,14 @@ class RegisterTestCase(TestCase):
         report an error and quit.
         """
 
-        def get(url: str, verify: Optional[bool] = None) -> Mock:
+        def get(url: str, verify: bool | None = None) -> Mock:
             r = Mock()
             r.status_code = 200
             r.json = lambda: {"nonce": "a"}
             return r
 
         def post(
-            url: str, json: Optional[JsonDict] = None, verify: Optional[bool] = None
+            url: str, json: JsonDict | None = None, verify: bool | None = None
         ) -> Mock:
             # Make sure we are sent the correct info
             assert json is not None
@@ -151,8 +150,8 @@ class RegisterTestCase(TestCase):
         requests.post = post
 
         # The fake stdout will be written here
-        out: List[str] = []
-        err_code: List[int] = []
+        out: list[str] = []
+        err_code: list[int] = []
 
         with patch("synapse._scripts.register_new_matrix_user.requests", requests):
             request_registration(
diff --git a/tests/server.py b/tests/server.py
index 3a81a4c6d9..55860701da 100644
--- a/tests/server.py
+++ b/tests/server.py
@@ -28,21 +28,17 @@ import sqlite3
 import time
 import uuid
 import warnings
+import weakref
 from collections import deque
 from io import SEEK_END, BytesIO
 from typing import (
     Any,
     Awaitable,
     Callable,
-    Deque,
-    Dict,
     Iterable,
-    List,
     MutableMapping,
     Optional,
     Sequence,
-    Tuple,
-    Type,
     TypeVar,
     Union,
     cast,
@@ -56,7 +52,7 @@ from zope.interface import implementer
 
 import twisted
 from twisted.enterprise import adbapi
-from twisted.internet import address, tcp, threads, udp
+from twisted.internet import address, defer, tcp, threads, udp
 from twisted.internet._resolver import SimpleResolverComplexifier
 from twisted.internet.address import IPv4Address, IPv6Address
 from twisted.internet.defer import Deferred, fail, maybeDeferred, succeed
@@ -85,6 +81,7 @@ from twisted.web.http_headers import Headers
 from twisted.web.resource import IResource
 from twisted.web.server import Request, Site
 
+from synapse.api.constants import MAX_REQUEST_SIZE
 from synapse.config.database import DatabaseConnectionConfig
 from synapse.config.homeserver import HomeServerConfig
 from synapse.events.auto_accept_invites import InviteAutoAccepter
@@ -103,7 +100,7 @@ from synapse.storage.database import LoggingDatabaseConnection, make_pool
 from synapse.storage.engines import BaseDatabaseEngine, create_engine
 from synapse.storage.prepare_database import prepare_database
 from synapse.types import ISynapseReactor, JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.utils import (
     LEAVE_DB,
@@ -114,7 +111,6 @@ from tests.utils import (
     POSTGRES_USER,
     SQLITE_PERSIST_DB,
     USE_POSTGRES_FOR_TESTS,
-    MockClock,
     default_config,
 )
 
@@ -124,11 +120,11 @@ R = TypeVar("R")
 P = ParamSpec("P")
 
 # the type of thing that can be passed into `make_request` in the headers list
-CustomHeaderType = Tuple[Union[str, bytes], Union[str, bytes]]
+CustomHeaderType = tuple[str | bytes, str | bytes]
 
 # A pre-prepared SQLite DB that is used as a template when creating new SQLite
 # DB each test run. This dramatically speeds up test set up when using SQLite.
-PREPPED_SQLITE_DB_CONN: Optional[LoggingDatabaseConnection] = None
+PREPPED_SQLITE_DB_CONN: LoggingDatabaseConnection | None = None
 
 
 class TimedOutException(Exception):
@@ -152,8 +148,8 @@ class FakeChannel:
     result: dict = attr.Factory(dict)
     _ip: str = "127.0.0.1"
     _producer: Optional[Union[IPullProducer, IPushProducer]] = None
-    resource_usage: Optional[ContextResourceUsage] = None
-    _request: Optional[Request] = None
+    resource_usage: ContextResourceUsage | None = None
+    _request: Request | None = None
 
     @property
     def request(self) -> Request:
@@ -172,7 +168,7 @@ class FakeChannel:
         return body
 
     @property
-    def json_list(self) -> List[JsonDict]:
+    def json_list(self) -> list[JsonDict]:
         body = json.loads(self.text_body)
         assert isinstance(body, list)
         return body
@@ -211,7 +207,7 @@ class FakeChannel:
         version: bytes,
         code: bytes,
         reason: bytes,
-        headers: Union[Headers, List[Tuple[bytes, bytes]]],
+        headers: Headers | list[tuple[bytes, bytes]],
     ) -> None:
         self.result["version"] = version
         self.result["code"] = code
@@ -246,7 +242,6 @@ class FakeChannel:
 
     def loseConnection(self) -> None:
         self.unregisterProducer()
-        self.transport.loseConnection()
 
     # Type ignore: mypy doesn't like the fact that producer isn't an IProducer.
     def registerProducer(self, producer: IProducer, streaming: bool) -> None:
@@ -362,18 +357,18 @@ class FakeSite:
 
 def make_request(
     reactor: MemoryReactorClock,
-    site: Union[Site, FakeSite],
-    method: Union[bytes, str],
-    path: Union[bytes, str],
-    content: Union[bytes, str, JsonDict] = b"",
-    access_token: Optional[str] = None,
-    request: Type[Request] = SynapseRequest,
+    site: Site | FakeSite,
+    method: bytes | str,
+    path: bytes | str,
+    content: bytes | str | JsonDict = b"",
+    access_token: str | None = None,
+    request: type[Request] = SynapseRequest,
     shorthand: bool = True,
-    federation_auth_origin: Optional[bytes] = None,
-    content_type: Optional[bytes] = None,
+    federation_auth_origin: bytes | None = None,
+    content_type: bytes | None = None,
     content_is_form: bool = False,
     await_result: bool = True,
-    custom_headers: Optional[Iterable[CustomHeaderType]] = None,
+    custom_headers: Iterable[CustomHeaderType] | None = None,
     client_ip: str = "127.0.0.1",
 ) -> FakeChannel:
     """
@@ -433,18 +428,29 @@ def make_request(
 
     channel = FakeChannel(site, reactor, ip=client_ip)
 
-    req = request(channel, site, our_server_name="test_server")
+    req = request(
+        channel,
+        site,
+        our_server_name="test_server",
+        max_request_body_size=MAX_REQUEST_SIZE,
+    )
     channel.request = req
 
     req.content = BytesIO(content)
     # Twisted expects to be at the end of the content when parsing the request.
     req.content.seek(0, SEEK_END)
 
-    # Old version of Twisted (<20.3.0) have issues with parsing x-www-form-urlencoded
-    # bodies if the Content-Length header is missing
-    req.requestHeaders.addRawHeader(
-        b"Content-Length", str(len(content)).encode("ascii")
-    )
+    # If `Content-Length` was passed in as a custom header, don't automatically add it
+    # here.
+    if custom_headers is None or not any(
+        (k if isinstance(k, bytes) else k.encode("ascii")) == b"Content-Length"
+        for k, _ in custom_headers
+    ):
+        # Old version of Twisted (<20.3.0) have issues with parsing x-www-form-urlencoded
+        # bodies if the Content-Length header is missing
+        req.requestHeaders.addRawHeader(
+            b"Content-Length", str(len(content)).encode("ascii")
+        )
 
     if access_token:
         req.requestHeaders.addRawHeader(
@@ -492,17 +498,17 @@ class ThreadedMemoryReactorClock(MemoryReactorClock):
     def __init__(self) -> None:
         self.threadpool = ThreadPool(self)
 
-        self._tcp_callbacks: Dict[Tuple[str, int], Callable] = {}
-        self._udp: List[udp.Port] = []
-        self.lookups: Dict[str, str] = {}
-        self._thread_callbacks: Deque[Callable[..., R]] = deque()
+        self._tcp_callbacks: dict[tuple[str, int], Callable] = {}
+        self._udp: list[udp.Port] = []
+        self.lookups: dict[str, str] = {}
+        self._thread_callbacks: deque[Callable[..., R]] = deque()
 
         lookups = self.lookups
 
         @implementer(IResolverSimple)
         class FakeResolver:
             def getHostByName(
-                self, name: str, timeout: Optional[Sequence[int]] = None
+                self, name: str, timeout: Sequence[int] | None = None
             ) -> "Deferred[str]":
                 if name not in lookups:
                     return fail(DNSLookupError("OH NO: unknown %s" % (name,)))
@@ -525,6 +531,19 @@ class ThreadedMemoryReactorClock(MemoryReactorClock):
         # overwrite it again.
         self.nameResolver = SimpleResolverComplexifier(FakeResolver())
 
+    def run(self) -> None:
+        """
+        Override the call from `MemoryReactorClock` to add an additional step that
+        cleans up any `whenRunningHooks` that have been called.
+        This is necessary for a clean shutdown to occur as these hooks can hold
+        references to the `SynapseHomeServer`.
+        """
+        super().run()
+
+        # `MemoryReactorClock` never clears the hooks that have already been called.
+        # So manually clear the hooks here after they have been run.
+        self.whenRunningHooks.clear()
+
     def installNameResolver(self, resolver: IHostnameResolver) -> IHostnameResolver:
         raise NotImplementedError()
 
@@ -609,7 +628,7 @@ class ThreadedMemoryReactorClock(MemoryReactorClock):
         port: int,
         factory: ClientFactory,
         timeout: float = 30,
-        bindAddress: Optional[Tuple[str, int]] = None,
+        bindAddress: tuple[str, int] | None = None,
     ) -> IConnector:
         """Fake L{IReactorTCP.connectTCP}."""
 
@@ -650,6 +669,19 @@ class ThreadedMemoryReactorClock(MemoryReactorClock):
             super().advance(0)
 
 
+def cleanup_test_reactor_system_event_triggers(
+    reactor: ThreadedMemoryReactorClock,
+) -> None:
+    """Cleanup any registered system event triggers.
+    The `twisted.internet.test.ThreadedMemoryReactor` does not implement
+    `removeSystemEventTrigger` so won't clean these triggers up on it's own properly.
+    When trying to override `removeSystemEventTrigger` in `ThreadedMemoryReactorClock`
+    in order to implement this functionality, twisted complains about the reactor being
+    unclean and fails some tests.
+    """
+    reactor.triggers.clear()
+
+
 def validate_connector(connector: tcp.Connector, expected_ip: str) -> None:
     """Try to validate the obtained connector as it would happen when
     synapse is running and the conection will be established.
@@ -767,7 +799,7 @@ class ThreadPool:
 
     def callInThreadWithCallback(
         self,
-        onResult: Callable[[bool, Union[Failure, R]], None],
+        onResult: Callable[[bool, Failure | R], None],
         function: Callable[P, R],
         *args: P.args,
         **kwargs: P.kwargs,
@@ -781,14 +813,19 @@ class ThreadPool:
         d: "Deferred[None]" = Deferred()
         d.addCallback(lambda x: function(*args, **kwargs))
         d.addBoth(_)
-        self._reactor.callLater(0, d.callback, True)
+        # mypy ignored here because:
+        #   - this is part of the test infrastructure (outside of Synapse) so tracking
+        #     these calls for for homeserver shutdown doesn't make sense.
+        self._reactor.callLater(0, d.callback, True)  # type: ignore[call-later-not-tracked]
         return d
 
 
-def get_clock() -> Tuple[ThreadedMemoryReactorClock, Clock]:
-    clock = ThreadedMemoryReactorClock()
-    hs_clock = Clock(clock)
-    return clock, hs_clock
+def get_clock() -> tuple[ThreadedMemoryReactorClock, Clock]:
+    # Ignore the linter error since this is an expected usage of creating a `Clock` for
+    # testing purposes.
+    reactor = ThreadedMemoryReactorClock()
+    hs_clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+    return reactor, hs_clock
 
 
 @implementer(ITCPTransport)
@@ -820,12 +857,12 @@ class FakeTransport:
     will get called back for connectionLost() notifications etc.
     """
 
-    _peer_address: Union[IPv4Address, IPv6Address] = attr.Factory(
+    _peer_address: IPv4Address | IPv6Address = attr.Factory(
         lambda: address.IPv4Address("TCP", "127.0.0.1", 5678)
     )
     """The value to be returned by getPeer"""
 
-    _host_address: Union[IPv4Address, IPv6Address] = attr.Factory(
+    _host_address: IPv4Address | IPv6Address = attr.Factory(
         lambda: address.IPv4Address("TCP", "127.0.0.1", 1234)
     )
     """The value to be returned by getHost"""
@@ -837,10 +874,10 @@ class FakeTransport:
     producer: Optional[IPushProducer] = None
     autoflush: bool = True
 
-    def getPeer(self) -> Union[IPv4Address, IPv6Address]:
+    def getPeer(self) -> IPv4Address | IPv6Address:
         return self._peer_address
 
-    def getHost(self) -> Union[IPv4Address, IPv6Address]:
+    def getHost(self) -> IPv4Address | IPv6Address:
         return self._host_address
 
     def loseConnection(self) -> None:
@@ -899,10 +936,16 @@ class FakeTransport:
             # some implementations of IProducer (for example, FileSender)
             # don't return a deferred.
             d = maybeDeferred(self.producer.resumeProducing)
-            d.addCallback(lambda x: self._reactor.callLater(0.1, _produce))
+            # mypy ignored here because:
+            #   - this is part of the test infrastructure (outside of Synapse) so tracking
+            #     these calls for for homeserver shutdown doesn't make sense.
+            d.addCallback(lambda x: self._reactor.callLater(0.1, _produce))  # type: ignore[call-later-not-tracked,call-overload]
 
         if not streaming:
-            self._reactor.callLater(0.0, _produce)
+            # mypy ignored here because:
+            #   - this is part of the test infrastructure (outside of Synapse) so tracking
+            #     these calls for for homeserver shutdown doesn't make sense.
+            self._reactor.callLater(0.0, _produce)  # type: ignore[call-later-not-tracked]
 
     def write(self, byt: bytes) -> None:
         if self.disconnecting:
@@ -914,13 +957,16 @@ class FakeTransport:
         # TLSMemoryBIOProtocol) get very confused if a read comes back while they are
         # still doing a write. Doing a callLater here breaks the cycle.
         if self.autoflush:
-            self._reactor.callLater(0.0, self.flush)
+            # mypy ignored here because:
+            #   - this is part of the test infrastructure (outside of Synapse) so tracking
+            #     these calls for for homeserver shutdown doesn't make sense.
+            self._reactor.callLater(0.0, self.flush)  # type: ignore[call-later-not-tracked]
 
     def writeSequence(self, seq: Iterable[bytes]) -> None:
         for x in seq:
             self.write(x)
 
-    def flush(self, maxbytes: Optional[int] = None) -> None:
+    def flush(self, maxbytes: int | None = None) -> None:
         if not self.buffer:
             # nothing to do. Don't write empty buffers: it upsets the
             # TLSMemoryBIOProtocol
@@ -944,7 +990,10 @@ class FakeTransport:
 
         self.buffer = self.buffer[len(to_write) :]
         if self.buffer and self.autoflush:
-            self._reactor.callLater(0.0, self.flush)
+            # mypy ignored here because:
+            #   - this is part of the test infrastructure (outside of Synapse) so tracking
+            #     these calls for for homeserver shutdown doesn't make sense.
+            self._reactor.callLater(0.0, self.flush)  # type: ignore[call-later-not-tracked]
 
         if not self.buffer and self.disconnecting:
             logger.info("FakeTransport: Buffer now empty, completing disconnect")
@@ -998,7 +1047,7 @@ class FakeTransport:
 
 def connect_client(
     reactor: ThreadedMemoryReactorClock, client_id: int
-) -> Tuple[IProtocol, AccumulatingProtocol]:
+) -> tuple[IProtocol, AccumulatingProtocol]:
     """
     Connect a client to a fake TCP transport.
 
@@ -1020,12 +1069,14 @@ class TestHomeServer(HomeServer):
 
 
 def setup_test_homeserver(
-    cleanup_func: Callable[[Callable[[], None]], None],
-    name: str = "test",
-    config: Optional[HomeServerConfig] = None,
+    *,
+    cleanup_func: Callable[[Callable[[], Optional["Deferred[None]"]]], None],
+    server_name: str = "test",
+    config: HomeServerConfig | None = None,
     reactor: Optional[ISynapseReactor] = None,
-    homeserver_to_use: Type[HomeServer] = TestHomeServer,
-    **kwargs: Any,
+    homeserver_to_use: type[HomeServer] = TestHomeServer,
+    db_txn_limit: int | None = None,
+    **extra_homeserver_attributes: Any,
 ) -> HomeServer:
     """
     Setup a homeserver suitable for running tests against.  Keyword arguments
@@ -1034,29 +1085,45 @@ def setup_test_homeserver(
     If no datastore is supplied, one is created and given to the homeserver.
 
     Args:
-        cleanup_func : The function used to register a cleanup routine for
-                       after the test.
+        cleanup_func: The function used to register a cleanup routine for
+            after the test. If the function returns a Deferred, the
+            test case will wait until the Deferred has fired before
+            proceeding to the next cleanup function.
+        server_name: Homeserver name
+        config: Homeserver config
+        reactor: Twisted reactor
+        homeserver_to_use: Homeserver class to instantiate.
+        db_txn_limit: Gives the maximum number of database transactions to run per
+            connection before reconnecting. 0 means no limit. If unset, defaults to None
+            here which will default upstream to `0`.
+        **extra_homeserver_attributes: Additional keyword arguments to install as
+            `@cache_in_self` attributes on the homeserver. For example, `clock` will be
+            installed as `hs._clock`.
 
     Calling this method directly is deprecated: you should instead derive from
     HomeserverTestCase.
     """
     if reactor is None:
-        from twisted.internet import reactor as _reactor
-
-        reactor = cast(ISynapseReactor, _reactor)
+        reactor = ThreadedMemoryReactorClock()
 
     if config is None:
-        config = default_config(name, parse=True)
+        config = default_config(server_name, parse=True)
+
+    server_name = config.server.server_name
+    if not isinstance(server_name, str):
+        raise ConfigError("Must be a string", ("server_name",))
+
+    if "clock" not in extra_homeserver_attributes:
+        # Ignore `multiple-internal-clocks` linter error here since we are creating a `Clock`
+        # for testing purposes (i.e. outside of Synapse).
+        extra_homeserver_attributes["clock"] = Clock(reactor, server_name=server_name)  # type: ignore[multiple-internal-clocks]
 
     config.caches.resize_all_caches()
 
-    if "clock" not in kwargs:
-        kwargs["clock"] = MockClock()
-
     if USE_POSTGRES_FOR_TESTS:
         test_db = "synapse_test_%s" % uuid.uuid4().hex
 
-        database_config = {
+        database_config: JsonDict = {
             "name": "psycopg2",
             "args": {
                 "dbname": test_db,
@@ -1088,10 +1155,6 @@ def setup_test_homeserver(
             "args": {"database": test_db_location, "cp_min": 1, "cp_max": 1},
         }
 
-        server_name = config.server.server_name
-        if not isinstance(server_name, str):
-            raise ConfigError("Must be a string", ("server_name",))
-
         # Check if we have set up a DB that we can use as a template.
         global PREPPED_SQLITE_DB_CONN
         if PREPPED_SQLITE_DB_CONN is None:
@@ -1111,8 +1174,8 @@ def setup_test_homeserver(
 
         database_config["_TEST_PREPPED_CONN"] = PREPPED_SQLITE_DB_CONN
 
-    if "db_txn_limit" in kwargs:
-        database_config["txn_limit"] = kwargs["db_txn_limit"]
+    if db_txn_limit is not None:
+        database_config["txn_limit"] = db_txn_limit
 
     database = DatabaseConnectionConfig("master", database_config)
     config.database.databases = [database]
@@ -1138,39 +1201,9 @@ def setup_test_homeserver(
         cur.close()
         db_conn.close()
 
-    hs = homeserver_to_use(
-        name,
-        config=config,
-        version_string="Synapse/tests",
-        reactor=reactor,
-    )
-
-    # Install @cache_in_self attributes
-    for key, val in kwargs.items():
-        setattr(hs, "_" + key, val)
-
-    # Mock TLS
-    hs.tls_server_context_factory = Mock()
-
-    # Patch `make_pool` before initialising the database, to make database transactions
-    # synchronous for testing.
-    with patch("synapse.storage.database.make_pool", side_effect=make_fake_db_pool):
-        hs.setup()
-
-    # Since we've changed the databases to run DB transactions on the same
-    # thread, we need to stop the event fetcher hogging that one thread.
-    hs.get_datastores().main.USE_DEDICATED_DB_THREADS_FOR_EVENT_FETCHING = False
-
-    if USE_POSTGRES_FOR_TESTS:
-        database_pool = hs.get_datastores().databases[0]
-
-        # We need to do cleanup on PostgreSQL
         def cleanup() -> None:
             import psycopg2
 
-            # Close all the db pools
-            database_pool._db_pool.close()
-
             dropped = False
 
             # Drop the test database
@@ -1215,6 +1248,96 @@ def setup_test_homeserver(
             # Register the cleanup hook
             cleanup_func(cleanup)
 
+    hs = homeserver_to_use(
+        server_name,
+        config=config,
+        reactor=reactor,
+    )
+
+    # Capture the `hs` as a `weakref` here to ensure there is no scenario where uncalled
+    # cleanup functions result in holding the `hs` in memory.
+    cleanup_hs_ref = weakref.ref(hs)
+
+    def shutdown_hs_on_cleanup() -> "Deferred[None]":
+        cleanup_hs = cleanup_hs_ref()
+        deferred: "Deferred[None]" = defer.succeed(None)
+        if cleanup_hs is not None:
+            deferred = defer.ensureDeferred(cleanup_hs.shutdown())
+        return deferred
+
+    # Register the cleanup hook for the homeserver.
+    # A full `hs.shutdown()` is necessary otherwise CI tests will fail while exhibiting
+    # strange behaviours.
+    cleanup_func(shutdown_hs_on_cleanup)
+
+    # Install @cache_in_self attributes
+    for key, val in extra_homeserver_attributes.items():
+        setattr(hs, "_" + key, val)
+
+    # Mock TLS
+    hs.tls_server_context_factory = Mock()
+
+    # Patch `make_pool` before initialising the database, to make database transactions
+    # synchronous for testing.
+    with patch("synapse.storage.database.make_pool", side_effect=make_fake_db_pool):
+        hs.setup()
+
+    # Ideally, setup/start would be separated but since this is historically used
+    # throughout tests, we keep the existing behavior for now. We probably just need to
+    # rename this function.
+    start_test_homeserver(hs=hs, cleanup_func=cleanup_func, reactor=reactor)
+
+    return hs
+
+
+def start_test_homeserver(
+    *,
+    hs: HomeServer,
+    cleanup_func: Callable[[Callable[[], Optional["Deferred[None]"]]], None],
+    reactor: ISynapseReactor,
+) -> None:
+    """
+    Start a homeserver for testing.
+
+    Args:
+        hs: The homeserver to start.
+        cleanup_func: The function used to register a cleanup routine for
+            after the test. If the function returns a Deferred, the
+            test case will wait until the Deferred has fired before
+            proceeding to the next cleanup function.
+        reactor: Twisted reactor
+    """
+
+    # Register background tasks required by this server. This must be done
+    # somewhat manually due to the background tasks not being registered
+    # unless handlers are instantiated.
+    #
+    # Since, we don't have to worry about `daemonize` (forking the process) in tests, we
+    # can just start the background tasks straight away after `hs.setup`. (compare this
+    # with where we call `hs.start_background_tasks()` outside of the test environment).
+    if hs.config.worker.run_background_tasks:
+        hs.start_background_tasks()
+
+    # Since we've changed the databases to run DB transactions on the same
+    # thread, we need to stop the event fetcher hogging that one thread.
+    hs.get_datastores().main.USE_DEDICATED_DB_THREADS_FOR_EVENT_FETCHING = False
+
+    if USE_POSTGRES_FOR_TESTS:
+        # Capture the `database_pool` as a `weakref` here to ensure there is no scenario where uncalled
+        # cleanup functions result in holding the `hs` in memory.
+        database_pool = weakref.ref(hs.get_datastores().databases[0])
+
+        # We need to do cleanup on PostgreSQL
+        def cleanup() -> None:
+            # Close all the db pools
+            db_pool = database_pool()
+            if db_pool is not None:
+                db_pool._db_pool.close()
+
+        if not LEAVE_DB:
+            # Register the cleanup hook
+            cleanup_func(cleanup)
+
     # bcrypt is far too slow to be doing in unit tests
     # Need to let the HS build an auth handler and then mess with it
     # because AuthHandler's constructor requires the HS, so we can't make one
@@ -1235,6 +1358,16 @@ def setup_test_homeserver(
 
     hs.get_media_sender_thread_pool = thread_pool  # type: ignore[method-assign]
 
+    # Load the OIDC provider metadatas, if OIDC is enabled.
+    # This matches `start` in synapse/app/_base.py
+    #
+    # TODO: Extract common startup logic somewhere cleaner
+    if hs.config.oidc.oidc_enabled:
+        oidc = hs.get_oidc_handler()
+        # Preload the provider metadata.
+        # This will spawn fire-and-forget background processes.
+        oidc.preload_metadata()
+
     # Load any configured modules into the homeserver
     module_api = hs.get_module_api()
     for module, module_config in hs.config.modules.loaded_modules:
@@ -1249,5 +1382,3 @@ def setup_test_homeserver(
     load_legacy_third_party_event_rules(hs)
     load_legacy_presence_router(hs)
     load_legacy_password_auth_providers(hs)
-
-    return hs
diff --git a/tests/server_notices/__init__.py b/tests/server_notices/__init__.py
index 1d23a126de..19bda218e3 100644
--- a/tests/server_notices/__init__.py
+++ b/tests/server_notices/__init__.py
@@ -19,7 +19,8 @@ import synapse.rest.admin
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 from tests import unittest
 from tests.unittest import override_config
@@ -131,7 +132,7 @@ class ServerNoticesTests(unittest.HomeserverTestCase):
                 break
 
             # Sleep and try again.
-            self.get_success(self.clock.sleep(0.1))
+            self.get_success(self.clock.sleep(Duration(milliseconds=100)))
         else:
             self.fail(
                 f"Failed to join the server notices room. No 'join' field in sync_body['rooms']: {sync_body['rooms']}"
diff --git a/tests/server_notices/test_consent.py b/tests/server_notices/test_consent.py
index db4a6370e8..45ed5b39d6 100644
--- a/tests/server_notices/test_consent.py
+++ b/tests/server_notices/test_consent.py
@@ -25,7 +25,7 @@ from twisted.internet.testing import MemoryReactor
 import synapse.rest.admin
 from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/server_notices/test_resource_limits_server_notices.py b/tests/server_notices/test_resource_limits_server_notices.py
index 0da12f14cd..a0c5582496 100644
--- a/tests/server_notices/test_resource_limits_server_notices.py
+++ b/tests/server_notices/test_resource_limits_server_notices.py
@@ -17,7 +17,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Tuple
 from unittest.mock import AsyncMock, Mock
 
 from twisted.internet.testing import MemoryReactor
@@ -32,7 +31,7 @@ from synapse.server_notices.resource_limits_server_notices import (
 )
 from synapse.server_notices.server_notices_sender import ServerNoticesSender
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -363,7 +362,7 @@ class TestResourceLimitsServerNoticesWithRealRooms(unittest.HomeserverTestCase):
 
         self.assertTrue(notice_in_room, "No server notice in room")
 
-    def _trigger_notice_and_join(self) -> Tuple[str, str, str]:
+    def _trigger_notice_and_join(self) -> tuple[str, str, str]:
         """Creates enough active users to hit the MAU limit and trigger a system notice
         about it, then joins the system notices room with one of the users created.
 
diff --git a/tests/state/test_v2.py b/tests/state/test_v2.py
index b4f2b98cc4..85ce5bede2 100644
--- a/tests/state/test_v2.py
+++ b/tests/state/test_v2.py
@@ -21,13 +21,8 @@
 import itertools
 from typing import (
     Collection,
-    Dict,
     Iterable,
-    List,
     Mapping,
-    Optional,
-    Set,
-    Tuple,
     TypeVar,
 )
 
@@ -47,6 +42,7 @@ from synapse.state.v2 import (
 )
 from synapse.storage.databases.main.event_federation import StateDifference
 from synapse.types import EventID, StateMap
+from synapse.util.duration import Duration
 
 from tests import unittest
 
@@ -66,7 +62,7 @@ ORIGIN_SERVER_TS = 0
 
 
 class FakeClock:
-    async def sleep(self, msec: float) -> None:
+    async def sleep(self, duration: Duration) -> None:
         return None
 
 
@@ -83,7 +79,7 @@ class FakeEvent:
         id: str,
         sender: str,
         type: str,
-        state_key: Optional[str],
+        state_key: str | None,
         content: Mapping[str, object],
     ):
         self.node_id = id
@@ -94,7 +90,7 @@ class FakeEvent:
         self.content = content
         self.room_id = ROOM_ID
 
-    def to_event(self, auth_events: List[str], prev_events: List[str]) -> EventBase:
+    def to_event(self, auth_events: list[str], prev_events: list[str]) -> EventBase:
         """Given the auth_events and prev_events, convert to a Frozen Event
 
         Args:
@@ -461,9 +457,9 @@ class StateTestCase(unittest.TestCase):
 
     def do_check(
         self,
-        events: List[FakeEvent],
-        edges: List[List[str]],
-        expected_state_ids: List[str],
+        events: list[FakeEvent],
+        edges: list[list[str]],
+        expected_state_ids: list[str],
     ) -> None:
         """Take a list of events and edges and calculate the state of the
         graph at END, and asserts it matches `expected_state_ids`
@@ -476,9 +472,9 @@ class StateTestCase(unittest.TestCase):
                 the keys that haven't changed since START).
         """
         # We want to sort the events into topological order for processing.
-        graph: Dict[str, Set[str]] = {}
+        graph: dict[str, set[str]] = {}
 
-        fake_event_map: Dict[str, FakeEvent] = {}
+        fake_event_map: dict[str, FakeEvent] = {}
 
         for ev in itertools.chain(INITIAL_EVENTS, events):
             graph[ev.node_id] = set()
@@ -491,8 +487,8 @@ class StateTestCase(unittest.TestCase):
             for a, b in pairwise(edge_list):
                 graph[a].add(b)
 
-        event_map: Dict[str, EventBase] = {}
-        state_at_event: Dict[str, StateMap[str]] = {}
+        event_map: dict[str, EventBase] = {}
+        state_at_event: dict[str, StateMap[str]] = {}
 
         # We copy the map as the sort consumes the graph
         graph_copy = {k: set(v) for k, v in graph.items()}
@@ -529,7 +525,7 @@ class StateTestCase(unittest.TestCase):
             #    EventBuilder. But this is Hard because the relevant attributes are
             #    DictProperty[T] descriptors on EventBase but normal Ts on FakeEvent.
             # 2. Define a `GenericEvent` Protocol describing `FakeEvent` only, and
-            #    change this function to accept Union[Event, EventBase, EventBuilder].
+            #    change this function to accept Event | EventBase | EventBuilder.
             #    This seems reasonable to me, but mypy isn't happy. I think that's
             #    a mypy bug, see https://github.com/python/mypy/issues/5570
             # Instead, resort to a type-ignore.
@@ -568,7 +564,7 @@ class StateTestCase(unittest.TestCase):
 
 class LexicographicalTestCase(unittest.TestCase):
     def test_simple(self) -> None:
-        graph: Dict[str, Set[str]] = {
+        graph: dict[str, set[str]] = {
             "l": {"o"},
             "m": {"n", "o"},
             "n": {"o"},
@@ -1020,7 +1016,7 @@ class AuthChainDifferenceTestCase(unittest.TestCase):
 T = TypeVar("T")
 
 
-def pairwise(iterable: Iterable[T]) -> Iterable[Tuple[T, T]]:
+def pairwise(iterable: Iterable[T]) -> Iterable[tuple[T, T]]:
     "s -> (s0,s1), (s1,s2), (s2, s3), ..."
     a, b = itertools.tee(iterable)
     next(b, None)
@@ -1029,11 +1025,11 @@ def pairwise(iterable: Iterable[T]) -> Iterable[Tuple[T, T]]:
 
 @attr.s
 class TestStateResolutionStore:
-    event_map: Dict[str, EventBase] = attr.ib()
+    event_map: dict[str, EventBase] = attr.ib()
 
     def get_events(
         self, event_ids: Collection[str], allow_rejected: bool = False
-    ) -> "defer.Deferred[Dict[str, EventBase]]":
+    ) -> "defer.Deferred[dict[str, EventBase]]":
         """Get events from the database
 
         Args:
@@ -1048,7 +1044,7 @@ class TestStateResolutionStore:
             {eid: self.event_map[eid] for eid in event_ids if eid in self.event_map}
         )
 
-    def _get_auth_chain(self, event_ids: Iterable[str]) -> List[str]:
+    def _get_auth_chain(self, event_ids: Iterable[str]) -> list[str]:
         """Gets the full auth chain for a set of events (including rejected
         events).
 
@@ -1085,9 +1081,9 @@ class TestStateResolutionStore:
     def get_auth_chain_difference(
         self,
         room_id: str,
-        auth_sets: List[Set[str]],
-        conflicted_state: Optional[Set[str]],
-        additional_backwards_reachable_conflicted_events: Optional[Set[str]],
+        auth_sets: list[set[str]],
+        conflicted_state: set[str] | None,
+        additional_backwards_reachable_conflicted_events: set[str] | None,
     ) -> "defer.Deferred[StateDifference]":
         chains = [frozenset(self._get_auth_chain(a)) for a in auth_sets]
 
diff --git a/tests/state/test_v21.py b/tests/state/test_v21.py
index 5e46b69fef..9f607176c9 100644
--- a/tests/state/test_v21.py
+++ b/tests/state/test_v21.py
@@ -18,7 +18,7 @@
 #
 #
 import itertools
-from typing import Dict, List, Optional, Sequence, Set
+from typing import Sequence
 
 from twisted.internet import defer
 from twisted.test.proto_helpers import MemoryReactor
@@ -38,7 +38,8 @@ from synapse.state.v2 import (
     resolve_events_with_store,
 )
 from synapse.types import StateMap
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 from tests import unittest
 from tests.state.test_v2 import TestStateResolutionStore
@@ -66,7 +67,7 @@ def monotonic_timestamp() -> int:
 
 
 class FakeClock:
-    async def sleep(self, duration_ms: float) -> None:
+    async def sleep(self, duration: Duration) -> None:
         defer.succeed(None)
 
 
@@ -357,11 +358,11 @@ class StateResV21TestCase(unittest.HomeserverTestCase):
         self,
         room_id: str,
         state_maps: Sequence[StateMap[str]],
-        event_map: Optional[Dict[str, EventBase]],
+        event_map: dict[str, EventBase] | None,
         state_res_store: StateResolutionStoreInterface,
-    ) -> Set[str]:
+    ) -> set[str]:
         _, conflicted_state = _seperate(state_maps)
-        conflicted_set: Optional[Set[str]] = set(
+        conflicted_set: set[str] | None = set(
             itertools.chain.from_iterable(conflicted_state.values())
         )
         if event_map is None:
@@ -377,7 +378,7 @@ class StateResV21TestCase(unittest.HomeserverTestCase):
     def get_resolution_and_verify_expected(
         self,
         state_maps: Sequence[StateMap[str]],
-        events: List[EventBase],
+        events: list[EventBase],
         expected: StateMap[str],
     ) -> None:
         room_id = events[0].room_id
@@ -446,7 +447,7 @@ class StateResV21TestCase(unittest.HomeserverTestCase):
                 )
             )
             # no matter how many events are persisted, the overall diff should always be the same.
-            self.assertEquals(got_auth_diff, got_auth_diff2)
+            self.assertEqual(got_auth_diff, got_auth_diff2)
 
         # now we will drip feed in `events` one-by-one, persisting them then resolving with the
         # rest. This ensures we correctly handle mixed persisted/unpersisted events. We will finish
@@ -458,7 +459,7 @@ class StateResV21TestCase(unittest.HomeserverTestCase):
             resolve_and_check()
 
     def persist_event(
-        self, event: EventBase, state: Optional[StateMap[str]] = None
+        self, event: EventBase, state: StateMap[str] | None = None
     ) -> None:
         """Persist the event, with optional state"""
         context = self.get_success(
@@ -473,12 +474,12 @@ class StateResV21TestCase(unittest.HomeserverTestCase):
     def create_event(
         self,
         event_type: str,
-        state_key: Optional[str],
+        state_key: str | None,
         sender: str,
-        content: Dict,
-        auth_events: List[str],
-        prev_events: Optional[List[str]] = None,
-        room_id: Optional[str] = None,
+        content: dict,
+        auth_events: list[str],
+        prev_events: list[str] | None = None,
+        room_id: str | None = None,
     ) -> EventBase:
         """Short-hand for event_from_pdu_json for fields we typically care about.
         Tests can override by just calling event_from_pdu_json directly."""
diff --git a/tests/storage/databases/main/test_deviceinbox.py b/tests/storage/databases/main/test_deviceinbox.py
index d3ddeaa57e..be585068fe 100644
--- a/tests/storage/databases/main/test_deviceinbox.py
+++ b/tests/storage/databases/main/test_deviceinbox.py
@@ -28,9 +28,9 @@ from synapse.rest import admin
 from synapse.rest.client import devices
 from synapse.server import HomeServer
 from synapse.storage.databases.main.deviceinbox import (
-    DEVICE_FEDERATION_INBOX_CLEANUP_DELAY_MS,
+    DEVICE_FEDERATION_INBOX_CLEANUP_DELAY,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -191,7 +191,7 @@ class DeviceInboxFederationInboxCleanupTestCase(HomeserverTestCase):
         self.db_pool = self.store.db_pool
 
         # Advance time to ensure we are past the cleanup delay
-        self.reactor.advance(DEVICE_FEDERATION_INBOX_CLEANUP_DELAY_MS * 2 / 1000)
+        self.reactor.advance(DEVICE_FEDERATION_INBOX_CLEANUP_DELAY.as_secs() * 2)
 
     def test_delete_old_federation_inbox_rows_skips_if_no_index(self) -> None:
         """Test that we don't delete rows if the index hasn't been created yet."""
@@ -245,7 +245,7 @@ class DeviceInboxFederationInboxCleanupTestCase(HomeserverTestCase):
                 )
             )
 
-        self.reactor.advance(2 * DEVICE_FEDERATION_INBOX_CLEANUP_DELAY_MS / 1000)
+        self.reactor.advance(2 * DEVICE_FEDERATION_INBOX_CLEANUP_DELAY.as_secs())
 
         # Insert new messages
         for i in range(5):
@@ -293,7 +293,7 @@ class DeviceInboxFederationInboxCleanupTestCase(HomeserverTestCase):
             )
 
         # Advance time to ensure we are past the cleanup delay
-        self.reactor.advance(2 * DEVICE_FEDERATION_INBOX_CLEANUP_DELAY_MS / 1000)
+        self.reactor.advance(2 * DEVICE_FEDERATION_INBOX_CLEANUP_DELAY.as_millis())
 
         # Run the cleanup - it should delete in batches and sleep between them
         deferred = defer.ensureDeferred(
diff --git a/tests/storage/databases/main/test_end_to_end_keys.py b/tests/storage/databases/main/test_end_to_end_keys.py
index 3992fc3264..d21dac6024 100644
--- a/tests/storage/databases/main/test_end_to_end_keys.py
+++ b/tests/storage/databases/main/test_end_to_end_keys.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional, Tuple
 
 from twisted.internet.testing import MemoryReactor
 
@@ -26,7 +25,7 @@ from synapse.server import HomeServer
 from synapse.storage._base import db_to_json
 from synapse.storage.database import LoggingTransaction
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -99,7 +98,7 @@ class EndToEndKeyWorkerStoreTestCase(HomeserverTestCase):
 
         def check_timestamp_column(
             txn: LoggingTransaction,
-        ) -> List[Tuple[JsonDict, Optional[int]]]:
+        ) -> list[tuple[JsonDict, int | None]]:
             """Fetch all rows for Alice's keys."""
             txn.execute(
                 """
diff --git a/tests/storage/databases/main/test_events_worker.py b/tests/storage/databases/main/test_events_worker.py
index f23609aee3..c786271c09 100644
--- a/tests/storage/databases/main/test_events_worker.py
+++ b/tests/storage/databases/main/test_events_worker.py
@@ -20,7 +20,7 @@
 #
 import json
 from contextlib import contextmanager
-from typing import Generator, List, Set, Tuple
+from typing import Generator
 from unittest import mock
 
 from twisted.enterprise.adbapi import ConnectionPool
@@ -38,8 +38,8 @@ from synapse.storage.databases.main.events_worker import (
     EventsWorkerStore,
 )
 from synapse.storage.types import Connection
-from synapse.util import Clock
 from synapse.util.async_helpers import yieldable_gather_results
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.test_utils.event_injection import create_event, inject_event
@@ -60,7 +60,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
         self.token = self.login(self.user, "pass")
         self.room_id = self.helper.create_room_as(self.user, tok=self.token)
 
-        self.event_ids: List[str] = []
+        self.event_ids: list[str] = []
         for i in range(3):
             event = self.get_success(
                 inject_event(
@@ -76,7 +76,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
             self.event_ids.append(event.event_id)
 
     def test_simple(self) -> None:
-        with LoggingContext(name="test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             res = self.get_success(
                 self.store.have_seen_events(
                     self.room_id, [self.event_ids[0], "eventdoesnotexist"]
@@ -88,7 +88,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
             self.assertEqual(ctx.get_resource_usage().db_txn_count, 1)
 
         # a second lookup of the same events should cause no queries
-        with LoggingContext(name="test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             res = self.get_success(
                 self.store.have_seen_events(
                     self.room_id, [self.event_ids[0], "eventdoesnotexist"]
@@ -113,7 +113,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
             )
         )
 
-        with LoggingContext(name="test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             # First, check `have_seen_event` for an event we have not seen yet
             # to prime the cache with a `false` value.
             res = self.get_success(
@@ -135,7 +135,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
             )
         )
 
-        with LoggingContext(name="test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             # Check `have_seen_event` again and we should see the updated fact
             # that we have now seen the event after persisting it.
             res = self.get_success(
@@ -166,7 +166,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
         res = self.store._get_event_cache.get_local((event.event_id,))
         self.assertEqual(res, None, "Event was cached when it should not have been.")
 
-        with LoggingContext(name="test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             # Persist the event which should invalidate then prefill the
             # `_get_event_cache` so we don't return stale values.
             # Side Note: Apparently, persisting an event isn't a transaction in the
@@ -200,7 +200,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
         Test to make sure that all events associated with the given `(room_id,)`
         are invalidated in the `have_seen_event` cache.
         """
-        with LoggingContext(name="test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             # Prime the cache with some values
             res = self.get_success(
                 self.store.have_seen_events(self.room_id, self.event_ids)
@@ -213,7 +213,7 @@ class HaveSeenEventsTestCase(unittest.HomeserverTestCase):
         # Clear the cache with any events associated with the `room_id`
         self.store.have_seen_event.invalidate((self.room_id,))
 
-        with LoggingContext(name="test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             res = self.get_success(
                 self.store.have_seen_events(self.room_id, self.event_ids)
             )
@@ -249,7 +249,7 @@ class EventCacheTestCase(unittest.HomeserverTestCase):
     def test_simple(self) -> None:
         """Test that we cache events that we pull from the DB."""
 
-        with LoggingContext("test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             self.get_success(self.store.get_event(self.event_id))
 
             # We should have fetched the event from the DB
@@ -263,7 +263,7 @@ class EventCacheTestCase(unittest.HomeserverTestCase):
         # Reset the event cache
         self.store._get_event_cache.clear()
 
-        with LoggingContext("test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             # We keep hold of the event event though we never use it.
             event = self.get_success(self.store.get_event(self.event_id))  # noqa: F841
 
@@ -273,7 +273,7 @@ class EventCacheTestCase(unittest.HomeserverTestCase):
         # Reset the event cache
         self.store._get_event_cache.clear()
 
-        with LoggingContext("test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             self.get_success(self.store.get_event(self.event_id))
 
             # Since the event is still in memory we shouldn't have fetched it
@@ -285,7 +285,7 @@ class EventCacheTestCase(unittest.HomeserverTestCase):
         out once.
         """
 
-        with LoggingContext("test") as ctx:
+        with LoggingContext(name="test", server_name=self.hs.hostname) as ctx:
             d = yieldable_gather_results(
                 self.store.get_event, [self.event_id, self.event_id]
             )
@@ -316,7 +316,7 @@ class GetEventsTestCase(unittest.HomeserverTestCase):
 
         room_id = self.helper.create_room_as(user_id, tok=user_tok)
 
-        event_ids: Set[str] = set()
+        event_ids: set[str] = set()
         for i in range(num_events):
             event = self.get_success(
                 inject_event(
@@ -371,7 +371,7 @@ class DatabaseOutageTestCase(unittest.HomeserverTestCase):
             )
         )
 
-        self.event_ids: List[str] = []
+        self.event_ids: list[str] = []
         for idx in range(1, 21):  # Stream ordering starts at 1.
             event_json = {
                 "type": f"test {idx}",
@@ -504,7 +504,7 @@ class GetEventCancellationTestCase(unittest.HomeserverTestCase):
     def blocking_get_event_calls(
         self,
     ) -> Generator[
-        Tuple["Deferred[None]", "Deferred[None]", "Deferred[None]"], None, None
+        tuple["Deferred[None]", "Deferred[None]", "Deferred[None]"], None, None
     ]:
         """Starts two concurrent `get_event` calls for the same event.
 
@@ -531,8 +531,8 @@ class GetEventCancellationTestCase(unittest.HomeserverTestCase):
             "runWithConnection",
             new=runWithConnection,
         ):
-            ctx1 = LoggingContext("get_event1")
-            ctx2 = LoggingContext("get_event2")
+            ctx1 = LoggingContext(name="get_event1", server_name=self.hs.hostname)
+            ctx2 = LoggingContext(name="get_event2", server_name=self.hs.hostname)
 
             async def get_event(ctx: LoggingContext) -> None:
                 with ctx:
diff --git a/tests/storage/databases/main/test_lock.py b/tests/storage/databases/main/test_lock.py
index e18e0f2792..622eb96ded 100644
--- a/tests/storage/databases/main/test_lock.py
+++ b/tests/storage/databases/main/test_lock.py
@@ -26,8 +26,8 @@ from twisted.internet.defer import Deferred
 from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
-from synapse.storage.databases.main.lock import _LOCK_TIMEOUT_MS, _RENEWAL_INTERVAL_MS
-from synapse.util import Clock
+from synapse.storage.databases.main.lock import _LOCK_TIMEOUT_MS, _RENEWAL_INTERVAL
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -72,15 +72,10 @@ class LockTestCase(unittest.HomeserverTestCase):
         release_lock.callback(None)
 
         # Run the tasks to completion.
-        # To work around `Linearizer`s using a different reactor to sleep when
-        # contended (https://github.com/matrix-org/synapse/issues/12841), we call
-        # `runUntilCurrent` on `twisted.internet.reactor`, which is a different
-        # reactor to that used by the homeserver.
-        assert isinstance(reactor, ReactorBase)
         self.get_success(task1)
-        reactor.runUntilCurrent()
+        self.pump()
         self.get_success(task2)
-        reactor.runUntilCurrent()
+        self.pump()
         self.get_success(task3)
 
         # At most one task should have held the lock at a time.
@@ -223,15 +218,11 @@ class ReadWriteLockTestCase(unittest.HomeserverTestCase):
         release_lock.callback(None)
 
         # Run the tasks to completion.
-        # To work around `Linearizer`s using a different reactor to sleep when
-        # contended (https://github.com/matrix-org/synapse/issues/12841), we call
-        # `runUntilCurrent` on `twisted.internet.reactor`, which is a different
-        # reactor to that used by the homeserver.
         assert isinstance(reactor, ReactorBase)
         self.get_success(task1)
-        reactor.runUntilCurrent()
+        self.pump()
         self.get_success(task2)
-        reactor.runUntilCurrent()
+        self.pump()
         self.get_success(task3)
 
         # At most one task should have held the lock at a time.
@@ -275,15 +266,11 @@ class ReadWriteLockTestCase(unittest.HomeserverTestCase):
         release_lock.callback(None)
 
         # Run the tasks to completion.
-        # To work around `Linearizer`s using a different reactor to sleep when
-        # contended (https://github.com/matrix-org/synapse/issues/12841), we call
-        # `runUntilCurrent` on `twisted.internet.reactor`, which is a different
-        # reactor to that used by the homeserver.
         assert isinstance(reactor, ReactorBase)
         self.get_success(task1)
-        reactor.runUntilCurrent()
+        self.pump()
         self.get_success(task2)
-        reactor.runUntilCurrent()
+        self.pump()
         self.get_success(task3)
 
         # At most one task should have held the lock at a time.
@@ -390,7 +377,7 @@ class ReadWriteLockTestCase(unittest.HomeserverTestCase):
 
         # Wait for ages with the lock, we should not be able to get the lock.
         for _ in range(10):
-            self.reactor.advance((_RENEWAL_INTERVAL_MS / 1000))
+            self.reactor.advance((_RENEWAL_INTERVAL.as_secs()))
 
         lock2 = self.get_success(
             self.store.try_acquire_read_write_lock("name", "key", write=True)
diff --git a/tests/storage/databases/main/test_receipts.py b/tests/storage/databases/main/test_receipts.py
index 4141f868d6..be29e0a7f4 100644
--- a/tests/storage/databases/main/test_receipts.py
+++ b/tests/storage/databases/main/test_receipts.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, Dict, Optional, Sequence, Tuple
+from typing import Any, Sequence
 
 from twisted.internet.testing import MemoryReactor
 
@@ -27,7 +27,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.storage.database import LoggingTransaction
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -51,8 +51,8 @@ class ReceiptsBackgroundUpdateStoreTestCase(HomeserverTestCase):
         update_name: str,
         index_name: str,
         table: str,
-        receipts: Dict[Tuple[str, str, str], Sequence[Dict[str, Any]]],
-        expected_unique_receipts: Dict[Tuple[str, str, str], Optional[Dict[str, Any]]],
+        receipts: dict[tuple[str, str, str], Sequence[dict[str, Any]]],
+        expected_unique_receipts: dict[tuple[str, str, str], dict[str, Any] | None],
     ) -> None:
         """Test that the background update to uniqueify non-thread receipts in
         the given receipts table works properly.
diff --git a/tests/storage/databases/main/test_room.py b/tests/storage/databases/main/test_room.py
index dda4294e63..4ed775ad76 100644
--- a/tests/storage/databases/main/test_room.py
+++ b/tests/storage/databases/main/test_room.py
@@ -28,7 +28,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.storage.databases.main.room import _BackgroundUpdates
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/storage/test__base.py b/tests/storage/test__base.py
index 7d260b7915..5602531880 100644
--- a/tests/storage/test__base.py
+++ b/tests/storage/test__base.py
@@ -20,12 +20,12 @@
 #
 
 import secrets
-from typing import Generator, List, Tuple, cast
+from typing import Generator, cast
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -52,9 +52,9 @@ class UpdateUpsertManyTests(unittest.HomeserverTestCase):
             )
         )
 
-    def _dump_table_to_tuple(self) -> Generator[Tuple[int, str, str], None, None]:
+    def _dump_table_to_tuple(self) -> Generator[tuple[int, str, str], None, None]:
         yield from cast(
-            List[Tuple[int, str, str]],
+            list[tuple[int, str, str]],
             self.get_success(
                 self.storage.db_pool.simple_select_list(
                     self.table_name, None, ["id, username, value"]
diff --git a/tests/storage/test_account_data.py b/tests/storage/test_account_data.py
index 794cefd04d..c91aad097d 100644
--- a/tests/storage/test_account_data.py
+++ b/tests/storage/test_account_data.py
@@ -19,14 +19,14 @@
 #
 #
 
-from typing import Iterable, Optional, Set
+from typing import Iterable
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.api.constants import AccountDataTypes
 from synapse.api.errors import Codes, SynapseError
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -37,7 +37,7 @@ class IgnoredUsersTestCase(unittest.HomeserverTestCase):
         self.user = "@user:test"
 
     def _update_ignore_list(
-        self, *ignored_user_ids: Iterable[str], ignorer_user_id: Optional[str] = None
+        self, *ignored_user_ids: Iterable[str], ignorer_user_id: str | None = None
     ) -> None:
         """Update the account data to block the given users."""
         if ignorer_user_id is None:
@@ -52,7 +52,7 @@ class IgnoredUsersTestCase(unittest.HomeserverTestCase):
         )
 
     def assert_ignorers(
-        self, ignored_user_id: str, expected_ignorer_user_ids: Set[str]
+        self, ignored_user_id: str, expected_ignorer_user_ids: set[str]
     ) -> None:
         self.assertEqual(
             self.get_success(self.store.ignored_by(ignored_user_id)),
@@ -60,7 +60,7 @@ class IgnoredUsersTestCase(unittest.HomeserverTestCase):
         )
 
     def assert_ignored(
-        self, ignorer_user_id: str, expected_ignored_user_ids: Set[str]
+        self, ignorer_user_id: str, expected_ignored_user_ids: set[str]
     ) -> None:
         self.assertEqual(
             self.get_success(self.store.ignored_users(ignorer_user_id)),
@@ -167,7 +167,7 @@ class IgnoredUsersTestCase(unittest.HomeserverTestCase):
         """Test that ignoring users updates the latest stream ID for the ignored
         user list account data."""
 
-        def get_latest_ignore_streampos(user_id: str) -> Optional[int]:
+        def get_latest_ignore_streampos(user_id: str) -> int | None:
             return self.get_success(
                 self.store.get_latest_stream_id_for_global_account_data_by_type_for_user(
                     user_id, AccountDataTypes.IGNORED_USER_LIST
diff --git a/tests/storage/test_appservice.py b/tests/storage/test_appservice.py
index 759fad6af1..4b9d069d6a 100644
--- a/tests/storage/test_appservice.py
+++ b/tests/storage/test_appservice.py
@@ -21,7 +21,7 @@
 import json
 import os
 import tempfile
-from typing import List, cast
+from typing import cast
 from unittest.mock import AsyncMock, Mock
 
 import yaml
@@ -39,7 +39,7 @@ from synapse.storage.databases.main.appservice import (
     ApplicationServiceTransactionStore,
 )
 from synapse.types import DeviceListUpdates
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -48,7 +48,7 @@ class ApplicationServiceStoreTestCase(unittest.HomeserverTestCase):
     def setUp(self) -> None:
         super().setUp()
 
-        self.as_yaml_files: List[str] = []
+        self.as_yaml_files: list[str] = []
 
         self.hs.config.appservice.app_service_config_files = self.as_yaml_files
         self.hs.config.caches.event_cache_size = 1
@@ -123,7 +123,7 @@ class ApplicationServiceStoreTestCase(unittest.HomeserverTestCase):
 class ApplicationServiceTransactionStoreTestCase(unittest.HomeserverTestCase):
     def setUp(self) -> None:
         super().setUp()
-        self.as_yaml_files: List[str] = []
+        self.as_yaml_files: list[str] = []
 
         self.hs.config.appservice.app_service_config_files = self.as_yaml_files
         self.hs.config.caches.event_cache_size = 1
@@ -180,7 +180,7 @@ class ApplicationServiceTransactionStoreTestCase(unittest.HomeserverTestCase):
         )
 
     def _insert_txn(
-        self, as_id: str, txn_id: int, events: List[Mock]
+        self, as_id: str, txn_id: int, events: list[Mock]
     ) -> "defer.Deferred[None]":
         return self.db_pool.runOperation(
             self.engine.convert_param_style(
@@ -277,7 +277,7 @@ class ApplicationServiceTransactionStoreTestCase(unittest.HomeserverTestCase):
         self,
     ) -> None:
         service = Mock(id=self.as_list[0]["id"])
-        events = cast(List[EventBase], [Mock(event_id="e1"), Mock(event_id="e2")])
+        events = cast(list[EventBase], [Mock(event_id="e1"), Mock(event_id="e2")])
         txn = self.get_success(
             defer.ensureDeferred(
                 self.store.create_appservice_txn(
diff --git a/tests/storage/test_background_update.py b/tests/storage/test_background_update.py
index 89a3b54a25..e3f79d7670 100644
--- a/tests/storage/test_background_update.py
+++ b/tests/storage/test_background_update.py
@@ -19,7 +19,7 @@
 #
 #
 import logging
-from typing import List, Tuple, cast
+from typing import cast
 from unittest.mock import AsyncMock, Mock
 
 import yaml
@@ -37,7 +37,8 @@ from synapse.storage.background_updates import (
 from synapse.storage.database import LoggingTransaction
 from synapse.storage.engines import PostgresEngine, Sqlite3Engine
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 from tests import unittest
 from tests.unittest import override_config
@@ -59,7 +60,7 @@ class BackgroundUpdateTestCase(unittest.HomeserverTestCase):
 
     async def update(self, progress: JsonDict, count: int) -> int:
         duration_ms = 10
-        await self.clock.sleep((count * duration_ms) / 1000)
+        await self.clock.sleep(Duration(milliseconds=count * duration_ms))
         progress = {"my_key": progress["my_key"] + 1}
         await self.store.db_pool.runInteraction(
             "update_progress",
@@ -309,7 +310,7 @@ class BackgroundUpdateTestCase(unittest.HomeserverTestCase):
 
         # Run the update with the long-running update item
         async def update_long(progress: JsonDict, count: int) -> int:
-            await self.clock.sleep((count * duration_ms) / 1000)
+            await self.clock.sleep(Duration(milliseconds=count * duration_ms))
             progress = {"my_key": progress["my_key"] + 1}
             await self.store.db_pool.runInteraction(
                 "update_progress",
@@ -535,7 +536,7 @@ class BackgroundUpdateValidateConstraintTestCase(unittest.HomeserverTestCase):
 
         # Check the correct values are in the new table.
         rows = cast(
-            List[Tuple[int, int]],
+            list[tuple[int, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="test_constraint",
@@ -652,7 +653,7 @@ class BackgroundUpdateValidateConstraintTestCase(unittest.HomeserverTestCase):
 
         # Check the correct values are in the new table.
         rows = cast(
-            List[Tuple[int, int]],
+            list[tuple[int, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="test_constraint",
diff --git a/tests/storage/test_base.py b/tests/storage/test_base.py
index 11313fc933..577229c119 100644
--- a/tests/storage/test_base.py
+++ b/tests/storage/test_base.py
@@ -86,7 +86,7 @@ class SQLBaseStoreTestCase(unittest.TestCase):
 
         conn_pool.runWithConnection = runWithConnection
 
-        config = default_config(name="test", parse=True)
+        config = default_config(server_name="test", parse=True)
         hs = TestHomeServer("test", config=config)
 
         if USE_POSTGRES_FOR_TESTS:
diff --git a/tests/storage/test_cleanup_extrems.py b/tests/storage/test_cleanup_extrems.py
index 94fb8e01a1..054e4a4d0b 100644
--- a/tests/storage/test_cleanup_extrems.py
+++ b/tests/storage/test_cleanup_extrems.py
@@ -31,7 +31,7 @@ from synapse.server import HomeServer
 from synapse.storage import prepare_database
 from synapse.storage.types import Cursor
 from synapse.types import UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/storage/test_client_ips.py b/tests/storage/test_client_ips.py
index de95272b52..bd68f2aaa1 100644
--- a/tests/storage/test_client_ips.py
+++ b/tests/storage/test_client_ips.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Any, Dict, List, Optional, Tuple, cast
+from typing import Any, cast
 from unittest.mock import AsyncMock
 
 from parameterized import parameterized
@@ -35,7 +35,7 @@ from synapse.storage.databases.main.client_ips import (
     DeviceLastConnectionInfo,
 )
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import make_request
@@ -104,7 +104,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
         self.pump(0)
 
         result = cast(
-            List[Tuple[str, str, str, Optional[str], int]],
+            list[tuple[str, str, str, str | None, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="user_ips",
@@ -135,7 +135,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
         self.pump(0)
 
         result = cast(
-            List[Tuple[str, str, str, Optional[str], int]],
+            list[tuple[str, str, str, str | None, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="user_ips",
@@ -184,7 +184,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
         else:
             # Check that the new IP and user agent has not been stored yet
             db_result = cast(
-                List[Tuple[str, Optional[str], Optional[str], str, Optional[int]]],
+                list[tuple[str, str | None, str | None, str, int | None]],
                 self.get_success(
                     self.store.db_pool.simple_select_list(
                         table="devices",
@@ -266,7 +266,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
 
         # Check that the new IP and user agent has not been stored yet
         db_result = cast(
-            List[Tuple[str, Optional[str], Optional[str], str, Optional[int]]],
+            list[tuple[str, str | None, str | None, str, int | None]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="devices",
@@ -381,7 +381,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
 
         # Check that the new IP and user agent has not been stored yet
         db_result = cast(
-            List[Tuple[str, str, str, int]],
+            list[tuple[str, str, str, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="user_ips",
@@ -589,7 +589,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
 
         # We should see that in the DB
         result = cast(
-            List[Tuple[str, str, str, Optional[str], int]],
+            list[tuple[str, str, str, str | None, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="user_ips",
@@ -616,7 +616,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
 
         # We should get no results.
         result = cast(
-            List[Tuple[str, str, str, Optional[str], int]],
+            list[tuple[str, str, str, str | None, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="user_ips",
@@ -695,7 +695,7 @@ class ClientIpStoreTestCase(unittest.HomeserverTestCase):
 
         # We should see that in the DB
         result = cast(
-            List[Tuple[str, str, str, Optional[str], int]],
+            list[tuple[str, str, str, str | None, int]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="user_ips",
@@ -745,9 +745,9 @@ class ClientIpAuthTestCase(unittest.HomeserverTestCase):
 
     def _runtest(
         self,
-        headers: Dict[bytes, bytes],
+        headers: dict[bytes, bytes],
         expected_ip: str,
-        make_request_args: Dict[str, Any],
+        make_request_args: dict[str, Any],
     ) -> None:
         device_id = "bleb"
 
diff --git a/tests/storage/test_database.py b/tests/storage/test_database.py
index 5e5937ff17..6213abd753 100644
--- a/tests/storage/test_database.py
+++ b/tests/storage/test_database.py
@@ -19,8 +19,10 @@
 #
 #
 
-from typing import Callable, Tuple
-from unittest.mock import Mock, call
+from typing import Callable
+from unittest.mock import Mock, call, patch
+
+import attr
 
 from twisted.internet import defer
 from twisted.internet.defer import CancelledError, Deferred
@@ -33,7 +35,7 @@ from synapse.storage.database import (
     LoggingTransaction,
     make_tuple_comparison_clause,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -140,6 +142,14 @@ class ExecuteScriptTestCase(unittest.HomeserverTestCase):
         )
 
 
+@attr.s(slots=True, auto_attribs=True)
+class TransactionMocks:
+    after_callback: Mock
+    exception_callback: Mock
+    commit: Mock
+    rollback: Mock
+
+
 class CallbacksTestCase(unittest.HomeserverTestCase):
     """Tests for transaction callbacks."""
 
@@ -149,7 +159,7 @@ class CallbacksTestCase(unittest.HomeserverTestCase):
 
     def _run_interaction(
         self, func: Callable[[LoggingTransaction], object]
-    ) -> Tuple[Mock, Mock]:
+    ) -> TransactionMocks:
         """Run the given function in a database transaction, with callbacks registered.
 
         Args:
@@ -163,53 +173,111 @@ class CallbacksTestCase(unittest.HomeserverTestCase):
         after_callback = Mock()
         exception_callback = Mock()
 
+        # Track commit/rollback calls on the LoggingDatabaseConnection used
+        # for the transaction so tests can assert whether attempts committed
+        # or rolled back.
+        commit_mock = Mock()
+        rollback_mock = Mock()
+
         def _test_txn(txn: LoggingTransaction) -> None:
             txn.call_after(after_callback, 123, 456, extra=789)
             txn.call_on_exception(exception_callback, 987, 654, extra=321)
             func(txn)
 
+        # Wrap the real commit/rollback so we record calls but still perform
+        # the original behaviour.
+        orig_commit = LoggingDatabaseConnection.commit
+        orig_rollback = LoggingDatabaseConnection.rollback
+
+        # type-ignore becauase we're just transparently passing through args/kwargs and
+        # returning whatever result that the original function does
+        def _commit(self, *a, **kw):  # type: ignore[no-untyped-def]
+            commit_mock()
+            return orig_commit(self, *a, **kw)
+
+        # type-ignore becauase we're just transparently passing through args/kwargs and
+        # returning whatever result that the original function does
+        def _rollback(self, *a, **kw):  # type: ignore[no-untyped-def]
+            rollback_mock()
+            return orig_rollback(self, *a, **kw)
+
         try:
-            self.get_success_or_raise(
-                self.db_pool.runInteraction("test_transaction", _test_txn)
-            )
+            with (
+                patch.object(LoggingDatabaseConnection, "commit", _commit),
+                patch.object(LoggingDatabaseConnection, "rollback", _rollback),
+            ):
+                self.get_success_or_raise(
+                    self.db_pool.runInteraction("test_transaction", _test_txn)
+                )
         except Exception:
             pass
 
-        return after_callback, exception_callback
+        # FIXME: Sanity check that every transaction is either committed or rolled back,
+        # see https://github.com/element-hq/synapse/issues/19202
+        # transaction_count = after_callback.call_count + exception_callback.call_count
+        # self.assertEqual(
+        #     transaction_count,
+        #     commit_mock.call_count + rollback_mock.call_count,
+        #     "We expect every transaction attempt to either commit or rollback. "
+        #     f"Saw {transaction_count} transactions, but only {commit_mock.call_count} commits and {rollback_mock.call_count} rollbacks",
+        # )
+
+        return TransactionMocks(
+            after_callback=after_callback,
+            exception_callback=exception_callback,
+            commit=commit_mock,
+            rollback=rollback_mock,
+        )
 
     def test_after_callback(self) -> None:
         """Test that the after callback is called when a transaction succeeds."""
-        after_callback, exception_callback = self._run_interaction(lambda txn: None)
+        txn_mocks = self._run_interaction(lambda txn: None)
 
-        after_callback.assert_called_once_with(123, 456, extra=789)
-        exception_callback.assert_not_called()
+        txn_mocks.after_callback.assert_called_once_with(123, 456, extra=789)
+        txn_mocks.exception_callback.assert_not_called()
+
+        # Should have commited right away
+        self.assertEqual(txn_mocks.commit.call_count, 1)
+        # (nothing was rolled back)
+        self.assertEqual(txn_mocks.rollback.call_count, 0)
 
     def test_exception_callback(self) -> None:
         """Test that the exception callback is called when a transaction fails."""
         _test_txn = Mock(side_effect=ZeroDivisionError)
-        after_callback, exception_callback = self._run_interaction(_test_txn)
+        txn_mocks = self._run_interaction(_test_txn)
 
-        after_callback.assert_not_called()
-        exception_callback.assert_called_once_with(987, 654, extra=321)
+        txn_mocks.after_callback.assert_not_called()
+        txn_mocks.exception_callback.assert_called_once_with(987, 654, extra=321)
+
+        # Nothing should have committed.
+        self.assertEqual(txn_mocks.commit.call_count, 0)
+        # FIXME: Every transaction should have been rolled back, see
+        # https://github.com/element-hq/synapse/issues/19202
+        # self.assertEqual(txn_mocks.rollback.call_count, 1)
 
     def test_failed_retry(self) -> None:
         """Test that the exception callback is called for every failed attempt."""
         # Always raise an `OperationalError`.
         _test_txn = Mock(side_effect=self.db_pool.engine.module.OperationalError)
-        after_callback, exception_callback = self._run_interaction(_test_txn)
+        txn_mocks = self._run_interaction(_test_txn)
 
-        after_callback.assert_not_called()
-        exception_callback.assert_has_calls(
+        txn_mocks.after_callback.assert_not_called()
+        txn_mocks.exception_callback.assert_has_calls(
             [
                 call(987, 654, extra=321),
                 call(987, 654, extra=321),
                 call(987, 654, extra=321),
                 call(987, 654, extra=321),
                 call(987, 654, extra=321),
-                call(987, 654, extra=321),
             ]
         )
-        self.assertEqual(exception_callback.call_count, 6)  # no additional calls
+        # no additional calls
+        self.assertEqual(txn_mocks.exception_callback.call_count, 5)
+
+        # Nothing should have committed.
+        self.assertEqual(txn_mocks.commit.call_count, 0)
+        # Every transaction should have been rolled back.
+        self.assertEqual(txn_mocks.rollback.call_count, 5)
 
     def test_successful_retry(self) -> None:
         """Test callbacks for a failed transaction followed by a successful attempt."""
@@ -217,19 +285,25 @@ class CallbacksTestCase(unittest.HomeserverTestCase):
         _test_txn = Mock(
             side_effect=[self.db_pool.engine.module.OperationalError, None]
         )
-        after_callback, exception_callback = self._run_interaction(_test_txn)
+        txn_mocks = self._run_interaction(_test_txn)
 
         # Calling both `after_callback`s when the first attempt failed is rather
         # surprising (https://github.com/matrix-org/synapse/issues/12184).
         # Let's document the behaviour in a test.
-        after_callback.assert_has_calls(
+        txn_mocks.after_callback.assert_has_calls(
             [
                 call(123, 456, extra=789),
                 call(123, 456, extra=789),
             ]
         )
-        self.assertEqual(after_callback.call_count, 2)  # no additional calls
-        exception_callback.assert_not_called()
+        # no additional calls
+        self.assertEqual(txn_mocks.after_callback.call_count, 2)
+        txn_mocks.exception_callback.assert_not_called()
+
+        # The last attempt should have committed.
+        self.assertEqual(txn_mocks.commit.call_count, 1)
+        # The first attempt should have been rolled back.
+        self.assertEqual(txn_mocks.rollback.call_count, 1)
 
 
 class CancellationTestCase(unittest.HomeserverTestCase):
@@ -282,7 +356,6 @@ class CancellationTestCase(unittest.HomeserverTestCase):
                 call(987, 654, extra=321),
                 call(987, 654, extra=321),
                 call(987, 654, extra=321),
-                call(987, 654, extra=321),
             ]
         )
-        self.assertEqual(exception_callback.call_count, 6)  # no additional calls
+        self.assertEqual(exception_callback.call_count, 5)  # no additional calls
diff --git a/tests/storage/test_devices.py b/tests/storage/test_devices.py
index e8ea813668..1d1979e19f 100644
--- a/tests/storage/test_devices.py
+++ b/tests/storage/test_devices.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Collection, List, Tuple
+from typing import Collection
 
 from twisted.internet.testing import MemoryReactor
 
@@ -27,7 +27,7 @@ import synapse.api.errors
 from synapse.api.constants import EduTypes
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -44,7 +44,7 @@ class DeviceStoreTestCase(HomeserverTestCase):
         config["federation_sender_instances"] = ["master"]
         return config
 
-    def add_device_change(self, user_id: str, device_ids: List[str], host: str) -> None:
+    def add_device_change(self, user_id: str, device_ids: list[str], host: str) -> None:
         """Add a device list change for the given device to
         `device_lists_outbound_pokes` table.
         """
@@ -306,7 +306,7 @@ class DeviceStoreTestCase(HomeserverTestCase):
     def _check_devices_in_updates(
         self,
         expected_device_ids: Collection[str],
-        device_updates: List[Tuple[str, JsonDict]],
+        device_updates: list[tuple[str, JsonDict]],
     ) -> None:
         """Check that an specific device ids exist in a list of device update EDUs"""
         self.assertEqual(len(device_updates), len(expected_device_ids))
diff --git a/tests/storage/test_directory.py b/tests/storage/test_directory.py
index 26bf6cf391..4fb81e38cd 100644
--- a/tests/storage/test_directory.py
+++ b/tests/storage/test_directory.py
@@ -23,7 +23,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
 from synapse.types import RoomAlias, RoomID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/storage/test_e2e_room_keys.py b/tests/storage/test_e2e_room_keys.py
index f390d11e41..2397d7b80e 100644
--- a/tests/storage/test_e2e_room_keys.py
+++ b/tests/storage/test_e2e_room_keys.py
@@ -23,7 +23,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
 from synapse.storage.databases.main.e2e_room_keys import RoomKey
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/storage/test_end_to_end_keys.py b/tests/storage/test_end_to_end_keys.py
index e46999022a..24fdb0bf6d 100644
--- a/tests/storage/test_end_to_end_keys.py
+++ b/tests/storage/test_end_to_end_keys.py
@@ -22,7 +22,7 @@
 from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/storage/test_event_chain.py b/tests/storage/test_event_chain.py
index b2480a139d..175a5ffc78 100644
--- a/tests/storage/test_event_chain.py
+++ b/tests/storage/test_event_chain.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Dict, List, Set, Tuple, cast
+from typing import cast
 
 from parameterized import parameterized
 
@@ -37,7 +37,7 @@ from synapse.storage.database import LoggingTransaction
 from synapse.storage.databases.main.events import _LinkMap
 from synapse.storage.types import Cursor
 from synapse.types import create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -420,7 +420,7 @@ class EventChainStoreTestCase(HomeserverTestCase):
 
     def persist(
         self,
-        events: List[EventBase],
+        events: list[EventBase],
     ) -> None:
         """Persist the given events and check that the links generated match
         those given.
@@ -464,11 +464,11 @@ class EventChainStoreTestCase(HomeserverTestCase):
         )
 
     def fetch_chains(
-        self, events: List[EventBase]
-    ) -> Tuple[Dict[str, Tuple[int, int]], _LinkMap]:
+        self, events: list[EventBase]
+    ) -> tuple[dict[str, tuple[int, int]], _LinkMap]:
         # Fetch the map from event ID -> (chain ID, sequence number)
         rows = cast(
-            List[Tuple[str, int, int]],
+            list[tuple[str, int, int]],
             self.get_success(
                 self.store.db_pool.simple_select_many_batch(
                     table="event_auth_chains",
@@ -487,7 +487,7 @@ class EventChainStoreTestCase(HomeserverTestCase):
 
         # Fetch all the links and pass them to the _LinkMap.
         auth_chain_rows = cast(
-            List[Tuple[int, int, int, int]],
+            list[tuple[int, int, int, int]],
             self.get_success(
                 self.store.db_pool.simple_select_many_batch(
                     table="event_auth_chain_links",
@@ -575,7 +575,7 @@ class EventChainBackgroundUpdateTestCase(HomeserverTestCase):
         self.token = self.login("foo", "pass")
         self.requester = create_requester(self.user_id)
 
-    def _generate_room(self) -> Tuple[str, List[Set[str]]]:
+    def _generate_room(self) -> tuple[str, list[set[str]]]:
         """Insert a room without a chain cover index."""
         room_id = self.helper.create_room_as(self.user_id, tok=self.token)
 
diff --git a/tests/storage/test_event_federation.py b/tests/storage/test_event_federation.py
index 2f79068f6b..59e914ca8b 100644
--- a/tests/storage/test_event_federation.py
+++ b/tests/storage/test_event_federation.py
@@ -21,16 +21,10 @@
 import datetime
 from typing import (
     Collection,
-    Dict,
-    FrozenSet,
     Iterable,
-    List,
     Mapping,
     NamedTuple,
-    Set,
-    Tuple,
     TypeVar,
-    Union,
     cast,
 )
 
@@ -53,7 +47,8 @@ from synapse.storage.database import LoggingTransaction
 from synapse.storage.types import Cursor
 from synapse.synapse_rust.events import EventInternalMetadata
 from synapse.types import JsonDict
-from synapse.util import Clock, json_encoder
+from synapse.util.clock import Clock
+from synapse.util.json import json_encoder
 
 import tests.unittest
 import tests.utils
@@ -73,7 +68,7 @@ import tests.utils
 #     |   |
 #     K   J
 
-AUTH_GRAPH: Dict[str, List[str]] = {
+AUTH_GRAPH: dict[str, list[str]] = {
     "a": ["e"],
     "b": ["e"],
     "c": ["g", "i"],
@@ -107,7 +102,7 @@ T = TypeVar("T")
 def get_all_topologically_sorted_orders(
     nodes: Iterable[T],
     graph: Mapping[T, Collection[T]],
-) -> List[List[T]]:
+) -> list[list[T]]:
     """Given a set of nodes and a graph, return all possible topological
     orderings.
     """
@@ -116,7 +111,7 @@ def get_all_topologically_sorted_orders(
     # we have a choice over which node to consider next.
 
     degree_map = dict.fromkeys(nodes, 0)
-    reverse_graph: Dict[T, Set[T]] = {}
+    reverse_graph: dict[T, set[T]] = {}
 
     for node, edges in graph.items():
         if node not in degree_map:
@@ -137,10 +132,10 @@ def get_all_topologically_sorted_orders(
 
 
 def _get_all_topologically_sorted_orders_inner(
-    reverse_graph: Dict[T, Set[T]],
-    zero_degree: List[T],
-    degree_map: Dict[T, int],
-) -> List[List[T]]:
+    reverse_graph: dict[T, set[T]],
+    zero_degree: list[T],
+    degree_map: dict[T, int],
+) -> list[list[T]]:
     new_paths = []
 
     # Rather than only choosing *one* item from the list of nodes with zero
@@ -174,7 +169,7 @@ def _get_all_topologically_sorted_orders_inner(
 def get_all_topologically_consistent_subsets(
     nodes: Iterable[T],
     graph: Mapping[T, Collection[T]],
-) -> Set[FrozenSet[T]]:
+) -> set[frozenset[T]]:
     """Get all subsets of the graph where if node N is in the subgraph, then all
     nodes that can reach that node (i.e. for all X there exists a path X -> N)
     are in the subgraph.
@@ -194,7 +189,7 @@ def get_all_topologically_consistent_subsets(
 @attr.s(auto_attribs=True, frozen=True, slots=True)
 class _BackfillSetupInfo:
     room_id: str
-    depth_map: Dict[str, int]
+    depth_map: dict[str, int]
 
 
 class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
@@ -572,7 +567,7 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
         #     |   |
         #     K   J
 
-        auth_graph: Dict[str, List[str]] = {
+        auth_graph: dict[str, list[str]] = {
             "a": ["e"],
             "b": ["e"],
             "c": ["g", "i"],
@@ -755,11 +750,11 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
             seq_num: int
 
         class TestLink(NamedTuple):
-            origin_chain_and_seq: Tuple[int, int]
-            target_chain_and_seq: Tuple[int, int]
+            origin_chain_and_seq: tuple[int, int]
+            target_chain_and_seq: tuple[int, int]
 
         # Map to chain IDs / seq nums
-        nodes: List[TestNode] = [
+        nodes: list[TestNode] = [
             TestNode("A1", 1, 1),
             TestNode("A2", 1, 2),
             TestNode("A3", 1, 3),
@@ -778,7 +773,7 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
             TestNode("G1", 7, 1),
             TestNode("G2", 7, 2),
         ]
-        links: List[TestLink] = [
+        links: list[TestLink] = [
             TestLink((2, 1), (1, 2)),  # B1 -> A2
             TestLink((3, 1), (2, 2)),  # C1 -> B2
             TestLink((4, 1), (3, 1)),  # D1 -> C1
@@ -817,9 +812,9 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
         # Define the test cases
         class TestCase(NamedTuple):
             name: str
-            conflicted: Set[str]
-            additional_backwards_reachable: Set[str]
-            want_conflicted_subgraph: Set[str]
+            conflicted: set[str]
+            additional_backwards_reachable: set[str]
+            want_conflicted_subgraph: set[str]
 
         # Reminder:
         # A1 <- A2 <- A3
@@ -914,7 +909,7 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
                 test_case.conflicted,
                 test_case.additional_backwards_reachable,
             )
-            self.assertEquals(
+            self.assertEqual(
                 result.conflicted_subgraph,
                 test_case.want_conflicted_subgraph,
                 f"{test_case.name} : conflicted subgraph mismatch",
@@ -935,7 +930,7 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
 
         room_id = "some_room_id"
 
-        def prev_event_format(prev_event_id: str) -> Union[Tuple[str, dict], str]:
+        def prev_event_format(prev_event_id: str) -> tuple[str, dict] | str:
             """Account for differences in prev_events format across room versions"""
             if room_version.event_format == EventFormatVersions.ROOM_V1_V2:
                 return prev_event_id, {}
@@ -1033,7 +1028,7 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
         #    |
         #    5 (newest)
 
-        event_graph: Dict[str, List[str]] = {
+        event_graph: dict[str, list[str]] = {
             "1": [],
             "2": ["1"],
             "3": ["2", "A"],
@@ -1049,7 +1044,7 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
             "b6": ["3"],
         }
 
-        depth_map: Dict[str, int] = {
+        depth_map: dict[str, int] = {
             "1": 1,
             "2": 2,
             "b1": 3,
@@ -1069,7 +1064,7 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
         # The rest are events in the room but not backfilled tet.
         our_server_events = {"5", "4", "B", "3", "A"}
 
-        complete_event_dict_map: Dict[str, JsonDict] = {}
+        complete_event_dict_map: dict[str, JsonDict] = {}
         stream_ordering = 0
         for event_id, prev_event_ids in event_graph.items():
             depth = depth_map[event_id]
@@ -1424,14 +1419,14 @@ class EventFederationWorkerStoreTestCase(tests.unittest.HomeserverTestCase):
 class FakeEvent:
     event_id: str
     room_id: str
-    auth_events: List[str]
+    auth_events: list[str]
 
     type = "foo"
     state_key = "foo"
 
     internal_metadata = EventInternalMetadata({})
 
-    def auth_event_ids(self) -> List[str]:
+    def auth_event_ids(self) -> list[str]:
         return self.auth_events
 
     def is_state(self) -> bool:
diff --git a/tests/storage/test_event_push_actions.py b/tests/storage/test_event_push_actions.py
index 640490a6e5..d5ed947094 100644
--- a/tests/storage/test_event_push_actions.py
+++ b/tests/storage/test_event_push_actions.py
@@ -19,7 +19,6 @@
 #
 #
 
-from typing import Optional, Tuple
 
 from twisted.internet.testing import MemoryReactor
 
@@ -29,7 +28,7 @@ from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.storage.databases.main.event_push_actions import NotifCounts
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -47,7 +46,7 @@ class EventPushActionsStoreTestCase(HomeserverTestCase):
         assert persist_events_store is not None
         self.persist_events_store = persist_events_store
 
-    def _create_users_and_room(self) -> Tuple[str, str, str, str, str]:
+    def _create_users_and_room(self) -> tuple[str, str, str, str, str]:
         """
         Creates two users and a shared room.
 
@@ -345,9 +344,7 @@ class EventPushActionsStoreTestCase(HomeserverTestCase):
                 aggregate_counts[room_id], notif_count + thread_notif_count
             )
 
-        def _create_event(
-            highlight: bool = False, thread_id: Optional[str] = None
-        ) -> str:
+        def _create_event(highlight: bool = False, thread_id: str | None = None) -> str:
             content: JsonDict = {
                 "msgtype": "m.text",
                 "body": user_id if highlight else "msg",
@@ -527,9 +524,7 @@ class EventPushActionsStoreTestCase(HomeserverTestCase):
                 aggregate_counts[room_id], notif_count + thread_notif_count
             )
 
-        def _create_event(
-            highlight: bool = False, thread_id: Optional[str] = None
-        ) -> str:
+        def _create_event(highlight: bool = False, thread_id: str | None = None) -> str:
             content: JsonDict = {
                 "msgtype": "m.text",
                 "body": user_id if highlight else "msg",
@@ -553,7 +548,7 @@ class EventPushActionsStoreTestCase(HomeserverTestCase):
         def _rotate() -> None:
             self.get_success(self.store._rotate_notifs())
 
-        def _mark_read(event_id: str, thread_id: Optional[str] = None) -> None:
+        def _mark_read(event_id: str, thread_id: str | None = None) -> None:
             self.get_success(
                 self.store.insert_receipt(
                     room_id,
diff --git a/tests/storage/test_events.py b/tests/storage/test_events.py
index 6d2e4e4bbe..7d1c96f97f 100644
--- a/tests/storage/test_events.py
+++ b/tests/storage/test_events.py
@@ -20,7 +20,6 @@
 #
 
 import logging
-from typing import List, Optional
 
 from twisted.internet.testing import MemoryReactor
 
@@ -32,13 +31,84 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import StateMap
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
 logger = logging.getLogger(__name__)
 
 
+class EventsTestCase(HomeserverTestCase):
+    servlets = [
+        admin.register_servlets,
+        room.register_servlets,
+        login.register_servlets,
+    ]
+
+    def prepare(
+        self, reactor: MemoryReactor, clock: Clock, homeserver: HomeServer
+    ) -> None:
+        self._store = self.hs.get_datastores().main
+
+    def test_get_senders_for_event_ids(self) -> None:
+        """Tests the `get_senders_for_event_ids` storage function."""
+
+        users_and_tokens: dict[str, str] = {}
+        for localpart_suffix in range(10):
+            localpart = f"user_{localpart_suffix}"
+            user_id = self.register_user(localpart, "rabbit")
+            token = self.login(localpart, "rabbit")
+
+            users_and_tokens[user_id] = token
+
+        room_creator_user_id = self.register_user("room_creator", "rabbit")
+        room_creator_token = self.login("room_creator", "rabbit")
+        users_and_tokens[room_creator_user_id] = room_creator_token
+
+        # Create a room and invite some users.
+        room_id = self.helper.create_room_as(
+            room_creator_user_id, tok=room_creator_token
+        )
+        event_ids_to_senders: dict[str, str] = {}
+        for user_id, token in users_and_tokens.items():
+            if user_id == room_creator_user_id:
+                continue
+
+            self.helper.invite(
+                room=room_id,
+                targ=user_id,
+                tok=room_creator_token,
+            )
+
+            # Have the user accept the invite and join the room.
+            self.helper.join(
+                room=room_id,
+                user=user_id,
+                tok=token,
+            )
+
+            # Have the user send an event.
+            response = self.helper.send_event(
+                room_id=room_id,
+                type="m.room.message",
+                content={
+                    "msgtype": "m.text",
+                    "body": f"hello, I'm {user_id}!",
+                },
+                tok=token,
+            )
+
+            # Record the event ID and sender.
+            event_id = response["event_id"]
+            event_ids_to_senders[event_id] = user_id
+
+        # Check that `get_senders_for_event_ids` returns the correct data.
+        response = self.get_success(
+            self._store.get_senders_for_event_ids(list(event_ids_to_senders.keys()))
+        )
+        self.assert_dict(event_ids_to_senders, response)
+
+
 class ExtremPruneTestCase(HomeserverTestCase):
     servlets = [
         admin.register_servlets,
@@ -97,7 +167,7 @@ class ExtremPruneTestCase(HomeserverTestCase):
         self.assert_extremities([self.remote_event_1.event_id])
 
     def persist_event(
-        self, event: EventBase, state: Optional[StateMap[str]] = None
+        self, event: EventBase, state: StateMap[str] | None = None
     ) -> None:
         """Persist the event, with optional state"""
         context = self.get_success(
@@ -109,7 +179,7 @@ class ExtremPruneTestCase(HomeserverTestCase):
         )
         self.get_success(self._persistence.persist_event(event, context))
 
-    def assert_extremities(self, expected_extremities: List[str]) -> None:
+    def assert_extremities(self, expected_extremities: list[str]) -> None:
         """Assert the current extremities for the room"""
         extremities = self.get_success(
             self.store.get_prev_events_for_room(self.room_id)
diff --git a/tests/storage/test_events_bg_updates.py b/tests/storage/test_events_bg_updates.py
index 7bbb5849a0..a5b53de77f 100644
--- a/tests/storage/test_events_bg_updates.py
+++ b/tests/storage/test_events_bg_updates.py
@@ -13,14 +13,16 @@
 #
 #
 
-from typing import Dict
+
+from canonicaljson import encode_canonical_json
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.api.constants import MAX_DEPTH
 from synapse.api.room_versions import RoomVersion, RoomVersions
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.types.storage import _BackgroundUpdates
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -48,7 +50,7 @@ class TestFixupMaxDepthCapBgUpdate(HomeserverTestCase):
             )
         )
 
-    def create_room(self, room_version: RoomVersion) -> Dict[str, int]:
+    def create_room(self, room_version: RoomVersion) -> dict[str, int]:
         """Create a room with a known room version and insert events.
 
         Returns the set of event IDs that exceed MAX_DEPTH and
@@ -67,7 +69,7 @@ class TestFixupMaxDepthCapBgUpdate(HomeserverTestCase):
         )
 
         # Insert events with some depths exceeding MAX_DEPTH
-        event_id_to_depth: Dict[str, int] = {}
+        event_id_to_depth: dict[str, int] = {}
         for depth in range(MAX_DEPTH - 5, MAX_DEPTH + 5):
             event_id = f"$event{depth}:example.com"
             event_id_to_depth[event_id] = depth
@@ -155,3 +157,133 @@ class TestFixupMaxDepthCapBgUpdate(HomeserverTestCase):
         # Assert that the topological_ordering of events has not been changed
         # from their depth.
         self.assertDictEqual(event_id_to_depth, dict(rows))
+
+
+class TestRedactionsRecheckBgUpdate(HomeserverTestCase):
+    """Test the background update that backfills the `recheck` column in redactions."""
+
+    def prepare(
+        self, reactor: MemoryReactor, clock: Clock, homeserver: HomeServer
+    ) -> None:
+        self.store = self.hs.get_datastores().main
+        self.db_pool = self.store.db_pool
+
+        # Re-insert the background update, since it already ran during setup.
+        self.get_success(
+            self.db_pool.simple_insert(
+                table="background_updates",
+                values={
+                    "update_name": _BackgroundUpdates.REDACTIONS_RECHECK_BG_UPDATE,
+                    "progress_json": "{}",
+                },
+            )
+        )
+        self.db_pool.updates._all_done = False
+
+    def _insert_redaction(
+        self,
+        event_id: str,
+        redacts: str,
+        recheck_redaction: bool | None = None,
+        insert_event_json: bool = True,
+    ) -> None:
+        """Insert a row into `redactions` and optionally a matching `event_json` row.
+
+        Args:
+            event_id: The event ID of the redaction event.
+            redacts: The event ID being redacted.
+            recheck_redaction: The value of `recheck_redaction` in internal metadata.
+                If None, the key is omitted from internal metadata.
+            insert_event_json: Whether to insert a corresponding row in `event_json`.
+        """
+        self.get_success(
+            self.db_pool.simple_insert(
+                table="redactions",
+                values={
+                    "event_id": event_id,
+                    "redacts": redacts,
+                    "have_censored": False,
+                    "received_ts": 0,
+                },
+            )
+        )
+
+        if insert_event_json:
+            internal_metadata: dict = {}
+            if recheck_redaction is not None:
+                internal_metadata["recheck_redaction"] = recheck_redaction
+
+            self.get_success(
+                self.db_pool.simple_insert(
+                    table="event_json",
+                    values={
+                        "event_id": event_id,
+                        "room_id": "!room:test",
+                        "internal_metadata": encode_canonical_json(
+                            internal_metadata
+                        ).decode("utf-8"),
+                        "json": "{}",
+                        "format_version": 3,
+                    },
+                )
+            )
+
+    def _get_recheck(self, event_id: str) -> bool:
+        row = self.get_success(
+            self.db_pool.simple_select_one(
+                table="redactions",
+                keyvalues={"event_id": event_id},
+                retcols=["recheck"],
+            )
+        )
+        return bool(row[0])
+
+    def test_recheck_true(self) -> None:
+        """A redaction with recheck_redaction=True in internal metadata gets recheck=True."""
+        self._insert_redaction("$redact1:test", "$target1:test", recheck_redaction=True)
+
+        self.wait_for_background_updates()
+
+        self.assertTrue(self._get_recheck("$redact1:test"))
+
+    def test_recheck_false(self) -> None:
+        """A redaction with recheck_redaction=False in internal metadata gets recheck=False."""
+        self._insert_redaction(
+            "$redact2:test", "$target2:test", recheck_redaction=False
+        )
+
+        self.wait_for_background_updates()
+
+        self.assertFalse(self._get_recheck("$redact2:test"))
+
+    def test_recheck_absent_from_metadata(self) -> None:
+        """A redaction with no recheck_redaction key in internal metadata gets recheck=False."""
+        self._insert_redaction("$redact3:test", "$target3:test", recheck_redaction=None)
+
+        self.wait_for_background_updates()
+
+        self.assertFalse(self._get_recheck("$redact3:test"))
+
+    def test_recheck_no_event_json(self) -> None:
+        """A redaction with no event_json row gets recheck=False."""
+        self._insert_redaction(
+            "$redact4:test", "$target4:test", insert_event_json=False
+        )
+
+        self.wait_for_background_updates()
+
+        self.assertFalse(self._get_recheck("$redact4:test"))
+
+    def test_batching(self) -> None:
+        """The update processes rows in batches, completing when all are done."""
+        self._insert_redaction("$redact5:test", "$target5:test", recheck_redaction=True)
+        self._insert_redaction(
+            "$redact6:test", "$target6:test", recheck_redaction=False
+        )
+        self._insert_redaction("$redact7:test", "$target7:test", recheck_redaction=True)
+
+        self.wait_for_background_updates()
+
+        self.assertTrue(self._get_recheck("$redact5:test"))
+        self.assertFalse(self._get_recheck("$redact6:test"))
+        self.assertTrue(self._get_recheck("$redact7:test"))
diff --git a/tests/storage/test_id_generators.py b/tests/storage/test_id_generators.py
index 9e949af482..051c5de44d 100644
--- a/tests/storage/test_id_generators.py
+++ b/tests/storage/test_id_generators.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict, List, Optional
 
 from twisted.internet.testing import MemoryReactor
 
@@ -35,7 +34,7 @@ from synapse.storage.util.sequence import (
     PostgresSequenceGenerator,
     SequenceGenerator,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 from tests.utils import USE_POSTGRES_FOR_TESTS
@@ -43,12 +42,12 @@ from tests.utils import USE_POSTGRES_FOR_TESTS
 
 class MultiWriterIdGeneratorBase(HomeserverTestCase):
     positive: bool = True
-    tables: List[str] = ["foobar"]
+    tables: list[str] = ["foobar"]
 
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.store = hs.get_datastores().main
         self.db_pool: DatabasePool = self.store.db_pool
-        self.instances: Dict[str, MultiWriterIdGenerator] = {}
+        self.instances: dict[str, MultiWriterIdGenerator] = {}
 
         self.get_success(self.db_pool.runInteraction("_setup_db", self._setup_db))
 
@@ -76,7 +75,7 @@ class MultiWriterIdGeneratorBase(HomeserverTestCase):
     def _create_id_generator(
         self,
         instance_name: str = "master",
-        writers: Optional[List[str]] = None,
+        writers: list[str] | None = None,
     ) -> MultiWriterIdGenerator:
         def _create(conn: LoggingDatabaseConnection) -> MultiWriterIdGenerator:
             return MultiWriterIdGenerator(
@@ -113,7 +112,7 @@ class MultiWriterIdGeneratorBase(HomeserverTestCase):
             self._replicate(instance_name)
 
     def _insert_row(
-        self, instance_name: str, stream_id: int, table: Optional[str] = None
+        self, instance_name: str, stream_id: int, table: str | None = None
     ) -> None:
         """Insert one row as the given instance with given stream_id."""
 
@@ -144,7 +143,7 @@ class MultiWriterIdGeneratorBase(HomeserverTestCase):
         self,
         instance_name: str,
         number: int,
-        table: Optional[str] = None,
+        table: str | None = None,
         update_stream_table: bool = True,
     ) -> None:
         """Insert N rows as the given instance, inserting with stream IDs pulled
diff --git a/tests/storage/test_invite_rule.py b/tests/storage/test_invite_rule.py
index 38c97ecaa3..ae99907704 100644
--- a/tests/storage/test_invite_rule.py
+++ b/tests/storage/test_invite_rule.py
@@ -1,4 +1,8 @@
-from synapse.storage.invite_rule import InviteRule, InviteRulesConfig
+from synapse.storage.invite_rule import (
+    AllowAllInviteRulesConfig,
+    InviteRule,
+    MSC4155InviteRulesConfig,
+)
 from synapse.types import UserID
 
 from tests import unittest
@@ -10,23 +14,23 @@ ignored_user = UserID.from_string("@ignored:ignore.example.org")
 
 
 class InviteFilterTestCase(unittest.TestCase):
-    def test_empty(self) -> None:
+    def test_allow_all(self) -> None:
         """Permit by default"""
-        config = InviteRulesConfig(None)
+        config = AllowAllInviteRulesConfig()
         self.assertEqual(
             config.get_invite_rule(regular_user.to_string()), InviteRule.ALLOW
         )
 
     def test_ignore_invalid(self) -> None:
         """Invalid strings are ignored"""
-        config = InviteRulesConfig({"blocked_users": ["not a user"]})
+        config = MSC4155InviteRulesConfig({"blocked_users": ["not a user"]})
         self.assertEqual(
             config.get_invite_rule(blocked_user.to_string()), InviteRule.ALLOW
         )
 
     def test_user_blocked(self) -> None:
         """Permit all, except explicitly blocked users"""
-        config = InviteRulesConfig({"blocked_users": [blocked_user.to_string()]})
+        config = MSC4155InviteRulesConfig({"blocked_users": [blocked_user.to_string()]})
         self.assertEqual(
             config.get_invite_rule(blocked_user.to_string()), InviteRule.BLOCK
         )
@@ -36,7 +40,7 @@ class InviteFilterTestCase(unittest.TestCase):
 
     def test_user_ignored(self) -> None:
         """Permit all, except explicitly ignored users"""
-        config = InviteRulesConfig({"ignored_users": [ignored_user.to_string()]})
+        config = MSC4155InviteRulesConfig({"ignored_users": [ignored_user.to_string()]})
         self.assertEqual(
             config.get_invite_rule(ignored_user.to_string()), InviteRule.IGNORE
         )
@@ -46,7 +50,7 @@ class InviteFilterTestCase(unittest.TestCase):
 
     def test_user_precedence(self) -> None:
         """Always take allowed over ignored, ignored over blocked, and then block."""
-        config = InviteRulesConfig(
+        config = MSC4155InviteRulesConfig(
             {
                 "allowed_users": [allowed_user.to_string()],
                 "ignored_users": [allowed_user.to_string(), ignored_user.to_string()],
@@ -70,7 +74,7 @@ class InviteFilterTestCase(unittest.TestCase):
     def test_server_blocked(self) -> None:
         """Block all users on the server except those allowed."""
         user_on_same_server = UserID("blocked", allowed_user.domain)
-        config = InviteRulesConfig(
+        config = MSC4155InviteRulesConfig(
             {
                 "allowed_users": [allowed_user.to_string()],
                 "blocked_servers": [allowed_user.domain],
@@ -86,7 +90,7 @@ class InviteFilterTestCase(unittest.TestCase):
     def test_server_ignored(self) -> None:
         """Ignore all users on the server except those allowed."""
         user_on_same_server = UserID("ignored", allowed_user.domain)
-        config = InviteRulesConfig(
+        config = MSC4155InviteRulesConfig(
             {
                 "allowed_users": [allowed_user.to_string()],
                 "ignored_servers": [allowed_user.domain],
@@ -104,7 +108,7 @@ class InviteFilterTestCase(unittest.TestCase):
         blocked_user_on_same_server = UserID("blocked", allowed_user.domain)
         ignored_user_on_same_server = UserID("ignored", allowed_user.domain)
         allowed_user_on_same_server = UserID("another", allowed_user.domain)
-        config = InviteRulesConfig(
+        config = MSC4155InviteRulesConfig(
             {
                 "ignored_users": [ignored_user_on_same_server.to_string()],
                 "blocked_users": [blocked_user_on_same_server.to_string()],
@@ -129,7 +133,7 @@ class InviteFilterTestCase(unittest.TestCase):
 
     def test_server_precedence(self) -> None:
         """Always take allowed over ignored, ignored over blocked, and then block."""
-        config = InviteRulesConfig(
+        config = MSC4155InviteRulesConfig(
             {
                 "allowed_servers": [allowed_user.domain],
                 "ignored_servers": [allowed_user.domain, ignored_user.domain],
@@ -152,7 +156,7 @@ class InviteFilterTestCase(unittest.TestCase):
 
     def test_server_glob(self) -> None:
         """Test that glob patterns match"""
-        config = InviteRulesConfig({"blocked_servers": ["*.example.org"]})
+        config = MSC4155InviteRulesConfig({"blocked_servers": ["*.example.org"]})
         self.assertEqual(
             config.get_invite_rule(allowed_user.to_string()), InviteRule.BLOCK
         )
diff --git a/tests/storage/test_monthly_active_users.py b/tests/storage/test_monthly_active_users.py
index 78ef2e67a2..4f97d89f78 100644
--- a/tests/storage/test_monthly_active_users.py
+++ b/tests/storage/test_monthly_active_users.py
@@ -17,14 +17,14 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, Dict, List
+from typing import Any
 from unittest.mock import AsyncMock
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.api.constants import UserTypes
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import default_config, override_config
@@ -32,7 +32,7 @@ from tests.unittest import default_config, override_config
 FORTY_DAYS = 40 * 24 * 60 * 60
 
 
-def gen_3pids(count: int) -> List[Dict[str, Any]]:
+def gen_3pids(count: int) -> list[dict[str, Any]]:
     """Generate `count` threepids as a list."""
     return [
         {"medium": "email", "address": "user%i@matrix.org" % i} for i in range(count)
@@ -40,7 +40,7 @@ def gen_3pids(count: int) -> List[Dict[str, Any]]:
 
 
 class MonthlyActiveUsersTestCase(unittest.HomeserverTestCase):
-    def default_config(self) -> Dict[str, Any]:
+    def default_config(self) -> dict[str, Any]:
         config = default_config("test")
 
         config.update({"limit_usage_by_mau": True, "max_mau_value": 50})
@@ -101,7 +101,7 @@ class MonthlyActiveUsersTestCase(unittest.HomeserverTestCase):
 
         # Test each of the registered users is marked as active
         timestamp = self.get_success(self.store.user_last_seen_monthly_active(user1))
-        # Mypy notes that one shouldn't compare Optional[int] to 0 with assertGreater.
+        # Mypy notes that one shouldn't compare int | None to 0 with assertGreater.
         # Check that timestamp really is an int.
         assert timestamp is not None
         self.assertGreater(timestamp, 0)
@@ -110,13 +110,13 @@ class MonthlyActiveUsersTestCase(unittest.HomeserverTestCase):
         self.assertGreater(timestamp, 0)
 
         # Test that users with reserved 3pids are not removed from the MAU table
-        # XXX some of this is redundant. poking things into the config shouldn't
-        # work, and in any case it's not obvious what we expect to happen when
-        # we advance the reactor.
-        self.hs.config.server.max_mau_value = 0
+        #
+        # The `start_phone_stats_home()` looping call will cause us to run
+        # `reap_monthly_active_users` after the time has advanced
         self.reactor.advance(FORTY_DAYS)
-        self.hs.config.server.max_mau_value = 5
 
+        # I guess we call this one more time for good measure? Perhaps because
+        # previously, the phone home stats weren't running in tests?
         self.get_success(self.store.reap_monthly_active_users())
 
         active_count = self.get_success(self.store.get_monthly_active_count())
diff --git a/tests/storage/test_profile.py b/tests/storage/test_profile.py
index 0f14e00e51..dbaf298697 100644
--- a/tests/storage/test_profile.py
+++ b/tests/storage/test_profile.py
@@ -25,7 +25,7 @@ from synapse.server import HomeServer
 from synapse.storage.database import LoggingTransaction
 from synapse.storage.engines import PostgresEngine
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/storage/test_purge.py b/tests/storage/test_purge.py
index 38d0cd6eb2..2894530d52 100644
--- a/tests/storage/test_purge.py
+++ b/tests/storage/test_purge.py
@@ -25,7 +25,7 @@ from synapse.rest.client import room
 from synapse.server import HomeServer
 from synapse.types.state import StateFilter
 from synapse.types.storage import _BackgroundUpdates
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/storage/test_receipts.py b/tests/storage/test_receipts.py
index 8f7f736175..27875dcebb 100644
--- a/tests/storage/test_receipts.py
+++ b/tests/storage/test_receipts.py
@@ -19,14 +19,14 @@
 #
 #
 
-from typing import Collection, Optional
+from typing import Collection
 
 from twisted.internet.testing import MemoryReactor
 
 from synapse.api.constants import ReceiptTypes
 from synapse.server import HomeServer
 from synapse.types import UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.test_utils.event_injection import create_event
 from tests.unittest import HomeserverTestCase
@@ -101,8 +101,8 @@ class ReceiptTestCase(HomeserverTestCase):
         )
 
     def get_last_unthreaded_receipt(
-        self, receipt_types: Collection[str], room_id: Optional[str] = None
-    ) -> Optional[str]:
+        self, receipt_types: Collection[str], room_id: str | None = None
+    ) -> str | None:
         """
         Fetch the event ID for the latest unthreaded receipt in the test room for the test user.
 
diff --git a/tests/storage/test_redaction.py b/tests/storage/test_redaction.py
index a9c0d7d9a9..c82ccf1600 100644
--- a/tests/storage/test_redaction.py
+++ b/tests/storage/test_redaction.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional, cast
+from typing import cast
 
 from canonicaljson import json
 
@@ -31,7 +31,7 @@ from synapse.events.builder import EventBuilder
 from synapse.server import HomeServer
 from synapse.synapse_rust.events import EventInternalMetadata
 from synapse.types import JsonDict, RoomID, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.utils import create_room
@@ -67,7 +67,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
         room: RoomID,
         user: UserID,
         membership: str,
-        extra_content: Optional[JsonDict] = None,
+        extra_content: JsonDict | None = None,
     ) -> EventBase:
         content = {"membership": membership}
         content.update(extra_content or {})
@@ -158,7 +158,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
             event,
         )
 
-        self.assertFalse("redacted_because" in event.unsigned)
+        self.assertIsNone(event.internal_metadata.redacted_by)
 
         # Redact event
         reason = "Because I said so"
@@ -168,7 +168,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
 
         self.assertEqual(msg_event.event_id, event.event_id)
 
-        self.assertTrue("redacted_because" in event.unsigned)
+        self.assertIsNotNone(event.internal_metadata.redacted_by)
 
         self.assertObjectHasAttributes(
             {
@@ -179,15 +179,6 @@ class RedactionTestCase(unittest.HomeserverTestCase):
             event,
         )
 
-        self.assertObjectHasAttributes(
-            {
-                "type": EventTypes.Redaction,
-                "user_id": self.u_alice.to_string(),
-                "content": {"reason": reason},
-            },
-            event.unsigned["redacted_because"],
-        )
-
     def test_redact_join(self) -> None:
         self.inject_room_member(self.room1, self.u_alice, Membership.JOIN)
 
@@ -206,7 +197,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
             event,
         )
 
-        self.assertFalse(hasattr(event, "redacted_because"))
+        self.assertIsNone(event.internal_metadata.redacted_by)
 
         # Redact event
         reason = "Because I said so"
@@ -216,7 +207,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
 
         event = self.get_success(self.store.get_event(msg_event.event_id))
 
-        self.assertTrue("redacted_because" in event.unsigned)
+        self.assertIsNotNone(event.internal_metadata.redacted_by)
 
         self.assertObjectHasAttributes(
             {
@@ -227,15 +218,6 @@ class RedactionTestCase(unittest.HomeserverTestCase):
             event,
         )
 
-        self.assertObjectHasAttributes(
-            {
-                "type": EventTypes.Redaction,
-                "user_id": self.u_alice.to_string(),
-                "content": {"reason": reason},
-            },
-            event.unsigned["redacted_because"],
-        )
-
     def test_circular_redaction(self) -> None:
         redaction_event_id1 = "$redaction1_id:test"
         redaction_event_id2 = "$redaction2_id:test"
@@ -247,9 +229,9 @@ class RedactionTestCase(unittest.HomeserverTestCase):
 
             async def build(
                 self,
-                prev_event_ids: List[str],
-                auth_event_ids: Optional[List[str]],
-                depth: Optional[int] = None,
+                prev_event_ids: list[str],
+                auth_event_ids: list[str] | None,
+                depth: int | None = None,
             ) -> EventBase:
                 built_event = await self._base_builder.build(
                     prev_event_ids=prev_event_ids, auth_event_ids=auth_event_ids
@@ -331,10 +313,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
         fetched = self.get_success(self.store.get_event(redaction_event_id1))
 
         # it should have been redacted
-        self.assertEqual(fetched.unsigned["redacted_by"], redaction_event_id2)
-        self.assertEqual(
-            fetched.unsigned["redacted_because"].event_id, redaction_event_id2
-        )
+        self.assertEqual(fetched.internal_metadata.redacted_by, redaction_event_id2)
 
     def test_redact_censor(self) -> None:
         """Test that a redacted event gets censored in the DB after a month"""
@@ -355,7 +334,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
             event,
         )
 
-        self.assertFalse("redacted_because" in event.unsigned)
+        self.assertIsNone(event.internal_metadata.redacted_by)
 
         # Redact event
         reason = "Because I said so"
@@ -363,7 +342,7 @@ class RedactionTestCase(unittest.HomeserverTestCase):
 
         event = self.get_success(self.store.get_event(msg_event.event_id))
 
-        self.assertTrue("redacted_because" in event.unsigned)
+        self.assertIsNotNone(event.internal_metadata.redacted_by)
 
         self.assertObjectHasAttributes(
             {
diff --git a/tests/storage/test_registration.py b/tests/storage/test_registration.py
index 992ccc779b..7ee81fabb6 100644
--- a/tests/storage/test_registration.py
+++ b/tests/storage/test_registration.py
@@ -24,7 +24,7 @@ from synapse.api.constants import UserTypes
 from synapse.api.errors import ThreepidValidationError
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID, UserInfo
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase, override_config
 
diff --git a/tests/storage/test_relations.py b/tests/storage/test_relations.py
index 0f3e3fe7eb..96cee365f2 100644
--- a/tests/storage/test_relations.py
+++ b/tests/storage/test_relations.py
@@ -23,7 +23,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.api.constants import MAIN_TIMELINE
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/storage/test_rollback_worker.py b/tests/storage/test_rollback_worker.py
index af69b93cf8..125c4499b0 100644
--- a/tests/storage/test_rollback_worker.py
+++ b/tests/storage/test_rollback_worker.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List
 from unittest import mock
 
 from twisted.internet.testing import MemoryReactor
@@ -29,12 +28,12 @@ from synapse.storage.database import LoggingDatabaseConnection
 from synapse.storage.prepare_database import PrepareDatabaseException, prepare_database
 from synapse.storage.schema import SCHEMA_VERSION
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
 
-def fake_listdir(filepath: str) -> List[str]:
+def fake_listdir(filepath: str) -> list[str]:
     """
     A fake implementation of os.listdir which we can use to mock out the filesystem.
 
diff --git a/tests/storage/test_room.py b/tests/storage/test_room.py
index a8a75d2973..f8c5260fa2 100644
--- a/tests/storage/test_room.py
+++ b/tests/storage/test_room.py
@@ -24,7 +24,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.api.room_versions import RoomVersions
 from synapse.server import HomeServer
 from synapse.types import RoomAlias, RoomID, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/storage/test_room_search.py b/tests/storage/test_room_search.py
index f7eaa83ec6..2c0ef19e9e 100644
--- a/tests/storage/test_room_search.py
+++ b/tests/storage/test_room_search.py
@@ -19,7 +19,6 @@
 #
 #
 
-from typing import List, Tuple
 from unittest.case import SkipTest
 
 from twisted.internet.testing import MemoryReactor
@@ -33,7 +32,7 @@ from synapse.storage.databases.main import DataStore
 from synapse.storage.databases.main.search import Phrase, SearchToken, _tokenize_query
 from synapse.storage.engines import PostgresEngine
 from synapse.storage.engines.sqlite import Sqlite3Engine
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase, skip_unless
 from tests.utils import USE_POSTGRES_FOR_TESTS
@@ -317,7 +316,7 @@ class MessageSearchTest(HomeserverTestCase):
             )
 
     def _check_test_cases(
-        self, store: DataStore, cases: List[Tuple[str, bool]]
+        self, store: DataStore, cases: list[tuple[str, bool]]
     ) -> None:
         # Run all the test cases versus search_msgs
         for query, expect_to_contain in cases:
diff --git a/tests/storage/test_roommember.py b/tests/storage/test_roommember.py
index fd489022a8..f8d64e8ce6 100644
--- a/tests/storage/test_roommember.py
+++ b/tests/storage/test_roommember.py
@@ -20,7 +20,7 @@
 #
 #
 import logging
-from typing import List, Optional, Tuple, cast
+from typing import cast
 
 from twisted.internet.testing import MemoryReactor
 
@@ -33,7 +33,7 @@ from synapse.server import HomeServer
 from synapse.storage.databases.main.roommember import extract_heroes_from_room_summary
 from synapse.storage.roommember import MemberSummary
 from synapse.types import UserID, create_requester
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.server import TestHomeServer
@@ -133,7 +133,7 @@ class RoomMemberStoreTestCase(unittest.HomeserverTestCase):
         room = self.helper.create_room_as(self.u_alice, tok=self.t_alice)
 
         res = cast(
-            List[Tuple[Optional[str], str]],
+            list[tuple[str | None, str]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     "room_memberships",
@@ -165,7 +165,7 @@ class RoomMemberStoreTestCase(unittest.HomeserverTestCase):
         )
 
         res2 = cast(
-            List[Tuple[Optional[str], str]],
+            list[tuple[str | None, str]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     "room_memberships",
@@ -408,9 +408,9 @@ class RoomSummaryTestCase(unittest.HomeserverTestCase):
     def _assert_member_summary(
         self,
         actual_member_summary: MemberSummary,
-        expected_member_list: List[str],
+        expected_member_list: list[str],
         *,
-        expected_member_count: Optional[int] = None,
+        expected_member_count: int | None = None,
     ) -> None:
         """
         Assert that the `MemberSummary` object has the expected members.
diff --git a/tests/storage/test_sliding_sync_tables.py b/tests/storage/test_sliding_sync_tables.py
index 1a7a0b4c5c..f5bbd49663 100644
--- a/tests/storage/test_sliding_sync_tables.py
+++ b/tests/storage/test_sliding_sync_tables.py
@@ -18,7 +18,7 @@
 #
 #
 import logging
-from typing import Dict, List, Optional, Tuple, cast
+from typing import cast
 
 import attr
 from parameterized import parameterized
@@ -30,19 +30,23 @@ from synapse.api.room_versions import RoomVersions
 from synapse.events import EventBase, StrippedStateEvent, make_event_from_dict
 from synapse.events.snapshot import EventContext
 from synapse.rest import admin
-from synapse.rest.client import login, room
+from synapse.rest.client import login, room, sync
 from synapse.server import HomeServer
 from synapse.storage.databases.main.events import DeltaState
 from synapse.storage.databases.main.events_bg_updates import (
     _resolve_stale_data_in_sliding_sync_joined_rooms_table,
     _resolve_stale_data_in_sliding_sync_membership_snapshots_table,
 )
-from synapse.types import create_requester
+from synapse.types import SlidingSyncStreamToken, create_requester
+from synapse.types.handlers.sliding_sync import (
+    LAZY_MEMBERS_UPDATE_INTERVAL,
+    StateValues,
+)
 from synapse.types.storage import _BackgroundUpdates
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
+from tests.rest.client.sliding_sync.test_sliding_sync import SlidingSyncBase
 from tests.test_utils.event_injection import create_event
-from tests.unittest import HomeserverTestCase
 
 logger = logging.getLogger(__name__)
 
@@ -55,12 +59,12 @@ class _SlidingSyncJoinedRoomResult:
     # `event.internal_metadata.stream_ordering` is marked optional because it only
     # exists for persisted events but in the context of these tests, we're only working
     # with persisted events and we're making comparisons so we will find any mismatch.
-    event_stream_ordering: Optional[int]
-    bump_stamp: Optional[int]
-    room_type: Optional[str]
-    room_name: Optional[str]
+    event_stream_ordering: int | None
+    bump_stamp: int | None
+    room_type: str | None
+    room_name: str | None
     is_encrypted: bool
-    tombstone_successor_room_id: Optional[str]
+    tombstone_successor_room_id: str | None
 
 
 @attr.s(slots=True, frozen=True, auto_attribs=True)
@@ -75,18 +79,18 @@ class _SlidingSyncMembershipSnapshotResult:
     # `event.internal_metadata.stream_ordering` is marked optional because it only
     # exists for persisted events but in the context of these tests, we're only working
     # with persisted events and we're making comparisons so we will find any mismatch.
-    event_stream_ordering: Optional[int]
+    event_stream_ordering: int | None
     has_known_state: bool
-    room_type: Optional[str]
-    room_name: Optional[str]
+    room_type: str | None
+    room_name: str | None
     is_encrypted: bool
-    tombstone_successor_room_id: Optional[str]
+    tombstone_successor_room_id: str | None
     # Make this default to "not forgotten" because it doesn't apply to many tests and we
     # don't want to force all of the tests to deal with it.
     forgotten: bool = False
 
 
-class SlidingSyncTablesTestCaseBase(HomeserverTestCase):
+class SlidingSyncTablesTestCaseBase(SlidingSyncBase):
     """
     Helpers to deal with testing that the
     `sliding_sync_joined_rooms`/`sliding_sync_membership_snapshots` database tables are
@@ -97,6 +101,7 @@ class SlidingSyncTablesTestCaseBase(HomeserverTestCase):
         admin.register_servlets,
         login.register_servlets,
         room.register_servlets,
+        sync.register_servlets,
     ]
 
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
@@ -112,7 +117,7 @@ class SlidingSyncTablesTestCaseBase(HomeserverTestCase):
 
         self.state_handler = self.hs.get_state_handler()
 
-    def _get_sliding_sync_joined_rooms(self) -> Dict[str, _SlidingSyncJoinedRoomResult]:
+    def _get_sliding_sync_joined_rooms(self) -> dict[str, _SlidingSyncJoinedRoomResult]:
         """
         Return the rows from the `sliding_sync_joined_rooms` table.
 
@@ -120,7 +125,7 @@ class SlidingSyncTablesTestCaseBase(HomeserverTestCase):
             Mapping from room_id to _SlidingSyncJoinedRoomResult.
         """
         rows = cast(
-            List[Tuple[str, int, int, str, str, bool, str]],
+            list[tuple[str, int, int, str, str, bool, str]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     "sliding_sync_joined_rooms",
@@ -153,7 +158,7 @@ class SlidingSyncTablesTestCaseBase(HomeserverTestCase):
 
     def _get_sliding_sync_membership_snapshots(
         self,
-    ) -> Dict[Tuple[str, str], _SlidingSyncMembershipSnapshotResult]:
+    ) -> dict[tuple[str, str], _SlidingSyncMembershipSnapshotResult]:
         """
         Return the rows from the `sliding_sync_membership_snapshots` table.
 
@@ -161,7 +166,7 @@ class SlidingSyncTablesTestCaseBase(HomeserverTestCase):
             Mapping from the (room_id, user_id) to _SlidingSyncMembershipSnapshotResult.
         """
         rows = cast(
-            List[Tuple[str, str, str, str, str, int, int, bool, str, str, bool, str]],
+            list[tuple[str, str, str, str, str, int, int, bool, str, str, bool, str]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     "sliding_sync_membership_snapshots",
@@ -202,78 +207,6 @@ class SlidingSyncTablesTestCaseBase(HomeserverTestCase):
             for row in rows
         }
 
-    _remote_invite_count: int = 0
-
-    def _create_remote_invite_room_for_user(
-        self,
-        invitee_user_id: str,
-        unsigned_invite_room_state: Optional[List[StrippedStateEvent]],
-    ) -> Tuple[str, EventBase]:
-        """
-        Create a fake invite for a remote room and persist it.
-
-        We don't have any state for these kind of rooms and can only rely on the
-        stripped state included in the unsigned portion of the invite event to identify
-        the room.
-
-        Args:
-            invitee_user_id: The person being invited
-            unsigned_invite_room_state: List of stripped state events to assist the
-                receiver in identifying the room.
-
-        Returns:
-            The room ID of the remote invite room and the persisted remote invite event.
-        """
-        invite_room_id = f"!test_room{self._remote_invite_count}:remote_server"
-
-        invite_event_dict = {
-            "room_id": invite_room_id,
-            "sender": "@inviter:remote_server",
-            "state_key": invitee_user_id,
-            "depth": 1,
-            "origin_server_ts": 1,
-            "type": EventTypes.Member,
-            "content": {"membership": Membership.INVITE},
-            "auth_events": [],
-            "prev_events": [],
-        }
-        if unsigned_invite_room_state is not None:
-            serialized_stripped_state_events = []
-            for stripped_event in unsigned_invite_room_state:
-                serialized_stripped_state_events.append(
-                    {
-                        "type": stripped_event.type,
-                        "state_key": stripped_event.state_key,
-                        "sender": stripped_event.sender,
-                        "content": stripped_event.content,
-                    }
-                )
-
-            invite_event_dict["unsigned"] = {
-                "invite_room_state": serialized_stripped_state_events
-            }
-
-        invite_event = make_event_from_dict(
-            invite_event_dict,
-            room_version=RoomVersions.V10,
-        )
-        invite_event.internal_metadata.outlier = True
-        invite_event.internal_metadata.out_of_band_membership = True
-
-        self.get_success(
-            self.store.maybe_store_room_on_outlier_membership(
-                room_id=invite_room_id, room_version=invite_event.room_version
-            )
-        )
-        context = EventContext.for_outlier(self.hs.get_storage_controllers())
-        persisted_event, _, _ = self.get_success(
-            self.persist_controller.persist_event(invite_event, context)
-        )
-
-        self._remote_invite_count += 1
-
-        return invite_room_id, persisted_event
-
     def _retract_remote_invite_for_user(
         self,
         user_id: str,
@@ -2246,7 +2179,7 @@ class SlidingSyncTablesTestCase(SlidingSyncTablesTestCaseBase):
         ]
     )
     def test_non_join_remote_invite_no_stripped_state(
-        self, _description: str, stripped_state: Optional[List[StrippedStateEvent]]
+        self, _description: str, stripped_state: list[StrippedStateEvent] | None
     ) -> None:
         """
         Test remote invite with no stripped state provided shows up in
@@ -3052,6 +2985,383 @@ class SlidingSyncTablesTestCase(SlidingSyncTablesTestCaseBase):
             exact=True,
         )
 
+    def test_lazy_loading_room_members_last_seen_ts(self) -> None:
+        """Test that the `last_seen_ts` column in
+        `sliding_sync_connection_lazy_members` is correctly kept up to date.
+
+        We expect that it only gets updated every
+        `LAZY_MEMBERS_UPDATE_INTERVAL`, rather than on every sync.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        room_id = self.helper.create_room_as(user2_id, tok=user2_tok, is_public=True)
+        self.helper.join(room_id, user1_id, tok=user1_tok)
+
+        # Send a message so that user1 comes down sync.
+        self.helper.send(room_id, "msg", tok=user1_tok)
+
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        response_body, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # Check that user1 is returned
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id]["required_state"],
+            {
+                state_map[(EventTypes.Member, user1_id)],
+            },
+            exact=True,
+        )
+
+        # Check that we have an entry in sliding_sync_connection_lazy_members
+        connection_pos1 = self.get_success(
+            SlidingSyncStreamToken.from_string(self.store, from_token)
+        ).connection_position
+        lazy_member_entries = self.get_success(
+            self.store.get_sliding_sync_connection_lazy_members(
+                connection_pos1, room_id, {user1_id}
+            )
+        )
+        self.assertIn(user1_id, lazy_member_entries)
+
+        prev_timestamp = lazy_member_entries[user1_id]
+
+        # If user1 sends a message then we consider it for lazy loading. We have
+        # previously returned it so we don't send the state down again, but it
+        # is still eligible for updating the timestamp. Since we last updated
+        # the timestamp within the last `LAZY_MEMBERS_UPDATE_INTERVAL`, we do not
+        # update it.
+        self.helper.send(room_id, "msg2", tok=user1_tok)
+
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        # We expect the required_state map to be empty as nothing has changed.
+        state_map = self.get_success(
+            self.storage_controllers.state.get_current_state(room_id)
+        )
+        self._assertRequiredStateIncludes(
+            response_body["rooms"][room_id].get("required_state", []),
+            {},
+            exact=True,
+        )
+
+        connection_pos2 = self.get_success(
+            SlidingSyncStreamToken.from_string(self.store, from_token)
+        ).connection_position
+
+        lazy_member_entries = self.get_success(
+            self.store.get_sliding_sync_connection_lazy_members(
+                connection_pos2, room_id, {user1_id}
+            )
+        )
+
+        # The timestamp should be unchanged.
+        self.assertEqual(lazy_member_entries[user1_id], prev_timestamp)
+
+        # Now advance the time by `LAZY_MEMBERS_UPDATE_INTERVAL` so that we
+        # would update the timestamp.
+        self.reactor.advance(LAZY_MEMBERS_UPDATE_INTERVAL.as_secs())
+
+        # Send a message from user2
+        self.helper.send(room_id, "msg3", tok=user2_tok)
+
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+
+        connection_pos3 = self.get_success(
+            SlidingSyncStreamToken.from_string(self.store, from_token)
+        ).connection_position
+
+        lazy_member_entries = self.get_success(
+            self.store.get_sliding_sync_connection_lazy_members(
+                connection_pos3, room_id, {user1_id}
+            )
+        )
+
+        # The timestamp for user1 should be unchanged, as they were not sent down.
+        self.assertEqual(lazy_member_entries[user1_id], prev_timestamp)
+
+        # Now if user1 sends a message, then the timestamp should be updated as
+        # its been over `LAZY_MEMBERS_UPDATE_INTERVAL` since we last updated it.
+        # (Even though we don't send the state down again).
+        self.helper.send(room_id, "msg4", tok=user1_tok)
+
+        response_body, from_token = self.do_sync(
+            sync_body, since=from_token, tok=user1_tok
+        )
+        connection_pos4 = self.get_success(
+            SlidingSyncStreamToken.from_string(self.store, from_token)
+        ).connection_position
+
+        lazy_member_entries = self.get_success(
+            self.store.get_sliding_sync_connection_lazy_members(
+                connection_pos4, room_id, {user1_id}
+            )
+        )
+        # The timestamp for user1 should be updated.
+        self.assertGreater(lazy_member_entries[user1_id], prev_timestamp)
+
+    def test_pruning_sliding_sync_connection_required_state(self) -> None:
+        """Test that we prune old entries from
+        `sliding_sync_connection_required_state`.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok, is_public=True)
+        self.helper.send_state(
+            room_id, EventTypes.Name, {"name": "A room"}, tok=user1_tok
+        )
+
+        # Do an initial sync, this will pull down the above room and thus cause
+        # us to store a single required state entry for the room.
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        _, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # Check that we have an entry in sliding_sync_connection_required_state
+        connection_pos1 = self.get_success(
+            SlidingSyncStreamToken.from_string(self.store, from_token)
+        ).connection_position
+
+        connection_key = self.get_success(
+            self.store.db_pool.simple_select_one_onecol(
+                table="sliding_sync_connection_positions",
+                keyvalues={"connection_position": connection_pos1},
+                retcol="connection_key",
+            )
+        )
+
+        required_state_entries = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sliding_sync_connection_required_state",
+                keyvalues={"connection_key": connection_key},
+                retcols=("required_state_id", "required_state"),
+            )
+        )
+
+        # We expect a single entry here for the one room ID.
+        self.assertEqual(len(required_state_entries), 1)
+        first_required_state_id = required_state_entries[0][0]
+
+        # Update the sync body to request more required state, so that we get
+        # another entry in the table.
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Name, ""],
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+
+        # We need to send a message to cause the room to come down the next
+        # sync. This shouldn't be necessary, but we don't currently implement
+        # immediately sending down the room when required_state is updated,
+        # see https://github.com/element-hq/synapse/issues/18844
+        self.helper.send(room_id, "msg1", tok=user1_tok)
+
+        _, from_token = self.do_sync(sync_body, since=from_token, tok=user1_tok)
+
+        required_state_entries = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sliding_sync_connection_required_state",
+                keyvalues={"connection_key": connection_key},
+                retcols=("required_state_id", "required_state"),
+            )
+        )
+
+        # We expect two entries here, one for old state and one for new state.
+        # The old entry doesn't get pruned yet as the previous from_token could
+        # still be used.
+        self.assertEqual(len(required_state_entries), 2)
+
+        # Sync again with the latest token. This time we expect the old
+        # entry to be pruned.
+        self.do_sync(sync_body, since=from_token, tok=user1_tok)
+
+        required_state_entries = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sliding_sync_connection_required_state",
+                keyvalues={"connection_key": connection_key},
+                retcols=("required_state_id", "required_state"),
+            )
+        )
+
+        self.assertEqual(len(required_state_entries), 1)
+
+        # Double check that we have pruned the old entry.
+        self.assertNotEqual(required_state_entries[0][0], first_required_state_id)
+
+    def test_pruning_sliding_sync_connection_required_state_forks(self) -> None:
+        """Test that we prune entries in
+        `sliding_sync_connection_required_state` for forked positions.
+        """
+
+        user1_id = self.register_user("user1", "pass")
+        user1_tok = self.login(user1_id, "pass")
+
+        room_id = self.helper.create_room_as(user1_id, tok=user1_tok, is_public=True)
+        self.helper.send_state(
+            room_id, EventTypes.Name, {"name": "A room"}, tok=user1_tok
+        )
+
+        # Do an initial sync, this will pull down the above room and thus cause
+        # us to store a single required state entry for the room.
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        _, from_token = self.do_sync(sync_body, tok=user1_tok)
+
+        # Check that we have an entry in sliding_sync_connection_required_state
+        connection_pos1 = self.get_success(
+            SlidingSyncStreamToken.from_string(self.store, from_token)
+        ).connection_position
+
+        connection_key = self.get_success(
+            self.store.db_pool.simple_select_one_onecol(
+                table="sliding_sync_connection_positions",
+                keyvalues={"connection_position": connection_pos1},
+                retcol="connection_key",
+            )
+        )
+
+        required_state_entries = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sliding_sync_connection_required_state",
+                keyvalues={"connection_key": connection_key},
+                retcols=("required_state_id", "required_state"),
+            )
+        )
+
+        # We expect a single entry here for the one room ID.
+        self.assertEqual(len(required_state_entries), 1)
+        first_required_state_id = required_state_entries[0][0]
+
+        # Update the sync body to request more required state, so that we get
+        # another entry in the table.
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Name, ""],
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+
+        # We need to send a message to cause the room to come down the next
+        # sync. This shouldn't be necessary, but we don't currently implement
+        # immediately sending down the room when required_state is updated,
+        # see https://github.com/element-hq/synapse/issues/18844
+        self.helper.send(room_id, "msg1", tok=user1_tok)
+
+        _, _ = self.do_sync(sync_body, since=from_token, tok=user1_tok)
+
+        required_state_entries = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sliding_sync_connection_required_state",
+                keyvalues={"connection_key": connection_key},
+                retcols=("required_state_id", "required_state"),
+            )
+        )
+
+        # We expect two entries here, one for old state and one for new state.
+        # The old entry doesn't get pruned yet as the previous from_token could
+        # still be used.
+        self.assertEqual(len(required_state_entries), 2)
+        second_required_state_id = sorted(required_state_entries)[1][0]
+
+        # We sync again, but with the old token, creating a fork in the
+        # connection positions. We change the sync body again so that the
+        # `required_state` doesn't get deduplicated.
+        sync_body = {
+            "lists": {
+                "foo-list": {
+                    "ranges": [[0, 1]],
+                    "required_state": [
+                        [EventTypes.Topic, ""],
+                        [EventTypes.Member, StateValues.LAZY],
+                    ],
+                    "timeline_limit": 1,
+                }
+            }
+        }
+        _, from_token = self.do_sync(sync_body, since=from_token, tok=user1_tok)
+
+        # There should now be three entries, one for each of the required_state.
+        required_state_entries = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sliding_sync_connection_required_state",
+                keyvalues={"connection_key": connection_key},
+                retcols=("required_state_id", "required_state"),
+            )
+        )
+
+        self.assertEqual(len(required_state_entries), 3)
+
+        # Sync again with the latest token. This should prune all except the
+        # latest entry in `sliding_sync_connection_required_state`.
+        _, from_token = self.do_sync(sync_body, since=from_token, tok=user1_tok)
+
+        required_state_entries = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sliding_sync_connection_required_state",
+                keyvalues={"connection_key": connection_key},
+                retcols=("required_state_id", "required_state"),
+            )
+        )
+
+        self.assertEqual(len(required_state_entries), 1)
+
+        # Double check that we have pruned the old entry.
+        self.assertNotEqual(required_state_entries[0][0], first_required_state_id)
+        self.assertNotEqual(required_state_entries[0][0], second_required_state_id)
+
 
 class SlidingSyncTablesBackgroundUpdatesTestCase(SlidingSyncTablesTestCaseBase):
     """
diff --git a/tests/storage/test_state.py b/tests/storage/test_state.py
index cbf68b3032..dbbede812d 100644
--- a/tests/storage/test_state.py
+++ b/tests/storage/test_state.py
@@ -19,8 +19,9 @@
 #
 #
 
+import json
 import logging
-from typing import List, Tuple, cast
+from typing import cast
 
 from immutabledict import immutabledict
 
@@ -32,7 +33,8 @@ from synapse.events import EventBase
 from synapse.server import HomeServer
 from synapse.types import JsonDict, RoomID, StateMap, UserID
 from synapse.types.state import StateFilter
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.stringutils import random_string
 
 from tests.unittest import HomeserverTestCase
 
@@ -593,7 +595,7 @@ class StateStoreTestCase(HomeserverTestCase):
 
         # check that only state events are in state_groups, and all state events are in state_groups
         res = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             self.get_success(
                 self.store.db_pool.simple_select_list(
                     table="state_groups",
@@ -618,7 +620,7 @@ class StateStoreTestCase(HomeserverTestCase):
         for event, context in processed_events_and_context:
             if event.is_state():
                 state = cast(
-                    List[Tuple[str, str]],
+                    list[tuple[str, str]],
                     self.get_success(
                         self.store.db_pool.simple_select_list(
                             table="state_groups_state",
@@ -631,7 +633,7 @@ class StateStoreTestCase(HomeserverTestCase):
                 self.assertEqual(event.state_key, state[0][1])
 
                 groups = cast(
-                    List[Tuple[str]],
+                    list[tuple[str]],
                     self.get_success(
                         self.store.db_pool.simple_select_list(
                             table="state_group_edges",
@@ -643,3 +645,315 @@ class StateStoreTestCase(HomeserverTestCase):
                     ),
                 )
                 self.assertEqual(context.state_group_before_event, groups[0][0])
+
+
+class CurrentStateDeltaStreamTestCase(HomeserverTestCase):
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        super().prepare(reactor, clock, hs)
+        self.store = hs.get_datastores().main
+        self.storage = hs.get_storage_controllers()
+        self.state_datastore = self.storage.state.stores.state
+        self.event_creation_handler = hs.get_event_creation_handler()
+        self.event_builder_factory = hs.get_event_builder_factory()
+
+        # Create a made-up room and a user.
+        self.alice_user_id = UserID.from_string("@alice:test")
+        self.room = RoomID.from_string("!abc1234:test")
+
+        self.get_success(
+            self.store.store_room(
+                self.room.to_string(),
+                room_creator_user_id="@creator:text",
+                is_public=True,
+                room_version=RoomVersions.V1,
+            )
+        )
+
+    def inject_state_event(
+        self, room: RoomID, sender: UserID, typ: str, state_key: str, content: JsonDict
+    ) -> EventBase:
+        builder = self.event_builder_factory.for_room_version(
+            RoomVersions.V1,
+            {
+                "type": typ,
+                "sender": sender.to_string(),
+                "state_key": state_key,
+                "room_id": room.to_string(),
+                "content": content,
+            },
+        )
+
+        event, unpersisted_context = self.get_success(
+            self.event_creation_handler.create_new_client_event(builder)
+        )
+
+        context = self.get_success(unpersisted_context.persist(event))
+
+        assert self.storage.persistence is not None
+        self.get_success(self.storage.persistence.persist_event(event, context))
+
+        return event
+
+    def test_get_partial_current_state_deltas_limit(self) -> None:
+        """
+        Tests that `get_partial_current_state_deltas` actually returns `limit` rows.
+
+        Regression test for https://github.com/element-hq/synapse/pull/18960.
+        """
+        # Inject a create event which other events can auth with.
+        self.inject_state_event(
+            self.room, self.alice_user_id, EventTypes.Create, "", {}
+        )
+
+        limit = 2
+
+        # Make N*2 state changes in the room, resulting in 2N+1 total state
+        # events (including the create event) in the room.
+        for i in range(limit * 2):
+            self.inject_state_event(
+                self.room,
+                self.alice_user_id,
+                EventTypes.Name,
+                "",
+                {"name": f"rename #{i}"},
+            )
+
+        # Call the function under test. This must return <= `limit` rows.
+        max_stream_id = self.store.get_room_max_stream_ordering()
+        clipped_stream_id, deltas = self.get_success(
+            self.store.get_partial_current_state_deltas(
+                prev_stream_id=0,
+                max_stream_id=max_stream_id,
+                limit=limit,
+            )
+        )
+
+        self.assertLessEqual(
+            len(deltas), limit, f"Returned {len(deltas)} rows, expected at most {limit}"
+        )
+
+        # Advancing from the clipped point should eventually drain the remainder.
+        # Make sure we make progress and don’t get stuck.
+        if deltas:
+            next_prev = clipped_stream_id
+            next_clipped, next_deltas = self.get_success(
+                self.store.get_partial_current_state_deltas(
+                    prev_stream_id=next_prev, max_stream_id=max_stream_id, limit=limit
+                )
+            )
+            self.assertNotEqual(
+                next_clipped, clipped_stream_id, "Did not advance clipped_stream_id"
+            )
+            # Still should respect the limit.
+            self.assertLessEqual(len(next_deltas), limit)
+
+    def test_non_unique_stream_ids_in_current_state_delta_stream(self) -> None:
+        """
+        Tests that `get_partial_current_state_deltas` always returns entire
+        groups of state deltas (grouped by `stream_id`), and never part of one.
+
+        We check by passing a `limit` that to the function that, if followed
+        blindly, would split a group of state deltas that share a `stream_id`.
+        The test passes if that group is not returned at all (because doing so
+        would overshoot the limit of returned state deltas).
+
+        Regression test for https://github.com/element-hq/synapse/pull/18960.
+        """
+        # Inject a create event to start with.
+        self.inject_state_event(
+            self.room, self.alice_user_id, EventTypes.Create, "", {}
+        )
+
+        # Then inject one "real" m.room.name event. This will give us a stream_id that
+        # we can create some more (fake) events with.
+        self.inject_state_event(
+            self.room,
+            self.alice_user_id,
+            EventTypes.Name,
+            "",
+            {"name": "rename #1"},
+        )
+
+        # Get the stream_id of the last-inserted event.
+        max_stream_id = self.store.get_room_max_stream_ordering()
+
+        # Make 3 more state changes in the room, resulting in 5 total state
+        # events (including the create event, and the first name update) in
+        # the room.
+        #
+        # All of these state deltas have the same `stream_id` as the original name event.
+        # Do so by editing the table directly as that's the simplest way to have
+        # all share the same `stream_id`.
+        self.get_success(
+            self.store.db_pool.simple_insert_many(
+                "current_state_delta_stream",
+                keys=(
+                    "stream_id",
+                    "room_id",
+                    "type",
+                    "state_key",
+                    "event_id",
+                    "prev_event_id",
+                    "instance_name",
+                ),
+                values=[
+                    (
+                        max_stream_id,
+                        self.room.to_string(),
+                        EventTypes.Name,
+                        "",
+                        f"${random_string(5)}:test",
+                        json.dumps({"name": f"rename #{i}"}),
+                        "master",
+                    )
+                    for i in range(3)
+                ],
+                desc="inject_room_name_state_events",
+            )
+        )
+
+        # Call the function under test with a limit of 4. Without the limit, we
+        # would return 5 state deltas:
+        #
+        # C N N N N
+        # 1 2 3 4 5
+        #
+        # C = m.room.create
+        # N = m.room.name
+        #
+        # With the limit, we should return only the create event, as returning 4
+        # state deltas would result in splitting a group:
+        #
+        # 2 3 3 3 3 - state IDs/groups
+        # C N N N N
+        # 1 2 3 4 X
+
+        clipped_stream_id, deltas = self.get_success(
+            self.store.get_partial_current_state_deltas(
+                prev_stream_id=0,
+                max_stream_id=max_stream_id,
+                limit=4,
+            )
+        )
+
+        # 2 is the stream ID of the m.room.create event.
+        self.assertEqual(clipped_stream_id, 2)
+        self.assertEqual(
+            len(deltas),
+            1,
+            f"Returned {len(deltas)} rows, expected only one (the create event): {deltas}",
+        )
+
+        # Advance once more with our limit of 4. We should now get all 4
+        # `m.room.name` state deltas as they can fit under the limit.
+        clipped_stream_id, next_deltas = self.get_success(
+            self.store.get_partial_current_state_deltas(
+                prev_stream_id=clipped_stream_id, max_stream_id=max_stream_id, limit=4
+            )
+        )
+        self.assertEqual(
+            clipped_stream_id, 3
+        )  # The stream ID of the 4 m.room.name events.
+
+        self.assertEqual(
+            len(next_deltas),
+            4,
+            f"Returned {len(next_deltas)} rows, expected all 4 m.room.name events: {next_deltas}",
+        )
+
+    def test_get_partial_current_state_deltas_does_not_enter_infinite_loop(
+        self,
+    ) -> None:
+        """
+        Tests that `get_partial_current_state_deltas` does not repeatedly return
+        zero entries due to the passed `limit` parameter being less than the
+        size of the next group of state deltas from the given `prev_stream_id`.
+        """
+        # Inject a create event to start with.
+        self.inject_state_event(
+            self.room, self.alice_user_id, EventTypes.Create, "", {}
+        )
+
+        # Then inject one "real" m.room.name event. This will give us a stream_id that
+        # we can create some more (fake) events with.
+        self.inject_state_event(
+            self.room,
+            self.alice_user_id,
+            EventTypes.Name,
+            "",
+            {"name": "rename #1"},
+        )
+
+        # Get the stream_id of the last-inserted event.
+        max_stream_id = self.store.get_room_max_stream_ordering()
+
+        # Make 3 more state changes in the room, resulting in 5 total state
+        # events (including the create event, and the first name update) in
+        # the room.
+        #
+        # All of these state deltas have the same `stream_id` as the original name event.
+        # Do so by editing the table directly as that's the simplest way to have
+        # all share the same `stream_id`.
+        self.get_success(
+            self.store.db_pool.simple_insert_many(
+                "current_state_delta_stream",
+                keys=(
+                    "stream_id",
+                    "room_id",
+                    "type",
+                    "state_key",
+                    "event_id",
+                    "prev_event_id",
+                    "instance_name",
+                ),
+                values=[
+                    (
+                        max_stream_id,
+                        self.room.to_string(),
+                        EventTypes.Name,
+                        "",
+                        f"${random_string(5)}:test",
+                        json.dumps({"name": f"rename #{i}"}),
+                        "master",
+                    )
+                    for i in range(3)
+                ],
+                desc="inject_room_name_state_events",
+            )
+        )
+
+        # Call the function under test with a limit of 4. Without the limit, we would return
+        # 5 state deltas:
+        #
+        # C N N N N
+        # 1 2 3 4 5
+        #
+        # C = m.room.create
+        # N = m.room.name
+        #
+        # With the limit, we should return only the create event, as returning 4
+        # state deltas would result in splitting a group:
+        #
+        # 2 3 3 3 3 - state IDs/groups
+        # C N N N N
+        # 1 2 3 4 X
+
+        clipped_stream_id, deltas = self.get_success(
+            self.store.get_partial_current_state_deltas(
+                prev_stream_id=2,  # Start after the create event (which has stream_id 2).
+                max_stream_id=max_stream_id,
+                limit=2,  # Less than the size of the next group (which is 4).
+            )
+        )
+
+        self.assertEqual(
+            clipped_stream_id, 3
+        )  # The stream ID of the 4 m.room.name events.
+
+        # We should get all 4 `m.room.name` state deltas, instead of 0, which
+        # would result in the caller entering an infinite loop.
+        self.assertEqual(
+            len(deltas),
+            4,
+            f"Returned {len(deltas)} rows, expected 4 even though it broke our limit: {deltas}",
+        )
diff --git a/tests/storage/test_state_deletion.py b/tests/storage/test_state_deletion.py
index 58cd118567..d4079c372e 100644
--- a/tests/storage/test_state_deletion.py
+++ b/tests/storage/test_state_deletion.py
@@ -20,7 +20,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.test_utils.event_injection import create_event
 from tests.unittest import HomeserverTestCase
diff --git a/tests/storage/test_sticky_events.py b/tests/storage/test_sticky_events.py
new file mode 100644
index 0000000000..60243cb2f4
--- /dev/null
+++ b/tests/storage/test_sticky_events.py
@@ -0,0 +1,278 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 Element Creations Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+import sqlite3
+
+from twisted.internet.testing import MemoryReactor
+
+from synapse.api.constants import (
+    EventContentFields,
+    EventTypes,
+    Membership,
+    StickyEvent,
+    StickyEventField,
+)
+from synapse.api.room_versions import RoomVersions
+from synapse.rest import admin
+from synapse.rest.client import login, register, room
+from synapse.server import HomeServer
+from synapse.types import JsonDict, create_requester
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
+
+from tests import unittest
+from tests.utils import USE_POSTGRES_FOR_TESTS
+
+
+class StickyEventsTestCase(unittest.HomeserverTestCase):
+    """
+    Tests for the storage functions related to MSC4354: Sticky Events
+    """
+
+    if not USE_POSTGRES_FOR_TESTS and sqlite3.sqlite_version_info < (3, 40, 0):
+        # We need the JSON functionality in SQLite
+        skip = f"SQLite version is too old to support sticky events: {sqlite3.sqlite_version_info} (See https://github.com/element-hq/synapse/issues/19428)"
+
+    servlets = [
+        room.register_servlets,
+        login.register_servlets,
+        register.register_servlets,
+        admin.register_servlets,
+    ]
+
+    def default_config(self) -> JsonDict:
+        config = super().default_config()
+        config["experimental_features"] = {"msc4354_enabled": True}
+        return config
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        self.store = self.hs.get_datastores().main
+
+        # Register an account and create a room
+        self.user_id = self.register_user("user", "pass")
+        self.token = self.login(self.user_id, "pass")
+        self.room_id = self.helper.create_room_as(self.user_id, tok=self.token)
+
+    def test_get_updated_sticky_events(self) -> None:
+        """Test getting updated sticky events between stream IDs."""
+        # Get the starting stream_id
+        start_id = self.store.get_max_sticky_events_stream_id()
+
+        event_id_1 = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "message 1", "msgtype": "m.text"},
+            tok=self.token,
+        )["event_id"]
+
+        mid_id = self.store.get_max_sticky_events_stream_id()
+
+        event_id_2 = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "message 2", "msgtype": "m.text"},
+            tok=self.token,
+        )["event_id"]
+
+        end_id = self.store.get_max_sticky_events_stream_id()
+
+        # Get all updates
+        updates = self.get_success(
+            self.store.get_updated_sticky_events(
+                from_id=start_id, to_id=end_id, limit=10
+            )
+        )
+        self.assertEqual(len(updates), 2)
+        self.assertEqual(updates[0].event_id, event_id_1)
+        self.assertEqual(updates[0].soft_failed, False)
+        self.assertEqual(updates[1].event_id, event_id_2)
+        self.assertEqual(updates[1].soft_failed, False)
+
+        # Get only the second update
+        updates = self.get_success(
+            self.store.get_updated_sticky_events(from_id=mid_id, to_id=end_id, limit=10)
+        )
+        self.assertEqual(len(updates), 1)
+        self.assertEqual(updates[0].event_id, event_id_2)
+        self.assertEqual(updates[0].soft_failed, False)
+
+    def test_delete_expired_sticky_events(self) -> None:
+        """Test deletion of expired sticky events."""
+        # Insert an expired event by advancing time past its duration
+        self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(milliseconds=1),
+            content={"body": "expired message", "msgtype": "m.text"},
+            tok=self.token,
+        )
+        self.reactor.advance(0.002)
+
+        # Insert a non-expired event
+        event_id_2 = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "non-expired message", "msgtype": "m.text"},
+            tok=self.token,
+        )["event_id"]
+
+        end_id = self.store.get_max_sticky_events_stream_id()
+
+        # Delete expired events
+        self.get_success(self.store._delete_expired_sticky_events())
+
+        # Check that only the non-expired event remains
+        sticky_events = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sticky_events", keyvalues=None, retcols=("stream_id", "event_id")
+            )
+        )
+        self.assertEqual(
+            sticky_events,
+            [
+                (end_id, event_id_2),
+            ],
+        )
+
+    def test_get_updated_sticky_events_with_limit(self) -> None:
+        """Test that the limit parameter works correctly."""
+        # Get the starting stream_id
+        start_id = self.store.get_max_sticky_events_stream_id()
+
+        event_id_1 = self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "message 1", "msgtype": "m.text"},
+            tok=self.token,
+        )["event_id"]
+
+        self.helper.send_sticky_event(
+            self.room_id,
+            EventTypes.Message,
+            duration=Duration(minutes=1),
+            content={"body": "message 2", "msgtype": "m.text"},
+            tok=self.token,
+        )
+
+        # Get only the first update
+        updates = self.get_success(
+            self.store.get_updated_sticky_events(
+                from_id=start_id, to_id=start_id + 2, limit=1
+            )
+        )
+        self.assertEqual(len(updates), 1)
+        self.assertEqual(updates[0].event_id, event_id_1)
+
+    def test_outlier_events_not_in_table(self) -> None:
+        """
+        Tests the behaviour of outliered and then de-outliered events in the
+        sticky_events table: they should only be added once they are de-outliered.
+        """
+        persist_controller = self.hs.get_storage_controllers().persistence
+        assert persist_controller is not None
+
+        user1_id = self.register_user("user1", "pass")
+        user2_id = self.register_user("user2", "pass")
+        user2_tok = self.login(user2_id, "pass")
+
+        start_id = self.store.get_max_sticky_events_stream_id()
+
+        room_id = self.helper.create_room_as(
+            user2_id, tok=user2_tok, room_version=RoomVersions.V10.identifier
+        )
+
+        # Create a membership event
+        event_dict = {
+            "type": EventTypes.Member,
+            "state_key": user1_id,
+            "sender": user1_id,
+            "room_id": room_id,
+            "content": {EventContentFields.MEMBERSHIP: Membership.JOIN},
+            StickyEvent.EVENT_FIELD_NAME: StickyEventField(
+                duration_ms=Duration(hours=1).as_millis()
+            ),
+        }
+
+        # Create the event twice: once as an outlier, once as a non-outlier.
+        # It's not at all obvious, but event creation before is deterministic
+        # (provided we don't change the forward extremities of the room!),
+        # so these two events are actually the same event with the same event ID.
+        (
+            event_outlier,
+            unpersisted_context_outlier,
+        ) = self.get_success(
+            self.hs.get_event_creation_handler().create_event(
+                requester=create_requester(user1_id),
+                event_dict=event_dict,
+                outlier=True,
+            )
+        )
+        (
+            event_non_outlier,
+            unpersisted_context_non_outlier,
+        ) = self.get_success(
+            self.hs.get_event_creation_handler().create_event(
+                requester=create_requester(user1_id),
+                event_dict=event_dict,
+                outlier=False,
+            )
+        )
+
+        # Safety check that we're testing what we think we are
+        self.assertEqual(event_outlier.event_id, event_non_outlier.event_id)
+
+        # Now persist the event as an outlier first of all
+        # FIXME: Should we use an `EventContext.for_outlier(...)` here?
+        # Doesn't seem to matter for this test.
+        context_outlier = self.get_success(
+            unpersisted_context_outlier.persist(event_outlier)
+        )
+        self.get_success(
+            persist_controller.persist_event(
+                event_outlier,
+                context_outlier,
+            )
+        )
+
+        # Since the event is outliered, it won't show up in the sticky_events table...
+        sticky_events = self.get_success(
+            self.store.db_pool.simple_select_list(
+                table="sticky_events", keyvalues=None, retcols=("stream_id", "event_id")
+            )
+        )
+        self.assertEqual(len(sticky_events), 0)
+
+        # Now persist the event properly so that it gets de-outliered.
+        context_non_outlier = self.get_success(
+            unpersisted_context_non_outlier.persist(event_non_outlier)
+        )
+        self.get_success(
+            persist_controller.persist_event(
+                event_non_outlier,
+                context_non_outlier,
+            )
+        )
+
+        end_id = self.store.get_max_sticky_events_stream_id()
+
+        # Check the event made it into the sticky_events table
+        updates = self.get_success(
+            self.store.get_updated_sticky_events(
+                from_id=start_id, to_id=end_id, limit=10
+            )
+        )
+        self.assertEqual(len(updates), 1)
+        self.assertEqual(updates[0].event_id, event_non_outlier.event_id)
diff --git a/tests/storage/test_stream.py b/tests/storage/test_stream.py
index ba2af1e044..d51fa1f8ba 100644
--- a/tests/storage/test_stream.py
+++ b/tests/storage/test_stream.py
@@ -20,7 +20,6 @@
 #
 
 import logging
-from typing import List, Tuple
 from unittest.mock import AsyncMock, patch
 
 from immutabledict import immutabledict
@@ -49,7 +48,7 @@ from synapse.types import (
     UserID,
     create_requester,
 )
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.test_utils.event_injection import create_event
 from tests.unittest import FederatingHomeserverTestCase, HomeserverTestCase
@@ -150,7 +149,7 @@ class PaginationTestCase(HomeserverTestCase):
         )
         self.event_id_none = res["event_id"]
 
-    def _filter_messages(self, filter: JsonDict) -> List[str]:
+    def _filter_messages(self, filter: JsonDict) -> list[str]:
         """Make a request to /messages with a filter, returns the chunk of events."""
 
         events, next_key, _ = self.get_success(
@@ -324,7 +323,7 @@ class GetLastEventInRoomBeforeStreamOrderingTestCase(HomeserverTestCase):
 
     def _send_event_on_instance(
         self, instance_name: str, room_id: str, access_token: str
-    ) -> Tuple[JsonDict, PersistedEventPosition]:
+    ) -> tuple[JsonDict, PersistedEventPosition]:
         """
         Send an event in a room and mimic that it was persisted by a specific
         instance/worker.
diff --git a/tests/storage/test_thread_subscriptions.py b/tests/storage/test_thread_subscriptions.py
index 2a5c440cf4..ec6f8c5bfb 100644
--- a/tests/storage/test_thread_subscriptions.py
+++ b/tests/storage/test_thread_subscriptions.py
@@ -12,7 +12,6 @@
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
 #
 
-from typing import Optional, Union
 
 from twisted.internet.testing import MemoryReactor
 
@@ -24,7 +23,7 @@ from synapse.storage.databases.main.thread_subscriptions import (
 )
 from synapse.storage.engines.sqlite import Sqlite3Engine
 from synapse.types import EventOrderings
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -102,10 +101,10 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
         self,
         thread_root_id: str,
         *,
-        automatic_event_orderings: Optional[EventOrderings],
-        room_id: Optional[str] = None,
-        user_id: Optional[str] = None,
-    ) -> Optional[Union[int, AutomaticSubscriptionConflicted]]:
+        automatic_event_orderings: EventOrderings | None,
+        room_id: str | None = None,
+        user_id: str | None = None,
+    ) -> int | AutomaticSubscriptionConflicted | None:
         if user_id is None:
             user_id = self.user_id
 
@@ -124,9 +123,9 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
     def _unsubscribe(
         self,
         thread_root_id: str,
-        room_id: Optional[str] = None,
-        user_id: Optional[str] = None,
-    ) -> Optional[int]:
+        room_id: str | None = None,
+        user_id: str | None = None,
+    ) -> int | None:
         if user_id is None:
             user_id = self.user_id
 
@@ -189,19 +188,19 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
         self._subscribe(self.other_thread_root_id, automatic_event_orderings=None)
 
         subscriptions = self.get_success(
-            self.store.get_updated_thread_subscriptions_for_user(
+            self.store.get_latest_updated_thread_subscriptions_for_user(
                 self.user_id,
                 from_id=0,
                 to_id=50,
                 limit=50,
             )
         )
-        min_id = min(id for (id, _, _) in subscriptions)
+        min_id = min(id for (id, _, _, _, _) in subscriptions)
         self.assertEqual(
             subscriptions,
             [
-                (min_id, self.room_id, self.thread_root_id),
-                (min_id + 1, self.room_id, self.other_thread_root_id),
+                (min_id, self.room_id, self.thread_root_id, True, True),
+                (min_id + 1, self.room_id, self.other_thread_root_id, True, False),
             ],
         )
 
@@ -212,7 +211,7 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
 
         # Check user has no subscriptions
         subscriptions = self.get_success(
-            self.store.get_updated_thread_subscriptions_for_user(
+            self.store.get_latest_updated_thread_subscriptions_for_user(
                 self.user_id,
                 from_id=0,
                 to_id=50,
@@ -280,20 +279,22 @@ class ThreadSubscriptionsTestCase(unittest.HomeserverTestCase):
 
         # Get updates for main user
         updates = self.get_success(
-            self.store.get_updated_thread_subscriptions_for_user(
+            self.store.get_latest_updated_thread_subscriptions_for_user(
                 self.user_id, from_id=0, to_id=stream_id2, limit=10
             )
         )
-        self.assertEqual(updates, [(stream_id1, self.room_id, self.thread_root_id)])
+        self.assertEqual(
+            updates, [(stream_id1, self.room_id, self.thread_root_id, True, True)]
+        )
 
         # Get updates for other user
         updates = self.get_success(
-            self.store.get_updated_thread_subscriptions_for_user(
+            self.store.get_latest_updated_thread_subscriptions_for_user(
                 other_user_id, from_id=0, to_id=max(stream_id1, stream_id2), limit=10
             )
         )
         self.assertEqual(
-            updates, [(stream_id2, self.room_id, self.other_thread_root_id)]
+            updates, [(stream_id2, self.room_id, self.other_thread_root_id, True, True)]
         )
 
     def test_should_skip_autosubscription_after_unsubscription(self) -> None:
diff --git a/tests/storage/test_transactions.py b/tests/storage/test_transactions.py
index 7b2ac9fce1..a58c33aff6 100644
--- a/tests/storage/test_transactions.py
+++ b/tests/storage/test_transactions.py
@@ -22,7 +22,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
 from synapse.storage.databases.main.transactions import DestinationRetryTimings
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
diff --git a/tests/storage/test_txn_limit.py b/tests/storage/test_txn_limit.py
index 4722da5005..6bf4ce48f1 100644
--- a/tests/storage/test_txn_limit.py
+++ b/tests/storage/test_txn_limit.py
@@ -23,7 +23,7 @@ from twisted.internet.testing import MemoryReactor
 
 from synapse.server import HomeServer
 from synapse.storage.types import Cursor
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/storage/test_user_directory.py b/tests/storage/test_user_directory.py
index 255de298f3..7b4acd985c 100644
--- a/tests/storage/test_user_directory.py
+++ b/tests/storage/test_user_directory.py
@@ -19,7 +19,7 @@
 #
 #
 import re
-from typing import Any, Dict, List, Optional, Set, Tuple, cast
+from typing import Any, cast
 from unittest import mock
 from unittest.mock import Mock, patch
 
@@ -37,7 +37,7 @@ from synapse.storage.databases.main.user_directory import (
 )
 from synapse.storage.roommember import ProfileInfo
 from synapse.types import UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.server import ThreadedMemoryReactorClock
 from tests.test_utils.event_injection import inject_member_event
@@ -56,21 +56,21 @@ class GetUserDirectoryTables:
     def __init__(self, store: DataStore):
         self.store = store
 
-    async def get_users_in_public_rooms(self) -> Set[Tuple[str, str]]:
+    async def get_users_in_public_rooms(self) -> set[tuple[str, str]]:
         """Fetch the entire `users_in_public_rooms` table.
 
         Returns a list of tuples (user_id, room_id) where room_id is public and
         contains the user with the given id.
         """
         r = cast(
-            List[Tuple[str, str]],
+            list[tuple[str, str]],
             await self.store.db_pool.simple_select_list(
                 "users_in_public_rooms", None, ("user_id", "room_id")
             ),
         )
         return set(r)
 
-    async def get_users_who_share_private_rooms(self) -> Set[Tuple[str, str, str]]:
+    async def get_users_who_share_private_rooms(self) -> set[tuple[str, str, str]]:
         """Fetch the entire `users_who_share_private_rooms` table.
 
         Returns a set of tuples (user_id, other_user_id, room_id) corresponding
@@ -78,7 +78,7 @@ class GetUserDirectoryTables:
         """
 
         rows = cast(
-            List[Tuple[str, str, str]],
+            list[tuple[str, str, str]],
             await self.store.db_pool.simple_select_list(
                 "users_who_share_private_rooms",
                 None,
@@ -87,13 +87,13 @@ class GetUserDirectoryTables:
         )
         return set(rows)
 
-    async def get_users_in_user_directory(self) -> Set[str]:
+    async def get_users_in_user_directory(self) -> set[str]:
         """Fetch the set of users in the `user_directory` table.
 
         This is useful when checking we've correctly excluded users from the directory.
         """
         result = cast(
-            List[Tuple[str]],
+            list[tuple[str]],
             await self.store.db_pool.simple_select_list(
                 "user_directory",
                 None,
@@ -102,7 +102,7 @@ class GetUserDirectoryTables:
         )
         return {row[0] for row in result}
 
-    async def get_profiles_in_user_directory(self) -> Dict[str, ProfileInfo]:
+    async def get_profiles_in_user_directory(self) -> dict[str, ProfileInfo]:
         """Fetch users and their profiles from the `user_directory` table.
 
         This is useful when we want to inspect display names and avatars.
@@ -110,7 +110,7 @@ class GetUserDirectoryTables:
         thing missing is an unused room_id column.
         """
         rows = cast(
-            List[Tuple[str, Optional[str], Optional[str]]],
+            list[tuple[str, str | None, str | None]],
             await self.store.db_pool.simple_select_list(
                 "user_directory",
                 None,
@@ -124,7 +124,7 @@ class GetUserDirectoryTables:
 
     async def get_tables(
         self,
-    ) -> Tuple[Set[str], Set[Tuple[str, str]], Set[Tuple[str, str, str]]]:
+    ) -> tuple[set[str], set[tuple[str, str]], set[tuple[str, str, str]]]:
         """Multiple tests want to inspect these tables, so expose them together."""
         return (
             await self.get_users_in_user_directory(),
@@ -277,7 +277,7 @@ class UserDirectoryInitialPopulationTestcase(HomeserverTestCase):
 
     def _create_rooms_and_inject_memberships(
         self, creator: str, token: str, joiner: str
-    ) -> Tuple[str, str]:
+    ) -> tuple[str, str]:
         """Create a public and private room as a normal user.
         Then get the `joiner` into those rooms.
         """
diff --git a/tests/storage/test_user_filters.py b/tests/storage/test_user_filters.py
index 8d928aa55c..954a420cc0 100644
--- a/tests/storage/test_user_filters.py
+++ b/tests/storage/test_user_filters.py
@@ -25,7 +25,7 @@ from twisted.internet.testing import MemoryReactor
 from synapse.server import HomeServer
 from synapse.storage.database import LoggingTransaction
 from synapse.storage.engines import PostgresEngine
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
diff --git a/tests/storage/util/test_partial_state_events_tracker.py b/tests/storage/util/test_partial_state_events_tracker.py
index 1e5663f137..026bc58180 100644
--- a/tests/storage/util/test_partial_state_events_tracker.py
+++ b/tests/storage/util/test_partial_state_events_tracker.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import Collection, Dict
+from typing import Collection
 from unittest import mock
 
 from twisted.internet.defer import CancelledError, ensureDeferred
@@ -35,9 +35,9 @@ from tests.unittest import TestCase
 class PartialStateEventsTrackerTestCase(TestCase):
     def setUp(self) -> None:
         # the results to be returned by the mocked get_partial_state_events
-        self._events_dict: Dict[str, bool] = {}
+        self._events_dict: dict[str, bool] = {}
 
-        async def get_partial_state_events(events: Collection[str]) -> Dict[str, bool]:
+        async def get_partial_state_events(events: Collection[str]) -> dict[str, bool]:
             return {e: self._events_dict[e] for e in events}
 
         self.mock_store = mock.Mock(spec_set=["get_partial_state_events"])
@@ -73,7 +73,7 @@ class PartialStateEventsTrackerTestCase(TestCase):
         # registration of the listener, it should not block.
         self._events_dict = {"event1": True, "event2": False}
 
-        async def get_partial_state_events(events: Collection[str]) -> Dict[str, bool]:
+        async def get_partial_state_events(events: Collection[str]) -> dict[str, bool]:
             res = {e: self._events_dict[e] for e in events}
             # change the result for next time
             self._events_dict = {"event1": False, "event2": False}
@@ -91,13 +91,13 @@ class PartialStateEventsTrackerTestCase(TestCase):
 
         self._events_dict = {"event1": True, "event2": False}
 
-        async def get_partial_state_events1(events: Collection[str]) -> Dict[str, bool]:
+        async def get_partial_state_events1(events: Collection[str]) -> dict[str, bool]:
             self.mock_store.get_partial_state_events.side_effect = (
                 get_partial_state_events2
             )
             return {e: self._events_dict[e] for e in events}
 
-        async def get_partial_state_events2(events: Collection[str]) -> Dict[str, bool]:
+        async def get_partial_state_events2(events: Collection[str]) -> dict[str, bool]:
             self.tracker.notify_un_partial_stated("event1")
             self._events_dict["event1"] = False
             return {e: self._events_dict[e] for e in events}
diff --git a/synapse/types/handlers/policy_server.py b/tests/synapse_rust/__init__.py
similarity index 89%
rename from synapse/types/handlers/policy_server.py
rename to tests/synapse_rust/__init__.py
index bfc09dabf4..e056679fd5 100644
--- a/synapse/types/handlers/policy_server.py
+++ b/tests/synapse_rust/__init__.py
@@ -1,4 +1,3 @@
-#
 # This file is licensed under the Affero General Public License (AGPL) version 3.
 #
 # Copyright (C) 2025 New Vector, Ltd
@@ -10,7 +9,3 @@
 #
 # See the GNU Affero General Public License for more details:
 # <https://www.gnu.org/licenses/agpl-3.0.html>.
-#
-
-RECOMMENDATION_OK = "ok"
-RECOMMENDATION_SPAM = "spam"
diff --git a/tests/synapse_rust/test_http_client.py b/tests/synapse_rust/test_http_client.py
new file mode 100644
index 0000000000..56fab3a0e1
--- /dev/null
+++ b/tests/synapse_rust/test_http_client.py
@@ -0,0 +1,243 @@
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 New Vector, Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+import json
+import logging
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import Any, Coroutine, Generator, TypeVar, Union
+
+from twisted.internet.defer import Deferred, ensureDeferred
+from twisted.internet.testing import MemoryReactor
+
+from synapse.logging.context import (
+    LoggingContext,
+    PreserveLoggingContext,
+    _Sentinel,
+    current_context,
+    run_in_background,
+)
+from synapse.server import HomeServer
+from synapse.synapse_rust.http_client import HttpClient
+from synapse.util.clock import Clock
+from synapse.util.json import json_decoder
+
+from tests.unittest import HomeserverTestCase
+
+logger = logging.getLogger(__name__)
+
+T = TypeVar("T")
+
+
+class StubRequestHandler(BaseHTTPRequestHandler):
+    server: "StubServer"
+
+    def do_GET(self) -> None:
+        self.server.calls += 1
+
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.end_headers()
+        self.wfile.write(json.dumps({"ok": True}).encode("utf-8"))
+
+    def log_message(self, format: str, *args: Any) -> None:
+        # Don't log anything; by default, the server logs to stderr
+        pass
+
+
+class StubServer(HTTPServer):
+    """A stub HTTP server that we can send requests to for testing.
+
+    This opens a real HTTP server on a random port, on a separate thread.
+    """
+
+    calls: int = 0
+    """How many times has the endpoint been requested."""
+
+    _thread: threading.Thread
+
+    def __init__(self) -> None:
+        super().__init__(("127.0.0.1", 0), StubRequestHandler)
+
+        self._thread = threading.Thread(
+            target=self.serve_forever,
+            name="StubServer",
+            kwargs={"poll_interval": 0.01},
+            daemon=True,
+        )
+        self._thread.start()
+
+    def shutdown(self) -> None:
+        super().shutdown()
+        self._thread.join()
+
+    @property
+    def endpoint(self) -> str:
+        return f"http://127.0.0.1:{self.server_port}/"
+
+
+class HttpClientTestCase(HomeserverTestCase):
+    def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
+        hs = self.setup_test_homeserver()
+
+        # XXX: We must create the Rust HTTP client before we call `reactor.run()` below.
+        # Twisted's `MemoryReactor` doesn't invoke `callWhenRunning` callbacks if it's
+        # already running and we rely on that to start the Tokio thread pool in Rust. In
+        # the future, this may not matter, see https://github.com/twisted/twisted/pull/12514
+        self._http_client = hs.get_proxied_http_client()
+        self._rust_http_client = HttpClient(
+            reactor=hs.get_reactor(),
+            user_agent=self._http_client.user_agent.decode("utf8"),
+        )
+
+        # This triggers the server startup hooks, which starts the Tokio thread pool
+        reactor.run()
+
+        return hs
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        self.server = StubServer()
+
+    def tearDown(self) -> None:
+        # MemoryReactor doesn't trigger the shutdown phases, and we want the
+        # Tokio thread pool to be stopped
+        # XXX: This logic should probably get moved somewhere else
+        shutdown_triggers = self.reactor.triggers.get("shutdown", {})
+        for phase in ["before", "during", "after"]:
+            triggers = shutdown_triggers.get(phase, [])
+            for callbable, args, kwargs in triggers:
+                callbable(*args, **kwargs)
+
+    def till_deferred_has_result(
+        self,
+        awaitable: Union[
+            "Coroutine[Deferred[Any], Any, T]",
+            "Generator[Deferred[Any], Any, T]",
+            "Deferred[T]",
+        ],
+    ) -> "Deferred[T]":
+        """Wait until a deferred has a result.
+
+        This is useful because the Rust HTTP client will resolve the deferred
+        using reactor.callFromThread, which are only run when we call
+        reactor.advance.
+        """
+        deferred = ensureDeferred(awaitable)
+        tries = 0
+        while not deferred.called:
+            time.sleep(0.1)
+            self.reactor.advance(0)
+            tries += 1
+            if tries > 100:
+                raise Exception("Timed out waiting for deferred to resolve")
+
+        return deferred
+
+    def _check_current_logcontext(self, expected_logcontext_string: str) -> None:
+        context = current_context()
+        assert isinstance(context, LoggingContext) or isinstance(context, _Sentinel), (
+            f"Expected LoggingContext({expected_logcontext_string}) but saw {context}"
+        )
+        self.assertEqual(
+            str(context),
+            expected_logcontext_string,
+            f"Expected LoggingContext({expected_logcontext_string}) but saw {context}",
+        )
+
+    def test_request_response(self) -> None:
+        """
+        Test to make sure we can make a basic request and get the expected
+        response.
+        """
+
+        async def do_request() -> None:
+            resp_body = await self._rust_http_client.get(
+                url=self.server.endpoint,
+                response_limit=1 * 1024 * 1024,
+            )
+            raw_response = json_decoder.decode(resp_body.decode("utf-8"))
+            self.assertEqual(raw_response, {"ok": True})
+
+        self.get_success(self.till_deferred_has_result(do_request()))
+        self.assertEqual(self.server.calls, 1)
+
+    def test_request_response_limit_exceeded(self) -> None:
+        """
+        Test to make sure we handle the response limit being exceeded
+        """
+
+        async def do_request() -> None:
+            await self._rust_http_client.get(
+                url=self.server.endpoint,
+                # Small limit so we hit the limit
+                response_limit=1,
+            )
+
+        self.assertFailure(
+            self.till_deferred_has_result(do_request()),
+            RuntimeError,
+        )
+        self.assertEqual(self.server.calls, 1)
+
+    async def test_logging_context(self) -> None:
+        """
+        Test to make sure the `LoggingContext` (logcontext) is handled correctly
+        when making requests.
+        """
+        # Sanity check that we start in the sentinel context
+        self._check_current_logcontext("sentinel")
+
+        callback_finished = False
+
+        async def do_request() -> None:
+            nonlocal callback_finished
+            try:
+                # Should have the same logcontext as the caller
+                self._check_current_logcontext("foo")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    # Make the actual request
+                    await self._rust_http_client.get(
+                        url=self.server.endpoint,
+                        response_limit=1 * 1024 * 1024,
+                    )
+                    self._check_current_logcontext("competing")
+
+                # Back to the caller's context outside of the `LoggingContext` block
+                self._check_current_logcontext("foo")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            # Fire off the function, but don't wait on it.
+            run_in_background(do_request)
+
+            # Now wait for the function under test to have run
+            with PreserveLoggingContext():
+                while not callback_finished:
+                    # await self.hs.get_clock().sleep(0)
+                    time.sleep(0.1)
+                    self.reactor.advance(0)
+
+            # check that the logcontext is left in a sane state.
+            self._check_current_logcontext("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_current_logcontext("sentinel")
diff --git a/tests/synapse_rust/test_room_versions.py b/tests/synapse_rust/test_room_versions.py
new file mode 100644
index 0000000000..aff1ab2783
--- /dev/null
+++ b/tests/synapse_rust/test_room_versions.py
@@ -0,0 +1,45 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2026 Element Creations Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+
+from synapse.api.room_versions import KNOWN_ROOM_VERSIONS
+
+from tests import unittest
+
+
+class KnownRoomVersionsMappingTestCase(unittest.TestCase):
+    """Tests for the Rust-backed KNOWN_ROOM_VERSIONS mapping."""
+
+    def test_contains_none(self) -> None:
+        """Test that `None in KNOWN_ROOM_VERSIONS` returns False
+        rather than raising a TypeError, matching Python dict semantics."""
+        self.assertFalse(None in KNOWN_ROOM_VERSIONS)
+
+    def test_contains_non_string(self) -> None:
+        """Test that non-string keys return False from __contains__."""
+        self.assertFalse(42 in KNOWN_ROOM_VERSIONS)  # type: ignore[comparison-overlap]
+        self.assertFalse(3.14 in KNOWN_ROOM_VERSIONS)  # type: ignore[comparison-overlap]
+        self.assertFalse([] in KNOWN_ROOM_VERSIONS)  # type: ignore[comparison-overlap]
+
+    def test_contains_known_version(self) -> None:
+        self.assertTrue("1" in KNOWN_ROOM_VERSIONS)
+
+    def test_contains_unknown_version(self) -> None:
+        self.assertFalse("unknown" in KNOWN_ROOM_VERSIONS)
+
+    def test_getitem_non_string_raises_key_error(self) -> None:
+        """Test that KNOWN_ROOM_VERSIONS[non_string] raises KeyError,
+        not TypeError, matching Python dict semantics."""
+        with self.assertRaises(KeyError):
+            KNOWN_ROOM_VERSIONS[42]  # type: ignore[index]
+        with self.assertRaises(KeyError):
+            KNOWN_ROOM_VERSIONS[None]  # type: ignore[index]
diff --git a/tests/test_distributor.py b/tests/test_distributor.py
index 19dafe64ed..2dd26833c8 100644
--- a/tests/test_distributor.py
+++ b/tests/test_distributor.py
@@ -26,9 +26,10 @@ from synapse.util.distributor import Distributor
 from . import unittest
 
 
-class DistributorTestCase(unittest.TestCase):
+class DistributorTestCase(unittest.HomeserverTestCase):
     def setUp(self) -> None:
-        self.dist = Distributor(server_name="test_server")
+        super().setUp()
+        self.dist = Distributor(hs=self.hs)
 
     def test_signal_dispatch(self) -> None:
         self.dist.declare("alert")
diff --git a/tests/test_event_auth.py b/tests/test_event_auth.py
index f12402f5f2..934a2fd307 100644
--- a/tests/test_event_auth.py
+++ b/tests/test_event_auth.py
@@ -20,7 +20,7 @@
 #
 
 import unittest
-from typing import Any, Collection, Dict, Iterable, List, Optional
+from typing import Any, Collection, Iterable
 
 from parameterized import parameterized
 
@@ -39,7 +39,7 @@ class _StubEventSourceStore:
     """A stub implementation of the EventSourceStore"""
 
     def __init__(self) -> None:
-        self._store: Dict[str, EventBase] = {}
+        self._store: dict[str, EventBase] = {}
 
     def add_event(self, event: EventBase) -> None:
         self._store[event.event_id] = event
@@ -54,7 +54,7 @@ class _StubEventSourceStore:
         redact_behaviour: EventRedactBehaviour,
         get_prev_content: bool = False,
         allow_rejected: bool = False,
-    ) -> Dict[str, EventBase]:
+    ) -> dict[str, EventBase]:
         assert allow_rejected
         assert not get_prev_content
         assert redact_behaviour == EventRedactBehaviour.as_is
@@ -745,7 +745,7 @@ class EventAuthTestCase(unittest.TestCase):
         test_room_v10_rejects_string_power_levels above handles the string case.
         """
 
-        def create_event(pl_event_content: Dict[str, Any]) -> EventBase:
+        def create_event(pl_event_content: dict[str, Any]) -> EventBase:
             return make_event_from_dict(
                 {
                     "room_id": TEST_ROOM_ID,
@@ -759,7 +759,7 @@ class EventAuthTestCase(unittest.TestCase):
                 room_version=RoomVersions.V10,
             )
 
-        contents: Iterable[Dict[str, Any]] = [
+        contents: Iterable[dict[str, Any]] = [
             {"notifications": {"room": None}},
             {"users": {"@alice:wonderland": []}},
             {"users_default": {}},
@@ -797,8 +797,8 @@ def _member_event(
     room_version: RoomVersion,
     user_id: str,
     membership: str,
-    sender: Optional[str] = None,
-    additional_content: Optional[dict] = None,
+    sender: str | None = None,
+    additional_content: dict | None = None,
 ) -> EventBase:
     return make_event_from_dict(
         {
@@ -818,7 +818,7 @@ def _member_event(
 def _join_event(
     room_version: RoomVersion,
     user_id: str,
-    additional_content: Optional[dict] = None,
+    additional_content: dict | None = None,
 ) -> EventBase:
     return _member_event(
         room_version,
@@ -861,7 +861,7 @@ def _alias_event(room_version: RoomVersion, sender: str, **kwargs: Any) -> Event
 
 def _build_auth_dict_for_room_version(
     room_version: RoomVersion, auth_events: Iterable[EventBase]
-) -> List:
+) -> list:
     if room_version.event_format == EventFormatVersions.ROOM_V1_V2:
         return [(e.event_id, "not_used") for e in auth_events]
     else:
@@ -871,7 +871,7 @@ def _build_auth_dict_for_room_version(
 def _random_state_event(
     room_version: RoomVersion,
     sender: str,
-    auth_events: Optional[Iterable[EventBase]] = None,
+    auth_events: Iterable[EventBase] | None = None,
 ) -> EventBase:
     if auth_events is None:
         auth_events = []
diff --git a/tests/test_mau.py b/tests/test_mau.py
index 1000870aa9..2d5c4c5d1c 100644
--- a/tests/test_mau.py
+++ b/tests/test_mau.py
@@ -20,8 +20,6 @@
 
 """Tests REST events for /rooms paths."""
 
-from typing import List, Optional
-
 from twisted.internet.testing import MemoryReactor
 
 from synapse.api.constants import APP_SERVICE_REGISTRATION_TYPE, LoginType
@@ -30,7 +28,7 @@ from synapse.appservice import ApplicationService
 from synapse.rest.client import register, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict, UserID
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 from tests.unittest import override_config
@@ -249,7 +247,7 @@ class TestMauLimit(unittest.HomeserverTestCase):
         }
     )
     def test_as_trial_days(self) -> None:
-        user_tokens: List[str] = []
+        user_tokens: list[str] = []
 
         def advance_time_and_sync() -> None:
             self.reactor.advance(24 * 60 * 61)
@@ -313,7 +311,7 @@ class TestMauLimit(unittest.HomeserverTestCase):
         )
 
     def create_user(
-        self, localpart: str, token: Optional[str] = None, appservice: bool = False
+        self, localpart: str, token: str | None = None, appservice: bool = False
     ) -> str:
         request_data = {
             "username": localpart,
diff --git a/tests/test_phone_home.py b/tests/test_phone_home.py
index 0b230ed0f5..1d450f8251 100644
--- a/tests/test_phone_home.py
+++ b/tests/test_phone_home.py
@@ -29,7 +29,7 @@ from synapse.rest import admin
 from synapse.rest.client import login, sync
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests.unittest import HomeserverTestCase
 
@@ -75,7 +75,7 @@ class CommonMetricsTestCase(HomeserverTestCase):
 
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.metrics_manager = hs.get_common_usage_metrics_manager()
-        self.get_success(self.metrics_manager.setup())
+        self.metrics_manager.setup()
 
     def test_dau(self) -> None:
         """Tests that the daily active users count is correctly updated."""
diff --git a/tests/test_server.py b/tests/test_server.py
index 0aa3584518..2326fafc75 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -20,7 +20,7 @@
 
 import re
 from http import HTTPStatus
-from typing import Awaitable, Callable, Dict, NoReturn, Optional, Tuple
+from typing import Awaitable, Callable, NoReturn
 
 from twisted.internet.defer import Deferred
 from twisted.web.resource import Resource
@@ -36,11 +36,12 @@ from synapse.http.server import (
 from synapse.http.site import SynapseRequest, SynapseSite
 from synapse.logging.context import make_deferred_yieldable
 from synapse.types import JsonDict
-from synapse.util import Clock
 from synapse.util.cancellation import cancellable
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
 from tests import unittest
-from tests.http.server._base import test_disconnect
+from tests.http.server._base import disconnect_and_assert
 from tests.server import (
     FakeChannel,
     FakeSite,
@@ -55,9 +56,9 @@ class JsonResourceTests(unittest.TestCase):
         reactor, clock = get_clock()
         self.reactor = reactor
         self.homeserver = setup_test_homeserver(
-            self.addCleanup,
-            clock=clock,
+            cleanup_func=self.addCleanup,
             reactor=self.reactor,
+            clock=clock,
         )
 
     def test_handler_for_request(self) -> None:
@@ -70,7 +71,7 @@ class JsonResourceTests(unittest.TestCase):
 
         def _callback(
             request: SynapseRequest, **kwargs: object
-        ) -> Tuple[int, Dict[str, object]]:
+        ) -> tuple[int, dict[str, object]]:
             got_kwargs.update(kwargs)
             return 200, kwargs
 
@@ -192,7 +193,7 @@ class JsonResourceTests(unittest.TestCase):
 
         def _callback(
             request: SynapseRequest, **kwargs: object
-        ) -> Tuple[int, Dict[str, object]]:
+        ) -> tuple[int, dict[str, object]]:
             return 200, {"result": True}
 
         res = JsonResource(self.homeserver)
@@ -211,15 +212,75 @@ class JsonResourceTests(unittest.TestCase):
         self.assertEqual(channel.code, 200)
         self.assertNotIn("body", channel.result)
 
+    def test_content_larger_than_content_length(self) -> None:
+        """
+        HTTP requests with content size exceeding Content-Length should be rejected with 400.
+        """
+
+        def _callback(
+            request: SynapseRequest, **kwargs: object
+        ) -> tuple[int, JsonDict]:
+            return 200, {}
+
+        res = JsonResource(self.homeserver)
+        res.register_paths(
+            "POST", [re.compile("^/_matrix/foo$")], _callback, "test_servlet"
+        )
+
+        channel = make_request(
+            self.reactor,
+            FakeSite(res, self.reactor),
+            b"POST",
+            b"/_matrix/foo",
+            {},
+            # Set the `Content-Length` value to be smaller than the actual content size
+            custom_headers=[("Content-Length", "1")],
+            # The request should disconnect early so don't await the result
+            await_result=False,
+        )
+
+        self.reactor.advance(0.1)
+        self.assertEqual(channel.code, 400)
+
+    def test_content_smaller_than_content_length(self) -> None:
+        """
+        HTTP requests with content size smaller than Content-Length should be rejected with 400.
+        """
+
+        def _callback(
+            request: SynapseRequest, **kwargs: object
+        ) -> tuple[int, JsonDict]:
+            return 200, {}
+
+        res = JsonResource(self.homeserver)
+        res.register_paths(
+            "POST", [re.compile("^/_matrix/foo$")], _callback, "test_servlet"
+        )
+
+        channel = make_request(
+            self.reactor,
+            FakeSite(res, self.reactor),
+            b"POST",
+            b"/_matrix/foo",
+            {},
+            # Set the `Content-Length` value to be larger than the actual content size
+            custom_headers=[("Content-Length", "10")],
+            # The request should disconnect early so don't await the result
+            await_result=False,
+        )
+
+        self.reactor.advance(0.1)
+        self.assertEqual(channel.code, 400)
+
 
 class OptionsResourceTests(unittest.TestCase):
     def setUp(self) -> None:
         reactor, clock = get_clock()
         self.reactor = reactor
         self.homeserver = setup_test_homeserver(
-            self.addCleanup,
-            clock=clock,
+            cleanup_func=self.addCleanup,
             reactor=self.reactor,
+            clock=clock,
         )
 
         class DummyResource(Resource):
@@ -236,17 +297,17 @@ class OptionsResourceTests(unittest.TestCase):
         """Create a request from the method/path and return a channel with the response."""
         # Create a site and query for the resource.
         site = SynapseSite(
-            "test",
-            "site_tag",
-            parse_listener_def(
+            logger_name="test",
+            site_tag="site_tag",
+            config=parse_listener_def(
                 0,
                 {
                     "type": "http",
                     "port": 0,
                 },
             ),
-            self.resource,
-            "1.0",
+            resource=self.resource,
+            server_version_string="1",
             max_request_body_size=4096,
             reactor=self.reactor,
             hs=self.homeserver,
@@ -309,7 +370,7 @@ class OptionsResourceTests(unittest.TestCase):
 
 class WrapHtmlRequestHandlerTests(unittest.TestCase):
     class TestResource(DirectServeHtmlResource):
-        callback: Optional[Callable[..., Awaitable[None]]]
+        callback: Callable[..., Awaitable[None]] | None
 
         async def _async_render_GET(self, request: SynapseRequest) -> None:
             assert self.callback is not None
@@ -405,12 +466,12 @@ class CancellableDirectServeJsonResource(DirectServeJsonResource):
         self.clock = clock
 
     @cancellable
-    async def _async_render_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+    async def _async_render_GET(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
-    async def _async_render_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
-        await self.clock.sleep(1.0)
+    async def _async_render_POST(self, request: SynapseRequest) -> tuple[int, JsonDict]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, {"result": True}
 
 
@@ -422,12 +483,12 @@ class CancellableDirectServeHtmlResource(DirectServeHtmlResource):
         self.clock = clock
 
     @cancellable
-    async def _async_render_GET(self, request: SynapseRequest) -> Tuple[int, bytes]:
-        await self.clock.sleep(1.0)
+    async def _async_render_GET(self, request: SynapseRequest) -> tuple[int, bytes]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, b"ok"
 
-    async def _async_render_POST(self, request: SynapseRequest) -> Tuple[int, bytes]:
-        await self.clock.sleep(1.0)
+    async def _async_render_POST(self, request: SynapseRequest) -> tuple[int, bytes]:
+        await self.clock.sleep(Duration(seconds=1))
         return HTTPStatus.OK, b"ok"
 
 
@@ -445,7 +506,7 @@ class DirectServeJsonResourceCancellationTests(unittest.TestCase):
         channel = make_request(
             self.reactor, self.site, "GET", "/sleep", await_result=False
         )
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=True,
@@ -457,7 +518,7 @@ class DirectServeJsonResourceCancellationTests(unittest.TestCase):
         channel = make_request(
             self.reactor, self.site, "POST", "/sleep", await_result=False
         )
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=False,
@@ -479,7 +540,7 @@ class DirectServeHtmlResourceCancellationTests(unittest.TestCase):
         channel = make_request(
             self.reactor, self.site, "GET", "/sleep", await_result=False
         )
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor,
             channel,
             expect_cancellation=True,
@@ -491,6 +552,6 @@ class DirectServeHtmlResourceCancellationTests(unittest.TestCase):
         channel = make_request(
             self.reactor, self.site, "POST", "/sleep", await_result=False
         )
-        test_disconnect(
+        disconnect_and_assert(
             self.reactor, channel, expect_cancellation=False, expected_body=b"ok"
         )
diff --git a/tests/test_state.py b/tests/test_state.py
index adb72b0730..7df95ebf8b 100644
--- a/tests/test_state.py
+++ b/tests/test_state.py
@@ -21,15 +21,9 @@
 from typing import (
     Any,
     Collection,
-    Dict,
     Generator,
     Iterable,
     Iterator,
-    List,
-    Optional,
-    Set,
-    Tuple,
-    cast,
 )
 from unittest.mock import AsyncMock, Mock
 
@@ -43,23 +37,22 @@ from synapse.events.snapshot import EventContext
 from synapse.state import StateHandler, StateResolutionHandler, _make_state_cache_entry
 from synapse.types import MutableStateMap, StateMap
 from synapse.types.state import StateFilter
-from synapse.util import Clock
 from synapse.util.macaroons import MacaroonGenerator
 
 from tests import unittest
-
-from .utils import MockClock, default_config
+from tests.server import get_clock
+from tests.utils import default_config
 
 _next_event_id = 1000
 
 
 def create_event(
-    name: Optional[str] = None,
-    type: Optional[str] = None,
-    state_key: Optional[str] = None,
+    name: str | None = None,
+    type: str | None = None,
+    state_key: str | None = None,
     depth: int = 2,
-    event_id: Optional[str] = None,
-    prev_events: Optional[List[Tuple[str, dict]]] = None,
+    event_id: str | None = None,
+    prev_events: list[tuple[str, dict]] | None = None,
     **kwargs: Any,
 ) -> EventBase:
     global _next_event_id
@@ -93,16 +86,16 @@ def create_event(
 
 class _DummyStore:
     def __init__(self) -> None:
-        self._event_to_state_group: Dict[str, int] = {}
-        self._group_to_state: Dict[int, MutableStateMap[str]] = {}
+        self._event_to_state_group: dict[str, int] = {}
+        self._group_to_state: dict[int, MutableStateMap[str]] = {}
 
-        self._event_id_to_event: Dict[str, EventBase] = {}
+        self._event_id_to_event: dict[str, EventBase] = {}
 
         self._next_group = 1
 
     async def get_state_groups_ids(
         self, room_id: str, event_ids: Collection[str]
-    ) -> Dict[int, MutableStateMap[str]]:
+    ) -> dict[int, MutableStateMap[str]]:
         groups = {}
         for event_id in event_ids:
             group = self._event_to_state_group.get(event_id)
@@ -112,7 +105,7 @@ class _DummyStore:
         return groups
 
     async def get_state_ids_for_group(
-        self, state_group: int, state_filter: Optional[StateFilter] = None
+        self, state_group: int, state_filter: StateFilter | None = None
     ) -> MutableStateMap[str]:
         return self._group_to_state[state_group]
 
@@ -120,9 +113,9 @@ class _DummyStore:
         self,
         event_id: str,
         room_id: str,
-        prev_group: Optional[int],
-        delta_ids: Optional[StateMap[str]],
-        current_state_ids: Optional[StateMap[str]],
+        prev_group: int | None,
+        delta_ids: StateMap[str] | None,
+        current_state_ids: StateMap[str] | None,
     ) -> int:
         state_group = self._next_group
         self._next_group += 1
@@ -139,7 +132,7 @@ class _DummyStore:
 
     async def get_events(
         self, event_ids: Collection[str], **kwargs: Any
-    ) -> Dict[str, EventBase]:
+    ) -> dict[str, EventBase]:
         return {
             e_id: self._event_id_to_event[e_id]
             for e_id in event_ids
@@ -148,12 +141,12 @@ class _DummyStore:
 
     async def get_partial_state_events(
         self, event_ids: Collection[str]
-    ) -> Dict[str, bool]:
+    ) -> dict[str, bool]:
         return dict.fromkeys(event_ids, False)
 
     async def get_state_group_delta(
         self, name: str
-    ) -> Tuple[Optional[int], Optional[StateMap[str]]]:
+    ) -> tuple[int | None, StateMap[str] | None]:
         return None, None
 
     def register_events(self, events: Iterable[EventBase]) -> None:
@@ -172,7 +165,7 @@ class _DummyStore:
 
     async def get_state_group_for_events(
         self, event_ids: Collection[str], await_full_state: bool = True
-    ) -> Dict[str, int]:
+    ) -> dict[str, int]:
         res = {}
         for event in event_ids:
             res[event] = self._event_to_state_group[event]
@@ -180,7 +173,7 @@ class _DummyStore:
 
     async def get_state_for_groups(
         self, groups: Collection[int]
-    ) -> Dict[int, MutableStateMap[str]]:
+    ) -> dict[int, MutableStateMap[str]]:
         res = {}
         for group in groups:
             state = self._group_to_state[group]
@@ -195,15 +188,15 @@ class DictObj(dict):
 
 
 class Graph:
-    def __init__(self, nodes: Dict[str, DictObj], edges: Dict[str, List[str]]):
-        events: Dict[str, EventBase] = {}
-        clobbered: Set[str] = set()
+    def __init__(self, nodes: dict[str, DictObj], edges: dict[str, list[str]]):
+        events: dict[str, EventBase] = {}
+        clobbered: set[str] = set()
 
         for event_id, fields in nodes.items():
             refs = edges.get(event_id)
             if refs:
                 clobbered.difference_update(refs)
-                prev_events: List[Tuple[str, dict]] = [(r, {}) for r in refs]
+                prev_events: list[tuple[str, dict]] = [(r, {}) for r in refs]
             else:
                 prev_events = []
 
@@ -248,7 +241,7 @@ class StateTestCase(unittest.TestCase):
                 "hostname",
             ]
         )
-        clock = cast(Clock, MockClock())
+        reactor, clock = get_clock()
         hs.config = default_config("tesths", True)
         hs.get_datastores.return_value = Mock(
             main=self.dummy_store,
@@ -283,7 +276,7 @@ class StateTestCase(unittest.TestCase):
 
         self.dummy_store.register_events(graph.walk())
 
-        context_store: Dict[str, EventContext] = {}
+        context_store: dict[str, EventContext] = {}
 
         for event in graph.walk():
             context = yield defer.ensureDeferred(
@@ -330,7 +323,7 @@ class StateTestCase(unittest.TestCase):
 
         self.dummy_store.register_events(graph.walk())
 
-        context_store: Dict[str, EventContext] = {}
+        context_store: dict[str, EventContext] = {}
 
         for event in graph.walk():
             context = yield defer.ensureDeferred(
@@ -391,7 +384,7 @@ class StateTestCase(unittest.TestCase):
 
         self.dummy_store.register_events(graph.walk())
 
-        context_store: Dict[str, EventContext] = {}
+        context_store: dict[str, EventContext] = {}
 
         for event in graph.walk():
             context = yield defer.ensureDeferred(
@@ -469,7 +462,7 @@ class StateTestCase(unittest.TestCase):
 
         self.dummy_store.register_events(graph.walk())
 
-        context_store: Dict[str, EventContext] = {}
+        context_store: dict[str, EventContext] = {}
 
         for event in graph.walk():
             context = yield defer.ensureDeferred(
@@ -492,7 +485,7 @@ class StateTestCase(unittest.TestCase):
         self.assertEqual(ctx_d.state_group_before_event, ctx_d.state_group)
 
     def _add_depths(
-        self, nodes: Dict[str, DictObj], edges: Dict[str, List[str]]
+        self, nodes: dict[str, DictObj], edges: dict[str, list[str]]
     ) -> None:
         def _get_depth(ev: str) -> int:
             node = nodes[ev]
diff --git a/tests/test_terms_auth.py b/tests/test_terms_auth.py
index 8065ae4b8a..bd5e6520ac 100644
--- a/tests/test_terms_auth.py
+++ b/tests/test_terms_auth.py
@@ -20,13 +20,12 @@
 
 from unittest.mock import Mock
 
-from twisted.internet.interfaces import IReactorTime
-from twisted.internet.testing import MemoryReactor, MemoryReactorClock
+from twisted.internet.testing import MemoryReactor
 
 from synapse.rest.client.register import register_servlets
 from synapse.server import HomeServer
 from synapse.types import JsonDict
-from synapse.util import Clock
+from synapse.util.clock import Clock
 
 from tests import unittest
 
@@ -49,13 +48,7 @@ class TermsTestCase(unittest.HomeserverTestCase):
         )
         return config
 
-    def prepare(
-        self, reactor: MemoryReactor, clock: Clock, homeserver: HomeServer
-    ) -> None:
-        # type-ignore: mypy-zope doesn't seem to recognise that MemoryReactorClock
-        # implements IReactorTime, via inheritance from twisted.internet.testing.Clock
-        self.clock: IReactorTime = MemoryReactorClock()  # type: ignore[assignment]
-        self.hs_clock = Clock(self.clock)
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
         self.url = "/_matrix/client/r0/register"
         self.registration_handler = Mock()
         self.auth_handler = Mock()
diff --git a/tests/test_test_utils.py b/tests/test_test_utils.py
deleted file mode 100644
index c52f963a7e..0000000000
--- a/tests/test_test_utils.py
+++ /dev/null
@@ -1,79 +0,0 @@
-#
-# This file is licensed under the Affero General Public License (AGPL) version 3.
-#
-# Copyright 2014-2016 OpenMarket Ltd
-# Copyright (C) 2023 New Vector, Ltd
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# See the GNU Affero General Public License for more details:
-# <https://www.gnu.org/licenses/agpl-3.0.html>.
-#
-# Originally licensed under the Apache License, Version 2.0:
-# <http://www.apache.org/licenses/LICENSE-2.0>.
-#
-# [This file includes modifications made by New Vector Limited]
-#
-#
-
-from tests import unittest
-from tests.utils import MockClock
-
-
-class MockClockTestCase(unittest.TestCase):
-    def setUp(self) -> None:
-        self.clock = MockClock()
-
-    def test_advance_time(self) -> None:
-        start_time = self.clock.time()
-
-        self.clock.advance_time(20)
-
-        self.assertEqual(20, self.clock.time() - start_time)
-
-    def test_later(self) -> None:
-        invoked = [0, 0]
-
-        def _cb0() -> None:
-            invoked[0] = 1
-
-        self.clock.call_later(10, _cb0)
-
-        def _cb1() -> None:
-            invoked[1] = 1
-
-        self.clock.call_later(20, _cb1)
-
-        self.assertFalse(invoked[0])
-
-        self.clock.advance_time(15)
-
-        self.assertTrue(invoked[0])
-        self.assertFalse(invoked[1])
-
-        self.clock.advance_time(5)
-
-        self.assertTrue(invoked[1])
-
-    def test_cancel_later(self) -> None:
-        invoked = [0, 0]
-
-        def _cb0() -> None:
-            invoked[0] = 1
-
-        t0 = self.clock.call_later(10, _cb0)
-
-        def _cb1() -> None:
-            invoked[1] = 1
-
-        self.clock.call_later(20, _cb1)
-
-        self.clock.cancel_call_later(t0)
-
-        self.clock.advance_time(30)
-
-        self.assertFalse(invoked[0])
-        self.assertTrue(invoked[1])
diff --git a/tests/test_types.py b/tests/test_types.py
index 0c08bc8ecc..1802f0fae3 100644
--- a/tests/test_types.py
+++ b/tests/test_types.py
@@ -19,7 +19,6 @@
 #
 #
 
-from typing import Type
 from unittest import skipUnless
 
 from immutabledict import immutabledict
@@ -152,7 +151,7 @@ class MapUsernameTestCase(unittest.TestCase):
 class MultiWriterTokenTestCase(unittest.HomeserverTestCase):
     """Tests for the different types of multi writer tokens."""
 
-    token_type: Type[AbstractMultiWriterStreamToken]
+    token_type: type[AbstractMultiWriterStreamToken]
 
     def test_basic_token(self) -> None:
         """Test that a simple stream token can be serialized and unserialized"""
diff --git a/tests/test_utils/__init__.py b/tests/test_utils/__init__.py
index 3e6fd03600..0df5a4e6c3 100644
--- a/tests/test_utils/__init__.py
+++ b/tests/test_utils/__init__.py
@@ -28,7 +28,7 @@ import json
 import sys
 import warnings
 from binascii import unhexlify
-from typing import TYPE_CHECKING, Awaitable, Callable, Tuple, TypeVar
+from typing import TYPE_CHECKING, Awaitable, Callable, TypeVar
 
 import attr
 import zope.interface
@@ -102,7 +102,7 @@ class FakeResponse:  # type: ignore[misc]
     attribute, and didn't support deliverBody until recently.
     """
 
-    version: Tuple[bytes, int, int] = (b"HTTP", 1, 1)
+    version: tuple[bytes, int, int] = (b"HTTP", 1, 1)
 
     # HTTP response code
     code: int = 200
diff --git a/tests/test_utils/event_injection.py b/tests/test_utils/event_injection.py
index c1eaf9a575..a90fc5884d 100644
--- a/tests/test_utils/event_injection.py
+++ b/tests/test_utils/event_injection.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Any, List, Optional, Tuple
+from typing import Any
 
 import synapse.server
 from synapse.api.constants import EventTypes
@@ -36,8 +36,8 @@ async def inject_member_event(
     room_id: str,
     sender: str,
     membership: str,
-    target: Optional[str] = None,
-    extra_content: Optional[dict] = None,
+    target: str | None = None,
+    extra_content: dict | None = None,
     **kwargs: Any,
 ) -> EventBase:
     """Inject a membership event into a room."""
@@ -61,8 +61,8 @@ async def inject_member_event(
 
 async def inject_event(
     hs: synapse.server.HomeServer,
-    room_version: Optional[str] = None,
-    prev_event_ids: Optional[List[str]] = None,
+    room_version: str | None = None,
+    prev_event_ids: list[str] | None = None,
     **kwargs: Any,
 ) -> EventBase:
     """Inject a generic event into a room
@@ -86,10 +86,10 @@ async def inject_event(
 
 async def create_event(
     hs: synapse.server.HomeServer,
-    room_version: Optional[str] = None,
-    prev_event_ids: Optional[List[str]] = None,
+    room_version: str | None = None,
+    prev_event_ids: list[str] | None = None,
     **kwargs: Any,
-) -> Tuple[EventBase, EventContext]:
+) -> tuple[EventBase, EventContext]:
     if room_version is None:
         room_version = await hs.get_datastores().main.get_room_version_id(
             kwargs["room_id"]
diff --git a/tests/test_utils/html_parsers.py b/tests/test_utils/html_parsers.py
index a0f39cb130..a9a4b98df2 100644
--- a/tests/test_utils/html_parsers.py
+++ b/tests/test_utils/html_parsers.py
@@ -20,7 +20,7 @@
 #
 
 from html.parser import HTMLParser
-from typing import Dict, Iterable, List, NoReturn, Optional, Tuple
+from typing import Iterable, NoReturn
 
 
 class TestHtmlParser(HTMLParser):
@@ -30,16 +30,16 @@ class TestHtmlParser(HTMLParser):
         super().__init__()
 
         # a list of links found in the doc
-        self.links: List[str] = []
+        self.links: list[str] = []
 
         # the values of any hidden <input>s: map from name to value
-        self.hiddens: Dict[str, Optional[str]] = {}
+        self.hiddens: dict[str, str | None] = {}
 
         # the values of any radio buttons: map from name to list of values
-        self.radios: Dict[str, List[Optional[str]]] = {}
+        self.radios: dict[str, list[str | None]] = {}
 
     def handle_starttag(
-        self, tag: str, attrs: Iterable[Tuple[str, Optional[str]]]
+        self, tag: str, attrs: Iterable[tuple[str, str | None]]
     ) -> None:
         attr_dict = dict(attrs)
         if tag == "a":
diff --git a/tests/test_utils/oidc.py b/tests/test_utils/oidc.py
index 5bf5e5cb0c..837a04077c 100644
--- a/tests/test_utils/oidc.py
+++ b/tests/test_utils/oidc.py
@@ -23,7 +23,7 @@
 import base64
 import json
 from hashlib import sha256
-from typing import Any, ContextManager, Dict, List, Optional, Tuple
+from typing import Any, ContextManager
 from unittest.mock import Mock, patch
 from urllib.parse import parse_qs
 
@@ -33,7 +33,7 @@ from twisted.web.http_headers import Headers
 from twisted.web.iweb import IResponse
 
 from synapse.server import HomeServer
-from synapse.util import Clock
+from synapse.util.clock import Clock
 from synapse.util.stringutils import random_string
 
 from tests.test_utils import FakeResponse
@@ -45,8 +45,8 @@ class FakeAuthorizationGrant:
     client_id: str
     redirect_uri: str
     scope: str
-    nonce: Optional[str]
-    sid: Optional[str]
+    nonce: str | None
+    sid: str | None
 
 
 class FakeOidcServer:
@@ -75,16 +75,16 @@ class FakeOidcServer:
         self.post_token_handler = Mock(side_effect=self._post_token_handler)
 
         # A code -> grant mapping
-        self._authorization_grants: Dict[str, FakeAuthorizationGrant] = {}
+        self._authorization_grants: dict[str, FakeAuthorizationGrant] = {}
         # An access token -> grant mapping
-        self._sessions: Dict[str, FakeAuthorizationGrant] = {}
+        self._sessions: dict[str, FakeAuthorizationGrant] = {}
 
         # We generate here an ECDSA key with the P-256 curve (ES256 algorithm) used for
         # signing JWTs. ECDSA keys are really quick to generate compared to RSA.
         self._key = ECKey.generate_key(crv="P-256", is_private=True)
         self._jwks = KeySet([ECKey.import_key(self._key.as_pem(is_private=False))])
 
-        self._id_token_overrides: Dict[str, Any] = {}
+        self._id_token_overrides: dict[str, Any] = {}
 
     def reset_mocks(self) -> None:
         self.request.reset_mock()
@@ -140,7 +140,7 @@ class FakeOidcServer:
     def get_jwks(self) -> dict:
         return self._jwks.as_dict()
 
-    def get_userinfo(self, access_token: str) -> Optional[dict]:
+    def get_userinfo(self, access_token: str) -> dict | None:
         """Given an access token, get the userinfo of the associated session."""
         session = self._sessions.get(access_token, None)
         if session is None:
@@ -220,9 +220,9 @@ class FakeOidcServer:
         scope: str,
         redirect_uri: str,
         userinfo: dict,
-        nonce: Optional[str] = None,
+        nonce: str | None = None,
         with_sid: bool = False,
-    ) -> Tuple[str, FakeAuthorizationGrant]:
+    ) -> tuple[str, FakeAuthorizationGrant]:
         """Start an authorization request, and get back the code to use on the authorization endpoint."""
         code = random_string(10)
         sid = None
@@ -242,7 +242,7 @@ class FakeOidcServer:
 
         return code, grant
 
-    def exchange_code(self, code: str) -> Optional[Dict[str, Any]]:
+    def exchange_code(self, code: str) -> dict[str, Any] | None:
         grant = self._authorization_grants.pop(code, None)
         if grant is None:
             return None
@@ -269,7 +269,7 @@ class FakeOidcServer:
         metadata: bool = False,
         token: bool = False,
         userinfo: bool = False,
-    ) -> ContextManager[Dict[str, Mock]]:
+    ) -> ContextManager[dict[str, Mock]]:
         """A context which makes a set of endpoints return a 500 error.
 
         Args:
@@ -296,11 +296,11 @@ class FakeOidcServer:
         self,
         method: str,
         uri: str,
-        data: Optional[bytes] = None,
-        headers: Optional[Headers] = None,
+        data: bytes | None = None,
+        headers: Headers | None = None,
     ) -> IResponse:
         """The override of the SimpleHttpClient#request() method"""
-        access_token: Optional[str] = None
+        access_token: str | None = None
 
         if headers is None:
             headers = Headers()
@@ -346,7 +346,7 @@ class FakeOidcServer:
         """Handles requests to the OIDC well-known document."""
         return FakeResponse.json(payload=self.get_metadata())
 
-    def _get_userinfo_handler(self, access_token: Optional[str]) -> IResponse:
+    def _get_userinfo_handler(self, access_token: str | None) -> IResponse:
         """Handles requests to the userinfo endpoint."""
         if access_token is None:
             return FakeResponse(code=401)
@@ -356,7 +356,7 @@ class FakeOidcServer:
 
         return FakeResponse.json(payload=user_info)
 
-    def _post_token_handler(self, params: Dict[str, List[str]]) -> IResponse:
+    def _post_token_handler(self, params: dict[str, list[str]]) -> IResponse:
         """Handles requests to the token endpoint."""
         code = params.get("code", [])
 
diff --git a/tests/test_visibility.py b/tests/test_visibility.py
index 285e28e0f9..b50faa2a49 100644
--- a/tests/test_visibility.py
+++ b/tests/test_visibility.py
@@ -18,7 +18,6 @@
 #
 #
 import logging
-from typing import Optional
 from unittest.mock import patch
 
 from twisted.test.proto_helpers import MemoryReactor
@@ -31,8 +30,11 @@ from synapse.rest import admin
 from synapse.rest.client import login, room
 from synapse.server import HomeServer
 from synapse.types import create_requester
-from synapse.util import Clock
-from synapse.visibility import filter_events_for_client, filter_events_for_server
+from synapse.util.clock import Clock
+from synapse.visibility import (
+    filter_and_transform_events_for_client,
+    filter_events_for_server,
+)
 
 from tests import unittest
 from tests.test_utils.event_injection import inject_event, inject_member_event
@@ -331,7 +333,7 @@ class FilterEventsForServerAdminsTestCase(HomeserverTestCase):
 
         # Do filter & assert
         filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 self.hs.get_storage_controllers(),
                 "@admin:test",
                 events_to_filter,
@@ -370,7 +372,7 @@ class FilterEventsForServerAdminsTestCase(HomeserverTestCase):
 
         # Do filter & assert
         filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 self.hs.get_storage_controllers(),
                 "@admin:test",
                 events_to_filter,
@@ -417,7 +419,7 @@ class FilterEventsForServerAdminsTestCase(HomeserverTestCase):
 
         # Do filter & assert
         filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 self.hs.get_storage_controllers(),
                 "@admin:test",
                 events_to_filter,
@@ -464,7 +466,7 @@ class FilterEventsForServerAdminsTestCase(HomeserverTestCase):
 
         # Do filter & assert
         filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 self.hs.get_storage_controllers(),
                 "@admin:test",
                 events_to_filter,
@@ -539,14 +541,14 @@ class FilterEventsForClientTestCase(HomeserverTestCase):
         # accidentally serving the same event object (with the same unsigned.membership
         # property) to both users.
         joiner_filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 self.hs.get_storage_controllers(),
                 "@joiner:test",
                 events_to_filter,
             )
         )
         resident_filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 self.hs.get_storage_controllers(),
                 "@resident:test",
                 events_to_filter,
@@ -642,7 +644,7 @@ class FilterEventsOutOfBandEventsForClientTestCase(
 
         # the invited user should be able to see both the invite and the rejection
         filtered_events = self.get_success(
-            filter_events_for_client(
+            filter_and_transform_events_for_client(
                 self.hs.get_storage_controllers(),
                 "@user:test",
                 [invite_event, reject_event],
@@ -663,7 +665,7 @@ class FilterEventsOutOfBandEventsForClientTestCase(
         # other users should see neither
         self.assertEqual(
             self.get_success(
-                filter_events_for_client(
+                filter_and_transform_events_for_client(
                     self.hs.get_storage_controllers(),
                     "@other:test",
                     [invite_event, reject_event],
@@ -693,9 +695,9 @@ async def inject_message_event(
     hs: HomeServer,
     room_id: str,
     sender: str,
-    body: Optional[str] = "testytest",
-    soft_failed: Optional[bool] = False,
-    policy_server_spammy: Optional[bool] = False,
+    body: str | None = "testytest",
+    soft_failed: bool | None = False,
+    policy_server_spammy: bool | None = False,
 ) -> EventBase:
     return await inject_event(
         hs,
diff --git a/tests/types/test_init.py b/tests/types/test_init.py
index b7a5b93ce9..8ca9bc7973 100644
--- a/tests/types/test_init.py
+++ b/tests/types/test_init.py
@@ -8,13 +8,13 @@ class RoomIDTestCase(TestCase):
     def test_can_create_msc4291_room_ids(self) -> None:
         valid_msc4291_room_id = "!31hneApxJ_1o-63DmFrpeqnkFfWppnzWso1JvH3ogLM"
         room_id = RoomID.from_string(valid_msc4291_room_id)
-        self.assertEquals(RoomID.is_valid(valid_msc4291_room_id), True)
-        self.assertEquals(
+        self.assertEqual(RoomID.is_valid(valid_msc4291_room_id), True)
+        self.assertEqual(
             room_id.to_string(),
             valid_msc4291_room_id,
         )
-        self.assertEquals(room_id.id, "!31hneApxJ_1o-63DmFrpeqnkFfWppnzWso1JvH3ogLM")
-        self.assertEquals(room_id.get_domain(), None)
+        self.assertEqual(room_id.id, "!31hneApxJ_1o-63DmFrpeqnkFfWppnzWso1JvH3ogLM")
+        self.assertEqual(room_id.get_domain(), None)
 
     def test_cannot_create_invalid_msc4291_room_ids(self) -> None:
         invalid_room_ids = [
@@ -47,5 +47,5 @@ class RoomIDTestCase(TestCase):
         ]
         for room_id_str in valid_room_ids:
             room_id = RoomID.from_string(room_id_str)
-            self.assertEquals(RoomID.is_valid(room_id_str), True)
+            self.assertEqual(RoomID.is_valid(room_id_str), True)
             self.assertIsNotNone(room_id.get_domain())
diff --git a/tests/unittest.py b/tests/unittest.py
index 5e6957dc6d..03db9a4282 100644
--- a/tests/unittest.py
+++ b/tests/unittest.py
@@ -33,18 +33,13 @@ from typing import (
     Awaitable,
     Callable,
     ClassVar,
-    Dict,
     Generic,
     Iterable,
-    List,
     Mapping,
     NoReturn,
     Optional,
     Protocol,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
 )
 from unittest.mock import Mock, patch
 
@@ -80,8 +75,8 @@ from synapse.logging.context import (
 from synapse.rest import RegisterServletsFunc
 from synapse.server import HomeServer
 from synapse.storage.keys import FetchKeyResult
-from synapse.types import JsonDict, Requester, UserID, create_requester
-from synapse.util import Clock
+from synapse.types import ISynapseReactor, JsonDict, Requester, UserID, create_requester
+from synapse.util.clock import Clock
 from synapse.util.httpresourcetree import create_resource_tree
 
 from tests.server import (
@@ -99,6 +94,8 @@ from tests.utils import checked_cast, default_config, setupdb
 setupdb()
 setup_logging()
 
+logger = logging.getLogger(__name__)
+
 TV = TypeVar("TV")
 _ExcType = TypeVar("_ExcType", bound=BaseException, covariant=True)
 
@@ -135,7 +132,7 @@ def around(target: TV) -> Callable[[Callable[Concatenate[S, P], R]], None]:
     return _around
 
 
-_TConfig = TypeVar("_TConfig", Config, RootConfig)
+_TConfig = TypeVar("_TConfig", Config, HomeServerConfig)
 
 
 def deepcopy_config(config: _TConfig) -> _TConfig:
@@ -161,13 +158,13 @@ def deepcopy_config(config: _TConfig) -> _TConfig:
 
 
 @functools.lru_cache(maxsize=8)
-def _parse_config_dict(config: str) -> RootConfig:
+def _parse_config_dict(config: str) -> HomeServerConfig:
     config_obj = HomeServerConfig()
     config_obj.parse_config_dict(json.loads(config), "", "")
     return config_obj
 
 
-def make_homeserver_config_obj(config: Dict[str, Any]) -> RootConfig:
+def make_homeserver_config_obj(config: dict[str, Any]) -> HomeServerConfig:
     """Creates a :class:`HomeServerConfig` instance with the given configuration dict.
 
     This is equivalent to::
@@ -248,7 +245,7 @@ class TestCase(unittest.TestCase):
 
             return ret
 
-    def assertObjectHasAttributes(self, attrs: Dict[str, object], obj: object) -> None:
+    def assertObjectHasAttributes(self, attrs: dict[str, object], obj: object) -> None:
         """Asserts that the given object has each of the attributes given, and
         that the value of each matches according to assertEqual."""
         for key in attrs.keys():
@@ -276,7 +273,7 @@ class TestCase(unittest.TestCase):
         actual_items: AbstractSet[TV],
         expected_items: AbstractSet[TV],
         exact: bool = False,
-        message: Optional[str] = None,
+        message: str | None = None,
     ) -> None:
         """
         Assert that all of the `expected_items` are included in the `actual_items`.
@@ -297,14 +294,14 @@ class TestCase(unittest.TestCase):
         elif not exact and actual_items >= expected_items:
             return
 
-        expected_lines: List[str] = []
+        expected_lines: list[str] = []
         for expected_item in expected_items:
             is_expected_in_actual = expected_item in actual_items
             expected_lines.append(
                 "{}  {}".format(" " if is_expected_in_actual else "?", expected_item)
             )
 
-        actual_lines: List[str] = []
+        actual_lines: list[str] = []
         for actual_item in actual_items:
             is_actual_in_expected = actual_item in expected_items
             actual_lines.append(
@@ -343,6 +340,9 @@ def logcontext_clean(target: TV) -> TV:
     """
 
     def logcontext_error(msg: str) -> NoReturn:
+        # Log so we can still see it in the logs like normal
+        logger.warning(msg)
+        # But also fail the test
         raise AssertionError("logcontext error: %s" % (msg))
 
     patcher = patch("synapse.logging.context.logcontext_error", new=logcontext_error)
@@ -377,7 +377,7 @@ class HomeserverTestCase(TestCase):
 
     hijack_auth: ClassVar[bool] = True
     needs_threadpool: ClassVar[bool] = False
-    servlets: ClassVar[List[RegisterServletsFunc]] = []
+    servlets: ClassVar[list[RegisterServletsFunc]] = []
 
     def __init__(self, methodName: str):
         super().__init__(methodName)
@@ -392,8 +392,8 @@ class HomeserverTestCase(TestCase):
         hijacking the authentication system to return a fixed user, and then
         calling the prepare function.
         """
+        # We need to share the reactor between the homeserver and all of our test utils.
         self.reactor, self.clock = get_clock()
-        self._hs_args = {"clock": self.clock, "reactor": self.reactor}
         self.hs = self.make_homeserver(self.reactor, self.clock)
 
         self.hs.get_datastores().main.tests_allow_no_chain_cover_index = False
@@ -511,7 +511,7 @@ class HomeserverTestCase(TestCase):
 
         Function to be overridden in subclasses.
         """
-        hs = self.setup_test_homeserver()
+        hs = self.setup_test_homeserver(reactor=reactor, clock=clock)
         return hs
 
     def create_test_resource(self) -> Resource:
@@ -525,7 +525,7 @@ class HomeserverTestCase(TestCase):
         create_resource_tree(self.create_resource_dict(), root_resource)
         return root_resource
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         """Create a resource tree for the test server
 
         A resource tree is a mapping from path to twisted.web.resource.
@@ -572,17 +572,17 @@ class HomeserverTestCase(TestCase):
 
     def make_request(
         self,
-        method: Union[bytes, str],
-        path: Union[bytes, str],
-        content: Union[bytes, str, JsonDict] = b"",
-        access_token: Optional[str] = None,
-        request: Type[Request] = SynapseRequest,
+        method: bytes | str,
+        path: bytes | str,
+        content: bytes | str | JsonDict = b"",
+        access_token: str | None = None,
+        request: type[Request] = SynapseRequest,
         shorthand: bool = True,
-        federation_auth_origin: Optional[bytes] = None,
-        content_type: Optional[bytes] = None,
+        federation_auth_origin: bytes | None = None,
+        content_type: bytes | None = None,
         content_is_form: bool = False,
         await_result: bool = True,
-        custom_headers: Optional[Iterable[CustomHeaderType]] = None,
+        custom_headers: Iterable[CustomHeaderType] | None = None,
         client_ip: str = "127.0.0.1",
     ) -> FakeChannel:
         """
@@ -634,7 +634,12 @@ class HomeserverTestCase(TestCase):
         )
 
     def setup_test_homeserver(
-        self, name: Optional[str] = None, **kwargs: Any
+        self,
+        server_name: str | None = None,
+        config: JsonDict | None = None,
+        reactor: Optional[ISynapseReactor] = None,
+        clock: Clock | None = None,
+        **extra_homeserver_attributes: Any,
     ) -> HomeServer:
         """
         Set up the test homeserver, meant to be called by the overridable
@@ -647,32 +652,41 @@ class HomeserverTestCase(TestCase):
         Returns:
             synapse.server.HomeServer
         """
-        kwargs = dict(kwargs)
-        kwargs.update(self._hs_args)
-        if "config" not in kwargs:
+        if config is None:
             config = self.default_config()
-        else:
-            config = kwargs["config"]
+
+        # The sane default is to use the same reactor and clock as our other test utils
+        if reactor is None:
+            reactor = self.reactor
+
+        if clock is None:
+            clock = self.clock
 
         # The server name can be specified using either the `name` argument or a config
         # override. The `name` argument takes precedence over any config overrides.
-        if name is not None:
-            config["server_name"] = name
+        if server_name is not None:
+            config["server_name"] = server_name
 
         # Parse the config from a config dict into a HomeServerConfig
         config_obj = make_homeserver_config_obj(config)
-        kwargs["config"] = config_obj
 
         # The server name in the config is now `name`, if provided, or the `server_name`
         # from a config override, or the default of "test". Whichever it is, we
         # construct a homeserver with a matching name.
-        kwargs["name"] = config_obj.server.server_name
+        server_name = config_obj.server.server_name
 
         async def run_bg_updates() -> None:
-            with LoggingContext("run_bg_updates"):
+            with LoggingContext(name="run_bg_updates", server_name=server_name):
                 self.get_success(stor.db_pool.updates.run_background_updates(False))
 
-        hs = setup_test_homeserver(self.addCleanup, **kwargs)
+        hs = setup_test_homeserver(
+            cleanup_func=self.addCleanup,
+            server_name=server_name,
+            config=config_obj,
+            reactor=reactor,
+            clock=clock,
+            **extra_homeserver_attributes,
+        )
         stor = hs.get_datastores().main
 
         # Run the database background updates, when running against "master".
@@ -683,8 +697,43 @@ class HomeserverTestCase(TestCase):
 
     def pump(self, by: float = 0.0) -> None:
         """
-        Pump the reactor enough that Deferreds will fire.
+        XXX: Deprecated: This method is deprecated. Use `self.reactor.advance(...)`
+        directly instead.
+
+        Pump the reactor enough that `clock.call_later` scheduled callbacks will fire.
+
+        To demystify this function, it simply advances time by the number of seconds
+        specified (defaults to `0`, we also multiply by 100, so `pump(1)` is 100 seconds
+        in 1 second steps/increments) whilst calling any pending callbacks, allowing any
+        queued/pending tasks to run because enough time has passed.
+
+        So for example, if you have some Synapse code that does
+        `clock.call_later(Duration(seconds=2), callback)`, then calling
+        `self.pump(by=0.02)` will advance time by 2 seconds, which is enough for that
+        callback to be ready to run now. Same for `clock.sleep(...)` ,
+        `clock.looping_call(...)`, and whatever other clock utilities that use
+        `clock.call_later` under the hood for scheduling tasks. Trying to use
+        `pump(by=...)` with exact math to meet a specific deadline feels pretty dirty
+        though which is why we recommend using `self.reactor.advance(...)` directly
+        nowadays.
+
+        We don't have any exact historical context for why `pump()` was introduced into
+        the codebase beyond the code itself. We assume that we multiply by 100 so that
+        when you use the clock to schedule something that schedules more things, it
+        tries to run the whole chain to completion.
+
+        XXX: If you're having to call this function, please call out in comments, which
+        scheduled thing you're aiming to trigger. Please also check whether the
+        `pump(...)` is even necessary as it was often misused.
+
+        Args:
+            by: The time increment in seconds to advance time by. We will advance time
+                in 100 steps, each step by this value.
         """
+        # We multiply by 100, so `pump(1)` actually advances time by 100 seconds in 1
+        # second steps/increments. We assume this was done so that when you use the
+        # clock to schedule something that schedules more things, it tries to run the
+        # whole chain to completion.
         self.reactor.pump([by] * 100)
 
     def get_success(self, d: Awaitable[TV], by: float = 0.0) -> TV:
@@ -693,7 +742,7 @@ class HomeserverTestCase(TestCase):
         return self.successResultOf(deferred)
 
     def get_failure(
-        self, d: Awaitable[Any], exc: Type[_ExcType], by: float = 0.0
+        self, d: Awaitable[Any], exc: type[_ExcType], by: float = 0.0
     ) -> _TypedFailure[_ExcType]:
         """
         Run a Deferred and get a Failure from it. The failure must be of the type `exc`.
@@ -731,8 +780,8 @@ class HomeserverTestCase(TestCase):
         self,
         username: str,
         password: str,
-        admin: Optional[bool] = False,
-        displayname: Optional[str] = None,
+        admin: bool | None = False,
+        displayname: str | None = None,
     ) -> str:
         """
         Register a user. Requires the Admin API be registered.
@@ -782,7 +831,8 @@ class HomeserverTestCase(TestCase):
         self,
         username: str,
         appservice_token: str,
-    ) -> Tuple[str, Optional[str]]:
+        inhibit_login: bool = False,
+    ) -> tuple[str, str | None]:
         """Register an appservice user as an application service.
         Requires the client-facing registration API be registered.
 
@@ -802,6 +852,7 @@ class HomeserverTestCase(TestCase):
             {
                 "username": username,
                 "type": "m.login.application_service",
+                "inhibit_login": inhibit_login,
             },
             access_token=appservice_token,
         )
@@ -812,9 +863,9 @@ class HomeserverTestCase(TestCase):
         self,
         username: str,
         password: str,
-        device_id: Optional[str] = None,
-        additional_request_fields: Optional[Dict[str, str]] = None,
-        custom_headers: Optional[Iterable[CustomHeaderType]] = None,
+        device_id: str | None = None,
+        additional_request_fields: dict[str, str] | None = None,
+        custom_headers: Iterable[CustomHeaderType] | None = None,
     ) -> str:
         """
         Log in a user, and get an access token. Requires the Login API be registered.
@@ -853,7 +904,7 @@ class HomeserverTestCase(TestCase):
         room_id: str,
         user: UserID,
         soft_failed: bool = False,
-        prev_event_ids: Optional[List[str]] = None,
+        prev_event_ids: list[str] | None = None,
     ) -> str:
         """
         Create and send an event.
@@ -945,7 +996,7 @@ class FederatingHomeserverTestCase(HomeserverTestCase):
             )
         )
 
-    def create_resource_dict(self) -> Dict[str, Resource]:
+    def create_resource_dict(self) -> dict[str, Resource]:
         d = super().create_resource_dict()
         d["/_matrix/federation"] = TransportLayerServer(self.hs)
         return d
@@ -954,9 +1005,9 @@ class FederatingHomeserverTestCase(HomeserverTestCase):
         self,
         method: str,
         path: str,
-        content: Optional[JsonDict] = None,
+        content: JsonDict | None = None,
         await_result: bool = True,
-        custom_headers: Optional[Iterable[CustomHeaderType]] = None,
+        custom_headers: Iterable[CustomHeaderType] | None = None,
         client_ip: str = "127.0.0.1",
     ) -> FakeChannel:
         """Make an inbound signed federation request to this server
@@ -1021,7 +1072,7 @@ def _auth_header_for_request(
     signing_key: signedjson.key.SigningKey,
     method: str,
     path: str,
-    content: Optional[JsonDict],
+    content: JsonDict | None,
 ) -> str:
     """Build a suitable Authorization header for an outgoing federation request"""
     request_description: JsonDict = {
diff --git a/tests/util/caches/test_deferred_cache.py b/tests/util/caches/test_deferred_cache.py
index 7017d6d70a..fc01a2f5e9 100644
--- a/tests/util/caches/test_deferred_cache.py
+++ b/tests/util/caches/test_deferred_cache.py
@@ -20,26 +20,31 @@
 #
 
 from functools import partial
-from typing import List, Tuple
 
 from twisted.internet import defer
 
 from synapse.util.caches.deferred_cache import DeferredCache
 
+from tests.server import get_clock
 from tests.unittest import TestCase
 
 
 class DeferredCacheTestCase(TestCase):
+    def setUp(self) -> None:
+        super().setUp()
+
+        _, self.clock = get_clock()
+
     def test_empty(self) -> None:
         cache: DeferredCache[str, int] = DeferredCache(
-            name="test", server_name="test_server"
+            name="test", clock=self.clock, server_name="test_server"
         )
         with self.assertRaises(KeyError):
             cache.get("foo")
 
     def test_hit(self) -> None:
         cache: DeferredCache[str, int] = DeferredCache(
-            name="test", server_name="test_server"
+            name="test", clock=self.clock, server_name="test_server"
         )
         cache.prefill("foo", 123)
 
@@ -47,7 +52,7 @@ class DeferredCacheTestCase(TestCase):
 
     def test_hit_deferred(self) -> None:
         cache: DeferredCache[str, int] = DeferredCache(
-            name="test", server_name="test_server"
+            name="test", clock=self.clock, server_name="test_server"
         )
         origin_d: "defer.Deferred[int]" = defer.Deferred()
         set_d = cache.set("k1", origin_d)
@@ -72,7 +77,7 @@ class DeferredCacheTestCase(TestCase):
     def test_callbacks(self) -> None:
         """Invalidation callbacks are called at the right time"""
         cache: DeferredCache[str, int] = DeferredCache(
-            name="test", server_name="test_server"
+            name="test", clock=self.clock, server_name="test_server"
         )
         callbacks = set()
 
@@ -107,7 +112,7 @@ class DeferredCacheTestCase(TestCase):
 
     def test_set_fail(self) -> None:
         cache: DeferredCache[str, int] = DeferredCache(
-            name="test", server_name="test_server"
+            name="test", clock=self.clock, server_name="test_server"
         )
         callbacks = set()
 
@@ -146,7 +151,7 @@ class DeferredCacheTestCase(TestCase):
 
     def test_get_immediate(self) -> None:
         cache: DeferredCache[str, int] = DeferredCache(
-            name="test", server_name="test_server"
+            name="test", clock=self.clock, server_name="test_server"
         )
         d1: "defer.Deferred[int]" = defer.Deferred()
         cache.set("key1", d1)
@@ -163,8 +168,8 @@ class DeferredCacheTestCase(TestCase):
         self.assertEqual(v, 2)
 
     def test_invalidate(self) -> None:
-        cache: DeferredCache[Tuple[str], int] = DeferredCache(
-            name="test", server_name="test_server"
+        cache: DeferredCache[tuple[str], int] = DeferredCache(
+            name="test", clock=self.clock, server_name="test_server"
         )
         cache.prefill(("foo",), 123)
         cache.invalidate(("foo",))
@@ -174,7 +179,7 @@ class DeferredCacheTestCase(TestCase):
 
     def test_invalidate_all(self) -> None:
         cache: DeferredCache[str, str] = DeferredCache(
-            name="testcache", server_name="test_server"
+            name="testcache", clock=self.clock, server_name="test_server"
         )
 
         callback_record = [False, False]
@@ -220,6 +225,7 @@ class DeferredCacheTestCase(TestCase):
     def test_eviction(self) -> None:
         cache: DeferredCache[int, str] = DeferredCache(
             name="test",
+            clock=self.clock,
             server_name="test_server",
             max_entries=2,
             apply_cache_factor_from_config=False,
@@ -238,6 +244,7 @@ class DeferredCacheTestCase(TestCase):
     def test_eviction_lru(self) -> None:
         cache: DeferredCache[int, str] = DeferredCache(
             name="test",
+            clock=self.clock,
             server_name="test_server",
             max_entries=2,
             apply_cache_factor_from_config=False,
@@ -258,8 +265,9 @@ class DeferredCacheTestCase(TestCase):
         cache.get(3)
 
     def test_eviction_iterable(self) -> None:
-        cache: DeferredCache[int, List[str]] = DeferredCache(
+        cache: DeferredCache[int, list[str]] = DeferredCache(
             name="test",
+            clock=self.clock,
             server_name="test_server",
             max_entries=3,
             apply_cache_factor_from_config=False,
diff --git a/tests/util/caches/test_descriptors.py b/tests/util/caches/test_descriptors.py
index 7865a67709..3fab6c4c57 100644
--- a/tests/util/caches/test_descriptors.py
+++ b/tests/util/caches/test_descriptors.py
@@ -23,12 +23,8 @@ from typing import (
     Any,
     Generator,
     Iterable,
-    List,
     Mapping,
     NoReturn,
-    Optional,
-    Set,
-    Tuple,
     cast,
 )
 from unittest import mock
@@ -49,6 +45,7 @@ from synapse.util.caches import descriptors
 from synapse.util.caches.descriptors import _CacheContext, cached, cachedList
 
 from tests import unittest
+from tests.server import get_clock
 from tests.test_utils import get_awaitable_result
 
 logger = logging.getLogger(__name__)
@@ -56,7 +53,10 @@ logger = logging.getLogger(__name__)
 
 def run_on_reactor() -> "Deferred[int]":
     d: "Deferred[int]" = Deferred()
-    cast(IReactorTime, reactor).callLater(0, d.callback, 0)
+    # mypy ignored here because:
+    #   - this is part of the test infrastructure (outside of Synapse) so tracking
+    #     these calls for for homeserver shutdown doesn't make sense.
+    cast(IReactorTime, reactor).callLater(0, d.callback, 0)  # type: ignore[call-later-not-tracked]
     return make_deferred_yieldable(d)
 
 
@@ -67,6 +67,7 @@ class DescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int, arg2: int) -> str:
@@ -102,6 +103,7 @@ class DescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached(num_args=1)
             def fn(self, arg1: int, arg2: int) -> str:
@@ -148,6 +150,7 @@ class DescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
         obj = Cls()
         obj.mock.return_value = "fish"
@@ -179,6 +182,7 @@ class DescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int, kwarg1: int = 2) -> str:
@@ -214,6 +218,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def fn(self, arg1: int) -> NoReturn:
@@ -236,9 +241,10 @@ class DescriptorTestCase(unittest.TestCase):
         """The wrapped function returns a failure"""
 
         class Cls:
-            result: Optional[Deferred] = None
+            result: Deferred | None = None
             call_count = 0
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def fn(self, arg1: int) -> Deferred:
@@ -247,7 +253,7 @@ class DescriptorTestCase(unittest.TestCase):
                 return self.result
 
         obj = Cls()
-        callbacks: Set[str] = set()
+        callbacks: set[str] = set()
 
         # set off an asynchronous request
         origin_d: Deferred = Deferred()
@@ -293,6 +299,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int) -> "Deferred[int]":
@@ -306,7 +313,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         @defer.inlineCallbacks
         def do_lookup() -> Generator["Deferred[Any]", object, int]:
-            with LoggingContext("c1") as c1:
+            with LoggingContext(name="c1", server_name="test_server") as c1:
                 r = yield obj.fn(1)
                 self.assertEqual(current_context(), c1)
             return cast(int, r)
@@ -337,6 +344,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int) -> Deferred:
@@ -350,7 +358,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         @defer.inlineCallbacks
         def do_lookup() -> Generator["Deferred[object]", object, None]:
-            with LoggingContext("c1") as c1:
+            with LoggingContext(name="c1", server_name="test_server") as c1:
                 try:
                     d = obj.fn(1)
                     self.assertEqual(
@@ -381,6 +389,7 @@ class DescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int, arg2: int = 2, arg3: int = 3) -> str:
@@ -419,9 +428,10 @@ class DescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached(iterable=True)
-            def fn(self, arg1: int, arg2: int) -> Tuple[str, ...]:
+            def fn(self, arg1: int, arg2: int) -> tuple[str, ...]:
                 return self.mock(arg1, arg2)
 
         obj = Cls()
@@ -453,6 +463,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached(iterable=True)
             def fn(self, arg1: int) -> NoReturn:
@@ -476,6 +487,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached(cache_context=True)
             async def func1(self, key: str, cache_context: _CacheContext) -> int:
@@ -504,6 +516,7 @@ class DescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             async def fn(self, arg1: int) -> str:
@@ -537,6 +550,7 @@ class DescriptorTestCase(unittest.TestCase):
         class Cls:
             inner_context_was_finished = False
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             async def fn(self, arg1: int) -> str:
@@ -547,7 +561,7 @@ class DescriptorTestCase(unittest.TestCase):
         obj = Cls()
 
         async def do_lookup() -> None:
-            with LoggingContext("c1") as c1:
+            with LoggingContext(name="c1", server_name="test_server") as c1:
                 try:
                     await obj.fn(123)
                     self.fail("No CancelledError thrown")
@@ -583,6 +597,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
     def test_passthrough(self) -> Generator["Deferred[Any]", object, None]:
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def func(self, key: str) -> str:
@@ -599,6 +614,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
 
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def func(self, key: str) -> str:
@@ -619,6 +635,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
 
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def func(self, key: str) -> str:
@@ -639,6 +656,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
     def test_invalidate_missing(self) -> None:
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def func(self, key: str) -> str:
@@ -652,6 +670,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
 
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached(max_entries=10)
             def func(self, key: int) -> int:
@@ -681,6 +700,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
 
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def func(self, key: str) -> "Deferred[int]":
@@ -701,6 +721,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
 
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def func(self, key: str) -> str:
@@ -736,6 +757,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
 
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached(max_entries=2)
             def func(self, key: str) -> str:
@@ -775,6 +797,7 @@ class CacheDecoratorTestCase(unittest.HomeserverTestCase):
 
         class A:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def func(self, key: str) -> str:
@@ -824,6 +847,7 @@ class CachedListDescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int, arg2: int) -> None:
@@ -843,7 +867,7 @@ class CachedListDescriptorTestCase(unittest.TestCase):
                 assert context.name == "c1"
                 return self.mock(args1, arg2)
 
-        with LoggingContext("c1") as c1:
+        with LoggingContext(name="c1", server_name="test_server") as c1:
             obj = Cls()
             obj.mock.return_value = {10: "fish", 20: "chips"}
 
@@ -890,13 +914,14 @@ class CachedListDescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int) -> None:
                 pass
 
             @descriptors.cachedList(cached_method_name="fn", list_name="args1")
-            def list_fn(self, args1: List[int]) -> "Deferred[Mapping[int, str]]":
+            def list_fn(self, args1: list[int]) -> "Deferred[Mapping[int, str]]":
                 return self.mock(args1)
 
         obj = Cls()
@@ -934,13 +959,14 @@ class CachedListDescriptorTestCase(unittest.TestCase):
             def __init__(self) -> None:
                 self.mock = mock.Mock()
                 self.server_name = "test_server"
+                _, self.clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached()
             def fn(self, arg1: int, arg2: int) -> None:
                 pass
 
             @descriptors.cachedList(cached_method_name="fn", list_name="args1")
-            async def list_fn(self, args1: List[int], arg2: int) -> Mapping[int, str]:
+            async def list_fn(self, args1: list[int], arg2: int) -> Mapping[int, str]:
                 # we want this to behave like an asynchronous function
                 await run_on_reactor()
                 return self.mock(args1, arg2)
@@ -975,13 +1001,14 @@ class CachedListDescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def fn(self, arg1: int) -> None:
                 pass
 
             @cachedList(cached_method_name="fn", list_name="args")
-            async def list_fn(self, args: List[int]) -> Mapping[int, str]:
+            async def list_fn(self, args: list[int]) -> Mapping[int, str]:
                 await complete_lookup
                 return {arg: str(arg) for arg in args}
 
@@ -1011,13 +1038,14 @@ class CachedListDescriptorTestCase(unittest.TestCase):
         class Cls:
             inner_context_was_finished = False
             server_name = "test_server"  # nb must be called this for @cached
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @cached()
             def fn(self, arg1: int) -> None:
                 pass
 
             @cachedList(cached_method_name="fn", list_name="args")
-            async def list_fn(self, args: List[int]) -> Mapping[int, str]:
+            async def list_fn(self, args: list[int]) -> Mapping[int, str]:
                 await make_deferred_yieldable(complete_lookup)
                 self.inner_context_was_finished = current_context().finished
                 return {arg: str(arg) for arg in args}
@@ -1025,7 +1053,7 @@ class CachedListDescriptorTestCase(unittest.TestCase):
         obj = Cls()
 
         async def do_lookup() -> None:
-            with LoggingContext("c1") as c1:
+            with LoggingContext(name="c1", server_name="test_server") as c1:
                 try:
                     await obj.list_fn([123])
                     self.fail("No CancelledError thrown")
@@ -1055,6 +1083,7 @@ class CachedListDescriptorTestCase(unittest.TestCase):
 
         class Cls:
             server_name = "test_server"
+            _, clock = get_clock()  # nb must be called this for @cached
 
             @descriptors.cached(tree=True)
             def fn(self, room_id: str, event_id: str) -> None:
@@ -1064,7 +1093,7 @@ class CachedListDescriptorTestCase(unittest.TestCase):
             # of arguments as the underlying cached function, just with one of
             # the arguments being an iterable
             @descriptors.cachedList(cached_method_name="fn", list_name="keys")
-            def list_fn(self, keys: Iterable[Tuple[str, str]]) -> None:
+            def list_fn(self, keys: Iterable[tuple[str, str]]) -> None:
                 pass
 
             # Corrected syntax ✅
diff --git a/tests/util/caches/test_response_cache.py b/tests/util/caches/test_response_cache.py
index 30cd6ef0e4..af42769890 100644
--- a/tests/util/caches/test_response_cache.py
+++ b/tests/util/caches/test_response_cache.py
@@ -19,6 +19,7 @@
 #
 #
 
+from functools import wraps
 from unittest.mock import Mock
 
 from parameterized import parameterized
@@ -26,6 +27,8 @@ from parameterized import parameterized
 from twisted.internet import defer
 
 from synapse.util.caches.response_cache import ResponseCache, ResponseCacheContext
+from synapse.util.cancellation import cancellable
+from synapse.util.duration import Duration
 
 from tests.server import get_clock
 from tests.unittest import TestCase
@@ -47,15 +50,23 @@ class ResponseCacheTestCase(TestCase):
 
     def with_cache(self, name: str, ms: int = 0) -> ResponseCache:
         return ResponseCache(
-            clock=self.clock, name=name, server_name="test_server", timeout_ms=ms
+            clock=self.clock,
+            name=name,
+            server_name="test_server",
+            timeout=Duration(milliseconds=ms),
         )
 
     @staticmethod
     async def instant_return(o: str) -> str:
         return o
 
-    async def delayed_return(self, o: str) -> str:
-        await self.clock.sleep(1)
+    @cancellable
+    async def delayed_return(
+        self,
+        o: str,
+        duration: Duration = Duration(seconds=1),  # noqa
+    ) -> str:
+        await self.clock.sleep(duration)
         return o
 
     def test_cache_hit(self) -> None:
@@ -182,7 +193,7 @@ class ResponseCacheTestCase(TestCase):
         async def non_caching(o: str, cache_context: ResponseCacheContext[int]) -> str:
             nonlocal call_count
             call_count += 1
-            await self.clock.sleep(1)
+            await self.clock.sleep(Duration(seconds=1))
             cache_context.should_cache = should_cache
             return o
 
@@ -222,3 +233,332 @@ class ResponseCacheTestCase(TestCase):
             self.assertCountEqual(
                 [], cache.keys(), "cache should not have the result now"
             )
+
+    def test_cache_func_errors(self) -> None:
+        """If the callback raises an error, the error should be raised to all
+        callers and the result should not be cached"""
+        cache = self.with_cache("error_cache", ms=3000)
+
+        expected_error = Exception("oh no")
+
+        async def erring(o: str) -> str:
+            await self.clock.sleep(Duration(seconds=1))
+            raise expected_error
+
+        wrap_d = defer.ensureDeferred(cache.wrap(0, erring, "ignored"))
+        self.assertNoResult(wrap_d)
+
+        # a second call should also return a pending deferred
+        wrap2_d = defer.ensureDeferred(cache.wrap(0, erring, "ignored"))
+        self.assertNoResult(wrap2_d)
+
+        # let the call complete
+        self.reactor.advance(1)
+
+        # both results should have completed with the error
+        self.assertFailure(wrap_d, Exception)
+        self.assertFailure(wrap2_d, Exception)
+
+    def test_cache_cancel_first_wait(self) -> None:
+        """Test that cancellation of the deferred returned by wrap() on the
+        first call does not immediately cause a cancellation error to be raised
+        when its cancelled and the wrapped function continues execution (unless
+        it times out).
+        """
+        cache = self.with_cache("cancel_cache", ms=3000)
+
+        expected_result = "howdy"
+
+        wrap_d = defer.ensureDeferred(
+            cache.wrap(0, self.delayed_return, expected_result)
+        )
+
+        # cancel the deferred before it has a chance to return
+        wrap_d.cancel()
+
+        # The cancel should be ignored for now, and the inner function should
+        # still be running.
+        self.assertNoResult(wrap_d)
+
+        # Advance the clock until the inner function should have returned, but
+        # not long enough for the cache entry to have expired.
+        self.reactor.advance(2)
+
+        # The deferred we're waiting on should now return a cancelled error.
+        self.assertFailure(wrap_d, defer.CancelledError)
+
+        # However future callers should get the result.
+        wrap_d2 = defer.ensureDeferred(
+            cache.wrap(0, self.delayed_return, expected_result)
+        )
+        self.assertEqual(expected_result, self.successResultOf(wrap_d2))
+
+    def test_cache_cancel_first_wait_expire(self) -> None:
+        """Test that cancellation of the deferred returned by wrap() and the
+        entry expiring before the wrapped function returns.
+
+        The wrapped function should be cancelled.
+        """
+        cache = self.with_cache("cancel_expire_cache", ms=300)
+
+        expected_result = "howdy"
+
+        # Wrap the function so that we can keep track of when it completes or
+        # errors.
+        completed = False
+        cancelled = False
+
+        @wraps(self.delayed_return)
+        async def wrapped(o: str) -> str:
+            nonlocal completed, cancelled
+
+            try:
+                return await self.delayed_return(o)
+            except defer.CancelledError:
+                cancelled = True
+                raise
+            finally:
+                completed = True
+
+        wrap_d = defer.ensureDeferred(cache.wrap(0, wrapped, expected_result))
+
+        # cancel the deferred before it has a chance to return
+        wrap_d.cancel()
+
+        # The cancel should be ignored for now, and the inner function should
+        # still be running.
+        self.assertNoResult(wrap_d)
+        self.assertFalse(completed, "wrapped function should not have completed yet")
+
+        # Advance the clock until the cache entry should have expired, but not
+        # long enough for the inner function to have returned.
+        self.reactor.advance(0.7)
+
+        # The deferred we're waiting on should now return a cancelled error.
+        self.assertFailure(wrap_d, defer.CancelledError)
+        self.assertTrue(completed, "wrapped function should have completed")
+        self.assertTrue(cancelled, "wrapped function should have been cancelled")
+
+    def test_cache_cancel_first_wait_other_observers(self) -> None:
+        """Test that cancellation of the deferred returned by wrap() does not
+        cause a cancellation error to be raised if there are other observers
+        still waiting on the result.
+        """
+        cache = self.with_cache("cancel_other_cache", ms=300)
+
+        expected_result = "howdy"
+
+        # Wrap the function so that we can keep track of when it completes or
+        # errors.
+        completed = False
+        cancelled = False
+
+        @wraps(self.delayed_return)
+        async def wrapped(o: str) -> str:
+            nonlocal completed, cancelled
+
+            try:
+                return await self.delayed_return(o)
+            except defer.CancelledError:
+                cancelled = True
+                raise
+            finally:
+                completed = True
+
+        wrap_d1 = defer.ensureDeferred(cache.wrap(0, wrapped, expected_result))
+        wrap_d2 = defer.ensureDeferred(cache.wrap(0, wrapped, expected_result))
+
+        # cancel the first deferred before it has a chance to return
+        wrap_d1.cancel()
+
+        # The cancel should be ignored for now, and the inner function should
+        # still be running.
+        self.assertNoResult(wrap_d1)
+        self.assertNoResult(wrap_d2)
+        self.assertFalse(completed, "wrapped function should not have completed yet")
+
+        # Advance the clock until the cache entry should have expired, but not
+        # long enough for the inner function to have returned.
+        self.reactor.advance(0.7)
+
+        # Neither deferred should have returned yet, since the inner function
+        # should still be running.
+        self.assertNoResult(wrap_d1)
+        self.assertNoResult(wrap_d2)
+        self.assertFalse(completed, "wrapped function should not have completed yet")
+
+        # Now advance the clock until the inner function should have returned.
+        self.reactor.advance(2.5)
+
+        # The wrapped function should have completed without cancellation.
+        self.assertTrue(completed, "wrapped function should have completed")
+        self.assertFalse(cancelled, "wrapped function should not have been cancelled")
+
+        # The first deferred we're waiting on should now return a cancelled error.
+        self.assertFailure(wrap_d1, defer.CancelledError)
+
+        # The second deferred should return the result.
+        self.assertEqual(expected_result, self.successResultOf(wrap_d2))
+
+    def test_cache_add_and_cancel(self) -> None:
+        """Test that waiting on the cache and cancelling repeatedly keeps the
+        cache entry alive.
+        """
+        cache = self.with_cache("cancel_add_cache", ms=300)
+
+        expected_result = "howdy"
+
+        # Wrap the function so that we can keep track of when it completes or
+        # errors.
+        completed = False
+        cancelled = False
+
+        @wraps(self.delayed_return)
+        async def wrapped(o: str) -> str:
+            nonlocal completed, cancelled
+
+            try:
+                return await self.delayed_return(o)
+            except defer.CancelledError:
+                cancelled = True
+                raise
+            finally:
+                completed = True
+
+        # Repeatedly await for the result and cancel it, which should keep the
+        # cache entry alive even though the total time exceeds the cache
+        # timeout.
+        deferreds = []
+        for _ in range(8):
+            # Await the deferred.
+            wrap_d = defer.ensureDeferred(cache.wrap(0, wrapped, expected_result))
+
+            # cancel the deferred before it has a chance to return
+            self.reactor.advance(0.05)
+            wrap_d.cancel()
+            deferreds.append(wrap_d)
+
+            # The cancel should not cause the inner function to be cancelled
+            # yet.
+            self.assertFalse(
+                completed, "wrapped function should not have completed yet"
+            )
+            self.assertFalse(
+                cancelled, "wrapped function should not have been cancelled yet"
+            )
+
+            # Advance the clock until the cache entry should have expired, but not
+            # long enough for the inner function to have returned.
+            self.reactor.advance(0.05)
+
+        # Now advance the clock until the inner function should have returned.
+        self.reactor.advance(0.2)
+
+        # All the deferreds we're waiting on should now return a cancelled error.
+        for wrap_d in deferreds:
+            self.assertFailure(wrap_d, defer.CancelledError)
+
+        # The wrapped function should have completed without cancellation.
+        self.assertTrue(completed, "wrapped function should have completed")
+        self.assertFalse(cancelled, "wrapped function should not have been cancelled")
+
+        # Querying the cache should return the completed result
+        wrap_d = defer.ensureDeferred(cache.wrap(0, wrapped, expected_result))
+        self.assertEqual(expected_result, self.successResultOf(wrap_d))
+
+    def test_cache_cancel_non_cancellable(self) -> None:
+        """Test that cancellation of the deferred returned by wrap() on a
+        non-cancellable entry does not cause a cancellation error to be raised
+        when it's cancelled and the wrapped function continues execution.
+        """
+        cache = self.with_cache("cancel_non_cancellable_cache", ms=300)
+
+        expected_result = "howdy"
+
+        # Wrap the function so that we can keep track of when it completes or
+        # errors.
+        completed = False
+        cancelled = False
+
+        async def wrapped(o: str) -> str:
+            nonlocal completed, cancelled
+
+            try:
+                return await self.delayed_return(o)
+            except defer.CancelledError:
+                cancelled = True
+                raise
+            finally:
+                completed = True
+
+        wrap_d = defer.ensureDeferred(cache.wrap(0, wrapped, expected_result))
+
+        # cancel the deferred before it has a chance to return
+        wrap_d.cancel()
+
+        # The cancel should be ignored for now, and the inner function should
+        # still be running.
+        self.assertNoResult(wrap_d)
+        self.assertFalse(completed, "wrapped function should not have completed yet")
+
+        # Advance the clock until the inner function should have returned, but
+        # not long enough for the cache entry to have expired.
+        self.reactor.advance(2)
+
+        # The deferred we're waiting on should be cancelled, but a new call to
+        # the cache should return the result.
+        self.assertFailure(wrap_d, defer.CancelledError)
+        wrap_d2 = defer.ensureDeferred(cache.wrap(0, wrapped, expected_result))
+        self.assertEqual(expected_result, self.successResultOf(wrap_d2))
+
+    def test_cache_cancel_then_error(self) -> None:
+        """Test that cancellation of the deferred returned by wrap() that then
+        subsequently errors is correctly propagated to a second caller.
+        """
+
+        cache = self.with_cache("cancel_then_error_cache", ms=3000)
+
+        expected_error = Exception("oh no")
+
+        # Wrap the function so that we can keep track of when it completes or
+        # errors.
+        completed = False
+        cancelled = False
+
+        @wraps(self.delayed_return)
+        async def wrapped(o: str) -> str:
+            nonlocal completed, cancelled
+
+            try:
+                await self.delayed_return(o)
+                raise expected_error
+            except defer.CancelledError:
+                cancelled = True
+                raise
+            finally:
+                completed = True
+
+        wrap_d1 = defer.ensureDeferred(cache.wrap(0, wrapped, "ignored"))
+        wrap_d2 = defer.ensureDeferred(cache.wrap(0, wrapped, "ignored"))
+
+        # cancel the first deferred before it has a chance to return
+        wrap_d1.cancel()
+
+        # The cancel should be ignored for now, and the inner function should
+        # still be running.
+        self.assertNoResult(wrap_d1)
+        self.assertNoResult(wrap_d2)
+        self.assertFalse(completed, "wrapped function should not have completed yet")
+
+        # Advance the clock until the inner function should have returned.
+        self.reactor.advance(2)
+
+        # The wrapped function should have completed with an error without cancellation.
+        self.assertTrue(completed, "wrapped function should have completed")
+        self.assertFalse(cancelled, "wrapped function should not have been cancelled")
+
+        # The first deferred we're waiting on should now return a cancelled error.
+        self.assertFailure(wrap_d1, defer.CancelledError)
+
+        # The second deferred should return the error.
+        self.assertFailure(wrap_d2, Exception)
diff --git a/tests/util/test_async_helpers.py b/tests/util/test_async_helpers.py
index cfd2882410..e4b1bb2b23 100644
--- a/tests/util/test_async_helpers.py
+++ b/tests/util/test_async_helpers.py
@@ -17,14 +17,14 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
+import logging
 import traceback
-from typing import Any, Coroutine, Generator, List, NoReturn, Optional, Tuple, TypeVar
+from typing import Any, Coroutine, NoReturn, TypeVar
 
 from parameterized import parameterized_class
 
 from twisted.internet import defer
 from twisted.internet.defer import CancelledError, Deferred, ensureDeferred
-from twisted.internet.task import Clock
 from twisted.python.failure import Failure
 
 from synapse.logging.context import (
@@ -45,7 +45,9 @@ from synapse.util.async_helpers import (
 )
 
 from tests.server import get_clock
-from tests.unittest import TestCase
+from tests.unittest import TestCase, logcontext_clean
+
+logger = logging.getLogger(__name__)
 
 T = TypeVar("T")
 
@@ -69,7 +71,7 @@ class ObservableDeferredTest(TestCase):
         observer1.addBoth(check_called_first)
 
         # store the results
-        results: List[Optional[int]] = [None, None]
+        results: list[int | None] = [None, None]
 
         def check_val(res: int, idx: int) -> int:
             results[idx] = res
@@ -100,7 +102,7 @@ class ObservableDeferredTest(TestCase):
         observer1.addBoth(check_called_first)
 
         # store the results
-        results: List[Optional[Failure]] = [None, None]
+        results: list[Failure | None] = [None, None]
 
         def check_failure(res: Failure, idx: int) -> None:
             results[idx] = res
@@ -118,7 +120,7 @@ class ObservableDeferredTest(TestCase):
         assert results[1] is not None
         self.assertEqual(str(results[1].value), "gah!", "observer 2 errback result")
 
-    def test_cancellation(self) -> None:
+    def test_cancellation_observer(self) -> None:
         """Test that cancelling an observer does not affect other observers."""
         origin_d: "Deferred[int]" = Deferred()
         observable = ObservableDeferred(origin_d, consumeErrors=True)
@@ -136,6 +138,10 @@ class ObservableDeferredTest(TestCase):
         self.assertFalse(observer1.called)
         self.failureResultOf(observer2, CancelledError)
         self.assertFalse(observer3.called)
+        # check that we remove the cancelled observer from the list of observers
+        # as a clean up.
+        self.assertEqual(len(observable.observers()), 2)
+        self.assertNotIn(observer2, observable.observers())
 
         # other observers resolve as normal
         origin_d.callback(123)
@@ -146,10 +152,26 @@ class ObservableDeferredTest(TestCase):
         observer4 = observable.observe()
         self.assertEqual(observer4.result, 123, "observer 4 callback result")
 
+    def test_cancellation_observee(self) -> None:
+        """Test that cancelling the original deferred cancels all observers."""
+        origin_d: "Deferred[int]" = Deferred()
+        observable = ObservableDeferred(origin_d, consumeErrors=True)
+
+        observer1 = observable.observe()
+        observer2 = observable.observe()
+
+        self.assertFalse(observer1.called)
+        self.assertFalse(observer2.called)
+
+        # cancel the original deferred
+        origin_d.cancel()
+        self.failureResultOf(observer1, CancelledError)
+        self.failureResultOf(observer2, CancelledError)
+
 
 class TimeoutDeferredTest(TestCase):
     def setUp(self) -> None:
-        self.clock = Clock()
+        self.reactor, self.clock = get_clock()
 
     def test_times_out(self) -> None:
         """Basic test case that checks that the original deferred is cancelled and that
@@ -162,12 +184,16 @@ class TimeoutDeferredTest(TestCase):
             cancelled = True
 
         non_completing_d: Deferred = Deferred(canceller)
-        timing_out_d = timeout_deferred(non_completing_d, 1.0, self.clock)
+        timing_out_d = timeout_deferred(
+            deferred=non_completing_d,
+            timeout=1.0,
+            clock=self.clock,
+        )
 
         self.assertNoResult(timing_out_d)
         self.assertFalse(cancelled, "deferred was cancelled prematurely")
 
-        self.clock.pump((1.0,))
+        self.reactor.pump((1.0,))
 
         self.assertTrue(cancelled, "deferred was not cancelled by timeout")
         self.failureResultOf(timing_out_d, defer.TimeoutError)
@@ -180,57 +206,156 @@ class TimeoutDeferredTest(TestCase):
             raise Exception("can't cancel this deferred")
 
         non_completing_d: Deferred = Deferred(canceller)
-        timing_out_d = timeout_deferred(non_completing_d, 1.0, self.clock)
+        timing_out_d = timeout_deferred(
+            deferred=non_completing_d,
+            timeout=1.0,
+            clock=self.clock,
+        )
 
         self.assertNoResult(timing_out_d)
 
-        self.clock.pump((1.0,))
+        self.reactor.pump((1.0,))
 
         self.failureResultOf(timing_out_d, defer.TimeoutError)
 
-    def test_logcontext_is_preserved_on_cancellation(self) -> None:
-        blocking_was_cancelled = False
+    @logcontext_clean
+    async def test_logcontext_is_preserved_on_timeout_cancellation(self) -> None:
+        """
+        Test that the logcontext is preserved when we timeout and the deferred is
+        cancelled.
+        """
+        # Sanity check that we start in the sentinel context
+        self.assertEqual(current_context(), SENTINEL_CONTEXT)
 
-        @defer.inlineCallbacks
-        def blocking() -> Generator["Deferred[object]", object, None]:
-            nonlocal blocking_was_cancelled
+        incomplete_deferred_was_cancelled = False
 
-            non_completing_d: Deferred = Deferred()
-            with PreserveLoggingContext():
-                try:
-                    yield non_completing_d
-                except CancelledError:
-                    blocking_was_cancelled = True
-                    raise
+        def mark_was_cancelled(res: Failure) -> None:
+            """
+            A passthrough errback which sets `incomplete_deferred_was_cancelled`.
 
-        with LoggingContext("one") as context_one:
-            # the errbacks should be run in the test logcontext
-            def errback(res: Failure, deferred_name: str) -> Failure:
-                self.assertIs(
-                    current_context(),
-                    context_one,
-                    "errback %s run in unexpected logcontext %s"
-                    % (deferred_name, current_context()),
+            This means we re-raise any exception and allows further errbacks (in
+            `timeout_deferred(...)`) to do their thing. Just trying to be a transparent
+            proxy of any exception while doing our internal test book-keeping.
+            """
+            nonlocal incomplete_deferred_was_cancelled
+            if res.check(CancelledError):
+                incomplete_deferred_was_cancelled = True
+            else:
+                logger.error(
+                    "Expected incomplete_d to fail with `CancelledError` because our "
+                    "`timeout_deferred(...)` utility canceled it but saw %s",
+                    res,
                 )
-                return res
 
-            original_deferred = blocking()
-            original_deferred.addErrback(errback, "orig")
-            timing_out_d = timeout_deferred(original_deferred, 1.0, self.clock)
-            self.assertNoResult(timing_out_d)
-            self.assertIs(current_context(), SENTINEL_CONTEXT)
-            timing_out_d.addErrback(errback, "timingout")
+            # Re-raise the exception so that any further errbacks can do their thing as
+            # normal
+            res.raiseException()
 
-            self.clock.pump((1.0,))
+        # Create a deferred which we will never complete
+        incomplete_d: Deferred = Deferred()
+        incomplete_d.addErrback(mark_was_cancelled)
 
-            self.assertTrue(
-                blocking_was_cancelled, "non-completing deferred was not cancelled"
+        with LoggingContext(name="one", server_name="test_server") as context_one:
+            timing_out_d = timeout_deferred(
+                deferred=incomplete_d,
+                timeout=1.0,
+                clock=self.clock,
             )
-            self.failureResultOf(timing_out_d, defer.TimeoutError)
+            self.assertNoResult(timing_out_d)
+            # We should still be in the logcontext we started in
             self.assertIs(current_context(), context_one)
 
+            # Pump the reactor until we trigger the timeout
+            #
+            # We're manually pumping the reactor (and causing any pending callbacks to
+            # be called) so we need to be in the sentinel logcontext to avoid leaking
+            # our current logcontext into the reactor (which would then get picked up
+            # and associated with the next thing the reactor does). `with
+            # PreserveLoggingContext()` will reset the logcontext to the sentinel while
+            # we're pumping the reactor in the block and return us back to our current
+            # logcontext after the block.
+            with PreserveLoggingContext():
+                self.reactor.pump(
+                    # We only need to pump `1.0` (seconds) as we set
+                    # `timeout_deferred(timeout=1.0)` above
+                    (1.0,)
+                )
 
-class _TestException(Exception):
+            # We expect the incomplete deferred to have been cancelled because of the
+            # timeout by this point
+            self.assertTrue(
+                incomplete_deferred_was_cancelled,
+                "incomplete deferred was not cancelled",
+            )
+            # We should see the `TimeoutError` (instead of a `CancelledError`)
+            self.failureResultOf(timing_out_d, defer.TimeoutError)
+            # We're still in the same logcontext
+            self.assertIs(current_context(), context_one)
+
+        # Back to the sentinel context
+        self.assertEqual(current_context(), SENTINEL_CONTEXT)
+
+    @logcontext_clean
+    async def test_logcontext_is_not_lost_when_awaiting_on_timeout_cancellation(
+        self,
+    ) -> None:
+        """
+        Test that the logcontext isn't lost when we `await make_deferred_yieldable(...)`
+        the deferred to complete/timeout and it times out.
+        """
+
+        # Sanity check that we start in the sentinel context
+        self.assertEqual(current_context(), SENTINEL_CONTEXT)
+
+        # Create a deferred which we will never complete
+        incomplete_d: Deferred = Deferred()
+
+        async def competing_task() -> None:
+            with LoggingContext(
+                name="competing", server_name="test_server"
+            ) as context_competing:
+                timing_out_d = timeout_deferred(
+                    deferred=incomplete_d,
+                    timeout=1.0,
+                    clock=self.clock,
+                )
+                self.assertNoResult(timing_out_d)
+                # We should still be in the logcontext we started in
+                self.assertIs(current_context(), context_competing)
+
+                # Mimic the normal use case to wait for the work to complete or timeout.
+                #
+                # In this specific test, we expect the deferred to timeout and raise an
+                # exception at this point.
+                await make_deferred_yieldable(timing_out_d)
+
+                self.fail(
+                    "We should not make it to this point as the `timing_out_d` should have been cancelled"
+                )
+
+        d = defer.ensureDeferred(competing_task())
+
+        # Still in the sentinel context
+        self.assertEqual(current_context(), SENTINEL_CONTEXT)
+
+        # Pump until we trigger the timeout
+        self.reactor.pump(
+            # We only need to pump `1.0` (seconds) as we set
+            # `timeout_deferred(timeout=1.0)` above
+            (1.0,)
+        )
+
+        # Still in the sentinel context
+        self.assertEqual(current_context(), SENTINEL_CONTEXT)
+
+        # We expect a failure due to the timeout
+        self.failureResultOf(d, defer.TimeoutError)
+
+        # Back to the sentinel context at the end of the day
+        self.assertEqual(current_context(), SENTINEL_CONTEXT)
+
+
+class _TestException(Exception):  #
     pass
 
 
@@ -502,7 +627,7 @@ class DelayCancellationTests(TestCase):
             await make_deferred_yieldable(blocking_d)
 
         async def outer() -> None:
-            with LoggingContext("c") as c:
+            with LoggingContext(name="c", server_name="test_server") as c:
                 try:
                     await delay_cancellation(inner())
                     self.fail("`CancelledError` was not raised")
@@ -526,8 +651,8 @@ class AwakenableSleeperTests(TestCase):
     "Tests AwakenableSleeper"
 
     def test_sleep(self) -> None:
-        reactor, _ = get_clock()
-        sleeper = AwakenableSleeper(reactor)
+        reactor, clock = get_clock()
+        sleeper = AwakenableSleeper(clock)
 
         d = defer.ensureDeferred(sleeper.sleep("name", 1000))
 
@@ -541,8 +666,8 @@ class AwakenableSleeperTests(TestCase):
         self.assertTrue(d.called)
 
     def test_explicit_wake(self) -> None:
-        reactor, _ = get_clock()
-        sleeper = AwakenableSleeper(reactor)
+        reactor, clock = get_clock()
+        sleeper = AwakenableSleeper(clock)
 
         d = defer.ensureDeferred(sleeper.sleep("name", 1000))
 
@@ -558,8 +683,8 @@ class AwakenableSleeperTests(TestCase):
         reactor.advance(0.6)
 
     def test_multiple_sleepers_timeout(self) -> None:
-        reactor, _ = get_clock()
-        sleeper = AwakenableSleeper(reactor)
+        reactor, clock = get_clock()
+        sleeper = AwakenableSleeper(clock)
 
         d1 = defer.ensureDeferred(sleeper.sleep("name", 1000))
 
@@ -578,8 +703,8 @@ class AwakenableSleeperTests(TestCase):
         self.assertTrue(d2.called)
 
     def test_multiple_sleepers_wake(self) -> None:
-        reactor, _ = get_clock()
-        sleeper = AwakenableSleeper(reactor)
+        reactor, clock = get_clock()
+        sleeper = AwakenableSleeper(clock)
 
         d1 = defer.ensureDeferred(sleeper.sleep("name", 1000))
 
@@ -603,7 +728,7 @@ class AwakenableSleeperTests(TestCase):
 class GatherCoroutineTests(TestCase):
     """Tests for `gather_optional_coroutines`"""
 
-    def make_coroutine(self) -> Tuple[Coroutine[Any, Any, T], "defer.Deferred[T]"]:
+    def make_coroutine(self) -> tuple[Coroutine[Any, Any, T], "defer.Deferred[T]"]:
         """Returns a coroutine and a deferred that it is waiting on to resolve"""
 
         d: "defer.Deferred[T]" = defer.Deferred()
@@ -617,7 +742,7 @@ class GatherCoroutineTests(TestCase):
     def test_single(self) -> None:
         "Test passing in a single coroutine works"
 
-        with LoggingContext("test_ctx") as text_ctx:
+        with LoggingContext(name="test_ctx", server_name="test_server") as text_ctx:
             deferred: "defer.Deferred[None]"
             coroutine, deferred = self.make_coroutine()
 
@@ -643,7 +768,7 @@ class GatherCoroutineTests(TestCase):
     def test_multiple_resolve(self) -> None:
         "Test passing in multiple coroutine that all resolve works"
 
-        with LoggingContext("test_ctx") as test_ctx:
+        with LoggingContext(name="test_ctx", server_name="test_server") as test_ctx:
             deferred1: "defer.Deferred[int]"
             coroutine1, deferred1 = self.make_coroutine()
             deferred2: "defer.Deferred[str]"
@@ -676,7 +801,7 @@ class GatherCoroutineTests(TestCase):
     def test_multiple_fail(self) -> None:
         "Test passing in multiple coroutine where one fails does the right thing"
 
-        with LoggingContext("test_ctx") as test_ctx:
+        with LoggingContext(name="test_ctx", server_name="test_server") as test_ctx:
             deferred1: "defer.Deferred[int]"
             coroutine1, deferred1 = self.make_coroutine()
             deferred2: "defer.Deferred[str]"
diff --git a/tests/util/test_background_queue.py b/tests/util/test_background_queue.py
new file mode 100644
index 0000000000..901b014845
--- /dev/null
+++ b/tests/util/test_background_queue.py
@@ -0,0 +1,117 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 Element Creations Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+
+
+from unittest.mock import Mock
+
+from twisted.internet.defer import Deferred
+from twisted.internet.testing import MemoryReactor
+
+from synapse.logging.context import PreserveLoggingContext, make_deferred_yieldable
+from synapse.server import HomeServer
+from synapse.util.background_queue import BackgroundQueue
+from synapse.util.clock import Clock
+
+from tests.unittest import HomeserverTestCase, logcontext_clean
+
+
+class BackgroundQueueTests(HomeserverTestCase):
+    def prepare(
+        self, reactor: MemoryReactor, clock: Clock, homeserver: HomeServer
+    ) -> None:
+        self._process_item_mock = Mock(spec_set=[])
+
+        self.queue = BackgroundQueue[int](
+            hs=homeserver,
+            name="test_queue",
+            callback=self._process_item_mock,
+            timeout_ms=1000,
+        )
+
+    @logcontext_clean
+    def test_simple_call(self) -> None:
+        """Test that items added to the queue are processed."""
+        # Register a deferred to be the return value of the callback.
+        callback_result_deferred: Deferred[None] = Deferred()
+        self._process_item_mock.side_effect = lambda _: make_deferred_yieldable(
+            callback_result_deferred
+        )
+
+        # Adding an item should cause the callback to be invoked.
+        self.queue.add(1)
+
+        self._process_item_mock.assert_called_once_with(1)
+        self._process_item_mock.reset_mock()
+
+        # Adding another item should not cause the callback to be invoked again
+        # until the previous one has completed.
+        self.queue.add(2)
+        self._process_item_mock.assert_not_called()
+
+        # Once the first callback completes, the second item should be
+        # processed.
+        with PreserveLoggingContext():
+            callback_result_deferred.callback(None)
+        self._process_item_mock.assert_called_once_with(2)
+
+    @logcontext_clean
+    def test_timeout(self) -> None:
+        """Test that the background process wakes up if its idle, and that it
+        times out after being idle."""
+
+        # Register a deferred to be the return value of the callback.
+        callback_result_deferred: Deferred[None] = Deferred()
+        self._process_item_mock.side_effect = lambda _: make_deferred_yieldable(
+            callback_result_deferred
+        )
+
+        # Adding an item should cause the callback to be invoked.
+        self.queue.add(1)
+
+        self._process_item_mock.assert_called_once_with(1)
+        self._process_item_mock.reset_mock()
+
+        # Let the callback complete.
+        with PreserveLoggingContext():
+            callback_result_deferred.callback(None)
+
+        # Advance the clock by less than the timeout, and add another item.
+        self.reactor.advance(0.5)
+        self.assertIsNotNone(self.queue._wakeup_event)
+        self.queue.add(2)
+
+        # The callback should be invoked again.
+        callback_result_deferred = Deferred()
+        self._process_item_mock.side_effect = lambda _: make_deferred_yieldable(
+            callback_result_deferred
+        )
+        self._process_item_mock.assert_called_once_with(2)
+        self._process_item_mock.reset_mock()
+
+        # Let the callback complete.
+        with PreserveLoggingContext():
+            callback_result_deferred.callback(None)
+
+        # Advance the clock by more than the timeout.
+        self.reactor.advance(1.5)
+
+        # The background process should have exited, we check this by checking
+        # the internal wakeup event has been removed.
+        self.assertIsNone(self.queue._wakeup_event)
+
+        # Add another item. This should cause a new background process to be
+        # started.
+        self.queue.add(3)
+
+        self._process_item_mock.assert_called_once_with(3)
diff --git a/tests/util/test_batching_queue.py b/tests/util/test_batching_queue.py
index 532582cf87..30b07dc6ad 100644
--- a/tests/util/test_batching_queue.py
+++ b/tests/util/test_batching_queue.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Tuple
 
 from prometheus_client import Gauge
 
@@ -32,13 +31,12 @@ from synapse.util.batching_queue import (
     number_queued,
 )
 
-from tests.server import get_clock
-from tests.unittest import TestCase
+from tests.unittest import HomeserverTestCase
 
 
-class BatchingQueueTestCase(TestCase):
+class BatchingQueueTestCase(HomeserverTestCase):
     def setUp(self) -> None:
-        self.clock, hs_clock = get_clock()
+        super().setUp()
 
         # We ensure that we remove any existing metrics for "test_queue".
         try:
@@ -48,15 +46,15 @@ class BatchingQueueTestCase(TestCase):
         except KeyError:
             pass
 
-        self._pending_calls: List[Tuple[List[str], defer.Deferred]] = []
+        self._pending_calls: list[tuple[list[str], defer.Deferred]] = []
         self.queue: BatchingQueue[str, str] = BatchingQueue(
             name="test_queue",
-            server_name="test_server",
-            clock=hs_clock,
+            hs=self.hs,
+            clock=self.clock,
             process_batch_callback=self._process_queue,
         )
 
-    async def _process_queue(self, values: List[str]) -> str:
+    async def _process_queue(self, values: list[str]) -> str:
         d: "defer.Deferred[str]" = defer.Deferred()
         self._pending_calls.append((values, d))
         return await make_deferred_yieldable(d)
@@ -108,7 +106,7 @@ class BatchingQueueTestCase(TestCase):
         self.assertFalse(queue_d.called)
 
         # We should see a call to `_process_queue` after a reactor tick.
-        self.clock.pump([0])
+        self.reactor.pump([0])
 
         self.assertEqual(len(self._pending_calls), 1)
         self.assertEqual(self._pending_calls[0][0], ["foo"])
@@ -134,7 +132,7 @@ class BatchingQueueTestCase(TestCase):
 
         self._assert_metrics(queued=2, keys=1, in_flight=2)
 
-        self.clock.pump([0])
+        self.reactor.pump([0])
 
         # We should see only *one* call to `_process_queue`
         self.assertEqual(len(self._pending_calls), 1)
@@ -158,7 +156,7 @@ class BatchingQueueTestCase(TestCase):
         self.assertFalse(self._pending_calls)
 
         queue_d1 = defer.ensureDeferred(self.queue.add_to_queue("foo1"))
-        self.clock.pump([0])
+        self.reactor.pump([0])
 
         self.assertEqual(len(self._pending_calls), 1)
 
@@ -185,7 +183,7 @@ class BatchingQueueTestCase(TestCase):
         self._assert_metrics(queued=2, keys=1, in_flight=2)
 
         # We should now see a second call to `_process_queue`
-        self.clock.pump([0])
+        self.reactor.pump([0])
         self.assertEqual(len(self._pending_calls), 1)
         self.assertEqual(self._pending_calls[0][0], ["foo2", "foo3"])
         self.assertFalse(queue_d2.called)
@@ -206,9 +204,9 @@ class BatchingQueueTestCase(TestCase):
         self.assertFalse(self._pending_calls)
 
         queue_d1 = defer.ensureDeferred(self.queue.add_to_queue("foo1", key=1))
-        self.clock.pump([0])
+        self.reactor.pump([0])
         queue_d2 = defer.ensureDeferred(self.queue.add_to_queue("foo2", key=2))
-        self.clock.pump([0])
+        self.reactor.pump([0])
 
         # We queue up another item with key=2 to check that we will keep taking
         # things off the queue.
@@ -240,7 +238,7 @@ class BatchingQueueTestCase(TestCase):
         self.assertFalse(queue_d3.called)
 
         # We should now see a call `_pending_calls` for `foo3`
-        self.clock.pump([0])
+        self.reactor.pump([0])
         self.assertEqual(len(self._pending_calls), 1)
         self.assertEqual(self._pending_calls[0][0], ["foo3"])
         self.assertFalse(queue_d3.called)
diff --git a/tests/util/test_check_dependencies.py b/tests/util/test_check_dependencies.py
index c052ba2b75..eed0519c44 100644
--- a/tests/util/test_check_dependencies.py
+++ b/tests/util/test_check_dependencies.py
@@ -22,9 +22,11 @@
 from contextlib import contextmanager
 from os import PathLike
 from pathlib import Path
-from typing import Generator, Optional, Union
+from typing import Generator, cast
 from unittest.mock import patch
 
+from packaging.markers import default_environment as packaging_default_environment
+
 from synapse.util.check_dependencies import (
     DependencyException,
     check_requirements,
@@ -42,7 +44,7 @@ class DummyDistribution(metadata.Distribution):
     def version(self) -> str:
         return self._version
 
-    def locate_file(self, path: Union[str, PathLike]) -> Path:
+    def locate_file(self, path: str | PathLike) -> Path:
         raise NotImplementedError()
 
     def read_text(self, filename: str) -> None:
@@ -61,7 +63,7 @@ distribution_with_no_version = DummyDistribution(None)  # type: ignore[arg-type]
 class TestDependencyChecker(TestCase):
     @contextmanager
     def mock_installed_package(
-        self, distribution: Optional[DummyDistribution]
+        self, distribution: DummyDistribution | None
     ) -> Generator[None, None, None]:
         """Pretend that looking up any package yields the given `distribution`.
 
@@ -80,6 +82,22 @@ class TestDependencyChecker(TestCase):
         ):
             yield
 
+    @contextmanager
+    def mock_python_version(self, version: str) -> Generator[None, None, None]:
+        """Override the marker environment to report the supplied `python_version`."""
+
+        def fake_default_environment() -> dict[str, str]:
+            env = cast(dict[str, str], dict(packaging_default_environment()))
+            env["python_version"] = version
+            env["python_full_version"] = f"{version}.0"
+            return env
+
+        with patch(
+            "synapse.util.check_dependencies.default_environment",
+            side_effect=fake_default_environment,
+        ):
+            yield
+
     def test_mandatory_dependency(self) -> None:
         """Complain if a required package is missing or old."""
         with patch(
@@ -183,11 +201,43 @@ class TestDependencyChecker(TestCase):
         """
         with patch(
             "synapse.util.check_dependencies.metadata.requires",
-            return_value=["setuptools_rust >= 1.3"],
+            return_value=["setuptools-rust >= 1.3"],
         ):
             with self.mock_installed_package(None):
-                # should not raise, even if setuptools_rust is not installed
+                # should not raise, even if setuptools-rust is not installed
                 check_requirements()
             with self.mock_installed_package(old):
-                # We also ignore old versions of setuptools_rust
+                # We also ignore old versions of setuptools-rust
                 check_requirements()
+
+    def test_python_version_markers_respected(self) -> None:
+        """
+        Tests that python_version markers are properly respected.
+
+        Specifically that older versions of dependencies can be installed in
+        environments with older Python versions.
+        """
+        requirements = [
+            "pydantic ~= 2.8; python_version < '3.14'",
+            "pydantic ~= 2.12; python_version >= '3.14'",
+        ]
+
+        with patch(
+            "synapse.util.check_dependencies.metadata.requires",
+            return_value=requirements,
+        ):
+            with self.mock_python_version("3.9"):
+                with self.mock_installed_package(DummyDistribution("2.12.3")):
+                    check_requirements()
+                with self.mock_installed_package(DummyDistribution("2.8.1")):
+                    check_requirements()
+                with self.mock_installed_package(DummyDistribution("2.7.0")):
+                    self.assertRaises(DependencyException, check_requirements)
+
+            with self.mock_python_version("3.14"):
+                with self.mock_installed_package(DummyDistribution("2.12.3")):
+                    check_requirements()
+                with self.mock_installed_package(DummyDistribution("2.8.1")):
+                    self.assertRaises(DependencyException, check_requirements)
+                with self.mock_installed_package(DummyDistribution("2.7.0")):
+                    self.assertRaises(DependencyException, check_requirements)
diff --git a/tests/util/test_clock.py b/tests/util/test_clock.py
new file mode 100644
index 0000000000..6c5a1158f5
--- /dev/null
+++ b/tests/util/test_clock.py
@@ -0,0 +1,77 @@
+#
+# This file is licensed under the Affero General Public License (AGPL) version 3.
+#
+# Copyright (C) 2025 Element Creations Ltd
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# See the GNU Affero General Public License for more details:
+# <https://www.gnu.org/licenses/agpl-3.0.html>.
+#
+#
+
+import weakref
+
+from synapse.util.duration import Duration
+
+from tests.unittest import HomeserverTestCase
+
+
+class ClockTestCase(HomeserverTestCase):
+    def test_looping_calls_are_gced(self) -> None:
+        """Test that looping calls are garbage collected after being stopped.
+
+        The `Clock` tracks looping calls so to allow stopping of all looping
+        calls via the clock.
+        """
+        clock = self.hs.get_clock()
+
+        # Create a new looping call, and take a weakref to it.
+        call = clock.looping_call(lambda: None, Duration(seconds=1))
+
+        weak_call = weakref.ref(call)
+
+        # Stop the looping call. It should get garbage collected after this.
+        call.stop()
+
+        # Delete our strong reference to the call (otherwise it won't get garbage collected).
+        del call
+
+        # Check that the call has been garbage collected.
+        self.assertIsNone(weak_call())
+
+    def test_looping_calls_stopped_on_clock_shutdown(self) -> None:
+        """Test that looping calls are stopped when the clock is shut down."""
+        clock = self.hs.get_clock()
+
+        was_called = False
+
+        def on_call() -> None:
+            nonlocal was_called
+            was_called = True
+
+        # Create a new looping call.
+        call = clock.looping_call(on_call, Duration(seconds=1))
+        weak_call = weakref.ref(call)
+        del call  # Remove our strong reference to the call.
+
+        # The call should still exist.
+        self.assertIsNotNone(weak_call())
+
+        # Advance the clock to trigger the call.
+        self.reactor.advance(2)
+        self.assertTrue(was_called)
+
+        # Shut down the clock, which should stop the looping call.
+        clock.shutdown()
+
+        # The call should have been garbage collected.
+        self.assertIsNone(weak_call())
+
+        # Advance the clock again; the call should not be called again.
+        was_called = False
+        self.reactor.advance(2)
+        self.assertFalse(was_called)
diff --git a/tests/util/test_dict_cache.py b/tests/util/test_dict_cache.py
index 246e18fd15..16e096a4b2 100644
--- a/tests/util/test_dict_cache.py
+++ b/tests/util/test_dict_cache.py
@@ -23,12 +23,14 @@
 from synapse.util.caches.dictionary_cache import DictionaryCache
 
 from tests import unittest
+from tests.server import get_clock
 
 
 class DictCacheTestCase(unittest.TestCase):
     def setUp(self) -> None:
+        _, clock = get_clock()
         self.cache: DictionaryCache[str, str, str] = DictionaryCache(
-            name="foobar", server_name="test_server", max_entries=10
+            name="foobar", clock=clock, server_name="test_server", max_entries=10
         )
 
     def test_simple_cache_hit_full(self) -> None:
diff --git a/tests/util/test_expiring_cache.py b/tests/util/test_expiring_cache.py
index 75bf50e644..8964359a6e 100644
--- a/tests/util/test_expiring_cache.py
+++ b/tests/util/test_expiring_cache.py
@@ -19,23 +19,22 @@
 #
 #
 
-from typing import List, cast
 
-from synapse.util import Clock
 from synapse.util.caches.expiringcache import ExpiringCache
 
-from tests.utils import MockClock
+from tests.server import get_clock
 
 from .. import unittest
 
 
 class ExpiringCacheTestCase(unittest.HomeserverTestCase):
     def test_get_set(self) -> None:
-        clock = MockClock()
+        reactor, clock = get_clock()
         cache: ExpiringCache[str, str] = ExpiringCache(
             cache_name="test",
             server_name="testserver",
-            clock=cast(Clock, clock),
+            hs=self.hs,
+            clock=clock,
             max_len=1,
         )
 
@@ -44,11 +43,12 @@ class ExpiringCacheTestCase(unittest.HomeserverTestCase):
         self.assertEqual(cache["key"], "value")
 
     def test_eviction(self) -> None:
-        clock = MockClock()
+        reactor, clock = get_clock()
         cache: ExpiringCache[str, str] = ExpiringCache(
             cache_name="test",
             server_name="testserver",
-            clock=cast(Clock, clock),
+            hs=self.hs,
+            clock=clock,
             max_len=2,
         )
 
@@ -63,11 +63,12 @@ class ExpiringCacheTestCase(unittest.HomeserverTestCase):
         self.assertEqual(cache.get("key3"), "value3")
 
     def test_iterable_eviction(self) -> None:
-        clock = MockClock()
-        cache: ExpiringCache[str, List[int]] = ExpiringCache(
+        reactor, clock = get_clock()
+        cache: ExpiringCache[str, list[int]] = ExpiringCache(
             cache_name="test",
             server_name="testserver",
-            clock=cast(Clock, clock),
+            hs=self.hs,
+            clock=clock,
             max_len=5,
             iterable=True,
         )
@@ -87,25 +88,26 @@ class ExpiringCacheTestCase(unittest.HomeserverTestCase):
         self.assertEqual(cache.get("key4"), [6, 7])
 
     def test_time_eviction(self) -> None:
-        clock = MockClock()
+        reactor, clock = get_clock()
         cache: ExpiringCache[str, int] = ExpiringCache(
             cache_name="test",
             server_name="testserver",
-            clock=cast(Clock, clock),
+            hs=self.hs,
+            clock=clock,
             expiry_ms=1000,
         )
 
         cache["key"] = 1
-        clock.advance_time(0.5)
+        reactor.advance(0.5)
         cache["key2"] = 2
 
         self.assertEqual(cache.get("key"), 1)
         self.assertEqual(cache.get("key2"), 2)
 
-        clock.advance_time(0.9)
+        reactor.advance(0.9)
         self.assertEqual(cache.get("key"), None)
         self.assertEqual(cache.get("key2"), 2)
 
-        clock.advance_time(1)
+        reactor.advance(1)
         self.assertEqual(cache.get("key"), None)
         self.assertEqual(cache.get("key2"), None)
diff --git a/tests/util/test_file_consumer.py b/tests/util/test_file_consumer.py
index ab0143e605..e6d54ddb8d 100644
--- a/tests/util/test_file_consumer.py
+++ b/tests/util/test_file_consumer.py
@@ -20,7 +20,7 @@
 
 import threading
 from io import BytesIO
-from typing import BinaryIO, Generator, Optional, cast
+from typing import BinaryIO, Generator, cast
 from unittest.mock import NonCallableMock
 
 from zope.interface import implementer
@@ -127,7 +127,7 @@ class FileConsumerTests(unittest.TestCase):
 @implementer(IPullProducer)
 class DummyPullProducer:
     def __init__(self) -> None:
-        self.consumer: Optional[BackgroundFileConsumer] = None
+        self.consumer: BackgroundFileConsumer | None = None
         self.deferred: "defer.Deferred[object]" = defer.Deferred()
 
     def resumeProducing(self) -> None:
@@ -159,7 +159,7 @@ class BlockingBytesWrite:
         self.closed = False
         self.write_lock = threading.Lock()
 
-        self._notify_write_deferred: Optional[defer.Deferred] = None
+        self._notify_write_deferred: defer.Deferred | None = None
         self._number_of_writes = 0
 
     def write(self, write_bytes: bytes) -> None:
diff --git a/tests/util/test_itertools.py b/tests/util/test_itertools.py
index 7a593cc683..016389d49b 100644
--- a/tests/util/test_itertools.py
+++ b/tests/util/test_itertools.py
@@ -18,7 +18,7 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Dict, Iterable, List, Sequence
+from typing import Iterable, Sequence
 
 from synapse.util.iterutils import (
     chunk_seq,
@@ -67,13 +67,13 @@ class SortTopologically(TestCase):
     def test_empty(self) -> None:
         "Test that an empty graph works correctly"
 
-        graph: Dict[int, List[int]] = {}
+        graph: dict[int, list[int]] = {}
         self.assertEqual(list(sorted_topologically([], graph)), [])
 
     def test_handle_empty_graph(self) -> None:
         "Test that a graph where a node doesn't have an entry is treated as empty"
 
-        graph: Dict[int, List[int]] = {}
+        graph: dict[int, list[int]] = {}
 
         # For disconnected nodes the output is simply sorted.
         self.assertEqual(list(sorted_topologically([1, 2], graph)), [1, 2])
@@ -81,7 +81,7 @@ class SortTopologically(TestCase):
     def test_disconnected(self) -> None:
         "Test that a graph with no edges work"
 
-        graph: Dict[int, List[int]] = {1: [], 2: []}
+        graph: dict[int, list[int]] = {1: [], 2: []}
 
         # For disconnected nodes the output is simply sorted.
         self.assertEqual(list(sorted_topologically([1, 2], graph)), [1, 2])
@@ -89,19 +89,19 @@ class SortTopologically(TestCase):
     def test_linear(self) -> None:
         "Test that a simple `4 -> 3 -> 2 -> 1` graph works"
 
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
 
         self.assertEqual(list(sorted_topologically([4, 3, 2, 1], graph)), [1, 2, 3, 4])
 
     def test_subset(self) -> None:
         "Test that only sorting a subset of the graph works"
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
 
         self.assertEqual(list(sorted_topologically([4, 3], graph)), [3, 4])
 
     def test_fork(self) -> None:
         "Test that a forked graph works"
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [1], 4: [2, 3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [1], 4: [2, 3]}
 
         # Valid orderings are `[1, 3, 2, 4]` or `[1, 2, 3, 4]`, but we should
         # always get the same one.
@@ -109,13 +109,13 @@ class SortTopologically(TestCase):
 
     def test_duplicates(self) -> None:
         "Test that a graph with duplicate edges work"
-        graph: Dict[int, List[int]] = {1: [], 2: [1, 1], 3: [2, 2], 4: [3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1, 1], 3: [2, 2], 4: [3]}
 
         self.assertEqual(list(sorted_topologically([4, 3, 2, 1], graph)), [1, 2, 3, 4])
 
     def test_multiple_paths(self) -> None:
         "Test that a graph with multiple paths between two nodes work"
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [2], 4: [3, 2, 1]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [2], 4: [3, 2, 1]}
 
         self.assertEqual(list(sorted_topologically([4, 3, 2, 1], graph)), [1, 2, 3, 4])
 
@@ -126,13 +126,13 @@ class SortTopologicallyBatched(TestCase):
     def test_empty(self) -> None:
         "Test that an empty graph works correctly"
 
-        graph: Dict[int, List[int]] = {}
+        graph: dict[int, list[int]] = {}
         self.assertEqual(list(sorted_topologically_batched([], graph)), [])
 
     def test_handle_empty_graph(self) -> None:
         "Test that a graph where a node doesn't have an entry is treated as empty"
 
-        graph: Dict[int, List[int]] = {}
+        graph: dict[int, list[int]] = {}
 
         # For disconnected nodes the output is simply sorted.
         self.assertEqual(list(sorted_topologically_batched([1, 2], graph)), [[1, 2]])
@@ -140,7 +140,7 @@ class SortTopologicallyBatched(TestCase):
     def test_disconnected(self) -> None:
         "Test that a graph with no edges work"
 
-        graph: Dict[int, List[int]] = {1: [], 2: []}
+        graph: dict[int, list[int]] = {1: [], 2: []}
 
         # For disconnected nodes the output is simply sorted.
         self.assertEqual(list(sorted_topologically_batched([1, 2], graph)), [[1, 2]])
@@ -148,7 +148,7 @@ class SortTopologicallyBatched(TestCase):
     def test_linear(self) -> None:
         "Test that a simple `4 -> 3 -> 2 -> 1` graph works"
 
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
 
         self.assertEqual(
             list(sorted_topologically_batched([4, 3, 2, 1], graph)),
@@ -157,13 +157,13 @@ class SortTopologicallyBatched(TestCase):
 
     def test_subset(self) -> None:
         "Test that only sorting a subset of the graph works"
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [2], 4: [3]}
 
         self.assertEqual(list(sorted_topologically_batched([4, 3], graph)), [[3], [4]])
 
     def test_fork(self) -> None:
         "Test that a forked graph works"
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [1], 4: [2, 3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [1], 4: [2, 3]}
 
         # Valid orderings are `[1, 3, 2, 4]` or `[1, 2, 3, 4]`, but we should
         # always get the same one.
@@ -173,7 +173,7 @@ class SortTopologicallyBatched(TestCase):
 
     def test_duplicates(self) -> None:
         "Test that a graph with duplicate edges work"
-        graph: Dict[int, List[int]] = {1: [], 2: [1, 1], 3: [2, 2], 4: [3]}
+        graph: dict[int, list[int]] = {1: [], 2: [1, 1], 3: [2, 2], 4: [3]}
 
         self.assertEqual(
             list(sorted_topologically_batched([4, 3, 2, 1], graph)),
@@ -182,7 +182,7 @@ class SortTopologicallyBatched(TestCase):
 
     def test_multiple_paths(self) -> None:
         "Test that a graph with multiple paths between two nodes work"
-        graph: Dict[int, List[int]] = {1: [], 2: [1], 3: [2], 4: [3, 2, 1]}
+        graph: dict[int, list[int]] = {1: [], 2: [1], 3: [2], 4: [3, 2, 1]}
 
         self.assertEqual(
             list(sorted_topologically_batched([4, 3, 2, 1], graph)),
diff --git a/tests/util/test_linearizer.py b/tests/util/test_linearizer.py
index 7510657b85..b2a631d747 100644
--- a/tests/util/test_linearizer.py
+++ b/tests/util/test_linearizer.py
@@ -19,16 +19,18 @@
 #
 #
 
-from typing import Hashable, Protocol, Tuple
+from typing import Hashable, Protocol
 
-from twisted.internet import defer, reactor
-from twisted.internet.base import ReactorBase
+from twisted.internet import defer
 from twisted.internet.defer import CancelledError, Deferred
 
 from synapse.logging.context import LoggingContext, current_context
 from synapse.util.async_helpers import Linearizer
 
 from tests import unittest
+from tests.server import (
+    get_clock,
+)
 
 
 class UnblockFunction(Protocol):
@@ -36,9 +38,12 @@ class UnblockFunction(Protocol):
 
 
 class LinearizerTestCase(unittest.TestCase):
+    def setUp(self) -> None:
+        self.reactor, self.clock = get_clock()
+
     def _start_task(
         self, linearizer: Linearizer, key: Hashable
-    ) -> Tuple["Deferred[None]", "Deferred[None]", UnblockFunction]:
+    ) -> tuple["Deferred[None]", "Deferred[None]", UnblockFunction]:
         """Starts a task which acquires the linearizer lock, blocks, then completes.
 
         Args:
@@ -73,13 +78,12 @@ class LinearizerTestCase(unittest.TestCase):
 
     def _pump(self) -> None:
         """Pump the reactor to advance `Linearizer`s."""
-        assert isinstance(reactor, ReactorBase)
-        while reactor.getDelayedCalls():
-            reactor.runUntilCurrent()
+        while self.reactor.getDelayedCalls():
+            self.reactor.pump([0] * 100)
 
     def test_linearizer(self) -> None:
         """Tests that a task is queued up behind an earlier task."""
-        linearizer = Linearizer()
+        linearizer = Linearizer(name="test_linearizer", clock=self.clock)
 
         key = object()
 
@@ -100,7 +104,7 @@ class LinearizerTestCase(unittest.TestCase):
 
         Runs through the same scenario as `test_linearizer`.
         """
-        linearizer = Linearizer()
+        linearizer = Linearizer(name="test_linearizer", clock=self.clock)
 
         key = object()
 
@@ -131,11 +135,11 @@ class LinearizerTestCase(unittest.TestCase):
 
         The stack should *not* explode when the slow thing completes.
         """
-        linearizer = Linearizer()
+        linearizer = Linearizer(name="test_linearizer", clock=self.clock)
         key = ""
 
         async def func(i: int) -> None:
-            with LoggingContext("func(%s)" % i) as lc:
+            with LoggingContext(name="func(%s)" % i, server_name="test_server") as lc:
                 async with linearizer.queue(key):
                     self.assertEqual(current_context(), lc)
 
@@ -151,24 +155,24 @@ class LinearizerTestCase(unittest.TestCase):
 
     def test_multiple_entries(self) -> None:
         """Tests a `Linearizer` with a concurrency above 1."""
-        limiter = Linearizer(max_count=3)
+        linearizer = Linearizer(name="test_linearizer", max_count=3, clock=self.clock)
 
         key = object()
 
-        _, acquired_d1, unblock1 = self._start_task(limiter, key)
+        _, acquired_d1, unblock1 = self._start_task(linearizer, key)
         self.assertTrue(acquired_d1.called)
 
-        _, acquired_d2, unblock2 = self._start_task(limiter, key)
+        _, acquired_d2, unblock2 = self._start_task(linearizer, key)
         self.assertTrue(acquired_d2.called)
 
-        _, acquired_d3, unblock3 = self._start_task(limiter, key)
+        _, acquired_d3, unblock3 = self._start_task(linearizer, key)
         self.assertTrue(acquired_d3.called)
 
         # These next two tasks have to wait.
-        _, acquired_d4, unblock4 = self._start_task(limiter, key)
+        _, acquired_d4, unblock4 = self._start_task(linearizer, key)
         self.assertFalse(acquired_d4.called)
 
-        _, acquired_d5, unblock5 = self._start_task(limiter, key)
+        _, acquired_d5, unblock5 = self._start_task(linearizer, key)
         self.assertFalse(acquired_d5.called)
 
         # Once the first task completes, the fourth task can continue.
@@ -186,13 +190,13 @@ class LinearizerTestCase(unittest.TestCase):
         unblock5()
 
         # The next task shouldn't have to wait.
-        _, acquired_d6, unblock6 = self._start_task(limiter, key)
+        _, acquired_d6, unblock6 = self._start_task(linearizer, key)
         self.assertTrue(acquired_d6)
         unblock6()
 
     def test_cancellation(self) -> None:
         """Tests cancellation while waiting for a `Linearizer`."""
-        linearizer = Linearizer()
+        linearizer = Linearizer(name="test_linearizer", clock=self.clock)
 
         key = object()
 
@@ -226,7 +230,7 @@ class LinearizerTestCase(unittest.TestCase):
 
     def test_cancellation_during_sleep(self) -> None:
         """Tests cancellation during the sleep just after waiting for a `Linearizer`."""
-        linearizer = Linearizer()
+        linearizer = Linearizer(name="test_linearizer", clock=self.clock)
 
         key = object()
 
diff --git a/tests/util/test_logcontext.py b/tests/util/test_logcontext.py
index af36e685d7..a4114cdfcc 100644
--- a/tests/util/test_logcontext.py
+++ b/tests/util/test_logcontext.py
@@ -19,24 +19,30 @@
 #
 #
 
+import logging
 from typing import Callable, Generator, cast
 
-import twisted.python.failure
 from twisted.internet import defer, reactor as _reactor
 
 from synapse.logging.context import (
     SENTINEL_CONTEXT,
     LoggingContext,
     PreserveLoggingContext,
+    _Sentinel,
     current_context,
     make_deferred_yieldable,
     nested_logging_context,
+    run_coroutine_in_background,
     run_in_background,
 )
 from synapse.types import ISynapseReactor
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 
-from .. import unittest
+from tests import unittest
+from tests.unittest import logcontext_clean
+
+logger = logging.getLogger(__name__)
 
 reactor = cast(ISynapseReactor, _reactor)
 
@@ -44,105 +50,609 @@ reactor = cast(ISynapseReactor, _reactor)
 class LoggingContextTestCase(unittest.TestCase):
     def _check_test_key(self, value: str) -> None:
         context = current_context()
-        assert isinstance(context, LoggingContext)
-        self.assertEqual(context.name, value)
+        assert isinstance(context, LoggingContext) or isinstance(context, _Sentinel), (
+            f"Expected LoggingContext({value}) but saw {context}"
+        )
+        self.assertEqual(
+            str(context), value, f"Expected LoggingContext({value}) but saw {context}"
+        )
 
+    @logcontext_clean
     def test_with_context(self) -> None:
-        with LoggingContext("test"):
+        with LoggingContext(name="test", server_name="test_server"):
             self._check_test_key("test")
 
+    @logcontext_clean
     async def test_sleep(self) -> None:
-        clock = Clock(reactor)
+        """
+        Test `Clock.sleep`
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
 
         async def competing_callback() -> None:
-            with LoggingContext("competing"):
-                await clock.sleep(0)
-                self._check_test_key("competing")
-
-        reactor.callLater(0, lambda: defer.ensureDeferred(competing_callback()))
-
-        with LoggingContext("one"):
-            await clock.sleep(0)
-            self._check_test_key("one")
-
-    def _test_run_in_background(self, function: Callable[[], object]) -> defer.Deferred:
-        sentinel_context = current_context()
-
-        callback_completed = False
-
-        with LoggingContext("one"):
-            # fire off function, but don't wait on it.
-            d2 = run_in_background(function)
-
-            def cb(res: object) -> object:
-                nonlocal callback_completed
-                callback_completed = True
-                return res
-
-            d2.addCallback(cb)
-
-            self._check_test_key("one")
-
-        # now wait for the function under test to have run, and check that
-        # the logcontext is left in a sane state.
-        d2 = defer.Deferred()
-
-        def check_logcontext() -> None:
-            if not callback_completed:
-                reactor.callLater(0.01, check_logcontext)
-                return
-
-            # make sure that the context was reset before it got thrown back
-            # into the reactor
+            nonlocal callback_finished
             try:
-                self.assertIs(current_context(), sentinel_context)
-                d2.callback(None)
-            except BaseException:
-                d2.errback(twisted.python.failure.Failure())
+                # A callback from the reactor should start with the sentinel context. In
+                # other words, another task shouldn't have leaked their context to us.
+                self._check_test_key("sentinel")
 
-        reactor.callLater(0.01, check_logcontext)
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
 
-        # test is done once d2 finishes
-        return d2
+                self._check_test_key("sentinel")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
 
-    def test_run_in_background_with_blocking_fn(self) -> defer.Deferred:
+        reactor.callLater(0, lambda: defer.ensureDeferred(competing_callback()))  # type: ignore[call-later-not-tracked]
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    @logcontext_clean
+    async def test_looping_call(self) -> None:
+        """
+        Test `Clock.looping_call`
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # A `looping_call` callback should have *some* logcontext since we should know
+                # which server spawned this loop and which server the logs came from.
+                self._check_test_key("looping_call")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
+
+                self._check_test_key("looping_call")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            lc = clock.looping_call(
+                lambda: defer.ensureDeferred(competing_callback()), Duration(seconds=0)
+            )
+            self._check_test_key("foo")
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+        # Stop the looping call to prevent "Reactor was unclean" errors
+        lc.stop()
+
+    @logcontext_clean
+    async def test_looping_call_now(self) -> None:
+        """
+        Test `Clock.looping_call_now`
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # A `looping_call` callback should have *some* logcontext since we should know
+                # which server spawned this loop and which server the logs came from.
+                self._check_test_key("looping_call")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
+
+                self._check_test_key("looping_call")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            lc = clock.looping_call_now(
+                lambda: defer.ensureDeferred(competing_callback()), Duration(seconds=0)
+            )
+            self._check_test_key("foo")
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+        # Stop the looping call to prevent "Reactor was unclean" errors
+        lc.stop()
+
+    @logcontext_clean
+    async def test_call_later(self) -> None:
+        """
+        Test `Clock.call_later`
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # A `call_later` callback should have *some* logcontext since we should know
+                # which server spawned this loop and which server the logs came from.
+                self._check_test_key("call_later")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
+
+                self._check_test_key("call_later")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            clock.call_later(
+                Duration(seconds=0), lambda: defer.ensureDeferred(competing_callback())
+            )
+            self._check_test_key("foo")
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    @logcontext_clean
+    async def test_deferred_callback_await_in_current_logcontext(self) -> None:
+        """
+        Test that calling the deferred callback in the current logcontext ("foo") and
+        waiting for it to finish in a logcontext blocks works as expected.
+
+        Works because "always await your awaitables".
+
+        Demonstrates one pattern that we can use fix the naive case where we just call
+        `d.callback(None)` without anything else. See the *Deferred callbacks* section
+        of docs/log_contexts.md for more details.
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # The deferred callback should have the same logcontext as the caller
+                self._check_test_key("foo")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
+
+                self._check_test_key("foo")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            d: defer.Deferred[None] = defer.Deferred()
+            d.addCallback(lambda _: defer.ensureDeferred(competing_callback()))
+            self._check_test_key("foo")
+            d.callback(None)
+            # The fix for the naive case is here (i.e. things don't work correctly if we
+            # don't await here).
+            #
+            # Wait for `d` to finish before continuing so the "main" logcontext is
+            # still active. This works because `d` already follows our logcontext
+            # rules. If not, we would also have to use `make_deferred_yieldable(d)`.
+            await d
+            self._check_test_key("foo")
+
+        await clock.sleep(Duration(seconds=0))
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    @logcontext_clean
+    async def test_deferred_callback_preserve_logging_context(self) -> None:
+        """
+        Test that calling the deferred callback inside `PreserveLoggingContext()` (in
+        the sentinel context) works as expected.
+
+        Demonstrates one pattern that we can use fix the naive case where we just call
+        `d.callback(None)` without anything else. See the *Deferred callbacks* section
+        of docs/log_contexts.md for more details.
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # The deferred callback should have the same logcontext as the caller
+                self._check_test_key("sentinel")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
+
+                self._check_test_key("sentinel")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            d: defer.Deferred[None] = defer.Deferred()
+            d.addCallback(lambda _: defer.ensureDeferred(competing_callback()))
+            self._check_test_key("foo")
+            # The fix for the naive case is here (i.e. things don't work correctly if we
+            # don't `PreserveLoggingContext()` here).
+            #
+            # `PreserveLoggingContext` will reset the logcontext to the sentinel before
+            # calling the callback, and restore the "foo" logcontext afterwards before
+            # continuing the foo block. This solves the problem because when the
+            # "competing" logcontext exits, it will restore the sentinel logcontext
+            # which is never finished by its nature, so there is no warning and no
+            # leakage into the reactor.
+            with PreserveLoggingContext():
+                d.callback(None)
+            self._check_test_key("foo")
+
+        await clock.sleep(Duration(seconds=0))
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    @logcontext_clean
+    async def test_deferred_callback_fire_and_forget_with_current_context(self) -> None:
+        """
+        Test that it's possible to call the deferred callback with the current context
+        while fire-and-forgetting the callback (no adverse effects like leaking the
+        logcontext into the reactor or restarting an already finished logcontext).
+
+        Demonstrates one pattern that we can use fix the naive case where we just call
+        `d.callback(None)` without anything else. See the *Deferred callbacks* section
+        of docs/log_contexts.md for more details.
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # The deferred callback should have the same logcontext as the caller
+                self._check_test_key("foo")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
+
+                self._check_test_key("foo")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        # Part of fix for the naive case is here (i.e. things don't work correctly if we
+        # don't `PreserveLoggingContext(...)` here).
+        #
+        # We can extend the lifetime of the "foo" logcontext is to avoid calling the
+        # context manager lifetime methods of `LoggingContext` (`__enter__`/`__exit__`).
+        # And we can still set the current logcontext by using `PreserveLoggingContext`
+        # and passing in the "foo" logcontext.
+        with PreserveLoggingContext(
+            LoggingContext(name="foo", server_name="test_server")
+        ):
+            d: defer.Deferred[None] = defer.Deferred()
+            d.addCallback(lambda _: defer.ensureDeferred(competing_callback()))
+            self._check_test_key("foo")
+            # Other part of fix for the naive case is here (i.e. things don't work
+            # correctly if we don't `run_in_background(...)` here).
+            #
+            # `run_in_background(...)` will run the whole lambda in the current
+            # logcontext and it handles the magic behind the scenes of a) restoring the
+            # calling logcontext before returning to the caller and b) resetting the
+            # logcontext to the sentinel after the deferred completes and we yield
+            # control back to the reactor to avoid leaking the logcontext into the
+            # reactor.
+            #
+            # We're using a lambda here as a little trick so we can still get everything
+            # to run in the "foo" logcontext, but return the deferred `d` itself so that
+            # `run_in_background` will wait on that to complete before resetting the
+            # logcontext to the sentinel.
+            #
+            # type-ignore[call-overload]: This appears like a mypy type inference bug. A
+            # function that returns a deferred is exactly what `run_in_background`
+            # expects.
+            #
+            # type-ignore[func-returns-value]: This appears like a mypy type inference
+            # bug. We're always returning the deferred `d`.
+            run_in_background(lambda: (d.callback(None), d)[1])  # type: ignore[call-overload, func-returns-value]
+            self._check_test_key("foo")
+
+        await clock.sleep(Duration(seconds=0))
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    async def _test_run_in_background(self, function: Callable[[], object]) -> None:
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            # Fire off the function, but don't wait on it.
+            deferred = run_in_background(function)
+            self._check_test_key("foo")
+
+            def callback(result: object) -> object:
+                nonlocal callback_finished
+                callback_finished = True
+                # Pass through the result
+                return result
+
+            # We `addBoth` because when exceptions happen, we still want to mark the
+            # callback as finished so that the test can complete and we see the
+            # underlying error.
+            deferred.addBoth(callback)
+
+            self._check_test_key("foo")
+
+            # Now wait for the function under test to have run, and check that
+            # the logcontext is left in a sane state.
+            while not callback_finished:
+                await clock.sleep(Duration(seconds=0))
+                self._check_test_key("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    @logcontext_clean
+    async def test_run_in_background_with_blocking_fn(self) -> None:
         async def blocking_function() -> None:
-            await Clock(reactor).sleep(0)
+            # Ignore linter error since we are creating a `Clock` for testing purposes.
+            await Clock(reactor, server_name="test_server").sleep(Duration(seconds=0))  # type: ignore[multiple-internal-clocks]
 
-        return self._test_run_in_background(blocking_function)
+        await self._test_run_in_background(blocking_function)
 
-    def test_run_in_background_with_non_blocking_fn(self) -> defer.Deferred:
+    @logcontext_clean
+    async def test_run_in_background_with_non_blocking_fn(self) -> None:
         @defer.inlineCallbacks
         def nonblocking_function() -> Generator["defer.Deferred[object]", object, None]:
             with PreserveLoggingContext():
                 yield defer.succeed(None)
 
-        return self._test_run_in_background(nonblocking_function)
+        await self._test_run_in_background(nonblocking_function)
 
-    def test_run_in_background_with_chained_deferred(self) -> defer.Deferred:
+    @logcontext_clean
+    async def test_run_in_background_with_chained_deferred(self) -> None:
         # a function which returns a deferred which looks like it has been
         # called, but is actually paused
         def testfunc() -> defer.Deferred:
             return make_deferred_yieldable(_chained_deferred_function())
 
-        return self._test_run_in_background(testfunc)
+        await self._test_run_in_background(testfunc)
+
+    @logcontext_clean
+    async def test_run_in_background_with_coroutine(self) -> None:
+        """
+        Test `run_in_background` with a coroutine that yields control back to the
+        reactor.
+
+        This will stress the logic around incomplete deferreds in `run_in_background`.
+        """
 
-    def test_run_in_background_with_coroutine(self) -> defer.Deferred:
         async def testfunc() -> None:
-            self._check_test_key("one")
-            d = defer.ensureDeferred(Clock(reactor).sleep(0))
+            self._check_test_key("foo")
+            # Ignore linter error since we are creating a `Clock` for testing purposes.
+            d = defer.ensureDeferred(
+                Clock(reactor, server_name="test_server").sleep(Duration(seconds=0))  # type: ignore[multiple-internal-clocks]
+            )
             self.assertIs(current_context(), SENTINEL_CONTEXT)
             await d
-            self._check_test_key("one")
+            self._check_test_key("foo")
 
-        return self._test_run_in_background(testfunc)
+        await self._test_run_in_background(testfunc)
+
+    @logcontext_clean
+    async def test_run_in_background_with_nonblocking_coroutine(self) -> None:
+        """
+        Test `run_in_background` with a "nonblocking" coroutine (never yields control
+        back to the reactor).
+
+        This will stress the logic around completed deferreds in `run_in_background`.
+        """
 
-    def test_run_in_background_with_nonblocking_coroutine(self) -> defer.Deferred:
         async def testfunc() -> None:
-            self._check_test_key("one")
+            self._check_test_key("foo")
 
-        return self._test_run_in_background(testfunc)
+        await self._test_run_in_background(testfunc)
 
+    @logcontext_clean
+    async def test_run_coroutine_in_background(self) -> None:
+        """
+        Test `run_coroutine_in_background` with a coroutine that yields control back to the
+        reactor.
+
+        This will stress the logic around incomplete deferreds in `run_coroutine_in_background`.
+        """
+        # Ignore linter error since we are creating a `Clock` for testing purposes.
+        clock = Clock(reactor, server_name="test_server")  # type: ignore[multiple-internal-clocks]
+
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # The callback should have the same logcontext as the caller
+                self._check_test_key("foo")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    await clock.sleep(Duration(seconds=0))
+                    self._check_test_key("competing")
+
+                self._check_test_key("foo")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            run_coroutine_in_background(competing_callback())
+            self._check_test_key("foo")
+            await clock.sleep(Duration(seconds=0))
+            self._check_test_key("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    @logcontext_clean
+    async def test_run_coroutine_in_background_with_nonblocking_coroutine(self) -> None:
+        """
+        Test `run_coroutine_in_background` with a "nonblocking" coroutine (never yields control
+        back to the reactor).
+
+        This will stress the logic around completed deferreds in `run_coroutine_in_background`.
+        """
+        # Sanity check that we start in the sentinel context
+        self._check_test_key("sentinel")
+
+        callback_finished = False
+
+        async def competing_callback() -> None:
+            nonlocal callback_finished
+            try:
+                # The callback should have the same logcontext as the caller
+                self._check_test_key("foo")
+
+                with LoggingContext(name="competing", server_name="test_server"):
+                    # We `await` here but there is nothing to wait for here since the
+                    # deferred is already complete so we should immediately continue
+                    # executing in the same context.
+                    await defer.succeed(None)
+
+                    self._check_test_key("competing")
+
+                self._check_test_key("foo")
+            finally:
+                # When exceptions happen, we still want to mark the callback as finished
+                # so that the test can complete and we see the underlying error.
+                callback_finished = True
+
+        with LoggingContext(name="foo", server_name="test_server"):
+            run_coroutine_in_background(competing_callback())
+            self._check_test_key("foo")
+
+        self.assertTrue(
+            callback_finished,
+            "Callback never finished which means the test probably didn't wait long enough",
+        )
+
+        # Back to the sentinel context
+        self._check_test_key("sentinel")
+
+    @logcontext_clean
     @defer.inlineCallbacks
     def test_make_deferred_yieldable(
         self,
@@ -151,12 +661,12 @@ class LoggingContextTestCase(unittest.TestCase):
         # the synapse rules.
         def blocking_function() -> defer.Deferred:
             d: defer.Deferred = defer.Deferred()
-            reactor.callLater(0, d.callback, None)
+            reactor.callLater(0, d.callback, None)  # type: ignore[call-later-not-tracked]
             return d
 
         sentinel_context = current_context()
 
-        with LoggingContext("one"):
+        with LoggingContext(name="foo", server_name="test_server"):
             d1 = make_deferred_yieldable(blocking_function())
             # make sure that the context was reset by make_deferred_yieldable
             self.assertIs(current_context(), sentinel_context)
@@ -164,15 +674,16 @@ class LoggingContextTestCase(unittest.TestCase):
             yield d1
 
             # now it should be restored
-            self._check_test_key("one")
+            self._check_test_key("foo")
 
+    @logcontext_clean
     @defer.inlineCallbacks
     def test_make_deferred_yieldable_with_chained_deferreds(
         self,
     ) -> Generator["defer.Deferred[object]", object, None]:
         sentinel_context = current_context()
 
-        with LoggingContext("one"):
+        with LoggingContext(name="foo", server_name="test_server"):
             d1 = make_deferred_yieldable(_chained_deferred_function())
             # make sure that the context was reset by make_deferred_yieldable
             self.assertIs(current_context(), sentinel_context)
@@ -180,10 +691,11 @@ class LoggingContextTestCase(unittest.TestCase):
             yield d1
 
             # now it should be restored
-            self._check_test_key("one")
+            self._check_test_key("foo")
 
+    @logcontext_clean
     def test_nested_logging_context(self) -> None:
-        with LoggingContext("foo"):
+        with LoggingContext(name="foo", server_name="test_server"):
             nested_context = nested_logging_context(suffix="bar")
             self.assertEqual(nested_context.name, "foo-bar")
 
@@ -196,7 +708,7 @@ def _chained_deferred_function() -> defer.Deferred:
 
     def cb(res: object) -> defer.Deferred:
         d2: defer.Deferred = defer.Deferred()
-        reactor.callLater(0, d2.callback, res)
+        reactor.callLater(0, d2.callback, res)  # type: ignore[call-later-not-tracked]
         return d2
 
     d.addCallback(cb)
diff --git a/tests/util/test_lrucache.py b/tests/util/test_lrucache.py
index b7acf58690..dcbfcfa2e4 100644
--- a/tests/util/test_lrucache.py
+++ b/tests/util/test_lrucache.py
@@ -20,7 +20,6 @@
 #
 
 
-from typing import List, Tuple
 from unittest.mock import Mock, patch
 
 from synapse.metrics.jemalloc import JemallocStats
@@ -29,18 +28,28 @@ from synapse.util.caches.lrucache import LruCache, setup_expire_lru_cache_entrie
 from synapse.util.caches.treecache import TreeCache
 
 from tests import unittest
+from tests.server import get_clock
 from tests.unittest import override_config
 
 
 class LruCacheTestCase(unittest.HomeserverTestCase):
+    def setUp(self) -> None:
+        super().setUp()
+
+        _, self.clock = get_clock()
+
     def test_get_set(self) -> None:
-        cache: LruCache[str, str] = LruCache(max_size=1)
+        cache: LruCache[str, str] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
         cache["key"] = "value"
         self.assertEqual(cache.get("key"), "value")
         self.assertEqual(cache["key"], "value")
 
     def test_eviction(self) -> None:
-        cache: LruCache[int, int] = LruCache(max_size=2)
+        cache: LruCache[int, int] = LruCache(
+            max_size=2, clock=self.clock, server_name="test_server"
+        )
         cache[1] = 1
         cache[2] = 2
 
@@ -54,7 +63,9 @@ class LruCacheTestCase(unittest.HomeserverTestCase):
         self.assertEqual(cache.get(3), 3)
 
     def test_setdefault(self) -> None:
-        cache: LruCache[str, int] = LruCache(max_size=1)
+        cache: LruCache[str, int] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
         self.assertEqual(cache.setdefault("key", 1), 1)
         self.assertEqual(cache.get("key"), 1)
         self.assertEqual(cache.setdefault("key", 2), 1)
@@ -63,15 +74,20 @@ class LruCacheTestCase(unittest.HomeserverTestCase):
         self.assertEqual(cache.get("key"), 2)
 
     def test_pop(self) -> None:
-        cache: LruCache[str, int] = LruCache(max_size=1)
+        cache: LruCache[str, int] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
         cache["key"] = 1
         self.assertEqual(cache.pop("key"), 1)
         self.assertEqual(cache.pop("key"), None)
 
     def test_del_multi(self) -> None:
         # The type here isn't quite correct as they don't handle TreeCache well.
-        cache: LruCache[Tuple[str, str], str] = LruCache(
-            max_size=4, cache_type=TreeCache
+        cache: LruCache[tuple[str, str], str] = LruCache(
+            max_size=4,
+            clock=self.clock,
+            cache_type=TreeCache,
+            server_name="test_server",
         )
         cache[("animal", "cat")] = "mew"
         cache[("animal", "dog")] = "woof"
@@ -91,7 +107,9 @@ class LruCacheTestCase(unittest.HomeserverTestCase):
         # Man from del_multi say "Yes".
 
     def test_clear(self) -> None:
-        cache: LruCache[str, int] = LruCache(max_size=1)
+        cache: LruCache[str, int] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
         cache["key"] = 1
         cache.clear()
         self.assertEqual(len(cache), 0)
@@ -99,7 +117,10 @@ class LruCacheTestCase(unittest.HomeserverTestCase):
     @override_config({"caches": {"per_cache_factors": {"mycache": 10}}})
     def test_special_size(self) -> None:
         cache: LruCache = LruCache(
-            max_size=10, server_name="test_server", cache_name="mycache"
+            max_size=10,
+            clock=self.clock,
+            server_name="test_server",
+            cache_name="mycache",
         )
         self.assertEqual(cache.max_size, 100)
 
@@ -107,7 +128,9 @@ class LruCacheTestCase(unittest.HomeserverTestCase):
 class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
     def test_get(self) -> None:
         m = Mock()
-        cache: LruCache[str, str] = LruCache(max_size=1)
+        cache: LruCache[str, str] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
 
         cache.set("key", "value")
         self.assertFalse(m.called)
@@ -126,7 +149,9 @@ class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
 
     def test_multi_get(self) -> None:
         m = Mock()
-        cache: LruCache[str, str] = LruCache(max_size=1)
+        cache: LruCache[str, str] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
 
         cache.set("key", "value")
         self.assertFalse(m.called)
@@ -145,7 +170,9 @@ class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
 
     def test_set(self) -> None:
         m = Mock()
-        cache: LruCache[str, str] = LruCache(max_size=1)
+        cache: LruCache[str, str] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
 
         cache.set("key", "value", callbacks=[m])
         self.assertFalse(m.called)
@@ -161,7 +188,9 @@ class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
 
     def test_pop(self) -> None:
         m = Mock()
-        cache: LruCache[str, str] = LruCache(max_size=1)
+        cache: LruCache[str, str] = LruCache(
+            max_size=1, clock=self.clock, server_name="test_server"
+        )
 
         cache.set("key", "value", callbacks=[m])
         self.assertFalse(m.called)
@@ -181,8 +210,11 @@ class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
         m3 = Mock()
         m4 = Mock()
         # The type here isn't quite correct as they don't handle TreeCache well.
-        cache: LruCache[Tuple[str, str], str] = LruCache(
-            max_size=4, cache_type=TreeCache
+        cache: LruCache[tuple[str, str], str] = LruCache(
+            max_size=4,
+            clock=self.clock,
+            cache_type=TreeCache,
+            server_name="test_server",
         )
 
         cache.set(("a", "1"), "value", callbacks=[m1])
@@ -205,7 +237,9 @@ class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
     def test_clear(self) -> None:
         m1 = Mock()
         m2 = Mock()
-        cache: LruCache[str, str] = LruCache(max_size=5)
+        cache: LruCache[str, str] = LruCache(
+            max_size=5, clock=self.clock, server_name="test_server"
+        )
 
         cache.set("key1", "value", callbacks=[m1])
         cache.set("key2", "value", callbacks=[m2])
@@ -222,7 +256,9 @@ class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
         m1 = Mock(name="m1")
         m2 = Mock(name="m2")
         m3 = Mock(name="m3")
-        cache: LruCache[str, str] = LruCache(max_size=2)
+        cache: LruCache[str, str] = LruCache(
+            max_size=2, clock=self.clock, server_name="test_server"
+        )
 
         cache.set("key1", "value", callbacks=[m1])
         cache.set("key2", "value", callbacks=[m2])
@@ -258,7 +294,9 @@ class LruCacheCallbacksTestCase(unittest.HomeserverTestCase):
 
 class LruCacheSizedTestCase(unittest.HomeserverTestCase):
     def test_evict(self) -> None:
-        cache: LruCache[str, List[int]] = LruCache(max_size=5, size_callback=len)
+        cache: LruCache[str, list[int]] = LruCache(
+            max_size=5, clock=self.clock, size_callback=len, server_name="test_server"
+        )
         cache["key1"] = [0]
         cache["key2"] = [1, 2]
         cache["key3"] = [3]
@@ -281,8 +319,11 @@ class LruCacheSizedTestCase(unittest.HomeserverTestCase):
 
     def test_zero_size_drop_from_cache(self) -> None:
         """Test that `drop_from_cache` works correctly with 0-sized entries."""
-        cache: LruCache[str, List[int]] = LruCache(
-            max_size=5, size_callback=lambda x: 0
+        cache: LruCache[str, list[int]] = LruCache(
+            max_size=5,
+            clock=self.clock,
+            size_callback=lambda x: 0,
+            server_name="test_server",
         )
         cache["key1"] = []
 
@@ -307,7 +348,9 @@ class TimeEvictionTestCase(unittest.HomeserverTestCase):
     def test_evict(self) -> None:
         setup_expire_lru_cache_entries(self.hs)
 
-        cache: LruCache[str, int] = LruCache(max_size=5, clock=self.hs.get_clock())
+        cache: LruCache[str, int] = LruCache(
+            max_size=5, server_name="test_server", clock=self.hs.get_clock()
+        )
 
         # Check that we evict entries we haven't accessed for 30 minutes.
         cache["key1"] = 1
@@ -359,7 +402,9 @@ class MemoryEvictionTestCase(unittest.HomeserverTestCase):
         mock_jemalloc_class.get_stat.return_value = 924288000
 
         setup_expire_lru_cache_entries(self.hs)
-        cache: LruCache[str, int] = LruCache(max_size=4, clock=self.hs.get_clock())
+        cache: LruCache[str, int] = LruCache(
+            max_size=4, server_name="test_server", clock=self.hs.get_clock()
+        )
 
         cache["key1"] = 1
         cache["key2"] = 2
@@ -396,7 +441,10 @@ class MemoryEvictionTestCase(unittest.HomeserverTestCase):
 class ExtraIndexLruCacheTestCase(unittest.HomeserverTestCase):
     def test_invalidate_simple(self) -> None:
         cache: LruCache[str, int] = LruCache(
-            max_size=10, extra_index_cb=lambda k, v: str(v)
+            max_size=10,
+            clock=self.hs.get_clock(),
+            server_name="test_server",
+            extra_index_cb=lambda k, v: str(v),
         )
         cache["key1"] = 1
         cache["key2"] = 2
@@ -411,7 +459,10 @@ class ExtraIndexLruCacheTestCase(unittest.HomeserverTestCase):
 
     def test_invalidate_multi(self) -> None:
         cache: LruCache[str, int] = LruCache(
-            max_size=10, extra_index_cb=lambda k, v: str(v)
+            max_size=10,
+            clock=self.hs.get_clock(),
+            server_name="test_server",
+            extra_index_cb=lambda k, v: str(v),
         )
         cache["key1"] = 1
         cache["key2"] = 1
diff --git a/tests/util/test_mutable_overlay_mapping.py b/tests/util/test_mutable_overlay_mapping.py
index a7335fca73..ed738919e4 100644
--- a/tests/util/test_mutable_overlay_mapping.py
+++ b/tests/util/test_mutable_overlay_mapping.py
@@ -13,7 +13,6 @@
 #
 
 import unittest
-from typing import Dict
 
 from synapse.util import MutableOverlayMapping
 
@@ -24,7 +23,7 @@ class TestMutableOverlayMapping(unittest.TestCase):
     def test_init(self) -> None:
         """Test initialization with different input types."""
         # Test with empty dict
-        empty_dict: Dict[str, int] = {}
+        empty_dict: dict[str, int] = {}
         mapping = MutableOverlayMapping(empty_dict)
         self.assertEqual(len(mapping), 0)
 
diff --git a/tests/util/test_ratelimitutils.py b/tests/util/test_ratelimitutils.py
index 20281d04fe..d3b123c778 100644
--- a/tests/util/test_ratelimitutils.py
+++ b/tests/util/test_ratelimitutils.py
@@ -18,7 +18,6 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import Optional
 
 from twisted.internet import defer
 from twisted.internet.defer import Deferred
@@ -139,7 +138,7 @@ def _await_resolution(reactor: ThreadedMemoryReactorClock, d: Deferred) -> float
     return (reactor.seconds() - start_time) * 1000
 
 
-def build_rc_config(settings: Optional[dict] = None) -> FederationRatelimitSettings:
+def build_rc_config(settings: dict | None = None) -> FederationRatelimitSettings:
     config_dict = default_config("test")
     config_dict.update(settings or {})
     config = HomeServerConfig()
diff --git a/tests/util/test_retryutils.py b/tests/util/test_retryutils.py
index 82baff5883..593be93ea3 100644
--- a/tests/util/test_retryutils.py
+++ b/tests/util/test_retryutils.py
@@ -35,6 +35,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             )
@@ -57,6 +58,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             )
@@ -89,6 +91,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             ),
@@ -104,6 +107,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             )
@@ -139,6 +143,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             )
@@ -165,6 +170,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
                 notifier=notifier,
@@ -238,6 +244,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             )
@@ -261,6 +268,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             ),
@@ -273,6 +281,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             )
@@ -297,6 +306,7 @@ class RetryLimiterTestCase(HomeserverTestCase):
             get_retry_limiter(
                 destination="test_dest",
                 our_server_name=self.hs.hostname,
+                hs=self.hs,
                 clock=self.clock,
                 store=store,
             ),
diff --git a/tests/util/test_rwlock.py b/tests/util/test_rwlock.py
index 12f821d684..36771188ae 100644
--- a/tests/util/test_rwlock.py
+++ b/tests/util/test_rwlock.py
@@ -19,7 +19,7 @@
 #
 #
 
-from typing import AsyncContextManager, Callable, Sequence, Tuple
+from typing import AsyncContextManager, Callable, Sequence
 
 from twisted.internet import defer
 from twisted.internet.defer import CancelledError, Deferred
@@ -35,7 +35,7 @@ class ReadWriteLockTestCase(unittest.TestCase):
         read_or_write: Callable[[str], AsyncContextManager],
         key: str,
         return_value: str,
-    ) -> Tuple["Deferred[str]", "Deferred[None]", "Deferred[None]"]:
+    ) -> tuple["Deferred[str]", "Deferred[None]", "Deferred[None]"]:
         """Starts a reader or writer which acquires the lock, blocks, then completes.
 
         Args:
@@ -67,7 +67,7 @@ class ReadWriteLockTestCase(unittest.TestCase):
 
     def _start_blocking_reader(
         self, rwlock: ReadWriteLock, key: str, return_value: str
-    ) -> Tuple["Deferred[str]", "Deferred[None]", "Deferred[None]"]:
+    ) -> tuple["Deferred[str]", "Deferred[None]", "Deferred[None]"]:
         """Starts a reader which acquires the lock, blocks, then releases the lock.
 
         See the docstring for `_start_reader_or_writer` for details about the arguments
@@ -77,7 +77,7 @@ class ReadWriteLockTestCase(unittest.TestCase):
 
     def _start_blocking_writer(
         self, rwlock: ReadWriteLock, key: str, return_value: str
-    ) -> Tuple["Deferred[str]", "Deferred[None]", "Deferred[None]"]:
+    ) -> tuple["Deferred[str]", "Deferred[None]", "Deferred[None]"]:
         """Starts a writer which acquires the lock, blocks, then releases the lock.
 
         See the docstring for `_start_reader_or_writer` for details about the arguments
@@ -87,7 +87,7 @@ class ReadWriteLockTestCase(unittest.TestCase):
 
     def _start_nonblocking_reader(
         self, rwlock: ReadWriteLock, key: str, return_value: str
-    ) -> Tuple["Deferred[str]", "Deferred[None]"]:
+    ) -> tuple["Deferred[str]", "Deferred[None]"]:
         """Starts a reader which acquires the lock, then releases it immediately.
 
         See the docstring for `_start_reader_or_writer` for details about the arguments.
@@ -106,7 +106,7 @@ class ReadWriteLockTestCase(unittest.TestCase):
 
     def _start_nonblocking_writer(
         self, rwlock: ReadWriteLock, key: str, return_value: str
-    ) -> Tuple["Deferred[str]", "Deferred[None]"]:
+    ) -> tuple["Deferred[str]", "Deferred[None]"]:
         """Starts a writer which acquires the lock, then releases it immediately.
 
         See the docstring for `_start_reader_or_writer` for details about the arguments.
diff --git a/tests/util/test_task_scheduler.py b/tests/util/test_task_scheduler.py
index 2171f91b4d..94c1d778e6 100644
--- a/tests/util/test_task_scheduler.py
+++ b/tests/util/test_task_scheduler.py
@@ -18,14 +18,15 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
-from typing import List, Optional, Tuple
 
-from twisted.internet.task import deferLater
+from twisted.internet.defer import Deferred
 from twisted.internet.testing import MemoryReactor
 
+from synapse.logging.context import make_deferred_yieldable
 from synapse.server import HomeServer
 from synapse.types import JsonMapping, ScheduledTask, TaskStatus
-from synapse.util import Clock
+from synapse.util.clock import Clock
+from synapse.util.duration import Duration
 from synapse.util.task_scheduler import TaskScheduler
 
 from tests.replication._base import BaseMultiWorkerStreamTestCase
@@ -39,10 +40,16 @@ class TestTaskScheduler(HomeserverTestCase):
         self.task_scheduler.register_action(self._sleeping_task, "_sleeping_task")
         self.task_scheduler.register_action(self._raising_task, "_raising_task")
         self.task_scheduler.register_action(self._resumable_task, "_resumable_task")
+        self.task_scheduler.register_action(
+            self._incrementing_active_task, "_incrementing_active_task"
+        )
+        self.task_scheduler.register_action(
+            self._incrementing_running_task, "_incrementing_running_task"
+        )
 
     async def _test_task(
         self, task: ScheduledTask
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         # This test task will copy the parameters to the result
         result = None
         if task.params:
@@ -68,7 +75,7 @@ class TestTaskScheduler(HomeserverTestCase):
 
         # The timestamp being 30s after now the task should been executed
         # after the first scheduling loop is run
-        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL_MS / 1000)
+        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL.as_secs())
 
         task = self.get_success(self.task_scheduler.get_task(task_id))
         assert task is not None
@@ -85,9 +92,9 @@ class TestTaskScheduler(HomeserverTestCase):
 
     async def _sleeping_task(
         self, task: ScheduledTask
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         # Sleep for a second
-        await deferLater(self.reactor, 1, lambda: None)
+        await self.hs.get_clock().sleep(Duration(seconds=1))
         return TaskStatus.COMPLETE, None, None
 
     def test_schedule_lot_of_tasks(self) -> None:
@@ -103,7 +110,7 @@ class TestTaskScheduler(HomeserverTestCase):
                 )
             )
 
-        def get_tasks_of_status(status: TaskStatus) -> List[ScheduledTask]:
+        def get_tasks_of_status(status: TaskStatus) -> list[ScheduledTask]:
             tasks = (
                 self.get_success(self.task_scheduler.get_task(task_id))
                 for task_id in task_ids
@@ -151,7 +158,7 @@ class TestTaskScheduler(HomeserverTestCase):
 
     async def _raising_task(
         self, task: ScheduledTask
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         raise Exception("raising")
 
     def test_schedule_raising_task(self) -> None:
@@ -165,13 +172,15 @@ class TestTaskScheduler(HomeserverTestCase):
 
     async def _resumable_task(
         self, task: ScheduledTask
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         if task.result and "in_progress" in task.result:
             return TaskStatus.COMPLETE, {"success": True}, None
         else:
             await self.task_scheduler.update_task(task.id, result={"in_progress": True})
+            # Create a deferred which we will never complete
+            incomplete_d: Deferred = Deferred()
             # Await forever to simulate an aborted task because of a restart
-            await deferLater(self.reactor, 2**16, lambda: None)
+            await make_deferred_yieldable(incomplete_d)
             # This should never been called
             return TaskStatus.ACTIVE, None, None
 
@@ -184,8 +193,8 @@ class TestTaskScheduler(HomeserverTestCase):
         self.assertEqual(task.status, TaskStatus.ACTIVE)
 
         # Simulate a synapse restart by emptying the list of running tasks
-        self.task_scheduler._running_tasks = set()
-        self.reactor.advance((TaskScheduler.SCHEDULE_INTERVAL_MS / 1000))
+        self.task_scheduler._running_tasks = {}
+        self.reactor.advance(TaskScheduler.SCHEDULE_INTERVAL.as_secs())
 
         task = self.get_success(self.task_scheduler.get_task(task_id))
         assert task is not None
@@ -193,6 +202,101 @@ class TestTaskScheduler(HomeserverTestCase):
         assert task.result is not None
         self.assertTrue(task.result.get("success"))
 
+    def _test_cancel_task(self, task_id: str) -> None:
+        task = self.get_success(self.task_scheduler.get_task(task_id))
+        assert task is not None
+        assert task.status == TaskStatus.ACTIVE
+
+        assert task.result and "counter" in task.result
+        current_counter = int(task.result["counter"])
+
+        self.reactor.advance(1)
+
+        task = self.get_success(self.task_scheduler.get_task(task_id))
+        assert task is not None
+        assert task.status == TaskStatus.ACTIVE
+
+        # At this point the task should have run at least one more time, let's check the counter
+        assert task.result and "counter" in task.result
+        new_counter = int(task.result["counter"])
+        assert new_counter > current_counter
+        current_counter = new_counter
+
+        # Cancelling active task
+        self.get_success(self.task_scheduler.cancel_task(task_id))
+
+        self.reactor.advance(1)
+
+        # Task should be marked as cancelled
+        task = self.get_success(self.task_scheduler.get_task(task_id))
+        assert task is not None
+        self.assertEqual(task.status, TaskStatus.CANCELLED)
+
+        # Task should be in the running tasks
+        assert task_id not in self.task_scheduler._running_tasks
+
+        # Counter should not increase anymore and stay the same
+        assert task.result and "counter" in task.result
+        new_counter = int(task.result["counter"])
+        assert new_counter == current_counter
+        current_counter = new_counter
+
+        # Let's check one more time to be sure that it is not increasing
+        self.reactor.advance(100)
+
+        task = self.get_success(self.task_scheduler.get_task(task_id))
+        assert task is not None
+        assert task.result and "counter" in task.result
+        new_counter = int(task.result["counter"])
+        assert new_counter == current_counter
+
+    async def _incrementing_running_task(
+        self, task: ScheduledTask
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
+        current_counter = 0
+
+        while True:
+            current_counter += 1
+            await self.task_scheduler.update_task(
+                task.id, result={"counter": current_counter}
+            )
+            await self.hs.get_clock().sleep(Duration(microseconds=1))
+
+        return TaskStatus.COMPLETE, None, None  # type: ignore[unreachable]
+
+    def test_cancel_running_task(self) -> None:
+        """Schedule and then cancel a long running task that increments a counter."""
+
+        task_id = self.get_success(
+            self.task_scheduler.schedule_task(
+                "_incrementing_running_task",
+            )
+        )
+
+        self._test_cancel_task(task_id)
+
+    async def _incrementing_active_task(
+        self, task: ScheduledTask
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
+        current_counter = 0
+        if task.result and "counter" in task.result:
+            current_counter = int(task.result["counter"])
+
+        return TaskStatus.ACTIVE, {"counter": current_counter + 1}, None
+
+    def test_cancel_active_task(self) -> None:
+        """Schedule and then cancel a long active task that increments a counter,
+        but step by step, by keeping the task ACTIVE even if it is not running
+        between the steps."""
+
+        task_id = self.get_success(
+            self.task_scheduler.schedule_task(
+                "_incrementing_active_task",
+            )
+        )
+
+        self._test_cancel_task(task_id)
+
 
 class TestTaskSchedulerWithBackgroundWorker(BaseMultiWorkerStreamTestCase):
     def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
@@ -201,7 +305,7 @@ class TestTaskSchedulerWithBackgroundWorker(BaseMultiWorkerStreamTestCase):
 
     async def _test_task(
         self, task: ScheduledTask
-    ) -> Tuple[TaskStatus, Optional[JsonMapping], Optional[str]]:
+    ) -> tuple[TaskStatus, JsonMapping | None, str | None]:
         return (TaskStatus.COMPLETE, None, None)
 
     @override_config({"run_background_tasks_on": "worker1"})
diff --git a/tests/util/test_wheel_timer.py b/tests/util/test_wheel_timer.py
index 6fa575a18e..3dd9a9891f 100644
--- a/tests/util/test_wheel_timer.py
+++ b/tests/util/test_wheel_timer.py
@@ -19,6 +19,7 @@
 #
 #
 
+from synapse.util.duration import Duration
 from synapse.util.wheel_timer import WheelTimer
 
 from .. import unittest
@@ -26,7 +27,7 @@ from .. import unittest
 
 class WheelTimerTestCase(unittest.TestCase):
     def test_single_insert_fetch(self) -> None:
-        wheel: WheelTimer[object] = WheelTimer(bucket_size=5)
+        wheel: WheelTimer[object] = WheelTimer(bucket_size=Duration(milliseconds=5))
 
         wheel.insert(100, "1", 150)
 
@@ -39,7 +40,7 @@ class WheelTimerTestCase(unittest.TestCase):
         self.assertListEqual(wheel.fetch(170), [])
 
     def test_multi_insert(self) -> None:
-        wheel: WheelTimer[object] = WheelTimer(bucket_size=5)
+        wheel: WheelTimer[object] = WheelTimer(bucket_size=Duration(milliseconds=5))
 
         wheel.insert(100, "1", 150)
         wheel.insert(105, "2", 130)
@@ -54,13 +55,13 @@ class WheelTimerTestCase(unittest.TestCase):
         self.assertListEqual(wheel.fetch(210), [])
 
     def test_insert_past(self) -> None:
-        wheel: WheelTimer[object] = WheelTimer(bucket_size=5)
+        wheel: WheelTimer[object] = WheelTimer(bucket_size=Duration(milliseconds=5))
 
         wheel.insert(100, "1", 50)
         self.assertListEqual(wheel.fetch(120), ["1"])
 
     def test_insert_past_multi(self) -> None:
-        wheel: WheelTimer[object] = WheelTimer(bucket_size=5)
+        wheel: WheelTimer[object] = WheelTimer(bucket_size=Duration(milliseconds=5))
 
         wheel.insert(100, "1", 150)
         wheel.insert(100, "2", 140)
@@ -72,7 +73,7 @@ class WheelTimerTestCase(unittest.TestCase):
         self.assertListEqual(wheel.fetch(240), [])
 
     def test_multi_insert_then_past(self) -> None:
-        wheel: WheelTimer[object] = WheelTimer(bucket_size=5)
+        wheel: WheelTimer[object] = WheelTimer(bucket_size=Duration(milliseconds=5))
 
         wheel.insert(100, "1", 150)
         wheel.insert(100, "2", 160)
diff --git a/tests/utils.py b/tests/utils.py
index d1b66d4159..0cf97a7e8d 100644
--- a/tests/utils.py
+++ b/tests/utils.py
@@ -24,27 +24,15 @@ import os
 import signal
 from types import FrameType, TracebackType
 from typing import (
-    Any,
-    Callable,
-    Dict,
-    List,
     Literal,
-    Optional,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     overload,
 )
 
-import attr
-from typing_extensions import ParamSpec
-
 from synapse.api.constants import EventTypes
 from synapse.api.room_versions import RoomVersions
 from synapse.config.homeserver import HomeServerConfig
 from synapse.config.server import DEFAULT_ROOM_VERSION
-from synapse.logging.context import current_context, set_current_context
 from synapse.server import HomeServer
 from synapse.storage.database import LoggingDatabaseConnection
 from synapse.storage.engines import create_engine
@@ -140,21 +128,27 @@ def setupdb() -> None:
 
 
 @overload
-def default_config(name: str, parse: Literal[False] = ...) -> Dict[str, object]: ...
+def default_config(
+    server_name: str, parse: Literal[False] = ...
+) -> dict[str, object]: ...
 
 
 @overload
-def default_config(name: str, parse: Literal[True]) -> HomeServerConfig: ...
+def default_config(server_name: str, parse: Literal[True]) -> HomeServerConfig: ...
 
 
 def default_config(
-    name: str, parse: bool = False
-) -> Union[Dict[str, object], HomeServerConfig]:
+    server_name: str, parse: bool = False
+) -> dict[str, object] | HomeServerConfig:
     """
     Create a reasonable test config.
+
+    Args:
+        server_name: homeserver name
+        parse: TODO
     """
     config_dict = {
-        "server_name": name,
+        "server_name": server_name,
         # Setting this to an empty list turns off federation sending.
         "federation_sender_instances": [],
         "media_store_path": "media",
@@ -204,7 +198,9 @@ def default_config(
         "rc_invites": {
             "per_room": {"per_second": 10000, "burst_count": 10000},
             "per_user": {"per_second": 10000, "burst_count": 10000},
+            "per_issuer": {"per_second": 10000, "burst_count": 10000},
         },
+        "rc_room_creation": {"per_second": 10000, "burst_count": 10000},
         "rc_3pid_validation": {"per_second": 10000, "burst_count": 10000},
         "rc_presence": {"per_user": {"per_second": 10000, "burst_count": 10000}},
         "saml2_enabled": False,
@@ -247,101 +243,6 @@ def mock_getRawHeaders(headers=None):  # type: ignore[no-untyped-def]
     return getRawHeaders
 
 
-P = ParamSpec("P")
-
-
-@attr.s(slots=True, auto_attribs=True)
-class Timer:
-    absolute_time: float
-    callback: Callable[[], None]
-    expired: bool
-
-
-# TODO: Make this generic over a ParamSpec?
-@attr.s(slots=True, auto_attribs=True)
-class Looper:
-    func: Callable[..., Any]
-    interval: float  # seconds
-    last: float
-    args: Tuple[object, ...]
-    kwargs: Dict[str, object]
-
-
-class MockClock:
-    now = 1000.0
-
-    def __init__(self) -> None:
-        # Timers in no particular order
-        self.timers: List[Timer] = []
-        self.loopers: List[Looper] = []
-
-    def time(self) -> float:
-        return self.now
-
-    def time_msec(self) -> int:
-        return int(self.time() * 1000)
-
-    def call_later(
-        self,
-        delay: float,
-        callback: Callable[P, object],
-        *args: P.args,
-        **kwargs: P.kwargs,
-    ) -> Timer:
-        ctx = current_context()
-
-        def wrapped_callback() -> None:
-            set_current_context(ctx)
-            callback(*args, **kwargs)
-
-        t = Timer(self.now + delay, wrapped_callback, False)
-        self.timers.append(t)
-
-        return t
-
-    def looping_call(
-        self,
-        function: Callable[P, object],
-        interval: float,
-        *args: P.args,
-        **kwargs: P.kwargs,
-    ) -> None:
-        self.loopers.append(Looper(function, interval / 1000.0, self.now, args, kwargs))
-
-    def cancel_call_later(self, timer: Timer, ignore_errs: bool = False) -> None:
-        if timer.expired:
-            if not ignore_errs:
-                raise Exception("Cannot cancel an expired timer")
-
-        timer.expired = True
-        self.timers = [t for t in self.timers if t != timer]
-
-    # For unit testing
-    def advance_time(self, secs: float) -> None:
-        self.now += secs
-
-        timers = self.timers
-        self.timers = []
-
-        for t in timers:
-            if t.expired:
-                raise Exception("Timer already expired")
-
-            if self.now >= t.absolute_time:
-                t.expired = True
-                t.callback()
-            else:
-                self.timers.append(t)
-
-        for looped in self.loopers:
-            if looped.last + looped.interval < self.now:
-                looped.func(*looped.args, **looped.kwargs)
-                looped.last = self.now
-
-    def advance_time_msec(self, ms: float) -> None:
-        self.advance_time(ms / 1000.0)
-
-
 async def create_room(hs: HomeServer, room_id: str, creator_id: str) -> None:
     """Creates and persist a creation event for the given room"""
 
@@ -380,7 +281,7 @@ async def create_room(hs: HomeServer, room_id: str, creator_id: str) -> None:
 T = TypeVar("T")
 
 
-def checked_cast(type: Type[T], x: object) -> T:
+def checked_cast(type: type[T], x: object) -> T:
     """A version of typing.cast that is checked at runtime.
 
     We have our own function for this for two reasons:
@@ -419,13 +320,13 @@ class test_timeout:
     ```
     """
 
-    def __init__(self, seconds: int, error_message: Optional[str] = None) -> None:
+    def __init__(self, seconds: int, error_message: str | None = None) -> None:
         self.error_message = f"Test timed out after {seconds}s"
         if error_message is not None:
             self.error_message += f": {error_message}"
         self.seconds = seconds
 
-    def handle_timeout(self, signum: int, frame: Optional[FrameType]) -> None:
+    def handle_timeout(self, signum: int, frame: FrameType | None) -> None:
         raise TestTimeout(self.error_message)
 
     def __enter__(self) -> None:
@@ -434,8 +335,8 @@ class test_timeout:
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_val: Optional[BaseException],
-        exc_tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
     ) -> None:
         signal.alarm(0)
diff --git a/tox.ini b/tox.ini
index a506b5034d..a0e397bbbf 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py39, py310, py311, py312, py313
+envlist = py310, py311, py312, py313
 
 # we require tox>=2.3.2 for the fix to https://github.com/tox-dev/tox/issues/208
 minversion = 2.3.2