Fix some dead torrents not being processed (#778 )

Fix Seeker not reporting an episode grab (#776 )
Add support for changing the username (#775 )
2026-09-08 11:28:02 -04:00 · 2026-09-08 14:39:26 +03:00 · 2026-09-08 13:14:46 +03:00 · 2026-09-08 13:14:30 +03:00 · 2026-09-08 00:11:38 +03:00 · 2026-09-08 00:11:12 +03:00
1452 changed files with 205423 additions and 44971 deletions
@@ -1 +1 @@
-github: Flaminel
+github: Cleanuparr
@@ -21,7 +21,7 @@ runs:
  using: "composite"
  steps:
    - name: Get vault secrets
-      uses: hashicorp/vault-action@v2
+      uses: hashicorp/vault-action@v4
      with:
        url: ${{ inputs.vault_host }}
        method: approle
@@ -0,0 +1,25 @@
+changelog:
+  exclude:
+    labels:
+      - duplicate
+      - invalid
+      - wontfix
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking
+    - title: Features
+      labels:
+        - enhancement
+    - title: Bug Fixes
+      labels:
+        - bug
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Maintenance
+      labels:
+        - chore
+    - title: Other Changes
+      labels:
+        - "*"
@@ -16,10 +16,20 @@ on:
        type: string
        required: false
        default: ''
+      ref:
+        description: 'Commit SHA to build. The image revision metadata uses this value. Defaults to the ref derived from the event.'
+        type: string
+        required: false
+        default: ''
+      pr_number:
+        description: 'PR number to tag the image with (pr-N). Required when called outside a pull_request event.'
+        type: string
+        required: false
+        default: ''

 # Cancel in-progress runs for the same PR
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: build-docker-${{ inputs.pr_number || github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

 permissions:
@@ -40,15 +50,25 @@ jobs:
      version_docker_tag: ${{ steps.build-info.outputs.version_docker_tag }}
      branch: ${{ steps.build-info.outputs.branch }}
      push: ${{ steps.build-info.outputs.push }}
-      github_sha: ${{ github.sha }}
+      github_sha: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}
    steps:
      - name: Initialize build info
        id: build-info
        timeout-minutes: 1
+        env:
+          GITHUB_HEAD_REF: ${{ github.head_ref }}
+          GITHUB_REF: ${{ github.ref }}
+          INPUT_VERSION: ${{ inputs.app_version }}
+          INPUT_REF: ${{ inputs.ref }}
+          INPUT_PR_NUMBER: ${{ inputs.pr_number }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
-          githubHeadRef="${{ github.head_ref }}"
-          githubRef="${{ github.ref }}"
-          inputVersion="${{ inputs.app_version }}"
+          githubHeadRef="$GITHUB_HEAD_REF"
+          githubRef="$GITHUB_REF"
+          inputVersion="$INPUT_VERSION"
+          inputRef="$INPUT_REF"
+          inputPrNumber="$INPUT_PR_NUMBER"
          latestDockerTag=""
          versionDockerTag=""
          majorVersionDockerTag=""
@@ -80,14 +100,18 @@ jobs:
              minorVersionDockerTag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
            fi
          else
-            if [[ -z "$githubHeadRef" ]]; then
+            if [[ -n "$inputPrNumber" ]]; then
+              # Pull request built outside a pull_request event (no head_ref available)
+              branch="$inputRef"
+              versionDockerTag="pr-$inputPrNumber"
+            elif [[ -z "$githubHeadRef" ]]; then
              # Main branch
              branch=${githubRef##*/}
              versionDockerTag="$branch"
            else
              # Pull request
-              branch=$githubHeadRef
-              versionDockerTag="$branch"
+              branch="$PR_HEAD_SHA"
+              versionDockerTag="pr-$PR_NUMBER"
            fi
          fi

@@ -133,7 +157,7 @@ jobs:
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -144,23 +168,24 @@ jobs:
            secrets/data/github packages_pat | PACKAGES_PAT

      - name: Checkout target repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        timeout-minutes: 1
        with:
          repository: ${{ github.repository }}
          ref: ${{ needs.prepare.outputs.branch }}
          token: ${{ env.REPO_READONLY_PAT }}
+          persist-credentials: false

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
        timeout-minutes: 5

      - name: Login to GitHub Container Registry
        if: needs.prepare.outputs.push == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -170,14 +195,14 @@ jobs:
        if: needs.prepare.outputs.push == 'true'
        id: build-push
        timeout-minutes: 30
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: ${{ github.workspace }}/code
          file: ${{ github.workspace }}/code/Dockerfile
          provenance: false
          labels: |
-            commit=sha-${{ needs.prepare.outputs.github_sha }}
-            version=${{ needs.prepare.outputs.version_docker_tag }}
+            org.opencontainers.image.revision=${{ needs.prepare.outputs.github_sha }}
+            org.opencontainers.image.version=${{ needs.prepare.outputs.version_docker_tag }}
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
@@ -190,14 +215,14 @@ jobs:
      - name: Build (no push)
        if: needs.prepare.outputs.push != 'true'
        timeout-minutes: 30
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: ${{ github.workspace }}/code
          file: ${{ github.workspace }}/code/Dockerfile
          provenance: false
          labels: |
-            commit=sha-${{ needs.prepare.outputs.github_sha }}
-            version=${{ needs.prepare.outputs.version_docker_tag }}
+            org.opencontainers.image.revision=${{ needs.prepare.outputs.github_sha }}
+            org.opencontainers.image.version=${{ needs.prepare.outputs.version_docker_tag }}
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
@@ -216,7 +241,7 @@ jobs:

      - name: Upload digest
        if: needs.prepare.outputs.push == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
@@ -230,17 +255,17 @@ jobs:
    if: needs.prepare.outputs.push == 'true'
    steps:
      - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -261,6 +286,8 @@ jobs:
          done

          docker buildx imagetools create $tag_args \
+            --annotation "index:org.opencontainers.image.version=${{ needs.prepare.outputs.version_docker_tag }}" \
+            --annotation "index:org.opencontainers.image.revision=${{ needs.prepare.outputs.github_sha }}" \
            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)

      - name: Inspect image
@@ -8,6 +8,24 @@ on:
        type: string
        required: false
        default: ''
+      ref:
+        description: 'Git ref to checkout (branch, tag, or SHA). Defaults to github.ref_name.'
+        type: string
+        required: false
+        default: ''
+      platforms:
+        description: 'JSON array of runtime/platform pairs to build. Defaults to all platforms.'
+        type: string
+        required: false
+        default: >-
+          [{"runtime":"win-x64","platform":"win-amd64"},
+           {"runtime":"linux-x64","platform":"linux-amd64"},
+           {"runtime":"linux-arm64","platform":"linux-arm64"},
+           {"runtime":"osx-x64","platform":"osx-amd64"},
+           {"runtime":"osx-arm64","platform":"osx-arm64"}]
+
+permissions:
+  contents: read

 jobs:
  # Build for each platform in parallel using matrix strategy
@@ -16,17 +34,7 @@ jobs:
    strategy:
      fail-fast: true
      matrix:
-        include:
-          - runtime: win-x64
-            platform: win-amd64
-          - runtime: linux-x64
-            platform: linux-amd64
-          - runtime: linux-arm64
-            platform: linux-arm64
-          - runtime: osx-x64
-            platform: osx-amd64
-          - runtime: osx-arm64
-            platform: osx-arm64
+        include: ${{ fromJSON(inputs.platforms) }}

    steps:
      - name: Set variables
@@ -55,7 +63,7 @@ jobs:
          echo "executableName=Cleanuparr.Api" >> $GITHUB_ENV

      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -66,20 +74,21 @@ jobs:
            secrets/data/github packages_pat | PACKAGES_PAT

      - name: Checkout target repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        timeout-minutes: 1
        with:
          repository: ${{ env.githubRepository }}
-          ref: ${{ github.ref_name }}
+          ref: ${{ inputs.ref || github.ref_name }}
          token: ${{ env.REPO_READONLY_PAT }}
+          persist-credentials: false

      - name: Setup dotnet
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: 10.0.200

      - name: Cache NuGet packages
-        uses: actions/cache@v4
+        uses: actions/cache@v6
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/*.csproj') }}
@@ -87,7 +96,7 @@ jobs:
            ${{ runner.os }}-nuget-

      - name: Download frontend artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: frontend-dist
          path: code/frontend/dist/ui/browser
@@ -119,7 +128,7 @@ jobs:
          zip -r ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-${{ matrix.platform }}.zip ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-${{ matrix.platform }}/

      - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: executable-${{ matrix.platform }}
          path: ./artifacts/*.zip
@@ -9,12 +9,15 @@ on:
        required: false
        default: ''

+permissions:
+  contents: read
+
 jobs:
  build-frontend:
    runs-on: ubuntu-latest
    steps:
      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -24,17 +27,18 @@ jobs:
            secrets/data/github repo_readonly_pat | REPO_READONLY_PAT

      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        timeout-minutes: 1
        with:
          repository: ${{ github.repository }}
          ref: ${{ inputs.ref || github.ref_name }}
          token: ${{ env.REPO_READONLY_PAT }}
+          persist-credentials: false

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'npm'
          cache-dependency-path: code/frontend/package-lock.json

@@ -45,7 +49,7 @@ jobs:
          npm run build

      - name: Upload frontend artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: frontend-dist
          path: code/frontend/dist/ui/browser
@@ -1,7 +1,7 @@
 name: Build macOS Installers

 permissions:
-  contents: write
+  contents: read

 on:
  workflow_call:
@@ -59,7 +59,7 @@ jobs:
          echo "executableName=Cleanuparr.Api" >> $GITHUB_ENV

      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -70,21 +70,22 @@ jobs:
            secrets/data/github packages_pat | PACKAGES_PAT

      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        with:
          repository: ${{ env.githubRepository }}
          ref: ${{ github.ref_name }}
          token: ${{ env.REPO_READONLY_PAT }}
          fetch-depth: 0
+          persist-credentials: false

      - name: Download frontend artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: frontend-dist
          path: code/frontend/dist/ui/browser

      - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: 10.0.200

@@ -369,7 +370,7 @@ jobs:
          echo "pkgName=${pkg_name}" >> $GITHUB_ENV

      - name: Upload installer as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: Cleanuparr-macos-${{ matrix.artifact_suffix }}-installer
          path: '${{ env.pkgName }}'
@@ -14,6 +14,9 @@ on:
        required: false
        default: ''

+permissions:
+  contents: read
+
 jobs:
  build-windows-installer:
    runs-on: windows-latest
@@ -49,7 +52,7 @@ jobs:
          echo "executableName=Cleanuparr.Api" >> $env:GITHUB_ENV

      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -60,20 +63,21 @@ jobs:
            secrets/data/github packages_pat | PACKAGES_PAT

      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        with:
          repository: ${{ env.githubRepository }}
          ref: ${{ inputs.ref || github.ref_name }}
          token: ${{ env.REPO_READONLY_PAT }}
+          persist-credentials: false

      - name: Download frontend artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: frontend-dist
          path: code/frontend/dist/ui/browser

      - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: 10.0.200

@@ -95,14 +99,7 @@ jobs:
      - name: Setup Inno Setup
        shell: pwsh
        run: |
-          # Download and install Inno Setup
-          $url = "https://jrsoftware.org/download.php/is.exe"
-          $output = "innosetup-installer.exe"
-          
-          Invoke-WebRequest -Uri $url -OutFile $output
-          Start-Process -FilePath $output -ArgumentList "/VERYSILENT", "/SUPPRESSMSGBOXES", "/NORESTART" -Wait
-          
-          # Add Inno Setup to PATH
+          choco install innosetup --no-progress -y
          $innoPath = "C:\Program Files (x86)\Inno Setup 6"
          echo "$innoPath" >> $env:GITHUB_PATH

@@ -143,10 +140,10 @@ jobs:
          echo "installerName=$installerName" >> $env:GITHUB_ENV

      - name: Upload installer artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: Cleanuparr-windows-installer
          path: installer/${{ env.installerName }}
          retention-days: 30

-      # Removed individual release step - handled by main release workflow 
+      # Removed individual release step - handled by main release workflow 
@@ -12,6 +12,9 @@ on:
      - 'whitelist_with_subtitles'
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  deploy:
    runs-on: ubuntu-latest
@@ -19,7 +22,9 @@ jobs:
    
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false

      - name: Create directory for static files
        run: |
@@ -33,8 +38,9 @@ jobs:
          cp whitelist_with_subtitles Cloudflare/static/
      
      - name: Deploy to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
        with:
          apiToken: ${{ secrets.CLOUDFLARE_PAGES_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: "Cloudflare"
-          command: pages deploy . --project-name=cleanuparr
+          command: pages deploy . --project-name=cleanuparr
@@ -1,20 +1,32 @@
-name: Deploy to Cloudflare Pages
+name: Deploy Status Page to Cloudflare Pages

 on:
-  push:
-    tags:
-      - "v*.*.*"
+  workflow_call:
+    inputs:
+      version:
+        description: 'Release version (e.g. v1.2.3)'
+        type: string
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (e.g. v1.2.3)'
+        type: string
+        required: true
+
+permissions:
+  contents: read

 jobs:
  deploy:
    runs-on: ubuntu-latest
-    name: Deploy to Cloudflare Pages
+    name: Deploy Status Page to Cloudflare Pages
    
    steps:
      - name: Create status files
        run: |
          mkdir -p status
-          echo "{ \"version\": \"${GITHUB_REF_NAME}\" }" > status/status.json
+          echo "{ \"version\": \"${{ inputs.version }}\" }" > status/status.json

          # Cache static files for 10 minutes
          cat > status/_headers << 'EOF'
@@ -23,8 +35,9 @@ jobs:
          EOF
      
      - name: Deploy to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
        with:
          apiToken: ${{ secrets.CLOUDFLARE_PAGES_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: "status"
-          command: pages deploy . --project-name=cleanuparr-status
+          command: pages deploy . --project-name=cleanuparr-status
@@ -19,10 +19,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false

      - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
        with:
          # Fail on critical and high severity vulnerabilities
          fail-on-severity: high
@@ -37,7 +39,7 @@ jobs:
          vulnerability-check: true

      - name: Upload dependency review results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: dependency-review-results
          path: dependency-review-*.json
@@ -0,0 +1,63 @@
+name: Docs Preview Cleanup
+
+on:
+  pull_request:
+    types: [closed]
+    paths:
+      - 'docs/**'
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number whose preview deployments to delete'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    # Skip fork PRs
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
+    env:
+      CF_API_TOKEN: ${{ secrets.CLOUDFLARE_PAGES_TOKEN }}
+      CF_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      PROJECT: cleanuparr-docs
+      BRANCH: pull-${{ github.event.pull_request.number || inputs.pr_number }}
+    steps:
+      - name: Delete preview deployments for this PR
+        run: |
+          set -euo pipefail
+          api="https://api.cloudflare.com/client/v4"
+          auth="Authorization: Bearer $CF_API_TOKEN"
+
+          if [ -z "${CF_ACCOUNT_ID:-}" ]; then
+            echo "CLOUDFLARE_ACCOUNT_ID repo variable is not set" >&2
+            exit 1
+          fi
+          echo "Account $CF_ACCOUNT_ID, tearing down branch $BRANCH"
+
+          ids=""
+          page=1
+          while :; do
+            resp=$(curl -fsS -H "$auth" \
+              "$api/accounts/$CF_ACCOUNT_ID/pages/projects/$PROJECT/deployments?page=$page&per_page=25")
+            count=$(echo "$resp" | jq '.result | length')
+            [ "$count" -eq 0 ] && break
+
+            page_ids=$(echo "$resp" | jq -r --arg b "$BRANCH" \
+              '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')
+            ids="$ids $page_ids"
+            page=$((page + 1))
+          done
+
+          deleted=0
+          for id in $ids; do
+            echo "Deleting deployment $id"
+            curl -fsS -X DELETE -H "$auth" \
+              "$api/accounts/$CF_ACCOUNT_ID/pages/projects/$PROJECT/deployments/$id?force=true" >/dev/null
+            deleted=$((deleted + 1))
+          done
+
+          echo "Deleted $deleted deployment(s) for $BRANCH"
@@ -0,0 +1,85 @@
+name: Docs Preview
+
+on:
+  pull_request:
+    paths:
+      - 'docs/**'
+
+concurrency:
+  group: docs-preview-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  preview:
+    runs-on: ubuntu-latest
+    # Skip fork PRs
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 26.x
+          cache: yarn
+          cache-dependency-path: docs/yarn.lock
+
+      - name: Install dependencies
+        working-directory: docs
+        run: yarn install --frozen-lockfile
+
+      - name: Build Docusaurus
+        working-directory: docs
+        run: yarn build
+
+      - name: Deploy preview to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v4
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_PAGES_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          workingDirectory: docs
+          command: pages deploy build --project-name=cleanuparr-docs --branch=pull-${{ github.event.pull_request.number }}
+
+      - name: Comment preview URL
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const url = `https://pull-${context.issue.number}.cleanuparr-docs.pages.dev`;
+            const marker = '<!-- docs-preview -->';
+            const body = [
+              marker,
+              `Docs preview for \`${context.payload.pull_request.head.ref}\` (\`${context.payload.pull_request.head.sha.substring(0, 7)}\`):`,
+              ``,
+              `${url}/docs`
+            ].join('\n');
+
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              per_page: 100
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body
+              });
+            }
@@ -1,9 +1,7 @@
 name: Deploy Docusaurus to GitHub Pages

 on:
-  push:
-    tags:
-      - "v*.*.*"
+  workflow_call: {}
  workflow_dispatch: {}

 permissions:
@@ -12,22 +10,20 @@ permissions:
  id-token: write

 jobs:
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
+  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: main
+          persist-credentials: false

      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
-          node-version: 24.x
+          node-version: 26.x
          cache: yarn
          cache-dependency-path: docs/yarn.lock

@@ -39,12 +35,39 @@ jobs:
        working-directory: docs
        run: yarn build

-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+      - name: Publish to org site
+        uses: peaceiris/actions-gh-pages@v4
        with:
-          path: docs/build
+          personal_token: ${{ secrets.DOCS_DEPLOY_TOKEN }}
+          external_repository: Cleanuparr/Cleanuparr.github.io
+          publish_branch: gh-pages
+          publish_dir: docs/build
+
+  redirect:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build redirect stub
+        run: |
+          mkdir redirect
+          cat > redirect/404.html <<'EOF'
+          <!doctype html>
+          <meta http-equiv="refresh" content="0;url=https://cleanuparr.github.io/docs">
+          <script>
+            var p = location.pathname.replace(/^\/Cleanuparr/, '');
+            location.replace('https://cleanuparr.github.io' + p + location.search + location.hash);
+          </script>
+          EOF
+          cp redirect/404.html redirect/index.html
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: redirect
          retention-days: 1

-      - name: Deploy to GitHub Pages
+      - name: Deploy redirect to GitHub Pages
        id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
@@ -1,22 +1,17 @@
 name: E2E Tests

 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'code/**'
-      - 'e2e/**'
-      - '.github/workflows/e2e.yml'
-  pull_request:
-    paths:
-      - 'code/**'
-      - 'e2e/**'
-      - '.github/workflows/e2e.yml'
  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout (branch, tag, or SHA). Defaults to the triggering ref.'
+        type: string
+        required: false
+        default: ''
+  workflow_dispatch:

 concurrency:
-  group: E2E Tests-${{ github.event.pull_request.number || github.ref }}
+  group: E2E Tests-${{ inputs.ref || github.ref }}
  cancel-in-progress: true

 permissions:
@@ -25,15 +20,51 @@ permissions:
 jobs:
  e2e:
    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 60
+
+    strategy:
+      fail-fast: false
+      matrix:
+        suite:
+          # These folders need only the app, Keycloak, nginx and the wiremocks.
+          - name: core
+            make-target: up-core
+            projects: >-
+              --project=account --project=arr --project=auth
+              --project=blacklist-sync --project=core --project=download-client
+              --project=general --project=notifications --project=oidc
+              --project=queue-cleaner --project=regression --project=seeker
+              --project=signalr
+          # These folders need the torrent clients and the tracker.
+          - name: clients
+            make-target: up-clients
+            projects: '--project=download-cleaner --project=malware-blocker'
+          # This folder needs the real arrs, the fake indexer and qBittorrent.
+          - name: live-arr
+            make-target: up-arr
+            projects: '--project=live-arr'
+          # Same stack, but the app is built from patched sources.
+          # See e2e/patches: the Seeker can be triggered instead of waited for.
+          - name: live-arr-fast
+            make-target: up-arr-fast
+            projects: '--project=live-arr-fast'
+          # This folder needs the real LazyLibrarian, the fake indexer and qBittorrent.
+          - name: live-lazylibrarian
+            make-target: up-lazylibrarian
+            projects: '--project=live-lazylibrarian'
+
+    name: e2e (${{ matrix.suite.name }})

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        timeout-minutes: 1
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false

      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -44,45 +75,57 @@ jobs:

      - name: Start services
        working-directory: e2e
-        run: docker compose -f docker-compose.e2e.yml up -d --build
+        run: make ${{ matrix.suite.make-target }}
        env:
          PACKAGES_USERNAME: ${{ github.repository_owner }}
          PACKAGES_PAT: ${{ env.PACKAGES_PAT }}

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
-          node-version: 22
+          node-version: 26
+          cache: 'npm'
+          cache-dependency-path: e2e/package-lock.json

      - name: Install E2E dependencies
        working-directory: e2e
        run: npm ci

+      - name: Resolve Playwright version
+        id: playwright
+        working-directory: e2e
+        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ steps.playwright.outputs.version }}
+
+      - name: Report runner disk space
+        run: df -h /
+
      - name: Install Playwright browsers
        working-directory: e2e
+        timeout-minutes: 10
+        env:
+          DEBUG: pw:install
        run: npx playwright install --with-deps chromium

-      - name: Wait for Keycloak
-        run: |
-          echo "Waiting for Keycloak realm to be ready..."
-          timeout 120 bash -c 'until curl -sf http://localhost:8080/realms/cleanuparr-test/.well-known/openid-configuration; do sleep 3; done'
-          echo "Keycloak ready!"
-
-      - name: Wait for app
-        run: |
-          echo "Waiting for Cleanuparr to be ready..."
-          timeout 120 bash -c 'until curl -sf http://localhost:5000/health; do sleep 3; done'
-          echo "App ready!"
-
      - name: Run E2E tests
        working-directory: e2e
-        run: npx playwright test
+        run: npx playwright test ${{ matrix.suite.projects }}
+
+      - name: Dump service logs
+        if: failure()
+        working-directory: e2e
+        run: docker compose -f docker-compose.e2e.yml logs --no-color --tail 500

      - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        if: always()
        with:
-          name: e2e-test-results
+          name: e2e-test-results-${{ matrix.suite.name }}
          path: |
            e2e/playwright-report/
            e2e/test-results/
@@ -91,4 +134,4 @@ jobs:
      - name: Stop services
        if: always()
        working-directory: e2e
-        run: docker compose -f docker-compose.e2e.yml down
+        run: make down
@@ -0,0 +1,74 @@
+name: PR Approve (Comment Triggered)
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+
+jobs:
+  approve:
+    runs-on: ubuntu-latest
+    if: github.event.issue.pull_request != null
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+
+    steps:
+      - name: Approve PR
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const comment = context.payload.comment.body.trim();
+
+            const ALLOWED_USERS = ['flaminel'];
+
+            if (comment !== '/approve') {
+              console.log(`Comment "${comment}" is not the approve command, skipping.`);
+              return;
+            }
+
+            const login = context.payload.comment.user.login;
+            if (!ALLOWED_USERS.includes(login.toLowerCase())) {
+              console.log(`User ${login} is not allowed to approve, skipping.`);
+              return;
+            }
+
+            const pr = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number
+            });
+
+            if (pr.data.state !== 'open') {
+              console.log('PR is not open, skipping.');
+              return;
+            }
+
+            if (pr.data.draft) {
+              console.log('PR is a draft, skipping.');
+              return;
+            }
+
+            await github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.data.number,
+              event: 'APPROVE',
+              body: `Approved on behalf of @${login}.`
+            });
+
+            console.log(`${login} approved PR #${pr.data.number} @ ${pr.data.head.sha}.`);
+
+            try {
+              await github.rest.reactions.createForIssueComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: context.payload.comment.id,
+                content: '+1'
+              });
+            } catch (e) {
+              console.log(`Could not add reaction: ${e}`);
+            }
@@ -4,21 +4,21 @@ on:
  issue_comment:
    types: [created]

-concurrency:
-  group: pr-build-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
 permissions:
-  issues: write
-  pull-requests: write
-  actions: read
+  contents: read

 jobs:
  validate:
    runs-on: ubuntu-latest
    if: github.event.issue.pull_request != null
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+      statuses: write
    outputs:
-      build_windows: ${{ steps.parse.outputs.build_windows }}
+      build: ${{ steps.parse.outputs.build }}
+      meta: ${{ steps.parse.outputs.meta }}
      pr_ref: ${{ steps.parse.outputs.pr_ref }}
      pr_sha: ${{ steps.parse.outputs.pr_sha }}
      pr_number: ${{ steps.parse.outputs.pr_number }}
@@ -26,20 +26,51 @@ jobs:
    steps:
      - name: Parse command and check permissions
        id: parse
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          script: |
            const comment = context.payload.comment.body.trim();

+            const ALLOWED_USERS = ['flaminel'];
+
            // Parse supported commands
            const commands = {
-              '/build-windows': 'build_windows'
+              '/build-windows': {
+                target: 'windows',
+                label: 'Windows installer',
+                artifacts: '`Cleanuparr-windows-installer`'
+              },
+              '/build-linux': {
+                target: 'linux',
+                label: 'Linux executables',
+                artifacts: '`executable-linux-amd64` and `executable-linux-arm64`'
+              },
+              '/test': {
+                target: 'test',
+                label: 'Unit tests',
+                artifacts: '`test-results`, `coverage-report` and `frontend-coverage-report`'
+              },
+              '/e2e': {
+                target: 'e2e',
+                label: 'E2E tests',
+                artifacts: '`e2e-test-results-core` and `e2e-test-results-clients`'
+              },
+              '/build-docker': {
+                target: 'docker',
+                label: 'Docker image',
+                artifacts: ''
+              }
            };

            const command = commands[comment];
            if (!command) {
              console.log(`Comment "${comment}" is not a recognized build command, skipping.`);
-              core.setOutput('build_windows', 'false');
+              return;
+            }
+
+            const login = context.payload.comment.user.login;
+            if (!ALLOWED_USERS.includes(login.toLowerCase())) {
+              console.log(`User ${login} is not allowed to trigger builds, skipping.`);
              return;
            }

@@ -64,49 +95,27 @@ jobs:
            // Verify PR is open
            if (pr.data.state !== 'open') {
              console.log('PR is not open, skipping.');
-              core.setOutput('build_windows', 'false');
              return;
            }

-            // Block fork PRs — fork code should not run with access to secrets
-            const isFork = pr.data.head.repo.full_name !== context.repo.owner + '/' + context.repo.repo;
-            if (isFork) {
-              console.log(`PR is from fork ${pr.data.head.repo.full_name}, blocking build.`);
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body: 'On-demand builds are not available for PRs from forks.'
-              });
-              core.setOutput('build_windows', 'false');
-              return;
-            }
+            console.log(`${login} triggered ${comment} on PR #${pr.data.number} @ ${pr.data.head.sha}.`);

-            // Verify commenter has write access
-            let permission = 'none';
            try {
-              const resp = await github.rest.repos.getCollaboratorPermissionLevel({
+              await github.rest.repos.createCommitStatus({
                owner: context.repo.owner,
                repo: context.repo.repo,
-                username: context.payload.comment.user.login
+                sha: pr.data.head.sha,
+                state: 'pending',
+                context: `pr-build / ${command.target}`,
+                description: `${command.label} running`,
+                target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`
              });
-              permission = resp.data.permission;
-            } catch (_) {}
-
-            if (!['admin', 'write'].includes(permission)) {
-              console.log(`User ${context.payload.comment.user.login} has '${permission}' permission — insufficient.`);
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body: `@${context.payload.comment.user.login} Only collaborators with write access can trigger builds.`
-              });
-              core.setOutput('build_windows', 'false');
-              return;
+            } catch (e) {
+              console.log(`Could not create commit status: ${e}`);
            }

-            console.log(`User ${context.payload.comment.user.login} has '${permission}' permission — proceeding with ${command}.`);
-            core.setOutput(command, 'true');
+            core.setOutput('build', command.target);
+            core.setOutput('meta', JSON.stringify({ label: command.label, artifacts: command.artifacts }));

            // Export PR details for downstream jobs
            core.setOutput('pr_ref', pr.data.head.ref);
@@ -115,59 +124,167 @@ jobs:

  build-frontend:
    needs: validate
-    if: needs.validate.outputs.build_windows == 'true'
+    if: needs.validate.outputs.build == 'windows' || needs.validate.outputs.build == 'linux'
    uses: ./.github/workflows/build-frontend.yml
    with:
-      ref: ${{ needs.validate.outputs.pr_ref }}
+      ref: ${{ needs.validate.outputs.pr_sha }}
    secrets: inherit

  build-windows:
    needs: [validate, build-frontend]
-    if: needs.validate.outputs.build_windows == 'true'
+    if: needs.validate.outputs.build == 'windows'
+    concurrency:
+      group: pr-build-windows-${{ needs.validate.outputs.pr_number }}
+      cancel-in-progress: true
    uses: ./.github/workflows/build-windows-installer.yml
    with:
-      ref: ${{ needs.validate.outputs.pr_ref }}
+      ref: ${{ needs.validate.outputs.pr_sha }}
+    secrets: inherit
+
+  build-linux:
+    needs: [validate, build-frontend]
+    if: needs.validate.outputs.build == 'linux'
+    concurrency:
+      group: pr-build-linux-${{ needs.validate.outputs.pr_number }}
+      cancel-in-progress: true
+    uses: ./.github/workflows/build-executable.yml
+    with:
+      ref: ${{ needs.validate.outputs.pr_sha }}
+      platforms: '[{"runtime":"linux-x64","platform":"linux-amd64"},{"runtime":"linux-arm64","platform":"linux-arm64"}]'
+    secrets: inherit
+
+  test:
+    needs: validate
+    if: needs.validate.outputs.build == 'test'
+    concurrency:
+      group: pr-test-${{ needs.validate.outputs.pr_number }}
+      cancel-in-progress: true
+    uses: ./.github/workflows/test.yml
+    with:
+      ref: ${{ needs.validate.outputs.pr_sha }}
+    secrets: inherit
+
+  e2e:
+    needs: validate
+    if: needs.validate.outputs.build == 'e2e'
+    concurrency:
+      group: pr-e2e-${{ needs.validate.outputs.pr_number }}
+      cancel-in-progress: true
+    uses: ./.github/workflows/e2e.yml
+    with:
+      ref: ${{ needs.validate.outputs.pr_sha }}
+    secrets: inherit
+
+  build-docker:
+    needs: validate
+    if: needs.validate.outputs.build == 'docker'
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/build-docker.yml
+    with:
+      ref: ${{ needs.validate.outputs.pr_sha }}
+      pr_number: ${{ needs.validate.outputs.pr_number }}
+      push_docker: true
    secrets: inherit

  post-result:
-    needs: [validate, build-windows]
-    if: always() && needs.validate.outputs.build_windows == 'true'
+    needs: [validate, build-frontend, build-windows, build-linux, test, e2e, build-docker]
+    if: always() && needs.validate.outputs.build != ''
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+      statuses: write

    steps:
      - name: Post result comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
+        env:
+          PR_REF: ${{ needs.validate.outputs.pr_ref }}
+          META: ${{ needs.validate.outputs.meta }}
        with:
          script: |
-            const buildResult = '${{ needs.build-windows.result }}';
-            const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
-            const prRef = '${{ needs.validate.outputs.pr_ref }}';
-            const prSha = '${{ needs.validate.outputs.pr_sha }}';
-            const shortSha = prSha.substring(0, 7);
+            const target = '${{ needs.validate.outputs.build }}';

-            // Skip comment for skipped builds
-            if (buildResult === 'skipped') {
-              console.log('Build was skipped, no comment needed.');
+            // needs.* is only readable inside this job, so the result lookup has to live here.
+            const results = {
+              windows: '${{ needs.build-windows.result }}',
+              linux: '${{ needs.build-linux.result }}',
+              test: '${{ needs.test.result }}',
+              e2e: '${{ needs.e2e.result }}',
+              docker: '${{ needs.build-docker.result }}'
+            };
+
+            const frontend = '${{ needs.build-frontend.result }}';
+
+            let result = results[target];
+            if (result === 'skipped' && (frontend === 'failure' || frontend === 'cancelled')) {
+              result = frontend;
+            }
+
+            if (!result || result === 'skipped') {
+              console.log(`Nothing to report for target "${target}" (${result}).`);
              return;
            }

-            let body;
-            if (buildResult === 'success') {
-              body = [
-                `Windows installer build **succeeded** for \`${prRef}\` (\`${shortSha}\`).`,
-                ``,
-                `**Download:** open the [workflow run](${runUrl}), scroll to the **Artifacts** section at the bottom.`,
-                `The artifact \`Cleanuparr-windows-installer\` is retained for 30 days.`
-              ].join('\n');
-            } else if (buildResult === 'cancelled') {
-              body = [
-                `Windows installer build was **cancelled** for \`${prRef}\` (\`${shortSha}\`).`,
-                ``,
-                `See the [workflow run](${runUrl}) for details.`
-              ].join('\n');
+            const { label, artifacts } = JSON.parse(process.env.META);
+            const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+
+            const prSha = '${{ needs.validate.outputs.pr_sha }}';
+            const statusContext = `pr-build / ${target}`;
+            let publishStatus = result !== 'cancelled';
+
+            if (publishStatus) {
+              try {
+                const combined = await github.rest.repos.getCombinedStatusForRef({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  ref: prSha
+                });
+                const current = combined.data.statuses.find(s => s.context === statusContext);
+                publishStatus = !current || current.state !== 'pending' || current.target_url === runUrl;
+              } catch (e) {
+                console.log(`Could not read the current commit status: ${e}`);
+              }
+            }
+
+            if (publishStatus) {
+              try {
+                await github.rest.repos.createCommitStatus({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  sha: prSha,
+                  state: result === 'success' ? 'success' : 'failure',
+                  context: statusContext,
+                  description: `${label} ${result}`,
+                  target_url: runUrl
+                });
+              } catch (e) {
+                console.log(`Could not update commit status: ${e}`);
+              }
            } else {
+              console.log(`A newer run owns "${statusContext}", skipping the status update.`);
+            }
+
+            const prRef = process.env.PR_REF;
+            const prNumber = parseInt('${{ needs.validate.outputs.pr_number }}');
+            const shortSha = prSha.substring(0, 7);
+
+            let body;
+            if (result === 'success') {
+              const how = target === 'docker'
+                ? [`**Pull:** \`docker pull ghcr.io/cleanuparr/cleanuparr:pr-${prNumber}\``]
+                : [
+                    `**Download:** open the [workflow run](${runUrl}), scroll to the **Artifacts** section at the bottom.`,
+                    `The ${artifacts} artifact(s) are attached to that run.`
+                  ];
+              body = [`${label} **succeeded** for \`${prRef}\` (\`${shortSha}\`).`, ``, ...how].join('\n');
+            } else {
+              const verb = result === 'cancelled' ? 'was **cancelled**' : '**failed**';
              body = [
-                `Windows installer build **failed** for \`${prRef}\` (\`${shortSha}\`).`,
+                `${label} ${verb} for \`${prRef}\` (\`${shortSha}\`).`,
                ``,
                `See the [workflow run](${runUrl}) for details.`
              ].join('\n');
@@ -176,6 +293,6 @@ jobs:
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
-              issue_number: parseInt('${{ needs.validate.outputs.pr_number }}'),
+              issue_number: prNumber,
              body
            });
@@ -0,0 +1,29 @@
+name: PR Label
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+
+concurrency:
+  group: PR Label-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  category:
+    name: Require category label
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fail when no category label is present
+        if: >-
+          !contains(github.event.pull_request.labels.*.name, 'breaking') &&
+          !contains(github.event.pull_request.labels.*.name, 'enhancement') &&
+          !contains(github.event.pull_request.labels.*.name, 'bug') &&
+          !contains(github.event.pull_request.labels.*.name, 'documentation') &&
+          !contains(github.event.pull_request.labels.*.name, 'chore')
+        run: |
+          echo "::error::Add one of these labels so the release notes can be categorised: breaking, enhancement, bug, documentation, chore"
+          exit 1
@@ -35,10 +35,16 @@ on:
        required: false
        default: false

+permissions:
+  contents: read
+
 jobs:
  # Validate release
  validate:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
    outputs:
      app_version: ${{ steps.version.outputs.app_version }}
      release_version: ${{ steps.version.outputs.release_version }}
@@ -46,7 +52,9 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false

      - name: Get version info
        id: version
@@ -89,6 +97,59 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+      - name: Check the version against PR labels
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APP_VERSION: ${{ steps.version.outputs.app_version }}
+        run: |
+          previous_tag=$(gh release view --json tagName --jq .tagName 2>/dev/null || echo "")
+
+          if [ -z "$previous_tag" ]; then
+            echo "No previous release found. Skipping the label check."
+            exit 0
+          fi
+
+          published=$(gh release view "$previous_tag" --json publishedAt --jq .publishedAt)
+
+          if ! breaking_list=$(gh api --paginate "repos/${{ github.repository }}/issues?labels=breaking&state=closed&since=$published&per_page=100" \
+            --jq ".[] | select(.pull_request.merged_at > \"$published\") | \"  #\(.number) \(.title)\""); then
+            echo "::error::Failed to query pull request labels, cannot verify the version"
+            printf '%s\n' "$breaking_list"
+            exit 1
+          fi
+
+          breaking=$(printf '%s' "$breaking_list" | grep -c . || true)
+
+          previous_version=${previous_tag#v}
+
+          if [ "$previous_version" = "$APP_VERSION" ]; then
+            echo "::error::$APP_VERSION is the same version as the previous release $previous_tag."
+            exit 1
+          fi
+
+          if [ "$(printf '%s\n%s\n' "$previous_version" "$APP_VERSION" | sort -V | tail -1)" != "$APP_VERSION" ]; then
+            echo "::error::$APP_VERSION is older than the previous release $previous_tag. Releases must move forward."
+            exit 1
+          fi
+
+          previous_minor=${previous_version%.*}
+          new_minor=${APP_VERSION%.*}
+
+          echo "Previous release: $previous_tag (published $published)"
+          echo "Breaking PRs merged since: $breaking"
+
+          if [ "$breaking" -gt 0 ] && [ "$previous_minor" = "$new_minor" ]; then
+            echo "::error::$breaking PR(s) labelled 'breaking' were merged since $previous_tag, so $APP_VERSION cannot be a patch release. Bump the minor, or remove the label if it was applied by mistake. See RELEASING.md."
+            printf '%s\n' "$breaking_list"
+            exit 1
+          fi
+
+          if [ "$breaking" -eq 0 ] && [ "$previous_minor" != "$new_minor" ]; then
+            echo "::warning::$APP_VERSION bumps the minor but no PR merged since $previous_tag carries the 'breaking' label. Intentional for a policy or milestone release, otherwise check the labels."
+          fi
+
+          echo "✅ Version $APP_VERSION is consistent with the PR labels."
+
  # Run tests
  test:
    needs: validate
@@ -96,33 +157,24 @@ jobs:
    uses: ./.github/workflows/test.yml
    secrets: inherit

-  # Run E2E tests
-  e2e:
-    needs: validate
-    if: ${{ needs.validate.outputs.is_tag == 'true' || github.event.inputs.runTests == 'true' }}
-    uses: ./.github/workflows/e2e.yml
-    secrets: inherit
-
  # Build frontend once for all build jobs and cache it
  build-frontend:
-    needs: [validate, test, e2e]
+    needs: [validate, test]
    if: |
      always() &&
      needs.validate.result == 'success' &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
-      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
    uses: ./.github/workflows/build-frontend.yml
    secrets: inherit

  # Build portable executables
  build-executables:
-    needs: [validate, test, e2e, build-frontend]
+    needs: [validate, test, build-frontend]
    if: |
      always() &&
      needs.validate.result == 'success' &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
-      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
      needs.build-frontend.result == 'success' &&
      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
    uses: ./.github/workflows/build-executable.yml
@@ -132,12 +184,11 @@ jobs:

  # Build Windows installer
  build-windows-installer:
-    needs: [validate, test, e2e, build-frontend]
+    needs: [validate, test, build-frontend]
    if: |
      always() &&
      needs.validate.result == 'success' &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
-      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
      needs.build-frontend.result == 'success' &&
      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
    uses: ./.github/workflows/build-windows-installer.yml
@@ -147,12 +198,11 @@ jobs:

  # Build macOS installers (Intel and ARM)
  build-macos:
-    needs: [validate, test, e2e, build-frontend]
+    needs: [validate, test, build-frontend]
    if: |
      always() &&
      needs.validate.result == 'success' &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
-      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
      needs.build-frontend.result == 'success' &&
      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
    uses: ./.github/workflows/build-macos-installer.yml
@@ -162,12 +212,14 @@ jobs:

  # Build and push Docker image(s)
  build-docker:
-    needs: [validate, test, e2e]
+    needs: [validate, test]
+    permissions:
+      contents: read
+      packages: write
    if: |
      always() &&
      needs.validate.result == 'success' &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
-      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildDocker == 'true')
    uses: ./.github/workflows/build-docker.yml
    with:
@@ -192,7 +244,7 @@ jobs:
    
    steps:
      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -202,20 +254,20 @@ jobs:
            secrets/data/github repo_readonly_pat | REPO_READONLY_PAT

      - name: Download executable artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: executable-*
          path: ./artifacts
          merge-multiple: true

      - name: Download Windows installer
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: Cleanuparr-windows-installer
          path: ./artifacts

      - name: Download macOS installers
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: Cleanuparr-macos-*-installer
          path: ./artifacts
@@ -229,7 +281,7 @@ jobs:
          echo "Total files: $(find ./artifacts -type f \( -name "*.zip" -o -name "*.pkg" -o -name "*.exe" \) | wc -l)"

      - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
        with:
          name: ${{ needs.validate.outputs.release_version }}
          tag_name: ${{ needs.validate.outputs.release_version }}
@@ -242,10 +294,32 @@ jobs:
            ./artifacts/*.pkg
            ./artifacts/*.exe

+  # Deploy docs after a successful release
+  deploy-docs:
+    needs: [create-release]
+    if: always() && needs.create-release.result == 'success'
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    uses: ./.github/workflows/docs.yml
+    secrets: inherit
+
+  # Deploy Cloudflare status page after a successful release
+  deploy-status:
+    needs: [validate, create-release]
+    if: always() && needs.create-release.result == 'success'
+    uses: ./.github/workflows/cloudflare-pages-status.yml
+    with:
+      version: ${{ needs.validate.outputs.release_version }}
+    secrets: inherit
+
  # Summary job
  summary:
-    needs: [validate, test, e2e, build-frontend, build-executables, build-windows-installer, build-macos, build-docker]
+    needs: [validate, test, build-frontend, build-executables, build-windows-installer, build-macos, build-docker]
    runs-on: ubuntu-latest
+    permissions:
+      actions: read
    if: always()

    steps:
@@ -289,7 +363,6 @@ jobs:
          }

          print_result "Tests" "${{ needs.test.result }}"
-          print_result "E2E Tests" "${{ needs.e2e.result }}"
          print_result "Frontend Build" "${{ needs.build-frontend.result }}"
          print_result "Portable Executables" "${{ needs.build-executables.result }}"
          print_result "Windows Installer" "${{ needs.build-windows-installer.result }}"
@@ -6,35 +6,50 @@ on:
      - main
    paths:
      - 'code/backend/**'
+      - 'code/frontend/**'
      - '.github/workflows/test.yml'
  pull_request:
    paths:
      - 'code/backend/**'
+      - 'code/frontend/**'
      - '.github/workflows/test.yml'
  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout (branch, tag, or SHA). Defaults to the triggering ref.'
+        type: string
+        required: false
+        default: ''

 # Cancel in-progress runs for the same PR
 concurrency:
-  group: Tests-${{ github.event.pull_request.number || github.ref }}
+  group: Tests-${{ inputs.ref || github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
-  test:
+  backend:
    runs-on: ubuntu-latest
    timeout-minutes: 10
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
        timeout-minutes: 1
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false

      - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: 10.0.200

      - name: Cache NuGet packages
-        uses: actions/cache@v4
+        uses: actions/cache@v6
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/*.csproj') }}
@@ -42,7 +57,7 @@ jobs:
            ${{ runner.os }}-nuget-

      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
+        uses: hashicorp/vault-action@v4
        with:
          url: ${{ secrets.VAULT_HOST }}
          method: approle
@@ -64,21 +79,22 @@ jobs:
        run: dotnet test code/backend/cleanuparr.sln --configuration Release --no-build --verbosity normal --logger trx --collect:"XPlat Code Coverage" --settings code/backend/coverage.runsettings --results-directory ./coverage

      - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: test-results
          path: ./coverage/*.trx
          retention-days: 30

      - name: Upload coverage reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: coverage-report
          path: ./coverage/**/coverage.cobertura.xml
          retention-days: 30

      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        if: inputs.ref == ''
+        uses: codecov/codecov-action@v7
        with:
          files: ./coverage/**/coverage.cobertura.xml
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -97,3 +113,52 @@ jobs:
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Test artifacts have been uploaded for detailed analysis." >> $GITHUB_STEP_SUMMARY
+
+  frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    defaults:
+      run:
+        working-directory: code/frontend
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        timeout-minutes: 1
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '26'
+          cache: 'npm'
+          cache-dependency-path: code/frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Run tests
+        run: npm run test:ci
+
+      - name: Upload coverage reports
+        uses: actions/upload-artifact@v7
+        with:
+          name: frontend-coverage-report
+          path: code/frontend/coverage/ui/lcov.info
+          retention-days: 30
+
+      - name: Upload coverage to Codecov
+        if: inputs.ref == ''
+        uses: codecov/codecov-action@v7
+        with:
+          files: code/frontend/coverage/ui/lcov.info
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
+          flags: frontend
+          name: frontend-coverage
@@ -22,6 +22,9 @@ on:
        description: 'Repository name without owner'
        value: ${{ jobs.version.outputs.repository_name }}

+permissions:
+  contents: read
+
 jobs:
  version:
    runs-on: ubuntu-latest
@@ -1,83 +1,135 @@
 # Cleanuparr - Claude AI Rules

-## 🚨 Critical Guidelines
+## Rules

-**READ THIS FIRST:**
-1. ⚠️ **DO NOT break existing functionality** - All features are critical and must continue to work
-2. ❓ **When in doubt, ASK** - Always clarify before implementing uncertain changes
-3. 📋 **Follow existing patterns** - Study the codebase style before making changes
-4. 🆕 **Ask before introducing new patterns** - Use current coding standards or get approval first
+1. **DO NOT break existing functionality** - All features are critical and must continue to work
+2. **When in doubt, ASK** - Don't assume, clarify with the maintainer first
+3. **Always read existing code before making changes** - Understand the current architecture and patterns
+4. **Follow existing patterns** - Study the codebase style and match it exactly
+5. **Ask before introducing new patterns** - Use current coding standards or get approval first
+6. **Prefer editing existing files over creating new ones** - Build on existing work
+7. **Flag potential gotchas or issues immediately** - Document and report anything unexpected
+8. **If unsure about an approach, ask before implementing**

 ## Project Overview

-Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, µTorrent and rTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
+Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients (qBittorrent, Transmission, Deluge, uTorrent, rTorrent). It provides malware protection, automated cleanup, and queue management for *arr applications.

 **Key Features:**
 - Strike system for bad downloads
 - Malware detection and blocking
- Automatic search triggering after removal
+- Automatic search triggering after removal (Seeker)
+- Missing and upgrade search
 - Orphaned download cleanup with cross-seed support
- Support for multiple notification providers (Discord, etc.)
+- Authentication (OIDC, 2FA)
+- Notification providers (Apprise, Discord, Gotify, Notifiarr, Ntfy, Pushover, Telegram)

 ## Architecture & Tech Stack

 ### Backend
 - **.NET 10.0** (C#) with ASP.NET Core
- **Architecture**: Clean Architecture pattern
-  - `Cleanuparr.Domain` - Domain models and business logic
+- **Architecture**: Clean Architecture with `Features/` subdirectory pattern
+  - `Cleanuparr.Api` - REST API and web host (`Features/` for endpoint groups)
  - `Cleanuparr.Application` - Application services and use cases
-  - `Cleanuparr.Infrastructure` - External integrations (*arr apps, download clients)
+  - `Cleanuparr.Domain` - Domain models (Entities, Enums, Exceptions)
+  - `Cleanuparr.Infrastructure` - External integrations (`Features/` for Arr, DownloadClient, Notifications, etc.)
  - `Cleanuparr.Persistence` - Data access with EF Core (SQLite)
-  - `Cleanuparr.Api` - REST API and web host
  - `Cleanuparr.Shared` - Shared utilities
- **Database**: SQLite with Entity Framework Core 10.0
-  - Two separate contexts: `DataContext` and `EventsContext`
+- **Database**: SQLite with Entity Framework Core
+  - Three separate contexts: `DataContext`, `EventsContext`, `UsersContext`
 - **Key Libraries**:
  - MassTransit (messaging)
  - Quartz.NET (scheduling)
  - Serilog (logging)
  - SignalR (real-time communication)
+- **Testing**: xUnit + NSubstitute + Shouldly
+  - Always use **NSubstitute** for mocking in new tests (Moq is being phased out)

 ### Frontend
- **Angular 21** with TypeScript 5.9 (standalone components, zoneless, OnPush)
- **UI**: Custom glassmorphism design system (no external UI frameworks)
+- **Angular 22** with TypeScript 6.0, Node 26 (standalone components, zoneless, OnPush)
+- **UI**: Custom glassmorphism design system with 33 custom components — no external UI frameworks
 - **Icons**: @ng-icons/core + @ng-icons/tabler-icons
- **Design System**: 3-layer SCSS (`_variables` → `_tokens` → `_themes`), dark/light themes
- **State Management**: @ngrx/signals (Angular signals-based)
- **Real-time Updates**: SignalR (@microsoft/signalr)
+- **Design System**: 3-layer SCSS (`_variables` -> `_tokens` -> `_themes`), dark/light themes
+- **State Management**: Angular signals (`signal`/`computed`/`effect`) — `@ngrx/signals` was removed (it was unused)
+- **Data fetching**: Angular 22 Resource API — `rxResource` from `@angular/core/rxjs-interop` (not manual `HttpClient.subscribe()`)
+- **Forms**: Angular 22 Signal Forms — `form()` + `[formField]` from `@angular/forms/signals` (settings forms; a few not-yet-migrated forms still use per-field signals)
+- **Real-time Updates**: @microsoft/signalr 10.0.0
 - **PWA**: Service Worker support enabled

-### Documentation
- **Docusaurus** (TypeScript-based static site)
- Hosted at https://cleanuparr.github.io/Cleanuparr/
+## Project Structure

-### Deployment
- **Docker** (primary distribution method)
- Standalone executables for Windows, macOS, and Linux
- Platform installers for Windows (.exe) and macOS (.pkg)
-
-## Development Setup
-
-### Prerequisites
- .NET 10.0 SDK
- Node.js 18+
- Git
- (Optional) Make for database migrations
- (Optional) JetBrains Rider or Visual Studio
-
-### GitHub Packages Authentication
-Cleanuparr uses GitHub Packages for NuGet dependencies. Configure access:
-
-```bash
-dotnet nuget add source \
-  --username YOUR_GITHUB_USERNAME \
-  --password YOUR_GITHUB_PAT \
-  --store-password-in-clear-text \
-  --name Cleanuparr \
-  https://nuget.pkg.github.com/Cleanuparr/index.json
+```
+Cleanuparr/
+├── code/
+│   ├── backend/
+│   │   ├── Cleanuparr.Api/              # REST API (Features/ for endpoint groups)
+│   │   ├── Cleanuparr.Api.Tests/        # API layer tests
+│   │   ├── Cleanuparr.Application/      # Business logic layer
+│   │   ├── Cleanuparr.Domain/           # Domain models
+│   │   ├── Cleanuparr.Infrastructure/   # External integrations (Features/ subdirs)
+│   │   ├── Cleanuparr.Infrastructure.Tests/
+│   │   ├── Cleanuparr.Persistence/      # SQLite data access
+│   │   ├── Cleanuparr.Persistence.Tests/
+│   │   └── Cleanuparr.Shared/           # Shared utilities
+│   ├── frontend/                        # Angular 22 application
+│   ├── Dockerfile                       # Multi-stage Docker build
+│   ├── entrypoint.sh                    # Docker entrypoint
+│   └── Makefile                         # Build & migration helpers
+├── docs/                                # Docusaurus documentation
+├── e2e/                                 # Playwright E2E tests
+├── .github/workflows/                   # CI/CD pipelines
+├── blacklist                            # Default malware patterns (strict)
+├── blacklist_permissive                 # Less strict malware patterns
+├── whitelist                            # Safe file extensions
+└── whitelist_with_subtitles             # Includes subtitle formats
 ```

-You need a GitHub PAT with `read:packages` permission.
+## Code Standards & Conventions
+
+**IMPORTANT:** Always study existing code in the relevant area before making changes. Match the existing style exactly.
+
+### Backend (C#)
+- Follow Microsoft C# Coding Conventions
+- Use nullable reference types (`<Nullable>enable</Nullable>`)
+- Add XML documentation comments for public APIs
+- Use meaningful names - avoid abbreviations unless widely understood
+- Keep services focused - single responsibility principle
+- New integrations go under `Features/` subdirectories (e.g., `Infrastructure/Features/Arr/`)
+- **One type per file** - every class, record, struct and enum lives in its own file, named after it
+- **Split as you go** - when a change touches a file holding several types, split that file as part of the change
+- Exception: a test double used by a single spec may stay nested in that spec; doubles shared across specs go in `TestHelpers/`
+
+### Frontend (TypeScript/Angular)
+- All components must be **standalone** with **ChangeDetectionStrategy.OnPush**
+- Use `input()` / `output()` function APIs (not `@Input()` / `@Output()` decorators)
+- Use Angular **signals** for reactive state (`signal()`, `computed()`, `effect()`)
+- **Data fetching**: use the **Resource API** (`rxResource`) with a reactive `params` + `stream`, not manual `HttpClient.subscribe()`; drive spinners/errors off `isLoading()`/`error()`
+- **Forms**: use **Signal Forms** (`form()` + `[formField]`) with a single model signal + schema validators; keep the JSON-snapshot dirty tracking (`buildSnapshot()`/`hasPendingChanges()`), do NOT use Signal Forms `dirty()` for the unsaved-changes guard
+- Follow the 3-layer SCSS design system (`_variables` -> `_tokens` -> `_themes`)
+- **Do not introduce external UI frameworks** (no PrimeNG, Material, Tailwind, etc.)
+- Component naming: `{feature}.component.ts`
+- Service naming: `{feature}.service.ts`
+- **Look at similar existing components before creating new ones**
+
+### Testing
+- **Backend**: xUnit + NSubstitute + Shouldly
+- Always use **NSubstitute** for mocking (Moq is being phased out)
+- Write unit tests for new features and bug fixes
+- Use descriptive test names that explain what is being tested
+- **Frontend**: Vitest via the `@angular/build:unit-test` builder in jsdom (`cd code/frontend && npm test`). Specs live next to the source as `{feature}.component.spec.ts`
+- Vitest globals are enabled in `tsconfig.spec.json`, so do NOT import `describe`/`it`/`expect`/`vi`
+- `angular.json` sets `skipTests: true` for all schematics, so `ng generate` never creates a spec. Write them by hand
+- Test components through `TestBed.createComponent` and the rendered DOM. For inputs/outputs, declare a standalone host component in the spec. In a **component** spec, stub the API class with a plain object of methods returning `of(...)`, never `HttpClient`
+- A spec for an **api class itself** (`{feature}.api.spec.ts`) is the one exception: override the `HttpClient` token with `vi.fn()` stubs and assert the URL and body, as `events.api.spec.ts` and `account.api.spec.ts` do. `provideHttpClientTesting` is banned everywhere
+- Keep stub observables synchronous: an `rxResource` fed by `of(...)` resolves inside one `fixture.detectChanges()`, an async source needs `await fixture.whenStable()`
+- Call `fixture.detectChanges()` after every interaction (zoneless + OnPush). For a bare `effect()`, use `TestBed.runInInjectionContext()` then `TestBed.tick()`
+
+### Git Commit Messages
+- Use clear, descriptive messages in imperative mood
+- Examples: "Add Discord notification support", "Fix memory leak in download client polling"
+- Reference issue numbers when applicable: "Fix #123: Handle null response from Radarr API"
+
+## Development Setup

 ### Running the Backend
 ```bash
@@ -97,254 +149,68 @@ UI runs at http://localhost:4200

 ### Running Tests
 ```bash
+# Backend
 cd code/backend
 dotnet test
+
+# Frontend
+cd code/frontend
+npm test            # ng test; watches in an interactive terminal, single run when not a TTY
+npm run test:ci     # single run with coverage, written to coverage/ui/ (what CI runs)
+npm run lint
 ```
-
-### Running Documentation
-```bash
-cd docs
-npm install
-npm start
-```
-Docs run at http://localhost:3000
-
-## Project Structure
-
-```
-Cleanuparr/
-├── code/
-│   ├── backend/
-│   │   ├── Cleanuparr.Api/           # API entry point
-│   │   ├── Cleanuparr.Application/   # Business logic layer
-│   │   ├── Cleanuparr.Domain/        # Domain models
-│   │   ├── Cleanuparr.Infrastructure/ # External integrations
-│   │   ├── Cleanuparr.Persistence/   # Database & EF Core
-│   │   ├── Cleanuparr.Shared/        # Shared utilities
-│   │   └── *.Tests/                  # Unit tests
-│   ├── frontend/                     # Angular 21 application
-│   ├── ui/                           # Built frontend assets
-│   ├── Dockerfile                    # Multi-stage Docker build
-│   ├── entrypoint.sh                 # Docker entrypoint
-│   └── Makefile                      # Build & migration helpers
-├── docs/                             # Docusaurus documentation
-├── Logo/                             # Branding assets
-├── .github/workflows/                # CI/CD pipelines
-├── blacklist                         # Default malware patterns
-├── blacklist_permissive              # Alternative blacklist
-├── whitelist                         # Safe file patterns
-└── CONTRIBUTING.md                   # Contribution guidelines
-```
-
-## Code Standards & Conventions
-
-**IMPORTANT:** Always study existing code in the relevant area before making changes. Match the existing style exactly.
-
-### Backend (C#)
- Follow [Microsoft C# Coding Conventions](https://docs.microsoft.com/dotnet/csharp/fundamentals/coding-style/coding-conventions)
- Use nullable reference types (`<Nullable>enable</Nullable>`)
- Add XML documentation comments for public APIs
- Write unit tests for business logic
- Use meaningful names - avoid abbreviations unless widely understood
- Keep services focused - single responsibility principle
- **Study existing service implementations before creating new ones**
-
-### Frontend (TypeScript/Angular)
- Follow [Angular Style Guide](https://angular.io/guide/styleguide)
- Use TypeScript strict mode
- All components must be **standalone** (no NgModules) with **ChangeDetectionStrategy.OnPush**
- Use `input()` / `output()` function APIs (not `@Input()` / `@Output()` decorators)
- Use Angular **signals** for reactive state (`signal()`, `computed()`, `effect()`)
- Follow the 3-layer SCSS design system (`_variables` → `_tokens` → `_themes`) for styling
- Component naming: `{feature}.component.ts`
- Service naming: `{feature}.service.ts`
- **Look at similar existing components before creating new ones**
-
-### Testing
- Write unit tests for new features and bug fixes
- Use descriptive test names that explain what is being tested
- Backend: xUnit or NUnit conventions
- Frontend: Jasmine/Karma
- **Test that existing functionality still works after changes**
-
-### Git Commit Messages
- Use clear, descriptive messages in imperative mood
- Examples: "Add Discord notification support", "Fix memory leak in download client polling"
- Reference issue numbers when applicable: "Fix #123: Handle null response from Radarr API"
-
-### Discovering Issues
-If you encounter potential gotchas, common mistakes, or areas that need special attention during development:
- **Flag them to the maintainer immediately**
- Document them if confirmed
- Consider if they should be added to this guide
+Both run as concurrent `backend` and `frontend` jobs in `.github/workflows/test.yml`.

 ## Database Migrations

-Cleanuparr uses two separate database contexts:
- **DataContext**: Main application data
- **EventsContext**: Event logging and audit trail
-
-### Creating Migrations
-From the `code` directory:
+Three separate database contexts, all commands run from the `code` directory:

 ```bash
-# Data migrations
+# Data migrations (DataContext)
 make migrate-data name=YourMigrationName

-# Events migrations
+# Events migrations (EventsContext)
 make migrate-events name=YourMigrationName
-```

-Example:
-```bash
-make migrate-data name=AddDownloadClientConfig
-make migrate-events name=AddStrikeEvents
+# Users migrations (UsersContext)
+make migrate-users name=YourMigrationName
 ```

 ## Common Development Workflows

 ### Adding a New *arr Application Integration
-1. Add integration in `Cleanuparr.Infrastructure/Arr/`
+1. Add integration in `Cleanuparr.Infrastructure/Features/Arr/`
 2. Update domain models in `Cleanuparr.Domain/`
 3. Create/update services in `Cleanuparr.Application/`
-4. Add API endpoints in `Cleanuparr.Api/`
+4. Add API endpoints in `Cleanuparr.Api/Features/Arr/`
 5. Update frontend in `code/frontend/src/app/`
-6. Document in `docs/docs/`

 ### Adding a New Download Client
-1. Add client implementation in `Cleanuparr.Infrastructure/DownloadClients/`
+1. Add client implementation in `Cleanuparr.Infrastructure/Features/DownloadClient/`
 2. Follow existing patterns (qBittorrent, Transmission, etc.)
 3. Add configuration models to `Cleanuparr.Domain/`
 4. Update API and frontend as above

 ### Adding a New Notification Provider
-1. Add provider in `Cleanuparr.Infrastructure/Notifications/`
+1. Add provider in `Cleanuparr.Infrastructure/Features/Notifications/`
 2. Update configuration models
 3. Add UI configuration in frontend
-4. Test with actual service

-## Important Files
-
-### Configuration Files
- `code/backend/Cleanuparr.Api/appsettings.json` - Backend configuration
- `code/frontend/angular.json` - Angular build configuration
- `code/Dockerfile` - Docker multi-stage build
- `docs/docusaurus.config.ts` - Documentation site config
-
-### CI/CD Workflows
- `.github/workflows/test.yml` - Run tests
- `.github/workflows/build-docker.yml` - Build Docker images
- `.github/workflows/build-executable.yml` - Build standalone executables
- `.github/workflows/release.yml` - Create releases
- `.github/workflows/docs.yml` - Deploy documentation
-
-### Malware Protection
- `blacklist` - Default malware file patterns (strict)
- `blacklist_permissive` - Less strict patterns
- `whitelist` - Known safe file extensions
- `whitelist_with_subtitles` - Includes subtitle formats
-
-## Contributing Guidelines
-
-### Before Starting Work
-1. **Announce your intent** - Comment on an issue or create a new one
-2. **Wait for approval** from maintainers
-3. Fork the repository and create a feature branch
-4. Make your changes following code standards
-5. Test thoroughly (both manual and automated tests)
-6. Submit a PR with clear description and testing notes
-
-### Pull Request Requirements
- Link to related issue
- Clear description of changes
- Evidence of testing
- Updated documentation if needed
- No breaking changes without discussion
-
-## Docker Development
-
-### Build Local Docker Image
-```bash
-cd code
-docker build \
-  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
-  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
-  -t cleanuparr:local \
-  -f Dockerfile .
-```
-
-### Multi-Architecture Build
-```bash
-docker buildx build \
-  --platform linux/amd64,linux/arm64 \
-  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
-  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
-  -t cleanuparr:local \
-  -f Dockerfile .
-```
-
-## Environment Variables
-
-When running via Docker:
- `PORT` - API port (default: 11011)
- `PUID` - User ID for file permissions
- `PGID` - Group ID for file permissions
- `TZ` - Timezone (e.g., `America/New_York`)
-
-## Security & Safety
-
- Never commit sensitive data (API keys, tokens, passwords)
- All *arr and download client credentials are stored encrypted
- The malware detection system uses pattern matching on file extensions and names
- Always validate user input on both frontend and backend
- Follow OWASP guidelines for web application security
-
-## Additional Resources
-
- **Documentation**: https://cleanuparr.github.io/Cleanuparr/
- **Discord**: https://discord.gg/SCtMCgtsc4
- **GitHub Issues**: https://github.com/Cleanuparr/Cleanuparr/issues
- **Releases**: https://github.com/Cleanuparr/Cleanuparr/releases
-
-## Working with Claude - IMPORTANT
-
-### Core Principles
-1. **When in doubt, ASK** - Don't assume, clarify with the maintainer first
-2. **Don't break existing functionality** - Everything is important and needs to work
-3. **Follow existing coding style** - Study the codebase patterns before making changes
-4. **Use current coding standards** - If you want to introduce something new, ask first
-
-### When Modifying Code
- **ALWAYS read existing files before suggesting changes**
- Understand the current architecture and patterns
- Prefer editing existing files over creating new ones
- Follow the established conventions in the codebase exactly
- Test changes locally when possible
- **If you're unsure about an approach, ask before implementing**
-
-### When Adding Features
- Review similar existing features first to understand patterns
- Maintain consistency with existing UI/UX patterns
- Update both backend and frontend together
- Add/update documentation
- Consider backwards compatibility
- **Ask about architectural decisions before implementing new patterns**
-
-### When Fixing Bugs
- Understand the root cause before proposing a fix
- **Be careful not to break other functionality** - test related areas
- Add tests to prevent regression
- Update relevant documentation if behavior changes
- Consider if other parts of the codebase might have similar issues
- **Flag any potential gotchas or issues you discover**
-
-## Notes
+## Key Gotchas

+- **Custom glassmorphism design system** - Do not introduce external UI frameworks (no PrimeNG, Material, Tailwind)
+- **All frontend components** must be standalone with OnPush change detection
+- **Frontend tests are zoneless**: `fakeAsync`/`tick()`/`flush()` from `@angular/core/testing` require Zone.js and will throw. Use `vi.useFakeTimers()` + `vi.advanceTimersByTime()`, restore with `vi.useRealTimers()`
+- **`@angular/build`'s unit-test runner sets `isolate: false`** (Vitest's own default is `isolate: true`, so its docs will tell you the opposite): module state, `localStorage`, fake timers and `document.documentElement` attributes/inline styles leak between spec files. Undo them in `afterEach`
+- **Node >= 25 shadows jsdom's `localStorage`**: vitest skips copying globals that already exist on `globalThis`, so specs would get an inert object (or `undefined` on Node 26). `src/testing/test-setup.ts` restores jsdom's Storage and is wired via `setupFiles` in `angular.json`. `matchMedia`, `IntersectionObserver`, `ResizeObserver` and `navigator.clipboard` are still absent in jsdom, stub them per spec
+- **Frontend toolchain is pinned high**: Node >= 26 and npm 11.6.2. CI uses `setup-node@v7` with `node-version: '26'`
+- **Database migrations** require awareness of all three contexts (Data, Events, Users)
+- **Malware blocker** is a critical security feature - changes require careful testing
+- **Cross-seed integration** allows keeping torrents that are actively seeding
+- **Real-time updates** use SignalR - maintain websocket patterns when adding features
+- Use `@ng-icons/core` + `@ng-icons/tabler-icons` for icons (NOT `angular-tabler-icons` which doesn't support Angular 22)
+- **Sidebar** stays dark purple in both themes - uses sidebar-specific CSS variables
 - The project uses **Clean Architecture** - respect layer boundaries
- Database migrations require both contexts - don't forget EventsContext
- Frontend uses a **custom glassmorphism design system** - don't introduce external UI frameworks (no PrimeNG, Material, etc.)
- All frontend components are **standalone** with **OnPush** change detection
- All downloads from *arr apps are processed through a **strike system**
- The malware blocker is a critical security feature - changes require careful testing
- Cross-seed integration allows keeping torrents that are actively seeding
- Real-time updates use **SignalR** - maintain websocket patterns when adding features
+- **Settings dirty tracking** uses JSON snapshot comparison (`buildSnapshot()` + `hasPendingChanges()`) — keep this even with Signal Forms; Signal Forms `dirty()` means "touched", not "differs from saved"
+- **Resource API** (`rxResource`): `value()` throws in the error state — always set a `defaultValue` (lists) or guard with `hasValue()` before reading
+- **Signal Forms** (`[formField]`) owns `min`/`max`/`disabled`/`required` — set these via schema validators, not template bindings. Custom controls satisfy the contract via `model()` signals (`chip-input` exposes a `value` model; `size-input`'s numeric-min input is named `minValue` to avoid clashing with the field min)
@@ -4,6 +4,13 @@ Thanks for your interest in contributing to Cleanuparr! This guide will help you

 ## Before You Start

+### AI usage
+
+In this ever-evolving field of work, AI is now the shiny new tool to help programmers work faster and there's nothing wrong with that.
+But it is **very** wrong to rely solely on AI tools to write, review and test your code.
+
+**If you do not have a background in programming and you do not intend to test your code properly, please do not submit AI-generated code.** If you still want to help in other ways such as testing features, that would also help a lot!
+
 ### Announce Your Intent

 Before starting any work, please let us know what you want to contribute:
@@ -20,7 +27,7 @@ This helps us avoid redundant work, git conflicts, and contributions that may no
 ### Prerequisites

 - [.NET 10.0 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
- [Node.js 18+](https://nodejs.org/)
+- [Node.js 26+](https://nodejs.org/)
 - [Git](https://git-scm.com/)
 - (Optional) [Make](https://www.gnu.org/software/make/) for database migrations
 - (Optional) IDE: [JetBrains Rider](https://www.jetbrains.com/rider/) or [Visual Studio](https://visualstudio.microsoft.com/)
@@ -153,6 +160,51 @@ make migrate-events name=AddAuditLogEvents

 The UI will be available at http://localhost:4200

+### Testing
+
+Unit tests run on [Vitest](https://vitest.dev/) through the Angular `@angular/build:unit-test` builder, in a jsdom environment. No browser download is required.
+
+```bash
+cd code/frontend
+
+# Watch mode, re-runs on save
+npm test
+
+# Single run with a coverage report, written to coverage/ui/. This is what CI runs
+npm run test:ci
+
+# Single run without coverage
+npm test -- --watch=false
+
+# Run a single spec
+npm test -- --include src/app/ui/chip-input/chip-input.component.spec.ts
+
+# Lint, also a CI gate
+npm run lint
+```
+
+`npm test` is Angular's `ng test`, which watches by default in an interactive terminal and runs once when stdout is not a TTY. CI therefore needs no extra flag, but do not rely on that locally: in your terminal `npm test` stays open until you quit it.
+
+#### Writing specs
+
+Specs live next to the code they cover, named `{feature}.component.spec.ts`. The Angular schematics in `angular.json` are configured with `skipTests: true`, so `ng generate` will not create a spec for you. Write it by hand.
+
+House style, follow the existing specs as reference:
+
+- Vitest globals (`describe`, `it`, `expect`, `vi`) are enabled via `tsconfig.spec.json`. Do not import them.
+- Use `TestBed.createComponent` and drive the rendered DOM. Assert on output, not on private internals.
+- For a component with inputs and outputs, declare a small standalone host component in the spec file and test through it. See `src/app/ui/chip-input/chip-input.component.spec.ts`.
+- Stub API classes with a plain object of methods returning `of(...)` from RxJS. Do not mock `HttpClient` and do not use `provideHttpClientTesting`. See `src/app/features/settings/seeker/seeker.component.spec.ts`.
+- Keep stub observables synchronous. An `rxResource` backed by `of(...)` resolves within a single `fixture.detectChanges()`, while an async source would need `await fixture.whenStable()`.
+- To flush a bare `effect()` outside a component, call it inside `TestBed.runInInjectionContext(...)` and flush with `TestBed.tick()`. See `src/app/core/services/overlay-stack.service.spec.ts`.
+- Put shared setup in a local `function setup()` inside the `describe` rather than in `beforeEach`, so each test reads top to bottom.
+- Components are zoneless and `OnPush`, so call `fixture.detectChanges()` after every interaction that should update the view.
+
+Two consequences of the zoneless, non-isolated test environment are worth knowing before you debug something strange:
+
+- `fakeAsync`, `tick()` and `flush()` from `@angular/core/testing` require Zone.js and **cannot** be used. Use `vi.useFakeTimers()` and `vi.advanceTimersByTime()` instead, and restore with `vi.useRealTimers()`.
+- The Angular `@angular/build` unit-test runner sets Vitest's `isolate` option to `false` to match the old Karma behaviour. Vitest's own default is `isolate: true`, so its documentation will tell you the opposite. In practice module-level state, `localStorage`, fake timers and anything written to `document.documentElement` leak into other spec files. Always undo them in `afterEach`.
+
 ## Documentation Development

 ### Setup
@@ -234,7 +286,7 @@ docker buildx build \
 ### Frontend (Angular/TypeScript)
 - Follow existing conventions and the [Angular Style Guide](https://angular.io/guide/styleguide)
 - Use TypeScript strict mode
- Write unit tests whenever possible
+- Write unit tests whenever possible, see [Frontend Development > Testing](#testing)

 ### Documentation
 - Use clear, concise language
@@ -1,7 +1,11 @@
+<div align="center">
+
 _Love this project? Give it a ⭐️ and let others know!_

 # <img width="24px" src="./Logo/256.png" alt="Cleanuparr"></img> Cleanuparr

+_/kliː.nʌp.ər/ — like "cleanuper", someone who does the cleanup. Not "CleanupArr" or "CleanUpArr"._
+
 ![Version](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcleanuparr-status.pages.dev%2Fstatus.json&query=%24.version&logo=git&label=version&color=blue)
 ![Total Downloads](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fghcr-badge.elias.eu.org%2Fapi%2FCleanuparr%2FCleanuparr%2Fcleanuparr&query=%24.downloadCount&style=flat&logo=docker&label=Total%20Downloads&color=blue)
 [![Tests](https://github.com/Cleanuparr/Cleanuparr/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/Cleanuparr/Cleanuparr/actions/workflows/test.yml)
@@ -9,7 +13,9 @@ _Love this project? Give it a ⭐️ and let others know!_

 [![Discord](https://img.shields.io/discord/1306721212587573389?color=7289DA&label=Discord&style=for-the-badge&logo=discord)](https://discord.gg/SCtMCgtsc4)

-Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. It removes incomplete or blocked downloads, updates queues, and enforces blacklists or whitelists to manage file selection. After removing blocked content, Cleanuparr can also trigger a search to replace the deleted shows/movies.
+</div>
+
+Cleanuparr is an advanced download manager for the Servarr ecosystem. It works with Sonarr, Radarr, Lidarr, Readarr, and Whisparr alongside download clients like qBittorrent, Transmission, and Deluge. Beyond cleaning up stalled, blocked, and malicious downloads, it searches for missing content and quality upgrades, manages seeding, and removes orphaned files.

 Cleanuparr was created primarily to address malicious files, such as `*.lnk` or `*.zipx`, that were getting stuck in Sonarr/Radarr and required manual intervention. Some of the reddit posts that made Cleanuparr come to life can be found [here](https://www.reddit.com/r/sonarr/comments/1gqnx16/psa_sonarr_downloaded_a_virus/), [here](https://www.reddit.com/r/sonarr/comments/1gqwklr/sonar_downloaded_a_mkv_file_which_looked_like_a/), [here](https://www.reddit.com/r/sonarr/comments/1gpw2wa/downloaded_waiting_to_import/) and [here](https://www.reddit.com/r/sonarr/comments/1gpi344/downloads_not_importing_no_files_found/).

@@ -23,8 +29,12 @@ Cleanuparr was created primarily to address malicious files, such as `*.lnk` or
 > - Remove and block downloads blocked by qBittorrent or by Cleanuparr's **Malware Blocker**.
 > - Remove and block known malware based on patterns found by the community.
 > - Automatically trigger a search for downloads removed from the arrs.
+> - Proactively search for **missing** items across your Radarr and Sonarr libraries.
+> - Search for **quality upgrades** for items that haven't met their quality profile's cutoff (a.k.a. **Cutoff Unmet**).
+> - Search for **custom format score upgrades** with automatic score tracking.
 > - Clean up downloads that have been **seeding** for a certain amount of time.
 > - Remove downloads that are **orphaned**/have no **hardlinks**/are not referenced by the arrs anymore (with [cross-seed](https://www.cross-seed.org/) support).
+> - Scan configured directories for **files not claimed by any active torrent**, move them to a dedicated orphaned directory, and optionally auto-purge.
 > - Notify on strike or download removal.
 > - Ignore certain torrent hashes, categories, tags or trackers from being processed by Cleanuparr.

@@ -43,6 +53,9 @@ https://cleanuparr.github.io/Cleanuparr/docs/screenshots
 - **Lidarr**
 - **Readarr**
 - **Whisparr v2**
+- **Whisparr v3**
+- **Sportarr**
+- **LazyLibrarian**

 ### Download Clients (latest version)
 - **qBittorrent**
@@ -74,6 +87,8 @@ docker run -d --name cleanuparr \

 For Docker Compose, health checks, and other installation methods, see the [Complete Installation Guide](https://cleanuparr.github.io/Cleanuparr/docs/installation/detailed), but not before reading the [Prerequisites](https://cleanuparr.github.io/Cleanuparr/docs/installation/).

+> Prefer not to self-host? A managed Cleanuparr instance is available via [ElfHosted](https://store.elfhosted.com/product-category/personal-stacks/?utm_source=github&utm_medium=readme&utm_campaign=cleanuparr-readme), bundled alongside Sonarr/Radarr to keep your queues tidy (7-day trial).
+
 ### 🌐 Access the Web Interface

 After installation, open your browser and navigate to:
@@ -0,0 +1,87 @@
+# Releasing Cleanuparr
+
+Versioning rules and the release process are detailed in the user-facing version of this policy at [docs/docs/installation/versioning.mdx](docs/docs/installation/versioning.mdx) and published under [Versioning](https://cleanuparr.github.io/docs/installation/versioning).
+
+## Versioning
+
+This policy takes effect starting with **v2.10.0**. Previous releases did not follow this approach, and their version numbers have no compatibility meaning.
+
+| Part | Bump when |
+| --- | --- |
+| Major | Probably never, unless something significant changes. |
+| Minor | The release contains a breaking change. |
+| Patch | Anything else: bug fixes and new features. |
+
+## Deciding the number
+
+Every pull request includes a category label, which is enforced by [pr-label.yml](.github/workflows/pr-label.yml). The `breaking` label determines the version number.
+
+From the `code` directory, use this command to list every breaking pull request that was merged since the last release and indicate which number to bump:
+
+```bash
+make release-check
+```
+
+To view the full release notes for a version before tagging it, without creating anything:
+
+```bash
+make release-notes version=2.11.0
+```
+
+A `## Breaking Changes` section means the release is a minor version. If this section is absent, the release is a patch.
+
+[release.yml](.github/workflows/release.yml) performs the same check and stops the release process before anything is built if breaking pull requests were merged but the minor version did not increment. It issues a warning but continues if the minor version moves without a breaking pull request leading it.
+
+Examples of breaking changes:
+
+- A migration that drops or rewrites data, preventing rollback to the previous version
+- Renaming or removing an environment variable
+- Dropping a platform, architecture, installer, or database provider
+- A default value that alters how an existing configuration interacts with user data
+- A setting whose unit or interpretation changes and cannot be altered by a migration
+- Dropping a download client or *arr application, or increasing the minimum supported version
+- A change to the public REST API (e.g., the `stats` endpoint)
+
+Examples of non-breaking changes:
+
+- A migration that simply adds columns or tables
+- Renaming any value stored in the database and configured through the UI, accompanied by a migration
+- Any change to the private REST API, which is intended only for the UI
+- Modifications to the Web UI layout, internal structure, or logging
+
+## Auditing migrations before a release
+
+The easiest breaking change to overlook is a migration that prevents rollback. To see the migrations added since the previous tag:
+
+```bash
+git diff --name-only <last-tag>..main -- '*/Migrations/**' \
+  | grep -v -e Designer -e Snapshot \
+  | xargs grep -l 'DropColumn\|DropTable\|AlterColumn\|RenameColumn\|DeleteData\|migrationBuilder\.Sql'
+```
+
+Only `Up()` matters, since every migration drops things in `Down()` by definition, leading to false positives in that grep.
+
+Additive changes are safe. `AddColumn` and `CreateTable` allow previous versions to start. However, a conversion or rewrite does not.
+
+## Release process
+
+Tag pushes that match `v*.*.*` trigger [release.yml](.github/workflows/release.yml).
+
+```bash
+git tag v2.10.0
+git push origin v2.10.0
+```
+
+### Release notes
+
+GitHub generates notes from the pull requests merged since the last tag, grouped into sections by label according to [release.yml](.github/release.yml):
+
+| Label | Section |
+| --- | --- |
+| `breaking` | Breaking Changes |
+| `enhancement` | Features |
+| `bug` | Bug Fixes |
+| `documentation` | Documentation |
+| `chore` | Maintenance |
+
+The status check for `Require category label` is mandatory on `main`, so a missing label will be caught before merging. Labels added after merging still apply because notes are generated at release time.
@@ -352,6 +352,7 @@
 *.lzo
 *.lzr
 *.lzx
+*.m2ts
 *.m3u
 *.m4a
 *.mac
@@ -1,5 +1,5 @@
 # Build Angular frontend
-FROM --platform=$BUILDPLATFORM node:25-alpine AS frontend-build
+FROM --platform=$BUILDPLATFORM node:26-alpine AS frontend-build
 WORKDIR /app

 # Copy package files first for better layer caching
@@ -68,6 +68,11 @@ ENV PUID=1000 \
 # Fix FileSystemWatcher in Docker: https://github.com/dotnet/dotnet-docker/issues/3546
 ENV DOTNET_USE_POLLING_FILE_WATCHER=true

+# GC tuning: prefer lower memory footprint over throughput
+ENV DOTNET_GCDynamicAdaptationMode=1 \
+    DOTNET_GCConserveMemory=5 \
+    DOTNET_GCRetainVM=0
+
 WORKDIR /app

 # Copy backend
@@ -7,19 +7,69 @@ migrate-data:
 ifndef name
 	$(error name is required. Usage: make migrate-data name=YourMigrationName)
 endif
-	dotnet ef migrations add $(name) --context DataContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Data
+	dotnet ef migrations add $(name) --context DataContext --project backend/Cleanuparr.Persistence.Sqlite/Cleanuparr.Persistence.Sqlite.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Data

 migrate-events:
 ifndef name
 	$(error name is required. Usage: make migrate-events name=YourMigrationName)
 endif
-	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
+	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence.Sqlite/Cleanuparr.Persistence.Sqlite.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events

 migrate-users:
 ifndef name
 	$(error name is required. Usage: make migrate-users name=YourMigrationName)
 endif
-	dotnet ef migrations add $(name) --context UsersContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Users
+	dotnet ef migrations add $(name) --context UsersContext --project backend/Cleanuparr.Persistence.Sqlite/Cleanuparr.Persistence.Sqlite.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Users
+
+PG_DUMMY = DATABASE_PROVIDER=postgres POSTGRES_HOST=localhost POSTGRES_PORT=5432 POSTGRES_USER=postgres POSTGRES_PASS=postgres POSTGRES_DB=cleanuparr
+
+migrate-postgres-data:
+ifndef name
+	$(error name is required. Usage: make migrate-postgres-data name=YourMigrationName)
+endif
+	$(PG_DUMMY) dotnet ef migrations add $(name) --context DataContext --project backend/Cleanuparr.Persistence.Postgres/Cleanuparr.Persistence.Postgres.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Data
+
+migrate-postgres-events:
+ifndef name
+	$(error name is required. Usage: make migrate-postgres-events name=YourMigrationName)
+endif
+	$(PG_DUMMY) dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence.Postgres/Cleanuparr.Persistence.Postgres.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
+
+migrate-postgres-users:
+ifndef name
+	$(error name is required. Usage: make migrate-postgres-users name=YourMigrationName)
+endif
+	$(PG_DUMMY) dotnet ef migrations add $(name) --context UsersContext --project backend/Cleanuparr.Persistence.Postgres/Cleanuparr.Persistence.Postgres.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Users
+
+release-check:
+	@previous=$$(gh release view --json tagName --jq .tagName) || exit 1; \
+	published=$$(gh release view --json publishedAt --jq .publishedAt); \
+	echo "Previous release: $$previous ($$published)"; \
+	echo ""; \
+	if ! breaking=$$(gh api --paginate "repos/{owner}/{repo}/issues?labels=breaking&state=closed&since=$$published&per_page=100" \
+		--jq ".[] | select(.pull_request.merged_at > \"$$published\") | \"  #\(.number) \(.title)\""); then \
+		echo "Failed to query pull request labels:" >&2; \
+		echo "$$breaking" >&2; \
+		exit 1; \
+	fi; \
+	if [ -n "$$breaking" ]; then \
+		echo "Breaking changes merged since $$previous:"; \
+		echo "$$breaking"; \
+		echo ""; \
+		echo "=> the next release must bump the MINOR"; \
+	else \
+		echo "No breaking changes merged since $$previous"; \
+		echo ""; \
+		echo "=> the next release can be a PATCH"; \
+	fi
+
+release-notes:
+ifndef version
+	$(error version is required. Usage: make release-notes version=2.11.0)
+endif
+	@previous=$$(gh release view --json tagName --jq .tagName); \
+	gh api -X POST repos/{owner}/{repo}/releases/generate-notes \
+		-f tag_name=v$(version) -f target_commitish=main -f previous_tag_name=$$previous --jq .body

 docker-build:
 ifndef tag
@@ -11,6 +11,7 @@
    <PackageReference Include="coverlet.collector" Version="6.0.4" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="NSubstitute" Version="5.3.0" />
    <PackageReference Include="Shouldly" Version="4.3.0" />
    <PackageReference Include="xunit" Version="2.9.3" />
    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
@@ -0,0 +1,39 @@
+using Cleanuparr.Domain.Enums;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Controllers;
+
+public sealed class EnumSentinelTests
+{
+    [Fact]
+    public void SelectableNames_omits_the_sentinel()
+    {
+        List<string> names = EnumSentinel.SelectableNames<EventType>();
+
+        names.ShouldNotContain(EnumSentinel.Unknown);
+        names.ShouldContain(nameof(EventType.StrikeReset));
+        names.Count.ShouldBe(Enum.GetNames<EventType>().Length - 1);
+    }
+
+    [Theory]
+    [InlineData(typeof(InstanceType))]
+    [InlineData(typeof(DownloadClientTypeName))]
+    [InlineData(typeof(DownloadClientType))]
+    [InlineData(typeof(NotificationProviderType))]
+    [InlineData(typeof(EventType))]
+    [InlineData(typeof(EventSeverity))]
+    [InlineData(typeof(ManualEventType))]
+    [InlineData(typeof(StrikeType))]
+    [InlineData(typeof(JobType))]
+    [InlineData(typeof(SearchCommandStatus))]
+    [InlineData(typeof(SeedingRuleAction))]
+    public void Identity_enums_pin_the_sentinel_to_its_own_value(Type enumType)
+    {
+        Convert.ToInt32(Enum.Parse(enumType, EnumSentinel.Unknown))
+            .ShouldBe(EnumSentinel.UnknownValue);
+
+        // A member added later cannot take the sentinel's place.
+        Enum.GetNames(enumType)[^1].ShouldBe(EnumSentinel.Unknown);
+    }
+}
@@ -0,0 +1,76 @@
+using Cleanuparr.Api.Contracts.Responses;
+using Cleanuparr.Api.Controllers;
+using Cleanuparr.Api.Features.Events.Contracts.Responses;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Cleanuparr.Persistence.Providers;
+using Microsoft.AspNetCore.Mvc;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Controllers;
+
+/// <summary>
+/// The sentinel is not a database value.
+/// A filter naming it has to be dropped before the query.
+/// </summary>
+public class EventsControllerFilterTests : IDisposable
+{
+    private readonly EventsContext _context;
+    private readonly EventsController _controller;
+
+    public EventsControllerFilterTests()
+    {
+        _context = SeekerTestDataFactory.CreateEventsContext();
+        _controller = new EventsController(_context, new SqliteDatabaseProvider());
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private async Task SeedOneEventAsync()
+    {
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.StalledStrike,
+            Message = "an event",
+            Severity = EventSeverity.Important,
+            Timestamp = DateTimeOffset.UtcNow,
+        });
+        await _context.SaveChangesAsync();
+    }
+
+    private static PaginatedResult<EventListItem> GetEvents(ActionResult<PaginatedResult<EventListItem>> action)
+    {
+        OkObjectResult ok = action.Result.ShouldBeOfType<OkObjectResult>();
+        return ok.Value.ShouldBeOfType<PaginatedResult<EventListItem>>();
+    }
+
+    [Theory]
+    [InlineData(EnumSentinel.Unknown)]
+    [InlineData("999")]
+    public async Task GetEvents_WithAnUnusableEventTypeFilter_IgnoresIt(string eventType)
+    {
+        await SeedOneEventAsync();
+
+        PaginatedResult<EventListItem> result = GetEvents(await _controller.GetEvents(eventType: eventType));
+
+        result.TotalCount.ShouldBe(1);
+    }
+
+    [Theory]
+    [InlineData(EnumSentinel.Unknown)]
+    [InlineData("999")]
+    public async Task GetEvents_WithAnUnusableSeverityFilter_IgnoresIt(string severity)
+    {
+        await SeedOneEventAsync();
+
+        PaginatedResult<EventListItem> result = GetEvents(await _controller.GetEvents(severity: severity));
+
+        result.TotalCount.ShouldBe(1);
+    }
+}
@@ -0,0 +1,102 @@
+using Cleanuparr.Api.Contracts.Responses;
+using Cleanuparr.Api.Controllers;
+using Cleanuparr.Api.Features.Events.Contracts.Responses;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Cleanuparr.Persistence.Providers;
+using Microsoft.AspNetCore.Mvc;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Controllers;
+
+/// <summary>
+/// Verifies the events list endpoint's ordering, filtering, search, and primitive-collection round-tripping.
+/// Runs against real SQLite so the projection is actually translated.
+/// </summary>
+public class EventsControllerMergeTests : IDisposable
+{
+    private readonly EventsContext _context;
+    private readonly EventsController _controller;
+
+    public EventsControllerMergeTests()
+    {
+        _context = SeekerTestDataFactory.CreateEventsContext();
+        _controller = new EventsController(_context, new SqliteDatabaseProvider());
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private async Task SeedAsync()
+    {
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.FailedImportStrike,
+            Message = "active",
+            Severity = EventSeverity.Important,
+            Timestamp = DateTimeOffset.UtcNow.AddDays(-1),
+            ItemTitle = "Active Item",
+            FailedImportReasons = ["reason one", "reason two"],
+            GrabbedItems = ["grab one"],
+        });
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.QueueItemDeleted,
+            Message = "archived",
+            Severity = EventSeverity.Important,
+            Timestamp = DateTimeOffset.UtcNow.AddDays(-100),
+            ItemTitle = "Archived Item",
+        });
+        await _context.SaveChangesAsync();
+    }
+
+    private static PaginatedResult<EventListItem> GetPage(ActionResult<PaginatedResult<EventListItem>> action)
+    {
+        OkObjectResult ok = action.Result.ShouldBeOfType<OkObjectResult>();
+        return ok.Value.ShouldBeOfType<PaginatedResult<EventListItem>>();
+    }
+
+    [Fact]
+    public async Task GetEvents_OrdersNewestFirst_AndRoundTripsCollections()
+    {
+        await SeedAsync();
+
+        PaginatedResult<EventListItem> page = GetPage(await _controller.GetEvents());
+
+        page.TotalCount.ShouldBe(2);
+        page.Items.Count.ShouldBe(2);
+        page.Items[0].Message.ShouldBe("active");   // newer
+        page.Items[1].Message.ShouldBe("archived");
+
+        // The primitive-collection columns must survive the Concat projection.
+        page.Items[0].FailedImportReasons.ShouldBe(["reason one", "reason two"]);
+        page.Items[0].GrabbedItems.ShouldBe(["grab one"]);
+    }
+
+    [Fact]
+    public async Task GetEvents_EventTypeFilter_Applies()
+    {
+        await SeedAsync();
+
+        PaginatedResult<EventListItem> page = GetPage(await _controller.GetEvents(eventType: nameof(EventType.QueueItemDeleted)));
+
+        page.TotalCount.ShouldBe(1);
+        page.Items[0].Message.ShouldBe("archived");
+    }
+
+    [Fact]
+    public async Task GetEvents_SearchFilter_MatchesArchivedItemTitle()
+    {
+        await SeedAsync();
+
+        PaginatedResult<EventListItem> page = GetPage(await _controller.GetEvents(search: "Archived"));
+
+        page.TotalCount.ShouldBe(1);
+        page.Items[0].Message.ShouldBe("archived");
+    }
+}
@@ -0,0 +1,174 @@
+using Cleanuparr.Api.Controllers;
+using Cleanuparr.Api.Features.Events.Contracts.Responses;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Cleanuparr.Persistence.Providers;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Mvc;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Controllers;
+
+public class EventsControllerTimelineTests : IDisposable
+{
+    private readonly EventsContext _context;
+    private readonly EventsController _controller;
+
+    public EventsControllerTimelineTests()
+    {
+        _context = SeekerTestDataFactory.CreateEventsContext();
+        _controller = new EventsController(_context, new SqliteDatabaseProvider());
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static EventTypeTimelineResponse GetTimeline(ActionResult<EventTypeTimelineResponse> action)
+    {
+        OkObjectResult ok = action.Result.ShouldBeOfType<OkObjectResult>();
+        return ok.Value.ShouldBeOfType<EventTypeTimelineResponse>();
+    }
+
+    [Fact]
+    public async Task GetTimeline_BucketsEventsByTypeAndDay()
+    {
+        DateOnly today = DateOnly.FromDateTime(DateTimeOffset.UtcNow.UtcDateTime);
+        DateTimeOffset sameDay = new(today.ToDateTime(new TimeOnly(12, 0)), TimeSpan.Zero);
+
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.FailedImportStrike,
+            Message = "active a",
+            Severity = EventSeverity.Important,
+            Timestamp = sameDay,
+        });
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.FailedImportStrike,
+            Message = "active b",
+            Severity = EventSeverity.Important,
+            Timestamp = sameDay.AddHours(-1),
+        });
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.StalledStrike,
+            Message = "active c",
+            Severity = EventSeverity.Important,
+            Timestamp = sameDay.AddHours(-2),
+        });
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.QueueItemDeleted,
+            Message = "older removal",
+            Severity = EventSeverity.Important,
+            Timestamp = DateTimeOffset.UtcNow.AddDays(-10),
+        });
+        await _context.SaveChangesAsync();
+
+        EventTypeTimelineResponse timeline = GetTimeline(await _controller.GetTimeline(hours: 24 * 30));
+
+        timeline.Types.ShouldBe(["FailedImportStrike", "StalledStrike", "QueueItemDeleted"]);
+
+        int failedImport = timeline.Buckets.Sum(b => b.Counts.GetValueOrDefault("FailedImportStrike"));
+        int stalled = timeline.Buckets.Sum(b => b.Counts.GetValueOrDefault("StalledStrike"));
+        int removed = timeline.Buckets.Sum(b => b.Counts.GetValueOrDefault("QueueItemDeleted"));
+
+        failedImport.ShouldBe(2);
+        stalled.ShouldBe(1);
+        removed.ShouldBe(1);
+
+        DateTimeOffset todayStart = new(today.ToDateTime(TimeOnly.MinValue), TimeSpan.Zero);
+        EventTypeTimelineBucket todayBucket = timeline.Buckets.Single(b => b.Date == todayStart);
+        todayBucket.Counts["FailedImportStrike"].ShouldBe(2);
+        todayBucket.Counts["StalledStrike"].ShouldBe(1);
+        todayBucket.Counts.ShouldNotContainKey("QueueItemDeleted");
+    }
+
+    [Fact]
+    public async Task GetTimeline_UsesHourlyBucketsForDayWindow()
+    {
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.StalledStrike,
+            Message = "recent",
+            Severity = EventSeverity.Important,
+            Timestamp = now.AddHours(-1),
+        });
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.StalledStrike,
+            Message = "earlier",
+            Severity = EventSeverity.Important,
+            Timestamp = now.AddHours(-3),
+        });
+        await _context.SaveChangesAsync();
+
+        EventTypeTimelineResponse timeline = GetTimeline(await _controller.GetTimeline(hours: 24));
+
+        int nonEmpty = timeline.Buckets.Count(b => b.Counts.GetValueOrDefault("StalledStrike") > 0);
+        nonEmpty.ShouldBe(2);
+        timeline.Buckets.Count.ShouldBeGreaterThan(2);
+    }
+
+    [Fact]
+    public async Task GetTimeline_ExcludesEventsOutsideWindow()
+    {
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.QueueItemDeleted,
+            Message = "too old",
+            Severity = EventSeverity.Important,
+            Timestamp = DateTimeOffset.UtcNow.AddDays(-40),
+        });
+        await _context.SaveChangesAsync();
+
+        EventTypeTimelineResponse timeline = GetTimeline(await _controller.GetTimeline(hours: 24 * 7));
+
+        timeline.Types.ShouldBeEmpty();
+        timeline.Buckets.ShouldAllBe(b => b.Counts.Count == 0);
+    }
+
+    [Fact]
+    public async Task GetTimeline_SumsEveryUnknownTypeInABucket()
+    {
+        DateOnly today = DateOnly.FromDateTime(DateTimeOffset.UtcNow.UtcDateTime);
+        DateTimeOffset sameDay = new(today.ToDateTime(new TimeOnly(12, 0)), TimeSpan.Zero);
+
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.FailedImportStrike,
+            Message = "first unknown",
+            Severity = EventSeverity.Important,
+            Timestamp = sameDay,
+        });
+        _context.Events.Add(new AppEvent
+        {
+            EventType = EventType.StalledStrike,
+            Message = "second unknown",
+            Severity = EventSeverity.Important,
+            Timestamp = sameDay.AddHours(-1),
+        });
+        await _context.SaveChangesAsync();
+
+        // Two types a newer version wrote.
+        // This build reads both as one.
+        await _context.Database.ExecuteSqlRawAsync(
+            "UPDATE events SET event_type = 'fromthefuture' WHERE message = 'first unknown'");
+        await _context.Database.ExecuteSqlRawAsync(
+            "UPDATE events SET event_type = 'alsofromthefuture' WHERE message = 'second unknown'");
+
+        EventTypeTimelineResponse timeline = GetTimeline(await _controller.GetTimeline(hours: 24 * 30));
+
+        timeline.Types.ShouldBe([EnumSentinel.Unknown]);
+
+        DateTimeOffset todayStart = new(today.ToDateTime(TimeOnly.MinValue), TimeSpan.Zero);
+        EventTypeTimelineBucket todayBucket = timeline.Buckets.Single(b => b.Date == todayStart);
+        todayBucket.Counts[EnumSentinel.Unknown].ShouldBe(2);
+    }
+}
@@ -0,0 +1,144 @@
+using Cleanuparr.Api.Controllers;
+using Cleanuparr.Api.Features.Status.Contracts.Responses;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Health;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using NSubstitute.ExceptionExtensions;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Controllers;
+
+public class StatusControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly IInstanceHealthChecker _healthChecker;
+    private readonly StatusController _controller;
+
+    public StatusControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        _healthChecker = Substitute.For<IInstanceHealthChecker>();
+        _controller = new StatusController(
+            Substitute.For<ILogger<StatusController>>(),
+            _dataContext,
+            _healthChecker);
+        ConfigControllerTestDataFactory.ConfigureProblemDetails(_controller);
+    }
+
+    private async Task<ArrInstance> AddEnabledInstance(InstanceType type, string name = "instance")
+    {
+        Guid configId = await _dataContext.ArrConfigs
+            .AsNoTracking()
+            .Where(x => x.Type == type)
+            .Select(x => x.Id)
+            .FirstAsync();
+
+        ArrInstance instance = new()
+        {
+            Name = name,
+            Url = new Uri("http://instance.local"),
+            ApiKey = "key",
+            Enabled = true,
+            ArrConfigId = configId,
+        };
+
+        _dataContext.ArrInstances.Add(instance);
+        await _dataContext.SaveChangesAsync();
+
+        return instance;
+    }
+
+    private static Dictionary<string, List<InstanceConnectionResponse>> AsDictionary(IActionResult result) =>
+        result.ShouldBeOfType<OkObjectResult>().Value
+            .ShouldBeOfType<Dictionary<string, List<InstanceConnectionResponse>>>();
+
+    [Fact]
+    public async Task GetMediaManagersStatus_CoversEveryInstanceType()
+    {
+        // Act
+        IActionResult result = await _controller.GetMediaManagersStatus();
+
+        // Assert: the list drives the response, so a forgotten member would vanish from the UI.
+        // The Unknown sentinel is not a media manager.
+        Dictionary<string, List<InstanceConnectionResponse>> status = AsDictionary(result);
+        foreach (InstanceType type in EnumSentinel.SelectableValues<InstanceType>())
+        {
+            status.ShouldContainKey(type.ToString());
+        }
+
+        status.ShouldNotContainKey(EnumSentinel.Unknown);
+    }
+
+    [Fact]
+    public async Task GetMediaManagersStatus_ProbesAnEnabledInstance()
+    {
+        // Arrange
+        await AddEnabledInstance(InstanceType.LazyLibrarian);
+
+        // Act
+        await _controller.GetMediaManagersStatus();
+
+        // Assert
+        await _healthChecker.Received(1).CheckAsync(InstanceType.LazyLibrarian, Arg.Any<ArrInstance>());
+    }
+
+    [Fact]
+    public async Task GetMediaManagersStatus_ReportsTheFailureReason()
+    {
+        // Arrange
+        await AddEnabledInstance(InstanceType.Sonarr);
+        _healthChecker
+            .CheckAsync(Arg.Any<InstanceType>(), Arg.Any<ArrInstance>())
+            .ThrowsAsync(new Exception("connection refused"));
+
+        // Act
+        IActionResult result = await _controller.GetMediaManagersStatus();
+
+        // Assert
+        InstanceConnectionResponse sonarr = AsDictionary(result)[nameof(InstanceType.Sonarr)].ShouldHaveSingleItem();
+        sonarr.IsConnected.ShouldBeFalse();
+        sonarr.Message.ShouldContain("connection refused");
+    }
+
+    [Fact]
+    public async Task GetSystemStatus_CountsInstancesPerType()
+    {
+        // Arrange
+        await AddEnabledInstance(InstanceType.Radarr, "one");
+        await AddEnabledInstance(InstanceType.Radarr, "two");
+
+        // Act
+        IActionResult result = await _controller.GetSystemStatus();
+
+        // Assert
+        SystemStatusResponse status = result.ShouldBeOfType<OkObjectResult>().Value
+            .ShouldBeOfType<SystemStatusResponse>();
+        status.MediaManagers[nameof(InstanceType.Radarr)].InstanceCount.ShouldBe(2);
+        status.MediaManagers[nameof(InstanceType.LazyLibrarian)].InstanceCount.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetDownloadClientStatus_ReturnsTheClientsKey()
+    {
+        // Act
+        IActionResult result = await _controller.GetDownloadClientStatus();
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>().Value
+            .ShouldBeOfType<Dictionary<string, List<DownloadClientStatusResponse>>>()
+            .ShouldContainKey("Clients");
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+}
@@ -0,0 +1,66 @@
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Events;
+
+/// <summary>
+/// Exercises the manual-event partial unique index against a real SQLite context configured with the
+/// production naming conventions. The EF Core InMemory provider ignores unique indexes, so the guarantee
+/// that <see cref="Cleanuparr.Infrastructure.Events.EventPublisher.PublishManualAsync"/> relies on to
+/// dedup racing publishers can only be verified here.
+/// </summary>
+public class ManualEventDedupTests : IDisposable
+{
+    private readonly EventsContext _context;
+
+    public ManualEventDedupTests()
+    {
+        _context = SeekerTestDataFactory.CreateEventsContext();
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static ManualEvent NewEvent(string hash, bool isResolved) => new()
+    {
+        Type = ManualEventType.RecurringDownload,
+        Message = "m",
+        Severity = EventSeverity.Warning,
+        ItemHash = hash,
+        IsResolved = isResolved,
+    };
+
+    [Fact]
+    public async Task TwoUnresolvedSameTypeAndHash_ViolatesUniqueIndex_WithSqliteConstraintError()
+    {
+        _context.ManualEvents.Add(NewEvent("abc123", isResolved: false));
+        _context.ManualEvents.Add(NewEvent("abc123", isResolved: false));
+
+        // The exception must surface as SQLITE_CONSTRAINT (19) — the exact code PublishManualAsync's
+        // catch filters on to treat the loser of a race as deduped.
+        DbUpdateException ex = await Should.ThrowAsync<DbUpdateException>(() => _context.SaveChangesAsync());
+        SqliteException sqliteEx = ex.InnerException.ShouldBeOfType<SqliteException>();
+        sqliteEx.SqliteErrorCode.ShouldBe(19);
+    }
+
+    [Fact]
+    public async Task ResolvedDuplicate_IsExemptFromUniqueIndex()
+    {
+        _context.ManualEvents.Add(NewEvent("abc123", isResolved: false));
+        await _context.SaveChangesAsync();
+
+        // The index is filtered on "is_resolved = 0", so a resolved row with the same type/hash is allowed.
+        _context.ManualEvents.Add(NewEvent("abc123", isResolved: true));
+        await Should.NotThrowAsync(() => _context.SaveChangesAsync());
+
+        (await _context.ManualEvents.CountAsync()).ShouldBe(2);
+    }
+}
@@ -0,0 +1,518 @@
+using Cleanuparr.Infrastructure.Health;
+using Cleanuparr.Api.Features.Arr.Contracts.Requests;
+using Cleanuparr.Api.Features.Arr.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Events.Interfaces;
+using Cleanuparr.Infrastructure.Features.Arr.Dtos;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.Arr;
+
+public class ArrConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly EventsContext _eventsContext;
+    private readonly IInstanceHealthChecker _healthChecker;
+    private readonly IEventPublisher _eventPublisher;
+    private readonly ArrConfigController _controller;
+
+    public ArrConfigControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        _eventsContext = ConfigControllerTestDataFactory.CreateEventsContext();
+        var logger = Substitute.For<ILogger<ArrConfigController>>();
+        _healthChecker = Substitute.For<IInstanceHealthChecker>();
+        _eventPublisher = Substitute.For<IEventPublisher>();
+        _controller = new ArrConfigController(logger, _dataContext, _eventsContext, _healthChecker, _eventPublisher);
+        ConfigControllerTestDataFactory.ConfigureProblemDetails(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        _eventsContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    #region GET configs
+
+    [Theory]
+    [InlineData(InstanceType.Sonarr)]
+    [InlineData(InstanceType.Radarr)]
+    [InlineData(InstanceType.Lidarr)]
+    [InlineData(InstanceType.Readarr)]
+    [InlineData(InstanceType.Whisparr)]
+    [InlineData(InstanceType.Sportarr)]
+    [InlineData(InstanceType.LazyLibrarian)]
+    public async Task GetArrConfig_AllTypes_ReturnOk(InstanceType type)
+    {
+        // Act
+        var result = await DispatchGet(type);
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var dto = ok.Value.ShouldBeOfType<ArrConfigDto>();
+        dto.Type.ShouldBe(type);
+    }
+
+    [Fact]
+    public async Task GetSonarrConfig_OrdersInstancesByName()
+    {
+        // Arrange
+        var config = await _dataContext.ArrConfigs.FirstAsync(c => c.Type == InstanceType.Sonarr);
+        _dataContext.ArrInstances.AddRange(
+            new ArrInstance { Name = "z", Url = new Uri("http://z"), ApiKey = "k", ArrConfigId = config.Id, Enabled = true },
+            new ArrInstance { Name = "a", Url = new Uri("http://a"), ApiKey = "k", ArrConfigId = config.Id, Enabled = true });
+        await _dataContext.SaveChangesAsync();
+
+        // Act
+        var result = await _controller.GetSonarrConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var dto = ok.Value.ShouldBeOfType<ArrConfigDto>();
+        dto.Instances[0].Name.ShouldBe("a");
+        dto.Instances[1].Name.ShouldBe("z");
+    }
+
+    #endregion
+
+    #region PUT configs
+
+    [Fact]
+    public async Task UpdateSonarrConfig_PersistsFailedImportMaxStrikes()
+    {
+        // Arrange
+        var request = new UpdateArrConfigRequest { FailedImportMaxStrikes = 7 };
+
+        // Act
+        var result = await _controller.UpdateSonarrConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        var saved = await _dataContext.ArrConfigs.AsNoTracking().FirstAsync(c => c.Type == InstanceType.Sonarr);
+        saved.FailedImportMaxStrikes.ShouldBe((short)7);
+    }
+
+    [Fact]
+    public async Task UpdateSonarrConfig_DefaultStrikes_PassesThrough()
+    {
+        // ArrConfig.Validate is currently a no-op; -1 (the default disabled value) is accepted
+        var request = new UpdateArrConfigRequest { FailedImportMaxStrikes = -1 };
+
+        // Act
+        var result = await _controller.UpdateSonarrConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+    }
+
+    #endregion
+
+    #region Create instance
+
+    [Fact]
+    public async Task CreateSonarrInstance_PersistsInstanceUnderSonarrConfig()
+    {
+        // Arrange
+        var request = new ArrInstanceRequest
+        {
+            Name = "test",
+            Url = "http://sonarr.test:8989",
+            ApiKey = "abc",
+            Version = 4f,
+        };
+
+        // Act
+        var result = await _controller.CreateSonarrInstance(request);
+
+        // Assert
+        var created = result.ShouldBeOfType<CreatedAtActionResult>();
+        var dto = created.Value.ShouldBeOfType<ArrInstanceDto>();
+        dto.Name.ShouldBe("test");
+        var sonarrConfig = await _dataContext.ArrConfigs
+            .Include(c => c.Instances)
+            .FirstAsync(c => c.Type == InstanceType.Sonarr);
+        sonarrConfig.Instances.ShouldContain(i => i.Name == "test");
+    }
+
+    [Fact]
+    public async Task CreateSonarrInstance_PlaceholderApiKey_ThrowsValidationException()
+    {
+        // Arrange — placeholder ApiKey is rejected by ArrInstanceRequest.ToEntity
+        var request = new ArrInstanceRequest
+        {
+            Name = "test",
+            Url = "http://sonarr.test:8989",
+            ApiKey = "••••••••",
+            Version = 4f,
+        };
+
+        // Act / Assert
+        await Should.ThrowAsync<Cleanuparr.Domain.Exceptions.ValidationException>(
+            () => _controller.CreateSonarrInstance(request));
+    }
+
+    #endregion
+
+    #region Update instance
+
+    [Fact]
+    public async Task UpdateSonarrInstance_UnknownId_ReturnsNotFound()
+    {
+        // Arrange
+        var request = new ArrInstanceRequest
+        {
+            Name = "x",
+            Url = "http://x",
+            ApiKey = "k",
+            Version = 4f,
+        };
+
+        // Act
+        var result = await _controller.UpdateSonarrInstance(Guid.NewGuid(), request);
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    [Fact]
+    public async Task UpdateSonarrInstance_Existing_PersistsChanges()
+    {
+        // Arrange
+        var sonarr = await _dataContext.ArrConfigs.FirstAsync(c => c.Type == InstanceType.Sonarr);
+        var instance = new ArrInstance
+        {
+            Name = "orig",
+            Url = new Uri("http://orig:8989"),
+            ApiKey = "k",
+            ArrConfigId = sonarr.Id,
+            Enabled = true,
+        };
+        _dataContext.ArrInstances.Add(instance);
+        await _dataContext.SaveChangesAsync();
+
+        var request = new ArrInstanceRequest
+        {
+            Name = "renamed",
+            Url = "http://renamed:8989",
+            ApiKey = "newkey",
+            Version = 4f,
+            Enabled = false,
+        };
+
+        // Act
+        var result = await _controller.UpdateSonarrInstance(instance.Id, request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        var saved = await _dataContext.ArrInstances.AsNoTracking().FirstAsync(i => i.Id == instance.Id);
+        saved.Name.ShouldBe("renamed");
+        saved.Enabled.ShouldBeFalse();
+        saved.ApiKey.ShouldBe("newkey");
+    }
+
+    #endregion
+
+    #region Delete instance
+
+    [Fact]
+    public async Task DeleteSonarrInstance_UnknownId_ReturnsNotFound()
+    {
+        // Act
+        var result = await _controller.DeleteSonarrInstance(Guid.NewGuid());
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    [Fact]
+    public async Task DeleteSonarrInstance_Existing_ReturnsNoContent()
+    {
+        // Arrange
+        var sonarr = await _dataContext.ArrConfigs.FirstAsync(c => c.Type == InstanceType.Sonarr);
+        var instance = new ArrInstance
+        {
+            Name = "doomed",
+            Url = new Uri("http://doomed:8989"),
+            ApiKey = "k",
+            ArrConfigId = sonarr.Id,
+            Enabled = true,
+        };
+        _dataContext.ArrInstances.Add(instance);
+        await _dataContext.SaveChangesAsync();
+
+        // Act
+        var result = await _controller.DeleteSonarrInstance(instance.Id);
+
+        // Assert
+        result.ShouldBeOfType<NoContentResult>();
+        (await _dataContext.ArrInstances.CountAsync(i => i.Id == instance.Id)).ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task DeleteSonarrInstance_FailsSearchEventsThatAreStillInFlight()
+    {
+        // Arrange
+        var sonarr = await _dataContext.ArrConfigs.FirstAsync(c => c.Type == InstanceType.Sonarr);
+        var instance = new ArrInstance
+        {
+            Name = "doomed",
+            Url = new Uri("http://doomed:8989"),
+            ApiKey = "k",
+            ArrConfigId = sonarr.Id,
+            Enabled = true,
+        };
+        _dataContext.ArrInstances.Add(instance);
+        await _dataContext.SaveChangesAsync();
+
+        // Act
+        await _controller.DeleteSonarrInstance(instance.Id);
+
+        // Assert
+        await _eventPublisher.Received(1).FailStrandedSearchEvents(instance.Id);
+    }
+
+    [Fact]
+    public async Task DeleteSonarrInstance_WhenStateCleanupFails_KeepsInstance()
+    {
+        // Arrange
+        var sonarr = await _dataContext.ArrConfigs.FirstAsync(c => c.Type == InstanceType.Sonarr);
+        var instance = new ArrInstance
+        {
+            Name = "doomed",
+            Url = new Uri("http://doomed:8989"),
+            ApiKey = "k",
+            ArrConfigId = sonarr.Id,
+            Enabled = true,
+        };
+        _dataContext.ArrInstances.Add(instance);
+        await _dataContext.SaveChangesAsync();
+
+        // Force the events cleanup to fail so the instance delete must roll back
+        await _eventsContext.DisposeAsync();
+
+        // Act
+        await Should.ThrowAsync<Exception>(() => _controller.DeleteSonarrInstance(instance.Id));
+
+        // Assert — instance is preserved (never deleted without its events state being removed)
+        (await _dataContext.ArrInstances.AsNoTracking().CountAsync(i => i.Id == instance.Id)).ShouldBe(1);
+    }
+
+    #endregion
+
+    #region Test instance
+
+    [Fact]
+    public async Task TestSonarrInstance_HealthCheckSucceeds_ReturnsOk()
+    {
+        // Arrange — IArrClient.HealthCheckAsync returns Task.CompletedTask by default
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr.test:8989",
+            ApiKey = "k",
+            Version = 4f,
+        };
+
+        // Act
+        var result = await _controller.TestSonarrInstance(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _healthChecker.Received(1).CheckAsync(InstanceType.Sonarr, Arg.Any<ArrInstance>());
+    }
+
+    [Fact]
+    public async Task TestSonarrInstance_HealthCheckThrows_ReturnsBadRequest()
+    {
+        // Arrange
+        _healthChecker.CheckAsync(Arg.Any<InstanceType>(), Arg.Any<ArrInstance>())
+            .Returns(Task.FromException(new HttpRequestException("unreachable")));
+
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr.test:8989",
+            ApiKey = "k",
+            Version = 4f,
+        };
+
+        // Act
+        var result = await _controller.TestSonarrInstance(request);
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+    }
+
+    [Fact]
+    public async Task TestSonarrInstance_PlaceholderApiKeyNoInstanceId_ReturnsBadRequest()
+    {
+        // Arrange — placeholder API key with no InstanceId means we can't resolve it; ToTestInstance throws
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr.test:8989",
+            ApiKey = "••••••••",
+            Version = 4f,
+        };
+
+        // Act
+        var result = await _controller.TestSonarrInstance(request);
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+    }
+
+    [Fact]
+    public async Task TestSonarrInstance_PlaceholderApiKeyResolvesFromInstanceId_RunsCheck()
+    {
+        // Arrange
+        var sonarr = await _dataContext.ArrConfigs.FirstAsync(c => c.Type == InstanceType.Sonarr);
+        var stored = new ArrInstance
+        {
+            Name = "stored",
+            Url = new Uri("http://stored:8989"),
+            ApiKey = "stored-key",
+            ArrConfigId = sonarr.Id,
+            Enabled = true,
+        };
+        _dataContext.ArrInstances.Add(stored);
+        await _dataContext.SaveChangesAsync();
+
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr.test:8989",
+            ApiKey = "••••••••",
+            Version = 4f,
+            InstanceId = stored.Id,
+        };
+
+        // Act
+        var result = await _controller.TestSonarrInstance(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _healthChecker.Received(1).CheckAsync(InstanceType.Sonarr, Arg.Is<ArrInstance>(i => i.ApiKey == "stored-key"));
+    }
+
+    #endregion
+
+    #region Route wiring
+
+    [Theory]
+    [InlineData(InstanceType.Sonarr)]
+    [InlineData(InstanceType.Radarr)]
+    [InlineData(InstanceType.Lidarr)]
+    [InlineData(InstanceType.Readarr)]
+    [InlineData(InstanceType.Whisparr)]
+    [InlineData(InstanceType.Sportarr)]
+    [InlineData(InstanceType.LazyLibrarian)]
+    public async Task InstanceRoutes_AllTypes_CreateUpdateDeleteAndTest(InstanceType type)
+    {
+        // Arrange: every route delegates to the same helper, so this covers the wiring per type.
+        ArrInstanceRequest request = new()
+        {
+            Name = "wired",
+            Url = "http://instance.test:1234",
+            ApiKey = "abc",
+            Version = 1f,
+        };
+
+        // Act + Assert: create
+        IActionResult created = await DispatchCreate(type, request);
+        ArrInstanceDto dto = created.ShouldBeOfType<CreatedAtActionResult>().Value.ShouldBeOfType<ArrInstanceDto>();
+
+        // Act + Assert: update
+        Guid id = dto.Id.ShouldNotBeNull();
+        IActionResult updated = await DispatchUpdate(type, id, request with { Name = "rewired" });
+        updated.ShouldBeOfType<OkObjectResult>().Value.ShouldBeOfType<ArrInstanceDto>().Name.ShouldBe("rewired");
+
+        // Act + Assert: connection test
+        IActionResult tested = await DispatchTest(type, new TestArrInstanceRequest
+        {
+            Url = request.Url,
+            ApiKey = request.ApiKey,
+            Version = request.Version,
+        });
+        tested.ShouldBeOfType<OkObjectResult>();
+        await _healthChecker.Received(1).CheckAsync(type, Arg.Any<ArrInstance>());
+
+        // Act + Assert: delete
+        IActionResult deleted = await DispatchDelete(type, id);
+        deleted.ShouldBeOfType<NoContentResult>();
+
+        ArrConfig config = await _dataContext.ArrConfigs
+            .Include(c => c.Instances)
+            .FirstAsync(c => c.Type == type);
+        config.Instances.ShouldBeEmpty();
+    }
+
+    #endregion
+
+    private Task<IActionResult> DispatchCreate(InstanceType type, ArrInstanceRequest request) => type switch
+    {
+        InstanceType.Sonarr => _controller.CreateSonarrInstance(request),
+        InstanceType.Radarr => _controller.CreateRadarrInstance(request),
+        InstanceType.Lidarr => _controller.CreateLidarrInstance(request),
+        InstanceType.Readarr => _controller.CreateReadarrInstance(request),
+        InstanceType.Whisparr => _controller.CreateWhisparrInstance(request),
+        InstanceType.Sportarr => _controller.CreateSportarrInstance(request),
+        InstanceType.LazyLibrarian => _controller.CreateLazyLibrarianInstance(request),
+        _ => throw new ArgumentOutOfRangeException(nameof(type)),
+    };
+
+    private Task<IActionResult> DispatchUpdate(InstanceType type, Guid id, ArrInstanceRequest request) => type switch
+    {
+        InstanceType.Sonarr => _controller.UpdateSonarrInstance(id, request),
+        InstanceType.Radarr => _controller.UpdateRadarrInstance(id, request),
+        InstanceType.Lidarr => _controller.UpdateLidarrInstance(id, request),
+        InstanceType.Readarr => _controller.UpdateReadarrInstance(id, request),
+        InstanceType.Whisparr => _controller.UpdateWhisparrInstance(id, request),
+        InstanceType.Sportarr => _controller.UpdateSportarrInstance(id, request),
+        InstanceType.LazyLibrarian => _controller.UpdateLazyLibrarianInstance(id, request),
+        _ => throw new ArgumentOutOfRangeException(nameof(type)),
+    };
+
+    private Task<IActionResult> DispatchDelete(InstanceType type, Guid id) => type switch
+    {
+        InstanceType.Sonarr => _controller.DeleteSonarrInstance(id),
+        InstanceType.Radarr => _controller.DeleteRadarrInstance(id),
+        InstanceType.Lidarr => _controller.DeleteLidarrInstance(id),
+        InstanceType.Readarr => _controller.DeleteReadarrInstance(id),
+        InstanceType.Whisparr => _controller.DeleteWhisparrInstance(id),
+        InstanceType.Sportarr => _controller.DeleteSportarrInstance(id),
+        InstanceType.LazyLibrarian => _controller.DeleteLazyLibrarianInstance(id),
+        _ => throw new ArgumentOutOfRangeException(nameof(type)),
+    };
+
+    private Task<IActionResult> DispatchTest(InstanceType type, TestArrInstanceRequest request) => type switch
+    {
+        InstanceType.Sonarr => _controller.TestSonarrInstance(request),
+        InstanceType.Radarr => _controller.TestRadarrInstance(request),
+        InstanceType.Lidarr => _controller.TestLidarrInstance(request),
+        InstanceType.Readarr => _controller.TestReadarrInstance(request),
+        InstanceType.Whisparr => _controller.TestWhisparrInstance(request),
+        InstanceType.Sportarr => _controller.TestSportarrInstance(request),
+        InstanceType.LazyLibrarian => _controller.TestLazyLibrarianInstance(request),
+        _ => throw new ArgumentOutOfRangeException(nameof(type)),
+    };
+
+    private Task<IActionResult> DispatchGet(InstanceType type) => type switch
+    {
+        InstanceType.Sonarr => _controller.GetSonarrConfig(),
+        InstanceType.Radarr => _controller.GetRadarrConfig(),
+        InstanceType.Lidarr => _controller.GetLidarrConfig(),
+        InstanceType.Readarr => _controller.GetReadarrConfig(),
+        InstanceType.Whisparr => _controller.GetWhisparrConfig(),
+        InstanceType.Sportarr => _controller.GetSportarrConfig(),
+        InstanceType.LazyLibrarian => _controller.GetLazyLibrarianConfig(),
+        _ => throw new ArgumentOutOfRangeException(nameof(type)),
+    };
+}
@@ -0,0 +1,149 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for POST /api/account/feature-views. Verifies that feature "first seen"
+/// timestamps are recorded per user, that recording is idempotent, and that the endpoint
+/// requires authentication.
+/// </summary>
+[Collection("Auth Integration Tests")]
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AccountControllerFeatureViewsTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private readonly CustomWebApplicationFactory _factory;
+    private readonly HttpClient _client;
+
+    private static string? _accessToken;
+
+    public AccountControllerFeatureViewsTests(CustomWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient();
+
+        if (_accessToken is not null)
+        {
+            _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+        }
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task Setup_CreateAccountAndLogin()
+    {
+        var createResponse = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "featureadmin",
+            password = "FeaturePassword123!"
+        });
+        createResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var completeResponse = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+        completeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var loginResponse = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "featureadmin",
+            password = "FeaturePassword123!"
+        });
+        loginResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await loginResponse.Content.ReadFromJsonAsync<JsonElement>();
+        _accessToken = body.GetProperty("tokens").GetProperty("accessToken").GetString();
+        _accessToken.ShouldNotBeNullOrEmpty();
+
+        _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task RecordFeatureViews_NewIds_RecordsTimestampsAndReturnsMapWithAnchor()
+    {
+        var response = await _client.PostAsJsonAsync("/api/account/feature-views", new
+        {
+            featureIds = new[] { "feature-a", "feature-b" }
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<FeatureViewsResponseDto>();
+        body.ShouldNotBeNull();
+        body.CreatedAt.ShouldNotBe(default);
+        body.Views.ShouldContainKey("feature-a");
+        body.Views.ShouldContainKey("feature-b");
+        body.Views["feature-a"].Offset.ShouldBe(TimeSpan.Zero);
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task RecordFeatureViews_DuplicateId_IsIdempotentAndKeepsOriginalTimestamp()
+    {
+        var firstResponse = await _client.PostAsJsonAsync("/api/account/feature-views", new
+        {
+            featureIds = new[] { "feature-a" }
+        });
+        firstResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+        var firstBody = await firstResponse.Content.ReadFromJsonAsync<FeatureViewsResponseDto>();
+        var originalTimestamp = firstBody!.Views["feature-a"];
+
+        var secondResponse = await _client.PostAsJsonAsync("/api/account/feature-views", new
+        {
+            featureIds = new[] { "feature-a" }
+        });
+        secondResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+        var secondBody = await secondResponse.Content.ReadFromJsonAsync<FeatureViewsResponseDto>();
+
+        secondBody!.Views["feature-a"].ShouldBe(originalTimestamp);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task RecordFeatureViews_WhenUnauthenticated_ReturnsUnauthorized()
+    {
+        var unauthClient = _factory.CreateClient();
+
+        var response = await unauthClient.PostAsJsonAsync("/api/account/feature-views", new
+        {
+            featureIds = new[] { "feature-a" }
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task RecordFeatureViews_TooManyIds_ReturnsBadRequest()
+    {
+        var tooMany = Enumerable.Range(0, 101).Select(i => $"feature-{i}").ToArray();
+
+        var response = await _client.PostAsJsonAsync("/api/account/feature-views", new
+        {
+            featureIds = tooMany
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task RecordFeatureViews_OverLengthId_IsSkipped()
+    {
+        var overLengthId = new string('x', 65);
+
+        var response = await _client.PostAsJsonAsync("/api/account/feature-views", new
+        {
+            featureIds = new[] { "feature-ok", overLengthId }
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<FeatureViewsResponseDto>();
+        body.ShouldNotBeNull();
+        body.Views.ShouldContainKey("feature-ok");
+        body.Views.ShouldNotContainKey(overLengthId);
+    }
+
+    private sealed record FeatureViewsResponseDto
+    {
+        public DateTimeOffset CreatedAt { get; init; }
+        public Dictionary<string, DateTimeOffset> Views { get; init; } = new();
+    }
+}
@@ -0,0 +1,103 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Covers the credential endpoints when a correctly signed access token names a user that does not exist.
+/// Authentication accepts the token, so the action itself has to reject the request.
+/// </summary>
+[Collection("Auth Integration Tests")]
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AccountControllerMissingUserTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private const string Username = "ghostadmin";
+    private const string Password = "GhostPassword123!";
+
+    private readonly CustomWebApplicationFactory _factory;
+    private readonly HttpClient _client;
+
+    public AccountControllerMissingUserTests(CustomWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient();
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task Setup_CreateAccount()
+    {
+        var createResponse = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = Username,
+            password = Password
+        });
+        createResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var completeResponse = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+        completeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task ChangePassword_ForAnUnknownUserId_ReturnsUnauthorized()
+    {
+        _client.DefaultRequestHeaders.Authorization = TokenForAnUnknownUser();
+
+        var response = await _client.PutAsJsonAsync("/api/account/password", new
+        {
+            currentPassword = Password,
+            newPassword = "AnotherPassword456!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task ChangeUsername_ForAnUnknownUserId_ReturnsUnauthorized()
+    {
+        _client.DefaultRequestHeaders.Authorization = TokenForAnUnknownUser();
+
+        var response = await _client.PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = Password,
+            newUsername = "renamedadmin"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task UpdateOidcConfig_ForAnUnknownUserId_ReturnsUnauthorized()
+    {
+        _client.DefaultRequestHeaders.Authorization = TokenForAnUnknownUser();
+
+        var response = await _client.PutAsJsonAsync("/api/account/oidc", new
+        {
+            enabled = true
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    private AuthenticationHeaderValue TokenForAnUnknownUser()
+    {
+        using var scope = _factory.Services.CreateScope();
+        var jwtService = scope.ServiceProvider.GetRequiredService<IJwtService>();
+
+        // Signed with the running app's key, so authentication passes and the lookup inside the action is what fails
+        string token = jwtService.GenerateAccessToken(new User
+        {
+            Id = Guid.NewGuid(),
+            Username = "gone",
+            PasswordHash = string.Empty,
+            TotpSecret = string.Empty,
+            ApiKey = string.Empty
+        });
+
+        return new AuthenticationHeaderValue("Bearer", token);
+    }
+}
@@ -87,7 +87,7 @@ public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTes

        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
-        body.GetProperty("error").GetString().ShouldContain("OIDC is not enabled");
+        body.GetProperty("detail").GetString().ShouldContain("OIDC is not enabled");
    }

    [Fact, TestPriority(3)]
@@ -214,6 +214,18 @@ public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTes
    }

    [Fact, TestPriority(12)]
+    public async Task ChangeUsername_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = "LinkPassword123!",
+            newUsername = "renamedadmin"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(13)]
    public async Task PlexLink_Blocked_WhenExclusiveModeActive()
    {
        var response = await _client.PostAsync("/api/account/plex/link", null);
@@ -221,7 +233,7 @@ public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTes
        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
    }

-    [Fact, TestPriority(13)]
+    [Fact, TestPriority(14)]
    public async Task PlexUnlink_Blocked_WhenExclusiveModeActive()
    {
        var response = await _client.DeleteAsync("/api/account/plex/link");
@@ -229,7 +241,7 @@ public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTes
        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
    }

-    [Fact, TestPriority(14)]
+    [Fact, TestPriority(15)]
    public async Task OidcConfigUpdate_StillWorks_WhenExclusiveModeActive()
    {
        var response = await _client.PutAsJsonAsync("/api/account/oidc", new
@@ -248,7 +260,7 @@ public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTes
        response.StatusCode.ShouldBe(HttpStatusCode.OK);
    }

-    [Fact, TestPriority(15)]
+    [Fact, TestPriority(16)]
    public async Task OidcUnlink_ResetsExclusiveMode()
    {
        var response = await _client.DeleteAsync("/api/account/oidc/link");
@@ -260,7 +272,7 @@ public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTes
        exclusiveMode.ShouldBeFalse();
    }

-    [Fact, TestPriority(16)]
+    [Fact, TestPriority(17)]
    public async Task DisableExclusiveMode_PasswordChangeWorks_Again()
    {
        // Re-enable OIDC with a linked subject but without exclusive mode
@@ -276,6 +288,26 @@ public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTes
        response.StatusCode.ShouldBe(HttpStatusCode.OK);
    }

+    [Fact, TestPriority(18)]
+    public async Task ChangePassword_WithWrongPassword_ReturnsBadRequestAndKeepsThePassword()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/password", new
+        {
+            currentPassword = "NotThePassword123!",
+            newPassword = "RejectedPassword000!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+
+        var login = await _factory.CreateClient().PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "linkadmin",
+            password = "NewPassword789!"
+        });
+
+        login.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
    #endregion

    #region Test Infrastructure
@@ -0,0 +1,469 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Tests that 2FA disable and regenerate accept a recovery code.
+/// </summary>
+[Collection("Auth Integration Tests")]
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AccountControllerTwoFactorTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private const string Username = "twofaadmin";
+    private const string Password = "TwoFactorPassword123!";
+
+    private readonly CustomWebApplicationFactory _factory;
+    private readonly HttpClient _client;
+
+    private static string? _accessToken;
+    private static string _secret = "";
+    private static List<string> _recoveryCodes = [];
+
+    public AccountControllerTwoFactorTests(CustomWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient();
+
+        if (_accessToken is not null)
+        {
+            _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+        }
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task Setup_CreateAccountAndLogin()
+    {
+        var createResponse = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = Username,
+            password = Password
+        });
+        createResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var completeResponse = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+        completeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var loginResponse = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = Username,
+            password = Password
+        });
+        loginResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await loginResponse.Content.ReadFromJsonAsync<JsonElement>();
+        _accessToken = body.GetProperty("tokens").GetProperty("accessToken").GetString();
+        _accessToken.ShouldNotBeNullOrEmpty();
+
+        _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Enable2fa_WithGeneratedTotpCode_TurnsTwoFactorOn()
+    {
+        await EnableTwoFactor();
+
+        (await IsTwoFactorEnabled()).ShouldBeTrue();
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task Disable2fa_WithRecoveryCode_Succeeds()
+    {
+        var response = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+        {
+            password = Password,
+            totpCode = _recoveryCodes[0]
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        (await IsTwoFactorEnabled()).ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task Regenerate2fa_WithRecoveryCode_RotatesSecretAndCodes()
+    {
+        await EnableTwoFactor();
+
+        var previousSecret = _secret;
+        var previousCodes = _recoveryCodes;
+
+        var response = await _client.PostAsJsonAsync("/api/account/2fa/regenerate", new
+        {
+            password = Password,
+            totpCode = previousCodes[0]
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        _secret = body.GetProperty("secret").GetString()!;
+        _recoveryCodes = ReadRecoveryCodes(body);
+
+        _secret.ShouldNotBe(previousSecret);
+        _recoveryCodes.Count.ShouldBe(10);
+        _recoveryCodes.ShouldNotContain(previousCodes[0]);
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task Disable2fa_WithCodeFromRegeneratedBatch_Succeeds()
+    {
+        var response = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+        {
+            password = Password,
+            totpCode = _recoveryCodes[0]
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        (await IsTwoFactorEnabled()).ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task Disable2fa_WithRecoveryCodeAlreadyConsumedAtLogin_IsRejected()
+    {
+        await EnableTwoFactor();
+
+        var anonymousClient = _factory.CreateClient();
+
+        var loginResponse = await anonymousClient.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = Username,
+            password = Password
+        });
+        loginResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var loginBody = await loginResponse.Content.ReadFromJsonAsync<JsonElement>();
+        loginBody.GetProperty("requiresTwoFactor").GetBoolean().ShouldBeTrue();
+
+        var twoFactorResponse = await anonymousClient.PostAsJsonAsync("/api/auth/login/2fa", new
+        {
+            loginToken = loginBody.GetProperty("loginToken").GetString(),
+            code = _recoveryCodes[0],
+            isRecoveryCode = true
+        });
+        twoFactorResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var disableResponse = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+        {
+            password = Password,
+            totpCode = _recoveryCodes[0]
+        });
+
+        disableResponse.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        (await IsTwoFactorEnabled()).ShouldBeTrue();
+
+        await ClearLockout();
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task Disable2fa_WithUnknownCode_IsRejected()
+    {
+        var response = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+        {
+            password = Password,
+            totpCode = "ZZZZ-ZZZZ"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        (await IsTwoFactorEnabled()).ShouldBeTrue();
+
+        await ClearLockout();
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task Regenerate2fa_WithUnknownCode_IsRejected()
+    {
+        HttpResponseMessage response = await _client.PostAsJsonAsync("/api/account/2fa/regenerate", new
+        {
+            password = Password,
+            totpCode = "ZZZZ-ZZZZ"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        (await IsTwoFactorEnabled()).ShouldBeTrue();
+
+        await ClearLockout();
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task Disable2fa_WithTotpCode_StillSucceeds()
+    {
+        var response = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+        {
+            password = Password,
+            totpCode = TotpTestHelper.GenerateTotpCode(_secret)
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        (await IsTwoFactorEnabled()).ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(9)]
+    public async Task Disable2fa_WithRepeatedBadCodes_EventuallyRateLimits()
+    {
+        await EnableTwoFactor();
+
+        try
+        {
+            var first = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+            {
+                password = Password,
+                totpCode = "ZZZZ-ZZZZ"
+            });
+
+            first.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+
+            var firstBody = await first.Content.ReadFromJsonAsync<JsonElement>();
+            firstBody.GetProperty("retryAfterSeconds").GetInt32().ShouldBeGreaterThan(0);
+
+            var second = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+            {
+                password = Password,
+                totpCode = "ZZZZ-ZZZZ"
+            });
+
+            second.StatusCode.ShouldBe(HttpStatusCode.TooManyRequests);
+            (await IsTwoFactorEnabled()).ShouldBeTrue();
+        }
+        finally
+        {
+            await ClearLockout();
+        }
+    }
+
+    [Fact, TestPriority(10)]
+    public async Task Disable2fa_AfterLockoutCleared_ResetsTheCounterOnSuccess()
+    {
+        await SeedFailedAttempts(3);
+
+        var response = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+        {
+            password = Password,
+            totpCode = TotpTestHelper.GenerateTotpCode(_secret)
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        (await IsTwoFactorEnabled()).ShouldBeFalse();
+
+        using var scope = _factory.Services.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+        var user = await context.Users.FirstAsync();
+
+        user.FailedLoginAttempts.ShouldBe(0);
+        user.LockoutEnd.ShouldBeNull();
+    }
+
+    [Fact, TestPriority(11)]
+    public async Task Login_WithTwoFactorEnabled_KeepsTheFailedAttemptCounter()
+    {
+        await EnableTwoFactor();
+
+        try
+        {
+            await SeedFailedAttempts(3);
+
+            await RequestLoginToken();
+
+            (await ReadFailedAttempts()).ShouldBe(3);
+        }
+        finally
+        {
+            await ClearLockout();
+            await DisableTwoFactor();
+        }
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task Login_WithConcurrentWrongPasswords_LocksOutTheSecondRequest()
+    {
+        await ClearLockout();
+
+        try
+        {
+            HttpResponseMessage[] responses = await Task.WhenAll(
+                _factory.CreateClient().PostAsJsonAsync("/api/auth/login", new { username = Username, password = "WrongPassword123!" }),
+                _factory.CreateClient().PostAsJsonAsync("/api/auth/login", new { username = Username, password = "WrongPassword123!" }));
+
+            responses.Count(response => response.StatusCode is HttpStatusCode.Unauthorized).ShouldBe(1);
+            responses.Count(response => response.StatusCode is HttpStatusCode.TooManyRequests).ShouldBe(1);
+        }
+        finally
+        {
+            await ClearLockout();
+        }
+    }
+
+    [Fact, TestPriority(20)]
+    public async Task Regenerate2fa_WhenIssuedConcurrently_AppliesOnce()
+    {
+        await EnableTwoFactor();
+
+        string sharedCode = _recoveryCodes[0];
+
+        const int attempts = 8;
+        HttpResponseMessage[] responses = await Task.WhenAll(
+            Enumerable.Range(0, attempts).Select(_ =>
+                _client.PostAsJsonAsync("/api/account/2fa/regenerate", new { password = Password, totpCode = sharedCode })));
+
+        // Losers are rejected as a spent code or as a lockout, depending on which increment lands first
+        responses.Count(response => response.StatusCode is HttpStatusCode.OK).ShouldBe(1);
+        responses.Count(response => response.StatusCode is not HttpStatusCode.OK).ShouldBe(attempts - 1);
+        (await CountRecoveryCodes()).ShouldBe(10);
+
+        HttpResponseMessage accepted = responses.First(response => response.StatusCode is HttpStatusCode.OK);
+        JsonElement body = await accepted.Content.ReadFromJsonAsync<JsonElement>();
+        _secret = body.GetProperty("secret").GetString()!;
+        _recoveryCodes = ReadRecoveryCodes(body);
+
+        await ClearLockout();
+    }
+
+    [Fact, TestPriority(21)]
+    public async Task Login2fa_WithSameRecoveryCodeConcurrently_SucceedsOnce()
+    {
+        string sharedCode = _recoveryCodes[0];
+
+        string firstToken = await RequestLoginToken();
+        string secondToken = await RequestLoginToken();
+
+        HttpResponseMessage[] responses = await Task.WhenAll(
+            _factory.CreateClient().PostAsJsonAsync("/api/auth/login/2fa", new { loginToken = firstToken, code = sharedCode, isRecoveryCode = true }),
+            _factory.CreateClient().PostAsJsonAsync("/api/auth/login/2fa", new { loginToken = secondToken, code = sharedCode, isRecoveryCode = true }));
+
+        responses.Count(response => response.StatusCode is HttpStatusCode.OK).ShouldBe(1);
+
+        await ClearLockout();
+    }
+
+    [Fact, TestPriority(22)]
+    public async Task Disable2fa_WithConcurrentBadCodes_LocksOutTheSecondRequest()
+    {
+        if (!await IsTwoFactorEnabled())
+        {
+            await EnableTwoFactor();
+        }
+
+        await ClearLockout();
+
+        try
+        {
+            HttpResponseMessage[] responses = await Task.WhenAll(
+                _client.PostAsJsonAsync("/api/account/2fa/disable", new { password = Password, totpCode = "ZZZZ-ZZZZ" }),
+                _client.PostAsJsonAsync("/api/account/2fa/disable", new { password = Password, totpCode = "ZZZZ-ZZZZ" }));
+
+            responses.Count(response => response.StatusCode is HttpStatusCode.BadRequest).ShouldBe(1);
+            responses.Count(response => response.StatusCode is HttpStatusCode.TooManyRequests).ShouldBe(1);
+            (await IsTwoFactorEnabled()).ShouldBeTrue();
+        }
+        finally
+        {
+            await ClearLockout();
+        }
+    }
+
+    private async Task<string> RequestLoginToken()
+    {
+        HttpResponseMessage response = await _factory.CreateClient().PostAsJsonAsync("/api/auth/login", new
+        {
+            username = Username,
+            password = Password
+        });
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        JsonElement body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("requiresTwoFactor").GetBoolean().ShouldBeTrue();
+
+        return body.GetProperty("loginToken").GetString()!;
+    }
+
+    private async Task<int> CountRecoveryCodes()
+    {
+        using IServiceScope scope = _factory.Services.CreateScope();
+        UsersContext context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+        return await context.RecoveryCodes.CountAsync();
+    }
+
+    private async Task SeedFailedAttempts(int attempts)
+    {
+        using IServiceScope scope = _factory.Services.CreateScope();
+        UsersContext context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+        User user = await context.Users.FirstAsync();
+
+        user.FailedLoginAttempts = attempts;
+        user.LockoutEnd = null;
+        await context.SaveChangesAsync();
+    }
+
+    private async Task<int> ReadFailedAttempts()
+    {
+        using IServiceScope scope = _factory.Services.CreateScope();
+        UsersContext context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+        return (await context.Users.AsNoTracking().FirstAsync()).FailedLoginAttempts;
+    }
+
+    private async Task ClearLockout()
+    {
+        using var scope = _factory.Services.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+        var user = await context.Users.FirstAsync();
+
+        user.FailedLoginAttempts = 0;
+        user.LockoutEnd = null;
+        await context.SaveChangesAsync();
+    }
+
+    private async Task EnableTwoFactor()
+    {
+        var enableResponse = await _client.PostAsJsonAsync("/api/account/2fa/enable", new
+        {
+            password = Password
+        });
+        enableResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await enableResponse.Content.ReadFromJsonAsync<JsonElement>();
+        _secret = body.GetProperty("secret").GetString()!;
+        _recoveryCodes = ReadRecoveryCodes(body);
+        _recoveryCodes.Count.ShouldBe(10);
+
+        var verifyResponse = await _client.PostAsJsonAsync("/api/account/2fa/enable/verify", new
+        {
+            code = TotpTestHelper.GenerateTotpCode(_secret)
+        });
+        verifyResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    private async Task DisableTwoFactor()
+    {
+        HttpResponseMessage response = await _client.PostAsJsonAsync("/api/account/2fa/disable", new
+        {
+            password = Password,
+            totpCode = TotpTestHelper.GenerateTotpCode(_secret)
+        });
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    private async Task<bool> IsTwoFactorEnabled()
+    {
+        var response = await _client.GetAsync("/api/account");
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        return body.GetProperty("twoFactorEnabled").GetBoolean();
+    }
+
+    private static List<string> ReadRecoveryCodes(JsonElement body)
+    {
+        return body.GetProperty("recoveryCodes")
+            .EnumerateArray()
+            .Select(code => code.GetString()!)
+            .ToList();
+    }
+}
@@ -0,0 +1,195 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for PUT /api/account/username.
+/// </summary>
+[Collection("Auth Integration Tests")]
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AccountControllerUsernameTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private const string Username = "renameadmin";
+    private const string NewUsername = "renamedadmin";
+    private const string Password = "RenamePassword123!";
+
+    private readonly CustomWebApplicationFactory _factory;
+    private readonly HttpClient _client;
+
+    private static string? _accessToken;
+
+    public AccountControllerUsernameTests(CustomWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient();
+
+        if (_accessToken is not null)
+        {
+            _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+        }
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task Setup_CreateAccountAndLogin()
+    {
+        var createResponse = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = Username,
+            password = Password
+        });
+        createResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var completeResponse = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+        completeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var loginResponse = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = Username,
+            password = Password
+        });
+        loginResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await loginResponse.Content.ReadFromJsonAsync<JsonElement>();
+        _accessToken = body.GetProperty("tokens").GetProperty("accessToken").GetString();
+        _accessToken.ShouldNotBeNullOrEmpty();
+
+        _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task ChangeUsername_WhenUnauthenticated_ReturnsUnauthorized()
+    {
+        var response = await _factory.CreateClient().PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = Password,
+            newUsername = NewUsername
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task ChangeUsername_WithWrongPassword_ReturnsBadRequestAndKeepsUsername()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = "WrongPassword123!",
+            newUsername = NewUsername
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        (await GetStoredUsername()).ShouldBe(Username);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task ChangeUsername_TooShortAfterTrimming_ReturnsBadRequest()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = Password,
+            newUsername = "   ab   "
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        (await GetStoredUsername()).ShouldBe(Username);
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task ChangeUsername_WithCurrentUsername_ReturnsBadRequest()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = Password,
+            newUsername = Username
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task ChangeUsername_ShorterThanThreeCharacters_IsRejectedByModelValidation()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = Password,
+            newUsername = "ab"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        (await GetStoredUsername()).ShouldBe(Username);
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task ChangeUsername_WithValidPassword_TrimsStoresAndRevokesRefreshTokens()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/username", new
+        {
+            currentPassword = Password,
+            newUsername = $"  {NewUsername}  "
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        (await GetStoredUsername()).ShouldBe(NewUsername);
+
+        using var scope = _factory.Services.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+        List<RefreshToken> tokens = await context.RefreshTokens.ToListAsync();
+
+        tokens.ShouldNotBeEmpty();
+        tokens.ShouldAllBe(t => t.RevokedAt != null);
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task Login_WithOldUsername_IsRejected()
+    {
+        var response = await _factory.CreateClient().PostAsJsonAsync("/api/auth/login", new
+        {
+            username = Username,
+            password = Password
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task Login_WithNewUsername_Succeeds()
+    {
+        await ClearLockout();
+
+        var response = await _factory.CreateClient().PostAsJsonAsync("/api/auth/login", new
+        {
+            username = NewUsername,
+            password = Password
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    private async Task<string> GetStoredUsername()
+    {
+        using var scope = _factory.Services.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+        User user = await context.Users.AsNoTracking().FirstAsync();
+
+        return user.Username;
+    }
+
+    private async Task ClearLockout()
+    {
+        using var scope = _factory.Services.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+        User user = await context.Users.FirstAsync();
+
+        user.FailedLoginAttempts = 0;
+        user.LockoutEnd = null;
+        await context.SaveChangesAsync();
+    }
+}
@@ -268,55 +268,7 @@ public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
        body.TryGetProperty("oidcProviderName", out _).ShouldBeTrue();
    }

-    #region TOTP helpers
-
    private static string _totpSecret = "";

-    private static string GenerateTotpCode(string base32Secret)
-    {
-        var key = Base32Decode(base32Secret);
-        var timestep = (long)(DateTime.UtcNow - DateTime.UnixEpoch).TotalSeconds / 30;
-        var timestepBytes = BitConverter.GetBytes(timestep);
-
-        if (BitConverter.IsLittleEndian)
-            Array.Reverse(timestepBytes);
-
-        using var hmac = new System.Security.Cryptography.HMACSHA1(key);
-        var hash = hmac.ComputeHash(timestepBytes);
-
-        var offset = hash[^1] & 0x0F;
-        var binaryCode =
-            ((hash[offset] & 0x7F) << 24) |
-            ((hash[offset + 1] & 0xFF) << 16) |
-            ((hash[offset + 2] & 0xFF) << 8) |
-            (hash[offset + 3] & 0xFF);
-
-        return (binaryCode % 1_000_000).ToString("D6");
-    }
-
-    private static byte[] Base32Decode(string base32)
-    {
-        const string alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-        base32 = base32.ToUpperInvariant().TrimEnd('=');
-
-        var bits = new List<byte>();
-        foreach (var c in base32)
-        {
-            var val = alphabet.IndexOf(c);
-            if (val < 0) continue;
-            for (var i = 4; i >= 0; i--)
-                bits.Add((byte)((val >> i) & 1));
-        }
-
-        var bytes = new byte[bits.Count / 8];
-        for (var i = 0; i < bytes.Length; i++)
-        {
-            for (var j = 0; j < 8; j++)
-                bytes[i] = (byte)((bytes[i] << 1) | bits[i * 8 + j]);
-        }
-
-        return bytes;
-    }
-
-    #endregion
+    private static string GenerateTotpCode(string base32Secret) => TotpTestHelper.GenerateTotpCode(base32Secret);
 }
@@ -0,0 +1,129 @@
+using Cleanuparr.Api.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging.Abstractions;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+public sealed class LoginAttemptTrackerTests : IDisposable
+{
+    private readonly SqliteConnection _connection;
+    private readonly UsersContext _usersContext;
+    private readonly LoginAttemptTracker _sut;
+    private readonly Guid _userId = Guid.NewGuid();
+
+    public LoginAttemptTrackerTests()
+    {
+        _connection = new SqliteConnection("DataSource=:memory:");
+        _connection.Open();
+
+        DbContextOptions<UsersContext> options = new DbContextOptionsBuilder<UsersContext>()
+            .UseSqlite(_connection)
+            .Options;
+
+        _usersContext = new UsersContext(options);
+        _usersContext.Database.EnsureCreated();
+
+        _usersContext.Users.Add(new User
+        {
+            Id = _userId,
+            Username = "admin",
+            PasswordHash = "hash",
+            TotpSecret = string.Empty,
+            ApiKey = "key",
+            SetupCompleted = true
+        });
+        _usersContext.SaveChanges();
+
+        _sut = new LoginAttemptTracker(_usersContext, NullLogger<LoginAttemptTracker>.Instance);
+    }
+
+    [Fact]
+    public async Task IncrementFailedAttempts_GrowsTheLockoutWindowWithEachAttempt()
+    {
+        (await _sut.IncrementFailedAttempts(_userId)).ShouldBe(2);
+        (await _sut.IncrementFailedAttempts(_userId)).ShouldBe(4);
+        (await _sut.IncrementFailedAttempts(_userId)).ShouldBe(6);
+
+        User user = await _usersContext.Users.FirstAsync(u => u.Id == _userId);
+        user.FailedLoginAttempts.ShouldBe(3);
+        user.LockoutEnd.ShouldNotBeNull();
+        LoginAttemptTracker.GetLockoutSecondsRemaining(user).ShouldNotBeNull();
+    }
+
+    [Fact]
+    public async Task IncrementFailedAttempts_StopsGrowingAtTheMaximumWindow()
+    {
+        User seeded = await _usersContext.Users.FirstAsync(u => u.Id == _userId);
+        seeded.FailedLoginAttempts = 148;
+        await _usersContext.SaveChangesAsync();
+
+        (await _sut.IncrementFailedAttempts(_userId)).ShouldBe(298);
+        (await _sut.IncrementFailedAttempts(_userId)).ShouldBe(300);
+        (await _sut.IncrementFailedAttempts(_userId)).ShouldBe(300);
+
+        User user = await _usersContext.Users.FirstAsync(u => u.Id == _userId);
+        user.FailedLoginAttempts.ShouldBe(151);
+        LoginAttemptTracker.GetLockoutSecondsRemaining(user)!.Value.ShouldBeLessThanOrEqualTo(300);
+    }
+
+    [Fact]
+    public async Task ResetFailedAttempts_ClearsTheCounterAndLockout()
+    {
+        await _sut.IncrementFailedAttempts(_userId);
+        await _sut.IncrementFailedAttempts(_userId);
+
+        await _sut.ResetFailedAttempts(_userId);
+
+        User user = await _usersContext.Users.FirstAsync(u => u.Id == _userId);
+        user.FailedLoginAttempts.ShouldBe(0);
+        user.LockoutEnd.ShouldBeNull();
+        LoginAttemptTracker.GetLockoutSecondsRemaining(user).ShouldBeNull();
+    }
+
+    [Fact]
+    public void GetLockoutSecondsRemaining_WithoutLockout_ReturnsNull()
+    {
+        User user = CreateUser(lockoutEnd: null);
+
+        LoginAttemptTracker.GetLockoutSecondsRemaining(user).ShouldBeNull();
+    }
+
+    [Fact]
+    public void GetLockoutSecondsRemaining_WithExpiredLockout_ReturnsNull()
+    {
+        User user = CreateUser(DateTimeOffset.UtcNow.AddSeconds(-1));
+
+        LoginAttemptTracker.GetLockoutSecondsRemaining(user).ShouldBeNull();
+    }
+
+    [Fact]
+    public void GetLockoutSecondsRemaining_WithActiveLockout_RoundsUpToWholeSeconds()
+    {
+        User user = CreateUser(DateTimeOffset.UtcNow.AddSeconds(9.9));
+
+        LoginAttemptTracker.GetLockoutSecondsRemaining(user).ShouldBe(10);
+    }
+
+    private static User CreateUser(DateTimeOffset? lockoutEnd)
+    {
+        return new User
+        {
+            Id = Guid.NewGuid(),
+            Username = "admin",
+            PasswordHash = "hash",
+            TotpSecret = string.Empty,
+            ApiKey = "key",
+            LockoutEnd = lockoutEnd
+        };
+    }
+
+    public void Dispose()
+    {
+        _usersContext.Dispose();
+        _connection.Dispose();
+    }
+}
@@ -1,6 +1,9 @@
 using System.Diagnostics;
 using System.Net;
 using System.Net.Http.Json;
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
 using Shouldly;

 namespace Cleanuparr.Api.Tests.Features.Auth;
@@ -83,14 +86,14 @@ public class LoginTimingTests : IClassFixture<TimingTestWebApplicationFactory>
    [Fact, TestPriority(4)]
    public async Task Login_LockedOutUser_StillCallsPasswordVerification()
    {
-        // Trigger lockout by making several failed login attempts
-        for (var i = 0; i < 5; i++)
+        // Set lockout state directly in the database to avoid timing sensitivity
+        using (var scope = _factory.Services.CreateScope())
        {
-            await _client.PostAsJsonAsync("/api/auth/login", new
-            {
-                username = "timingtest",
-                password = "WrongPassword!"
-            });
+            var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            var user = await context.Users.FirstAsync();
+            user.FailedLoginAttempts = 5;
+            user.LockoutEnd = DateTime.UtcNow.AddMinutes(5);
+            await context.SaveChangesAsync();
        }

        _factory.TrackingPasswordService.Reset();
@@ -103,6 +106,16 @@ public class LoginTimingTests : IClassFixture<TimingTestWebApplicationFactory>

        response.StatusCode.ShouldBe(HttpStatusCode.TooManyRequests);
        _factory.TrackingPasswordService.VerifyPasswordCallCount.ShouldBeGreaterThanOrEqualTo(1);
+
+        // Reset lockout for subsequent tests
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            var user = await context.Users.FirstAsync();
+            user.FailedLoginAttempts = 0;
+            user.LockoutEnd = null;
+            await context.SaveChangesAsync();
+        }
    }

    [Fact, TestPriority(5)]
@@ -67,9 +67,11 @@ public class OidcAuthControllerTests : IClassFixture<OidcAuthControllerTests.Oid
        var response = await _client.PostAsync("/api/auth/oidc/start", null);

        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        response.Content.Headers.ContentType!.MediaType.ShouldBe("application/problem+json");

        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
-        body.GetProperty("error").GetString()!.ShouldContain("OIDC is not enabled");
+        body.GetProperty("detail").GetString()!.ShouldContain("OIDC is not enabled");
+        body.GetProperty("traceId").GetString().ShouldNotBeNullOrEmpty();
    }

    [Fact, TestPriority(3)]
@@ -0,0 +1,62 @@
+using System.Security.Cryptography;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+internal static class TotpTestHelper
+{
+    public static string GenerateTotpCode(string base32Secret)
+    {
+        var key = Base32Decode(base32Secret);
+        var timestep = (long)(DateTime.UtcNow - DateTime.UnixEpoch).TotalSeconds / 30;
+        var timestepBytes = BitConverter.GetBytes(timestep);
+
+        if (BitConverter.IsLittleEndian)
+        {
+            Array.Reverse(timestepBytes);
+        }
+
+        using var hmac = new HMACSHA1(key);
+        var hash = hmac.ComputeHash(timestepBytes);
+
+        var offset = hash[^1] & 0x0F;
+        var binaryCode =
+            ((hash[offset] & 0x7F) << 24) |
+            ((hash[offset + 1] & 0xFF) << 16) |
+            ((hash[offset + 2] & 0xFF) << 8) |
+            (hash[offset + 3] & 0xFF);
+
+        return (binaryCode % 1_000_000).ToString("D6");
+    }
+
+    private static byte[] Base32Decode(string base32)
+    {
+        const string alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+        base32 = base32.ToUpperInvariant().TrimEnd('=');
+
+        var bits = new List<byte>();
+        foreach (var c in base32)
+        {
+            var val = alphabet.IndexOf(c);
+            if (val < 0)
+            {
+                continue;
+            }
+
+            for (var i = 4; i >= 0; i--)
+            {
+                bits.Add((byte)((val >> i) & 1));
+            }
+        }
+
+        var bytes = new byte[bits.Count / 8];
+        for (var i = 0; i < bytes.Length; i++)
+        {
+            for (var j = 0; j < 8; j++)
+            {
+                bytes[i] = (byte)((bytes[i] << 1) | bits[i * 8 + j]);
+            }
+        }
+
+        return bytes;
+    }
+}
@@ -0,0 +1,174 @@
+using Cleanuparr.Api.Features.BlacklistSync.Contracts.Requests;
+using Cleanuparr.Api.Features.BlacklistSync.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.BlacklistSync;
+
+public class BlacklistSyncConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly IJobManagementService _jobManagementService;
+    private readonly BlacklistSyncConfigController _controller;
+
+    public BlacklistSyncConfigControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<BlacklistSyncConfigController>>();
+        _jobManagementService = Substitute.For<IJobManagementService>();
+        _controller = new BlacklistSyncConfigController(logger, _dataContext, _jobManagementService);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    [Fact]
+    public async Task GetBlacklistSyncConfig_ReturnsExistingConfig()
+    {
+        // Act
+        var result = await _controller.GetBlacklistSyncConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldBeOfType<BlacklistSyncConfig>();
+    }
+
+    [Fact]
+    public async Task UpdateBlacklistSyncConfig_BecameEnabled_StartsAndTriggersJob()
+    {
+        // Arrange — start disabled, enable with URL path
+        var request = new UpdateBlacklistSyncConfigRequest
+        {
+            Enabled = true,
+            BlacklistPath = "https://example.com/blacklist.txt",
+        };
+
+        // Act
+        var result = await _controller.UpdateBlacklistSyncConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StartJob(JobType.BlacklistSynchronizer, null, Arg.Any<string>());
+        await _jobManagementService.Received(1).TriggerJobOnce(JobType.BlacklistSynchronizer);
+        await _jobManagementService.DidNotReceive().StopJob(Arg.Any<JobType>());
+    }
+
+    [Fact]
+    public async Task UpdateBlacklistSyncConfig_BecameDisabled_StopsJob()
+    {
+        // Arrange — pre-enable so the toggle to disabled hits the stop path
+        var existing = await _dataContext.BlacklistSyncConfigs.FirstAsync();
+        existing.Enabled = true;
+        existing.BlacklistPath = "https://example.com/blacklist.txt";
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateBlacklistSyncConfigRequest
+        {
+            Enabled = false,
+            BlacklistPath = existing.BlacklistPath,
+        };
+
+        // Act
+        var result = await _controller.UpdateBlacklistSyncConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StopJob(JobType.BlacklistSynchronizer);
+        await _jobManagementService.DidNotReceive().StartJob(Arg.Any<JobType>(), Arg.Any<Cleanuparr.Infrastructure.Models.JobSchedule?>(), Arg.Any<string?>());
+    }
+
+    [Fact]
+    public async Task UpdateBlacklistSyncConfig_StaysEnabledAndPathChanged_TriggersOnce()
+    {
+        // Arrange — pre-enable
+        var existing = await _dataContext.BlacklistSyncConfigs.FirstAsync();
+        existing.Enabled = true;
+        existing.BlacklistPath = "https://example.com/old.txt";
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateBlacklistSyncConfigRequest
+        {
+            Enabled = true,
+            BlacklistPath = "https://example.com/new.txt",
+        };
+
+        // Act
+        var result = await _controller.UpdateBlacklistSyncConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).TriggerJobOnce(JobType.BlacklistSynchronizer);
+        await _jobManagementService.DidNotReceive().StartJob(Arg.Any<JobType>(), Arg.Any<Cleanuparr.Infrastructure.Models.JobSchedule?>(), Arg.Any<string?>());
+        await _jobManagementService.DidNotReceive().StopJob(Arg.Any<JobType>());
+    }
+
+    [Fact]
+    public async Task UpdateBlacklistSyncConfig_StaysEnabledNoPathChange_NoJobOps()
+    {
+        // Arrange — pre-enable, then resubmit identical values
+        var existing = await _dataContext.BlacklistSyncConfigs.FirstAsync();
+        existing.Enabled = true;
+        existing.BlacklistPath = "https://example.com/list.txt";
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateBlacklistSyncConfigRequest
+        {
+            Enabled = true,
+            BlacklistPath = existing.BlacklistPath,
+        };
+
+        // Act
+        var result = await _controller.UpdateBlacklistSyncConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.DidNotReceive().StartJob(Arg.Any<JobType>(), Arg.Any<Cleanuparr.Infrastructure.Models.JobSchedule?>(), Arg.Any<string?>());
+        await _jobManagementService.DidNotReceive().StopJob(Arg.Any<JobType>());
+        await _jobManagementService.DidNotReceive().TriggerJobOnce(Arg.Any<JobType>());
+    }
+
+    [Fact]
+    public async Task UpdateBlacklistSyncConfig_EnabledWithMissingPath_Throws()
+    {
+        // Arrange
+        var request = new UpdateBlacklistSyncConfigRequest
+        {
+            Enabled = true,
+            BlacklistPath = null,
+        };
+
+        // Act / Assert — Validate throws and is rethrown
+        await Should.ThrowAsync<Exception>(() => _controller.UpdateBlacklistSyncConfig(request));
+    }
+
+    [Fact]
+    public async Task UpdateBlacklistSyncConfig_PersistsChangesToDatabase()
+    {
+        // Arrange
+        var request = new UpdateBlacklistSyncConfigRequest
+        {
+            Enabled = true,
+            BlacklistPath = "https://example.com/list.txt",
+        };
+
+        // Act
+        await _controller.UpdateBlacklistSyncConfig(request);
+
+        // Assert
+        var saved = await _dataContext.BlacklistSyncConfigs.AsNoTracking().FirstAsync();
+        saved.Enabled.ShouldBeTrue();
+        saved.BlacklistPath.ShouldBe("https://example.com/list.txt");
+    }
+}
@@ -0,0 +1,106 @@
+using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Responses;
+using Cleanuparr.Api.Features.DownloadCleaner.Controllers;
+using Cleanuparr.Api.Tests.Features.DownloadCleaner.TestHelpers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
+
+namespace Cleanuparr.Api.Tests.Features.DownloadCleaner;
+
+public class DeadTorrentConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly DeadTorrentConfigController _controller;
+
+    public DeadTorrentConfigControllerTests()
+    {
+        _dataContext = SeedingRulesTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<DeadTorrentConfigController>>();
+        _controller = new DeadTorrentConfigController(logger, _dataContext);
+        ControllerTestContext.Attach(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static DeadTorrentConfigRequest ValidRequest(
+        bool enabled = true,
+        string targetCategory = "cleanuparr-dead",
+        bool useTag = false,
+        ushort maxStrikes = 3,
+        List<string>? categories = null)
+        => new()
+        {
+            Enabled = enabled,
+            TargetCategory = targetCategory,
+            UseTag = useTag,
+            MaxStrikes = maxStrikes,
+            Categories = categories ?? ["movies"],
+        };
+
+    [Fact]
+    public async Task Update_ValidRequest_PersistsConfig()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+
+        var result = await _controller.UpdateDeadTorrentConfig(client.Id, ValidRequest(maxStrikes: 5, categories: ["movies", "tv"]));
+
+        result.ShouldBeOfType<OkObjectResult>();
+        var saved = await _dataContext.DeadTorrentConfigs.AsNoTracking().SingleAsync(d => d.DownloadClientConfigId == client.Id);
+        saved.Enabled.ShouldBeTrue();
+        saved.MaxStrikes.ShouldBe((ushort)5);
+        saved.Categories.ShouldBe(new List<string> { "movies", "tv" });
+    }
+
+    [Fact]
+    public async Task Update_ThenGet_RoundTrips()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        await _controller.UpdateDeadTorrentConfig(client.Id, ValidRequest(useTag: true, maxStrikes: 4));
+
+        var result = await _controller.GetDeadTorrentConfig(client.Id);
+
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var config = ok.Value.ShouldBeOfType<DeadTorrentConfigResponse>();
+        config.UseTag.ShouldBeTrue();
+        config.MaxStrikes.ShouldBe((ushort)4);
+    }
+
+    [Fact]
+    public async Task Update_StrikesBelowMinimum_ThrowsValidationException()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.UpdateDeadTorrentConfig(client.Id, ValidRequest(maxStrikes: 2)));
+    }
+
+    [Fact]
+    public async Task Update_EnabledForRTorrent_ReturnsBadRequest()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext, DownloadClientTypeName.rTorrent, "Test rTorrent");
+
+        var result = await _controller.UpdateDeadTorrentConfig(client.Id, ValidRequest());
+
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status400BadRequest);
+    }
+
+    [Fact]
+    public async Task Update_NonExistentClient_ReturnsNotFound()
+    {
+        var result = await _controller.UpdateDeadTorrentConfig(Guid.NewGuid(), ValidRequest());
+
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status404NotFound);
+    }
+}
@@ -0,0 +1,128 @@
+using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadCleaner.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.DownloadCleaner;
+
+public class DownloadCleanerConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly IJobManagementService _jobManagementService;
+    private readonly DownloadCleanerConfigController _controller;
+
+    public DownloadCleanerConfigControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<DownloadCleanerConfigController>>();
+        _jobManagementService = Substitute.For<IJobManagementService>();
+        _controller = new DownloadCleanerConfigController(logger, _dataContext, _jobManagementService);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    [Fact]
+    public async Task GetDownloadCleanerConfig_NoClients_ReturnsConfigWithEmptyClientsList()
+    {
+        // Act
+        var result = await _controller.GetDownloadCleanerConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldNotBeNull();
+    }
+
+    [Fact]
+    public async Task UpdateDownloadCleanerConfig_Enabled_StartsJob()
+    {
+        // Arrange
+        var request = new UpdateDownloadCleanerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "0 0 * * * ?",
+            IgnoredDownloads = new List<string>(),
+        };
+
+        // Act
+        var result = await _controller.UpdateDownloadCleanerConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StartJob(JobType.DownloadCleaner, null, "0 0 * * * ?");
+    }
+
+    [Fact]
+    public async Task UpdateDownloadCleanerConfig_Disabled_StopsJob()
+    {
+        // Arrange — pre-enable
+        var existing = await _dataContext.DownloadCleanerConfigs.FirstAsync();
+        existing.Enabled = true;
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateDownloadCleanerConfigRequest
+        {
+            Enabled = false,
+            CronExpression = "0 0 * * * ?",
+            IgnoredDownloads = new List<string>(),
+        };
+
+        // Act
+        var result = await _controller.UpdateDownloadCleanerConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StopJob(JobType.DownloadCleaner);
+    }
+
+    [Fact]
+    public async Task UpdateDownloadCleanerConfig_InvalidCron_PropagatesValidationException()
+    {
+        // Arrange — controller's catch only handles System.ComponentModel.DataAnnotations.ValidationException;
+        // CronValidationHelper throws Cleanuparr.Domain.Exceptions.ValidationException which propagates.
+        var request = new UpdateDownloadCleanerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "not-a-cron",
+            IgnoredDownloads = new List<string>(),
+        };
+
+        // Act / Assert
+        await Should.ThrowAsync<Cleanuparr.Domain.Exceptions.ValidationException>(
+            () => _controller.UpdateDownloadCleanerConfig(request));
+    }
+
+    [Fact]
+    public async Task UpdateDownloadCleanerConfig_PersistsChanges()
+    {
+        // Arrange
+        var request = new UpdateDownloadCleanerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "0 0/15 * * * ?",
+            UseAdvancedScheduling = true,
+            IgnoredDownloads = new List<string> { "skip-me" },
+        };
+
+        // Act
+        await _controller.UpdateDownloadCleanerConfig(request);
+
+        // Assert
+        var saved = await _dataContext.DownloadCleanerConfigs.AsNoTracking().FirstAsync();
+        saved.Enabled.ShouldBeTrue();
+        saved.CronExpression.ShouldBe("0 0/15 * * * ?");
+        saved.UseAdvancedScheduling.ShouldBeTrue();
+        saved.IgnoredDownloads.ShouldContain("skip-me");
+    }
+}
@@ -0,0 +1,597 @@
+using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Responses;
+using Cleanuparr.Api.Features.DownloadCleaner.Controllers;
+using Cleanuparr.Api.Tests.Features.DownloadCleaner.TestHelpers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Domain.Exceptions;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.DownloadCleaner;
+
+public class SeedingRulesControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly SeedingRulesController _controller;
+
+    public SeedingRulesControllerTests()
+    {
+        _dataContext = SeedingRulesTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<SeedingRulesController>>();
+        _controller = new SeedingRulesController(logger, _dataContext);
+        ControllerTestContext.Attach(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static SeedingRuleRequest CreateValidRequest(
+        string name = "Test Rule",
+        List<string>? categories = null,
+        List<string>? trackerPatterns = null,
+        List<string>? tagsAny = null,
+        List<string>? tagsAll = null,
+        int? priority = null,
+        double maxRatio = 2.0,
+        double minSeedTime = 0,
+        double maxSeedTime = -1,
+        int minSeeders = 0,
+        double maxInactiveDays = -1,
+        bool deleteSourceFiles = true,
+        SeedingRuleAction action = SeedingRuleAction.Delete)
+    {
+        return new SeedingRuleRequest
+        {
+            Name = name,
+            Categories = categories ?? ["movies"],
+            TrackerPatterns = trackerPatterns ?? [],
+            TagsAny = tagsAny ?? [],
+            TagsAll = tagsAll ?? [],
+            Priority = priority,
+            PrivacyType = TorrentPrivacyType.Both,
+            MaxRatio = maxRatio,
+            MinSeedTime = minSeedTime,
+            MaxSeedTime = maxSeedTime,
+            MinSeeders = minSeeders,
+            MaxInactiveDays = maxInactiveDays,
+            DeleteSourceFiles = deleteSourceFiles,
+            Action = action,
+        };
+    }
+
+    private static List<SeedingRuleResponse> GetRulesFromOk(IActionResult result)
+    {
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        IEnumerable<SeedingRuleResponse> rules = okResult.Value.ShouldBeAssignableTo<IEnumerable<SeedingRuleResponse>>()!;
+        return rules.ToList();
+    }
+
+    private static T GetCreatedRule<T>(IActionResult result) where T : ISeedingRule
+    {
+        var createdResult = result.ShouldBeOfType<CreatedAtActionResult>();
+        return createdResult.Value.ShouldBeOfType<T>();
+    }
+
+    // ──────────────────────────────────────────────────────────────────────
+    // GetSeedingRules
+    // ──────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task GetSeedingRules_EmptyRules_ReturnsEmptyList()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+
+        var result = await _controller.GetSeedingRules(client.Id);
+
+        GetRulesFromOk(result).ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task GetSeedingRules_ReturnsRulesOrderedByPriority()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "Rule C", priority: 3);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "Rule A", priority: 1);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "Rule B", priority: 2);
+
+        var result = await _controller.GetSeedingRules(client.Id);
+
+        List<SeedingRuleResponse> rules = GetRulesFromOk(result);
+        rules.Count.ShouldBe(3);
+        rules[0].Name.ShouldBe("Rule A");
+        rules[1].Name.ShouldBe("Rule B");
+        rules[2].Name.ShouldBe("Rule C");
+    }
+
+    [Fact]
+    public async Task GetSeedingRules_NonExistentClient_ReturnsNotFound()
+    {
+        var result = await _controller.GetSeedingRules(Guid.NewGuid());
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status404NotFound);
+    }
+
+    [Fact]
+    public async Task GetSeedingRules_QBitClient_ReturnsTagFields()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id,
+            tagsAny: ["hd", "private"], tagsAll: ["required"]);
+
+        var result = await _controller.GetSeedingRules(client.Id);
+
+        SeedingRuleResponse rule = GetRulesFromOk(result).Single();
+        rule.TagsAny.ShouldBe(new List<string> { "hd", "private" });
+        rule.TagsAll.ShouldBe(new List<string> { "required" });
+    }
+
+    [Fact]
+    public async Task GetSeedingRules_ReturnsMinSeeders()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, minSeeders: 5);
+
+        var result = await _controller.GetSeedingRules(client.Id);
+
+        SeedingRuleResponse rule = GetRulesFromOk(result).Single();
+        rule.MinSeeders.ShouldBe(5);
+    }
+
+    [Fact]
+    public async Task GetSeedingRules_DelugeClient_ReturnsEmptyTagFields()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext, DownloadClientTypeName.Deluge, "Test Deluge");
+        SeedingRulesTestDataFactory.AddDelugeSeedingRule(_dataContext, client.Id);
+
+        var result = await _controller.GetSeedingRules(client.Id);
+
+        SeedingRuleResponse rule = GetRulesFromOk(result).Single();
+        rule.TagsAny.ShouldBeEmpty();
+        rule.TagsAll.ShouldBeEmpty();
+    }
+
+    // ──────────────────────────────────────────────────────────────────────
+    // CreateSeedingRule
+    // ──────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task CreateSeedingRule_ValidRequest_ReturnsCreated()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var request = CreateValidRequest(name: "Movies Rule", categories: ["movies", "films"]);
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+
+        var createdResult = result.ShouldBeOfType<CreatedAtActionResult>();
+        createdResult.StatusCode.ShouldBe(201);
+
+        QBitSeedingRule rule = GetCreatedRule<QBitSeedingRule>(result);
+        rule.Name.ShouldBe("Movies Rule");
+        rule.Categories.ShouldBe(new List<string> { "movies", "films" });
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_AutoAssignsPriority_WhenNotProvided()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var request = CreateValidRequest();
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+
+        GetCreatedRule<QBitSeedingRule>(result).Priority.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_SetsMinSeeders()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var request = CreateValidRequest(minSeeders: 5);
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+
+        GetCreatedRule<QBitSeedingRule>(result).MinSeeders.ShouldBe(5);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_SetsMaxInactiveDays()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var request = CreateValidRequest(maxInactiveDays: 30);
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+
+        GetCreatedRule<QBitSeedingRule>(result).MaxInactiveDays.ShouldBe(30);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_AutoAssignsSequentialPriority()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, priority: 1);
+
+        var request = CreateValidRequest(name: "Second Rule", categories: ["tv"]);
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+
+        GetCreatedRule<QBitSeedingRule>(result).Priority.ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_DuplicatePriority_ReturnsBadRequest()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, priority: 1);
+
+        var request = CreateValidRequest(priority: 1);
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status400BadRequest);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_NonExistentClient_ReturnsNotFound()
+    {
+        var request = CreateValidRequest();
+
+        var result = await _controller.CreateSeedingRule(Guid.NewGuid(), request);
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status404NotFound);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_EmptyCategories_ReturnsBadRequest()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var request = CreateValidRequest(categories: []);
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.CreateSeedingRule(client.Id, request));
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_SanitizesWhitespaceInLists()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var request = CreateValidRequest(
+            trackerPatterns: ["", "  ", "valid.com", " trimmed.com "]);
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+
+        QBitSeedingRule rule = GetCreatedRule<QBitSeedingRule>(result);
+        rule.TrackerPatterns.ShouldBe(new List<string> { "valid.com", "trimmed.com" });
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_ForTransmission_CreatesTransmissionRule()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext,
+            DownloadClientTypeName.Transmission, "Test Transmission");
+        var request = CreateValidRequest(tagsAny: ["tag1"]);
+
+        var result = await _controller.CreateSeedingRule(client.Id, request);
+
+        GetCreatedRule<TransmissionSeedingRule>(result).TagsAny.ShouldBe(new List<string> { "tag1" });
+    }
+
+    [Theory]
+    [InlineData(DownloadClientTypeName.qBittorrent)]
+    [InlineData(DownloadClientTypeName.Transmission)]
+    [InlineData(DownloadClientTypeName.Deluge)]
+    [InlineData(DownloadClientTypeName.uTorrent)]
+    [InlineData(DownloadClientTypeName.rTorrent)]
+    public async Task CreateSeedingRule_WithStopAction_ReturnsStopAction(DownloadClientTypeName typeName)
+    {
+        DownloadClientConfig client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext, typeName, $"Test {typeName}");
+        SeedingRuleRequest request = CreateValidRequest(action: SeedingRuleAction.Stop);
+
+        IActionResult result = await _controller.CreateSeedingRule(client.Id, request);
+
+        result.ShouldBeOfType<CreatedAtActionResult>();
+        SeedingRuleResponse rule = GetRulesFromOk(await _controller.GetSeedingRules(client.Id)).Single();
+        rule.Action.ShouldBe(SeedingRuleAction.Stop);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_ActionOmitted_DefaultsToDelete()
+    {
+        DownloadClientConfig client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRuleRequest request = new()
+        {
+            Name = "Rule without an action",
+            Categories = ["movies"],
+            MaxRatio = 2.0,
+        };
+
+        IActionResult result = await _controller.CreateSeedingRule(client.Id, request);
+
+        GetCreatedRule<QBitSeedingRule>(result).Action.ShouldBe(SeedingRuleAction.Delete);
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_UnknownAction_ThrowsValidationException()
+    {
+        DownloadClientConfig client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRuleRequest request = CreateValidRequest(action: SeedingRuleAction.Unknown);
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.CreateSeedingRule(client.Id, request));
+    }
+
+    [Fact]
+    public async Task CreateSeedingRule_UndefinedAction_ThrowsValidationException()
+    {
+        DownloadClientConfig client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        SeedingRuleRequest request = CreateValidRequest(action: (SeedingRuleAction)5);
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.CreateSeedingRule(client.Id, request));
+    }
+
+    // ──────────────────────────────────────────────────────────────────────
+    // UpdateSeedingRule
+    // ──────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task UpdateSeedingRule_ValidRequest_ReturnsOk()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        var request = CreateValidRequest(name: "Updated Name", categories: ["tv", "anime"]);
+
+        var result = await _controller.UpdateSeedingRule(rule.Id, request);
+
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var updated = okResult.Value.ShouldBeOfType<QBitSeedingRule>();
+        updated.Name.ShouldBe("Updated Name");
+        updated.Categories.ShouldBe(new List<string> { "tv", "anime" });
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_DoesNotChangePriority()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, priority: 5);
+
+        var request = CreateValidRequest(priority: 1);
+
+        var result = await _controller.UpdateSeedingRule(rule.Id, request);
+
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var updated = okResult.Value.ShouldBeOfType<QBitSeedingRule>();
+        updated.Priority.ShouldBe(5);
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_UpdatesTagsForTagFilterableClient()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        var request = CreateValidRequest(tagsAny: ["new-tag"], tagsAll: ["must-have"]);
+
+        var result = await _controller.UpdateSeedingRule(rule.Id, request);
+
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var updated = okResult.Value.ShouldBeOfType<QBitSeedingRule>();
+        updated.TagsAny.ShouldBe(new List<string> { "new-tag" });
+        updated.TagsAll.ShouldBe(new List<string> { "must-have" });
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_UpdatesMinSeeders()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        var request = CreateValidRequest(minSeeders: 5);
+
+        var result = await _controller.UpdateSeedingRule(rule.Id, request);
+
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var updated = okResult.Value.ShouldBeOfType<QBitSeedingRule>();
+        updated.MinSeeders.ShouldBe(5);
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_UpdatesMaxInactiveDays()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        var request = CreateValidRequest(maxInactiveDays: 30);
+
+        var result = await _controller.UpdateSeedingRule(rule.Id, request);
+
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var updated = okResult.Value.ShouldBeOfType<QBitSeedingRule>();
+        updated.MaxInactiveDays.ShouldBe(30);
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_NonExistentRule_ReturnsNotFound()
+    {
+        var request = CreateValidRequest();
+
+        var result = await _controller.UpdateSeedingRule(Guid.NewGuid(), request);
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status404NotFound);
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_ValidationFailure_ReturnsBadRequest()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        // Both maxRatio and maxSeedTime negative → validation failure
+        var request = CreateValidRequest(maxRatio: -1, maxSeedTime: -1);
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.UpdateSeedingRule(rule.Id, request));
+    }
+
+    [Theory]
+    [InlineData(DownloadClientTypeName.qBittorrent)]
+    [InlineData(DownloadClientTypeName.Transmission)]
+    [InlineData(DownloadClientTypeName.Deluge)]
+    [InlineData(DownloadClientTypeName.uTorrent)]
+    [InlineData(DownloadClientTypeName.rTorrent)]
+    public async Task UpdateSeedingRule_ChangedToStopAction_ReturnsStopAction(DownloadClientTypeName typeName)
+    {
+        DownloadClientConfig client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext, typeName, $"Test {typeName}");
+        await _controller.CreateSeedingRule(client.Id, CreateValidRequest());
+        Guid ruleId = GetRulesFromOk(await _controller.GetSeedingRules(client.Id)).Single().Id;
+
+        IActionResult result = await _controller.UpdateSeedingRule(ruleId, CreateValidRequest(action: SeedingRuleAction.Stop));
+
+        result.ShouldBeOfType<OkObjectResult>();
+        SeedingRuleResponse rule = GetRulesFromOk(await _controller.GetSeedingRules(client.Id)).Single();
+        rule.Action.ShouldBe(SeedingRuleAction.Stop);
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_UnknownAction_ThrowsValidationException()
+    {
+        DownloadClientConfig client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        QBitSeedingRule rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        SeedingRuleRequest request = CreateValidRequest(action: SeedingRuleAction.Unknown);
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.UpdateSeedingRule(rule.Id, request));
+    }
+
+    [Fact]
+    public async Task UpdateSeedingRule_UndefinedAction_ThrowsValidationException()
+    {
+        DownloadClientConfig client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        QBitSeedingRule rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        SeedingRuleRequest request = CreateValidRequest(action: (SeedingRuleAction)5);
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.UpdateSeedingRule(rule.Id, request));
+    }
+
+    // ──────────────────────────────────────────────────────────────────────
+    // ReorderSeedingRules
+    // ──────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task ReorderSeedingRules_ValidRequest_ReturnsNoContent()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule1 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "A", priority: 1);
+        var rule2 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "B", priority: 2);
+
+        var request = new ReorderSeedingRulesRequest { OrderedIds = [rule2.Id, rule1.Id] };
+
+        var result = await _controller.ReorderSeedingRules(client.Id, request);
+        result.ShouldBeOfType<NoContentResult>();
+    }
+
+    [Fact]
+    public async Task ReorderSeedingRules_AssignsSequentialPriorities()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule1 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "A", priority: 1);
+        var rule2 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "B", priority: 2);
+        var rule3 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "C", priority: 3);
+
+        // Reverse order
+        var request = new ReorderSeedingRulesRequest { OrderedIds = [rule3.Id, rule2.Id, rule1.Id] };
+        await _controller.ReorderSeedingRules(client.Id, request);
+
+        List<SeedingRuleResponse> rules = GetRulesFromOk(await _controller.GetSeedingRules(client.Id));
+
+        rules[0].Name.ShouldBe("C");
+        rules[0].Priority.ShouldBe(1);
+        rules[1].Name.ShouldBe("B");
+        rules[1].Priority.ShouldBe(2);
+        rules[2].Name.ShouldBe("A");
+        rules[2].Priority.ShouldBe(3);
+    }
+
+    [Fact]
+    public async Task ReorderSeedingRules_NonExistentClient_ReturnsNotFound()
+    {
+        var request = new ReorderSeedingRulesRequest { OrderedIds = [Guid.NewGuid()] };
+
+        var result = await _controller.ReorderSeedingRules(Guid.NewGuid(), request);
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status404NotFound);
+    }
+
+    [Fact]
+    public async Task ReorderSeedingRules_DuplicateIds_ReturnsBadRequest()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule1 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "A", priority: 1);
+        var rule2 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "B", priority: 2);
+
+        var request = new ReorderSeedingRulesRequest { OrderedIds = [rule1.Id, rule1.Id] };
+
+        var result = await _controller.ReorderSeedingRules(client.Id, request);
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status400BadRequest);
+    }
+
+    [Fact]
+    public async Task ReorderSeedingRules_WrongCount_ReturnsBadRequest()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule1 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "A", priority: 1);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "B", priority: 2);
+
+        // Only send 1 of 2 IDs
+        var request = new ReorderSeedingRulesRequest { OrderedIds = [rule1.Id] };
+
+        var result = await _controller.ReorderSeedingRules(client.Id, request);
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status400BadRequest);
+    }
+
+    [Fact]
+    public async Task ReorderSeedingRules_UnknownRuleId_ReturnsBadRequest()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule1 = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "A", priority: 1);
+        SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id, name: "B", priority: 2);
+
+        var request = new ReorderSeedingRulesRequest { OrderedIds = [rule1.Id, Guid.NewGuid()] };
+
+        var result = await _controller.ReorderSeedingRules(client.Id, request);
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status400BadRequest);
+    }
+
+    // ──────────────────────────────────────────────────────────────────────
+    // DeleteSeedingRule
+    // ──────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task DeleteSeedingRule_ExistingRule_ReturnsNoContent()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        var result = await _controller.DeleteSeedingRule(rule.Id);
+        result.ShouldBeOfType<NoContentResult>();
+    }
+
+    [Fact]
+    public async Task DeleteSeedingRule_VerifiesRuleRemoved()
+    {
+        var client = SeedingRulesTestDataFactory.AddDownloadClient(_dataContext);
+        var rule = SeedingRulesTestDataFactory.AddQBitSeedingRule(_dataContext, client.Id);
+
+        await _controller.DeleteSeedingRule(rule.Id);
+
+        GetRulesFromOk(await _controller.GetSeedingRules(client.Id)).ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task DeleteSeedingRule_NonExistentRule_ReturnsNotFound()
+    {
+        var result = await _controller.DeleteSeedingRule(Guid.NewGuid());
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(StatusCodes.Status404NotFound);
+    }
+}
@@ -0,0 +1,213 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Cleanuparr.Persistence.Models.Configuration.General;
+using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Tests.Features.DownloadCleaner.TestHelpers;
+
+/// <summary>
+/// Factory for creating SQLite in-memory contexts for SeedingRulesController tests
+/// </summary>
+public static class SeedingRulesTestDataFactory
+{
+    public static DataContext CreateDataContext()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<DataContext>()
+            .UseSqlite(connection)
+            .Options;
+
+        var context = new DataContext(options);
+        context.Database.EnsureCreated();
+
+        SeedDefaultData(context);
+        return context;
+    }
+
+    private static void SeedDefaultData(DataContext context)
+    {
+        context.GeneralConfigs.Add(new GeneralConfig
+        {
+            Id = Guid.NewGuid(),
+            DryRun = false,
+            IgnoredDownloads = [],
+            Log = new LoggingConfig()
+        });
+
+        context.ArrConfigs.AddRange(
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Sonarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Radarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Lidarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Readarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Whisparr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Sportarr, Instances = [], FailedImportMaxStrikes = 3 }
+        );
+
+        context.QueueCleanerConfigs.Add(new QueueCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            FailedImport = new FailedImportConfig()
+        });
+
+        context.ContentBlockerConfigs.Add(new ContentBlockerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            DeletePrivate = false,
+            Sonarr = new BlocklistSettings { Enabled = false },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false },
+            Sportarr = new BlocklistSettings { Enabled = false }
+        });
+
+        context.DownloadCleanerConfigs.Add(new DownloadCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = []
+        });
+
+        context.SeekerConfigs.Add(new SeekerConfig
+        {
+            Id = Guid.NewGuid(),
+            SearchEnabled = true,
+            ProactiveSearchEnabled = false
+        });
+
+        context.SaveChanges();
+    }
+
+    public static DownloadClientConfig AddDownloadClient(
+        DataContext context,
+        DownloadClientTypeName typeName = DownloadClientTypeName.qBittorrent,
+        string name = "Test qBittorrent")
+    {
+        var config = new DownloadClientConfig
+        {
+            Id = Guid.NewGuid(),
+            Name = name,
+            TypeName = typeName,
+            Type = DownloadClientType.Torrent,
+            Enabled = true,
+            Host = new Uri("http://localhost:8080"),
+            Username = "admin",
+            Password = "admin"
+        };
+
+        context.DownloadClients.Add(config);
+        context.SaveChanges();
+        return config;
+    }
+
+    public static QBitSeedingRule AddQBitSeedingRule(
+        DataContext context,
+        Guid downloadClientId,
+        string name = "Test Rule",
+        int priority = 1,
+        List<string>? categories = null,
+        List<string>? trackerPatterns = null,
+        List<string>? tagsAny = null,
+        List<string>? tagsAll = null,
+        double maxRatio = 2.0,
+        double minSeedTime = 0,
+        double maxSeedTime = -1,
+        int minSeeders = 0)
+    {
+        var rule = new QBitSeedingRule
+        {
+            Id = Guid.NewGuid(),
+            DownloadClientConfigId = downloadClientId,
+            Name = name,
+            Priority = priority,
+            Categories = categories ?? ["movies"],
+            TrackerPatterns = trackerPatterns ?? [],
+            TagsAny = tagsAny ?? [],
+            TagsAll = tagsAll ?? [],
+            PrivacyType = TorrentPrivacyType.Both,
+            MaxRatio = maxRatio,
+            MinSeedTime = minSeedTime,
+            MaxSeedTime = maxSeedTime,
+            MinSeeders = minSeeders,
+            DeleteSourceFiles = true,
+        };
+
+        context.QBitSeedingRules.Add(rule);
+        context.SaveChanges();
+        return rule;
+    }
+
+    public static DelugeSeedingRule AddDelugeSeedingRule(
+        DataContext context,
+        Guid downloadClientId,
+        string name = "Test Rule",
+        int priority = 1,
+        List<string>? categories = null,
+        double maxRatio = 2.0,
+        double maxSeedTime = -1,
+        int minSeeders = 0)
+    {
+        var rule = new DelugeSeedingRule
+        {
+            Id = Guid.NewGuid(),
+            DownloadClientConfigId = downloadClientId,
+            Name = name,
+            Priority = priority,
+            Categories = categories ?? ["movies"],
+            TrackerPatterns = [],
+            PrivacyType = TorrentPrivacyType.Both,
+            MaxRatio = maxRatio,
+            MinSeedTime = 0,
+            MaxSeedTime = maxSeedTime,
+            MinSeeders = minSeeders,
+            DeleteSourceFiles = true,
+        };
+
+        context.DelugeSeedingRules.Add(rule);
+        context.SaveChanges();
+        return rule;
+    }
+
+    public static TransmissionSeedingRule AddTransmissionSeedingRule(
+        DataContext context,
+        Guid downloadClientId,
+        string name = "Test Rule",
+        int priority = 1,
+        List<string>? categories = null,
+        double maxRatio = 2.0,
+        double maxSeedTime = -1,
+        int minSeeders = 0)
+    {
+        var rule = new TransmissionSeedingRule
+        {
+            Id = Guid.NewGuid(),
+            DownloadClientConfigId = downloadClientId,
+            Name = name,
+            Priority = priority,
+            Categories = categories ?? ["movies"],
+            TrackerPatterns = [],
+            TagsAny = [],
+            TagsAll = [],
+            PrivacyType = TorrentPrivacyType.Both,
+            MaxRatio = maxRatio,
+            MinSeedTime = 0,
+            MaxSeedTime = maxSeedTime,
+            MinSeeders = minSeeders,
+            DeleteSourceFiles = true,
+        };
+
+        context.TransmissionSeedingRules.Add(rule);
+        context.SaveChanges();
+        return rule;
+    }
+}
@@ -0,0 +1,200 @@
+using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Responses;
+using Cleanuparr.Api.Features.DownloadCleaner.Controllers;
+using Cleanuparr.Domain.Exceptions;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.DownloadCleaner;
+
+public class UnlinkedConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly UnlinkedConfigController _controller;
+
+    public UnlinkedConfigControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<UnlinkedConfigController>>();
+        _controller = new UnlinkedConfigController(logger, _dataContext);
+        ConfigControllerTestDataFactory.ConfigureProblemDetails(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    [Fact]
+    public async Task GetUnlinkedConfig_ClientNotFound_ReturnsNotFound()
+    {
+        // Act
+        var result = await _controller.GetUnlinkedConfig(Guid.NewGuid());
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    [Fact]
+    public async Task GetUnlinkedConfig_ClientWithoutConfig_ReturnsOkWithNull()
+    {
+        // Arrange — add a client but no UnlinkedConfig
+        var client = AddDownloadClient();
+
+        // Act
+        var result = await _controller.GetUnlinkedConfig(client.Id);
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task GetUnlinkedConfig_ClientWithConfig_ReturnsConfig()
+    {
+        // Arrange
+        var client = AddDownloadClient();
+        _dataContext.UnlinkedConfigs.Add(new UnlinkedConfig
+        {
+            DownloadClientConfigId = client.Id,
+            Enabled = true,
+            TargetCategory = "unlinked-cat",
+            Categories = new List<string> { "regular" },
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // Act
+        var result = await _controller.GetUnlinkedConfig(client.Id);
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var config = ok.Value.ShouldBeOfType<UnlinkedConfigResponse>();
+        config.Enabled.ShouldBeTrue();
+        config.TargetCategory.ShouldBe("unlinked-cat");
+    }
+
+    [Fact]
+    public async Task UpdateUnlinkedConfig_ClientNotFound_ReturnsNotFound()
+    {
+        // Arrange
+        var dto = new UnlinkedConfigRequest { Enabled = false };
+
+        // Act
+        var result = await _controller.UpdateUnlinkedConfig(Guid.NewGuid(), dto);
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    [Fact]
+    public async Task UpdateUnlinkedConfig_NewConfig_CreatesAndReturnsIt()
+    {
+        // Arrange
+        var client = AddDownloadClient();
+        var dto = new UnlinkedConfigRequest
+        {
+            Enabled = false,
+            TargetCategory = "unlinked-cat",
+            Categories = new List<string> { "movies" },
+        };
+
+        // Act
+        var result = await _controller.UpdateUnlinkedConfig(client.Id, dto);
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var saved = await _dataContext.UnlinkedConfigs.AsNoTracking()
+            .FirstAsync(u => u.DownloadClientConfigId == client.Id);
+        saved.TargetCategory.ShouldBe("unlinked-cat");
+        saved.Categories.ShouldContain("movies");
+    }
+
+    [Fact]
+    public async Task UpdateUnlinkedConfig_ExistingConfig_UpdatesInPlace()
+    {
+        // Arrange
+        var client = AddDownloadClient();
+        _dataContext.UnlinkedConfigs.Add(new UnlinkedConfig
+        {
+            DownloadClientConfigId = client.Id,
+            Enabled = false,
+            TargetCategory = "old-cat",
+        });
+        await _dataContext.SaveChangesAsync();
+
+        var dto = new UnlinkedConfigRequest
+        {
+            Enabled = false,
+            TargetCategory = "new-cat",
+        };
+
+        // Act
+        var result = await _controller.UpdateUnlinkedConfig(client.Id, dto);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        var rows = await _dataContext.UnlinkedConfigs
+            .Where(u => u.DownloadClientConfigId == client.Id)
+            .ToListAsync();
+        rows.Count.ShouldBe(1);
+        rows[0].TargetCategory.ShouldBe("new-cat");
+    }
+
+    [Fact]
+    public async Task UpdateUnlinkedConfig_EnabledButNoCategories_ReturnsBadRequest()
+    {
+        // Arrange — enabled requires at least one category per Validate()
+        var client = AddDownloadClient();
+        var dto = new UnlinkedConfigRequest
+        {
+            Enabled = true,
+            TargetCategory = "unlinked-cat",
+            Categories = new List<string>(),
+        };
+
+        // Act + Assert
+        await Should.ThrowAsync<ValidationException>(
+            () => _controller.UpdateUnlinkedConfig(client.Id, dto));
+    }
+
+    [Fact]
+    public async Task UpdateUnlinkedConfig_TargetInCategories_ReturnsBadRequest()
+    {
+        // Arrange — TargetCategory must not appear in Categories
+        var client = AddDownloadClient();
+        var dto = new UnlinkedConfigRequest
+        {
+            Enabled = true,
+            TargetCategory = "unlinked-cat",
+            Categories = new List<string> { "movies", "unlinked-cat" },
+        };
+
+        // Act + Assert
+        await Should.ThrowAsync<ValidationException>(
+            () => _controller.UpdateUnlinkedConfig(client.Id, dto));
+    }
+
+    private DownloadClientConfig AddDownloadClient()
+    {
+        var client = new DownloadClientConfig
+        {
+            Id = Guid.NewGuid(),
+            Name = "test-client",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+        };
+        _dataContext.DownloadClients.Add(client);
+        _dataContext.SaveChanges();
+        return client;
+    }
+}
@@ -0,0 +1,275 @@
+using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadClient.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Entities.HealthCheck;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.DownloadClient;
+using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.DownloadClient;
+
+public class DownloadClientControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly IDynamicHttpClientFactory _dynamicHttpClientFactory;
+    private readonly IDownloadServiceFactory _downloadServiceFactory;
+    private readonly DownloadClientController _controller;
+
+    public DownloadClientControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<DownloadClientController>>();
+        _dynamicHttpClientFactory = Substitute.For<IDynamicHttpClientFactory>();
+        _downloadServiceFactory = Substitute.For<IDownloadServiceFactory>();
+        _controller = new DownloadClientController(logger, _dataContext, _dynamicHttpClientFactory, _downloadServiceFactory);
+        ConfigControllerTestDataFactory.ConfigureProblemDetails(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    [Fact]
+    public async Task GetDownloadClientConfig_EmptyDatabase_ReturnsOkWithEmptyClients()
+    {
+        // Act
+        var result = await _controller.GetDownloadClientConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldNotBeNull();
+    }
+
+    [Fact]
+    public async Task GetDownloadClientConfig_OrdersByTypeThenName()
+    {
+        // Arrange — add 3 clients out of order
+        _dataContext.DownloadClients.AddRange(
+            NewClient("z-client", DownloadClientTypeName.qBittorrent),
+            NewClient("a-client", DownloadClientTypeName.qBittorrent),
+            NewClient("b-client", DownloadClientTypeName.Deluge)
+        );
+        await _dataContext.SaveChangesAsync();
+
+        // Act
+        var result = await _controller.GetDownloadClientConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var dict = ok.Value!.GetType().GetProperty("clients")!.GetValue(ok.Value) as List<DownloadClientConfig>;
+        dict.ShouldNotBeNull();
+        dict!.Count.ShouldBe(3);
+        // qBittorrent (0) comes before Deluge (1) by enum value, then alphabetical within type
+        dict![0].Name.ShouldBe("a-client");
+        dict![1].Name.ShouldBe("z-client");
+        dict![2].Name.ShouldBe("b-client");
+    }
+
+    [Fact]
+    public async Task CreateDownloadClientConfig_ValidRequest_ReturnsCreated()
+    {
+        // Arrange
+        var request = new CreateDownloadClientRequest
+        {
+            Enabled = true,
+            Name = "my-client",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://localhost:8080",
+            Username = "user",
+            Password = "pass",
+        };
+
+        // Act
+        var result = await _controller.CreateDownloadClientConfig(request);
+
+        // Assert
+        var created = result.ShouldBeOfType<CreatedAtActionResult>();
+        var entity = created.Value.ShouldBeOfType<DownloadClientConfig>();
+        entity.Name.ShouldBe("my-client");
+        (await _dataContext.DownloadClients.CountAsync()).ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task CreateDownloadClientConfig_InvalidHost_PropagatesValidationException()
+    {
+        // Arrange
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "x",
+            Host = string.Empty,
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+        };
+
+        // Act / Assert — Validate throws, controller's generic catch logs and re-throws
+        await Should.ThrowAsync<Cleanuparr.Domain.Exceptions.ValidationException>(
+            () => _controller.CreateDownloadClientConfig(request));
+    }
+
+    [Fact]
+    public async Task UpdateDownloadClientConfig_UnknownId_ReturnsNotFound()
+    {
+        // Arrange
+        var request = new UpdateDownloadClientRequest
+        {
+            Name = "x",
+            Host = "http://localhost:8080",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+        };
+
+        // Act
+        var result = await _controller.UpdateDownloadClientConfig(Guid.NewGuid(), request);
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    [Fact]
+    public async Task UpdateDownloadClientConfig_ExistingClient_PersistsChanges()
+    {
+        // Arrange
+        var client = NewClient("orig", DownloadClientTypeName.qBittorrent);
+        _dataContext.DownloadClients.Add(client);
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateDownloadClientRequest
+        {
+            Enabled = true,
+            Name = "renamed",
+            Host = "http://newhost:9090",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+        };
+
+        // Act
+        var result = await _controller.UpdateDownloadClientConfig(client.Id, request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        var saved = await _dataContext.DownloadClients.AsNoTracking().FirstAsync(c => c.Id == client.Id);
+        saved.Name.ShouldBe("renamed");
+        saved.Host!.ToString().ShouldContain("newhost");
+    }
+
+    [Fact]
+    public async Task DeleteDownloadClientConfig_ExistingClient_RemovesAndUnregistersHttpClient()
+    {
+        // Arrange
+        var client = NewClient("doomed", DownloadClientTypeName.qBittorrent);
+        _dataContext.DownloadClients.Add(client);
+        await _dataContext.SaveChangesAsync();
+
+        // Act
+        var result = await _controller.DeleteDownloadClientConfig(client.Id);
+
+        // Assert
+        result.ShouldBeOfType<NoContentResult>();
+        (await _dataContext.DownloadClients.CountAsync()).ShouldBe(0);
+        _dynamicHttpClientFactory.Received(1).UnregisterConfiguration($"DownloadClient_{client.Id}");
+    }
+
+    [Fact]
+    public async Task DeleteDownloadClientConfig_UnknownId_ReturnsNotFound()
+    {
+        // Act
+        var result = await _controller.DeleteDownloadClientConfig(Guid.NewGuid());
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+        _dynamicHttpClientFactory.DidNotReceive().UnregisterConfiguration(Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task TestDownloadClient_Healthy_ReturnsOkWithResponseTime()
+    {
+        // Arrange
+        var downloadService = Substitute.For<IDownloadService>();
+        downloadService.HealthCheckAsync().Returns(new HealthCheckResult
+        {
+            IsHealthy = true,
+            ResponseTime = TimeSpan.FromMilliseconds(123),
+        });
+        _downloadServiceFactory.GetDownloadService(Arg.Any<DownloadClientConfig>()).Returns(downloadService);
+
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://localhost:8080",
+            Password = "pass",
+        };
+
+        // Act
+        var result = await _controller.TestDownloadClient(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+    }
+
+    [Fact]
+    public async Task TestDownloadClient_Unhealthy_ReturnsBadRequestWithMessage()
+    {
+        // Arrange
+        var downloadService = Substitute.For<IDownloadService>();
+        downloadService.HealthCheckAsync().Returns(new HealthCheckResult
+        {
+            IsHealthy = false,
+            ErrorMessage = "connection refused",
+        });
+        _downloadServiceFactory.GetDownloadService(Arg.Any<DownloadClientConfig>()).Returns(downloadService);
+
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://localhost:8080",
+            Password = "pass",
+        };
+
+        // Act
+        var result = await _controller.TestDownloadClient(request);
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+    }
+
+    [Fact]
+    public async Task TestDownloadClient_InvalidHost_ReturnsBadRequest()
+    {
+        // Arrange — empty host fails Validate; the controller wraps the exception in BadRequest
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = string.Empty,
+            Password = "pass",
+        };
+
+        // Act
+        var result = await _controller.TestDownloadClient(request);
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+    }
+
+    private static DownloadClientConfig NewClient(string name, DownloadClientTypeName typeName) => new()
+    {
+        Id = Guid.NewGuid(),
+        Name = name,
+        TypeName = typeName,
+        Type = DownloadClientType.Torrent,
+        Host = new Uri("http://localhost:8080"),
+    };
+}
@@ -0,0 +1,174 @@
+using Cleanuparr.Api.Features.General.Contracts.Requests;
+using Cleanuparr.Api.Features.General.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.General;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.General;
+
+public class GeneralConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly EventsContext _eventsContext;
+    private readonly IDynamicHttpClientFactory _dynamicHttpClientFactory;
+    private readonly GeneralConfigController _controller;
+
+    public GeneralConfigControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        _eventsContext = ConfigControllerTestDataFactory.CreateEventsContext();
+        _dynamicHttpClientFactory = Substitute.For<IDynamicHttpClientFactory>();
+
+        var logger = Substitute.For<ILogger<GeneralConfigController>>();
+        _controller = new GeneralConfigController(logger, _dataContext);
+
+        // Mount a DefaultHttpContext with a ServiceProvider that resolves IDynamicHttpClientFactory
+        var services = new ServiceCollection();
+        services.AddSingleton(_dynamicHttpClientFactory);
+        _controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { RequestServices = services.BuildServiceProvider() },
+        };
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        _eventsContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    [Fact]
+    public async Task GetGeneralConfig_ReturnsExistingConfig()
+    {
+        // Act
+        var result = await _controller.GetGeneralConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldBeOfType<GeneralConfig>();
+    }
+
+    [Fact]
+    public async Task UpdateGeneralConfig_PersistsChangesAndUpdatesHttpClients()
+    {
+        // Arrange — keep Log defaults matching DB so loggingChanged=false (avoid LoggingConfigManager statics)
+        var existing = await _dataContext.GeneralConfigs.AsNoTracking().FirstAsync();
+        var request = new UpdateGeneralConfigRequest
+        {
+            DisplaySupportBanner = false,
+            DryRun = false,
+            HttpMaxRetries = 5,
+            HttpTimeout = 60,
+            HttpSendUserAgent = true,
+            StatusCheckEnabled = false,
+            EncryptionKey = existing.EncryptionKey,
+            IgnoredDownloads = new List<string> { "ignored-item" },
+            StrikeInactivityWindowHours = 48,
+            Log = MatchingLogRequest(existing.Log),
+            Auth = new UpdateAuthConfigRequest(),
+        };
+
+        // Act
+        var result = await _controller.UpdateGeneralConfig(request, _eventsContext);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        _dynamicHttpClientFactory.Received(1).UpdateAllClientsFromGeneralConfig(Arg.Any<GeneralConfig>());
+
+        var saved = await _dataContext.GeneralConfigs.AsNoTracking().FirstAsync();
+        saved.DisplaySupportBanner.ShouldBeFalse();
+        saved.HttpMaxRetries.ShouldBe((ushort)5);
+        saved.HttpTimeout.ShouldBe((ushort)60);
+        saved.HttpSendUserAgent.ShouldBeTrue();
+        saved.StrikeInactivityWindowHours.ShouldBe((ushort)48);
+        saved.IgnoredDownloads.ShouldContain("ignored-item");
+    }
+
+    [Fact]
+    public async Task UpdateGeneralConfig_InvalidHttpTimeout_Throws()
+    {
+        // Arrange — HttpTimeout=0 fails validation
+        var existing = await _dataContext.GeneralConfigs.AsNoTracking().FirstAsync();
+        var request = new UpdateGeneralConfigRequest
+        {
+            HttpTimeout = 0,
+            EncryptionKey = existing.EncryptionKey,
+            StrikeInactivityWindowHours = 24,
+            Log = MatchingLogRequest(existing.Log),
+            Auth = new UpdateAuthConfigRequest(),
+        };
+
+        // Act / Assert
+        await Should.ThrowAsync<Exception>(() => _controller.UpdateGeneralConfig(request, _eventsContext));
+    }
+
+    [Fact]
+    public async Task UpdateGeneralConfig_InvalidStrikeWindow_Throws()
+    {
+        // Arrange — StrikeInactivityWindowHours > 168 fails validation
+        var existing = await _dataContext.GeneralConfigs.AsNoTracking().FirstAsync();
+        var request = new UpdateGeneralConfigRequest
+        {
+            HttpTimeout = 60,
+            EncryptionKey = existing.EncryptionKey,
+            StrikeInactivityWindowHours = 200,
+            Log = MatchingLogRequest(existing.Log),
+            Auth = new UpdateAuthConfigRequest(),
+        };
+
+        // Act / Assert
+        await Should.ThrowAsync<Exception>(() => _controller.UpdateGeneralConfig(request, _eventsContext));
+    }
+
+    [Fact]
+    public async Task UpdateGeneralConfig_ConnectivityCheckEnabledWithNoUrls_Throws()
+    {
+        // Arrange — connectivity check enabled but no URLs fails validation
+        var existing = await _dataContext.GeneralConfigs.AsNoTracking().FirstAsync();
+        var request = new UpdateGeneralConfigRequest
+        {
+            HttpTimeout = 60,
+            EncryptionKey = existing.EncryptionKey,
+            StrikeInactivityWindowHours = 24,
+            ConnectivityCheckEnabled = true,
+            ConnectivityCheckUrls = new List<string>(),
+            Log = MatchingLogRequest(existing.Log),
+            Auth = new UpdateAuthConfigRequest(),
+        };
+
+        // Act / Assert
+        await Should.ThrowAsync<Exception>(() => _controller.UpdateGeneralConfig(request, _eventsContext));
+    }
+
+    [Fact]
+    public async Task PurgeAllStrikes_ReturnsDeletedCounts()
+    {
+        // Act
+        var result = await _controller.PurgeAllStrikes(_eventsContext);
+
+        // Assert — initially empty, but the endpoint still succeeds with zero counts
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldNotBeNull();
+    }
+
+    private static UpdateLoggingConfigRequest MatchingLogRequest(LoggingConfig existing) => new()
+    {
+        Level = existing.Level,
+        RollingSizeMB = existing.RollingSizeMB,
+        RetainedFileCount = existing.RetainedFileCount,
+        TimeLimitHours = existing.TimeLimitHours,
+        ArchiveEnabled = existing.ArchiveEnabled,
+        ArchiveRetainedCount = existing.ArchiveRetainedCount,
+        ArchiveTimeLimitHours = existing.ArchiveTimeLimitHours,
+    };
+}
@@ -0,0 +1,47 @@
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features;
+
+public class LogSanitizerTests
+{
+    [Fact]
+    public void SanitizeForLog_LeavesAPlainValueUntouched()
+    {
+        "admin".SanitizeForLog().ShouldBe("admin");
+    }
+
+    [Fact]
+    public void SanitizeForLog_KeepsPrintableSymbolsAndAccents()
+    {
+        "admin.user+1_ó".SanitizeForLog().ShouldBe("admin.user+1_ó");
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    public void SanitizeForLog_MapsMissingValuesToEmpty(string? value)
+    {
+        value.SanitizeForLog().ShouldBe(string.Empty);
+    }
+
+    [Fact]
+    public void SanitizeForLog_StripsTheLineBreaksUsedToForgeAnEntry()
+    {
+        string forged = "admin\n2026-01-01 00:00:00.000 [ERR] Injected entry";
+
+        forged.SanitizeForLog().ShouldBe("admin2026-01-01 00:00:00.000 [ERR] Injected entry");
+    }
+
+    [Fact]
+    public void SanitizeForLog_StripsCarriageReturns()
+    {
+        "admin\r\nsecond line".SanitizeForLog().ShouldBe("adminsecond line");
+    }
+
+    [Fact]
+    public void SanitizeForLog_StripsEscapeSequencesAndOtherControlCharacters()
+    {
+        "adm\u001b[31min\tuser\0".SanitizeForLog().ShouldBe("adm[31minuser");
+    }
+}
@@ -0,0 +1,155 @@
+using Cleanuparr.Api.Features.MalwareBlocker.Contracts.Requests;
+using Cleanuparr.Api.Features.MalwareBlocker.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.MalwareBlocker;
+
+public class MalwareBlockerConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly IJobManagementService _jobManagementService;
+    private readonly MalwareBlockerConfigController _controller;
+
+    public MalwareBlockerConfigControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<MalwareBlockerConfigController>>();
+        _jobManagementService = Substitute.For<IJobManagementService>();
+        _controller = new MalwareBlockerConfigController(logger, _dataContext, _jobManagementService);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    [Fact]
+    public async Task GetMalwareBlockerConfig_ReturnsExistingConfig()
+    {
+        // Act
+        var result = await _controller.GetMalwareBlockerConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldBeOfType<ContentBlockerConfig>();
+    }
+
+    [Fact]
+    public async Task UpdateMalwareBlockerConfig_Enabled_StartsJobWithCron()
+    {
+        // Arrange — Enabled requires at least one blocklist with a valid path
+        var request = new UpdateMalwareBlockerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "0/5 * * * * ?",
+            Sonarr = new BlocklistSettings { Enabled = true, BlocklistPath = "https://example.com/blocklist.txt" },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false },
+            Sportarr = new BlocklistSettings { Enabled = false },
+        };
+
+        // Act
+        var result = await _controller.UpdateMalwareBlockerConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StartJob(JobType.MalwareBlocker, null, "0/5 * * * * ?");
+        await _jobManagementService.DidNotReceive().StopJob(Arg.Any<JobType>());
+    }
+
+    [Fact]
+    public async Task UpdateMalwareBlockerConfig_Disabled_StopsJob()
+    {
+        // Arrange — pre-enable
+        var existing = await _dataContext.ContentBlockerConfigs.FirstAsync();
+        existing.Enabled = true;
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateMalwareBlockerConfigRequest
+        {
+            Enabled = false,
+            CronExpression = "0/5 * * * * ?",
+            Sonarr = new BlocklistSettings { Enabled = false },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false },
+            Sportarr = new BlocklistSettings { Enabled = false },
+        };
+
+        // Act
+        var result = await _controller.UpdateMalwareBlockerConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StopJob(JobType.MalwareBlocker);
+        await _jobManagementService.DidNotReceive().StartJob(Arg.Any<JobType>(), Arg.Any<Cleanuparr.Infrastructure.Models.JobSchedule?>(), Arg.Any<string?>());
+    }
+
+    [Fact]
+    public async Task UpdateMalwareBlockerConfig_InvalidCronExpression_PropagatesValidationException()
+    {
+        // Arrange — CronValidationHelper throws Cleanuparr.Domain.Exceptions.ValidationException,
+        // which the controller's catch (System.ComponentModel.DataAnnotations.ValidationException) does NOT match.
+        var request = new UpdateMalwareBlockerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "definitely-not-a-cron",
+            Sonarr = new BlocklistSettings { Enabled = false },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false },
+            Sportarr = new BlocklistSettings { Enabled = false },
+        };
+
+        // Act / Assert
+        await Should.ThrowAsync<Cleanuparr.Domain.Exceptions.ValidationException>(
+            () => _controller.UpdateMalwareBlockerConfig(request));
+        await _jobManagementService.DidNotReceive().StartJob(Arg.Any<JobType>(), Arg.Any<Cleanuparr.Infrastructure.Models.JobSchedule?>(), Arg.Any<string?>());
+    }
+
+    [Fact]
+    public async Task UpdateMalwareBlockerConfig_PersistsChanges()
+    {
+        // Arrange
+        var request = new UpdateMalwareBlockerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "0/10 * * * * ?",
+            IgnorePrivate = true,
+            DeletePrivate = false,
+            Sonarr = new BlocklistSettings { Enabled = true, BlocklistPath = "https://example.com/list.txt" },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false },
+            Sportarr = new BlocklistSettings { Enabled = false },
+            IgnoredDownloads = new List<string> { "foo" },
+        };
+
+        // Act
+        await _controller.UpdateMalwareBlockerConfig(request);
+
+        // Assert
+        var saved = await _dataContext.ContentBlockerConfigs.AsNoTracking().FirstAsync();
+        saved.Enabled.ShouldBeTrue();
+        saved.CronExpression.ShouldBe("0/10 * * * * ?");
+        saved.IgnorePrivate.ShouldBeTrue();
+        saved.Sonarr.Enabled.ShouldBeTrue();
+        saved.IgnoredDownloads.ShouldContain("foo");
+    }
+}
@@ -0,0 +1,395 @@
+using Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+using Cleanuparr.Api.Features.Notifications.Contracts.Responses;
+using Cleanuparr.Api.Features.Notifications.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Notifications;
+using Cleanuparr.Infrastructure.Features.Notifications.Apprise;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.Notifications;
+
+public class NotificationProvidersControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly NotificationProvidersController _controller;
+
+    public NotificationProvidersControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+
+        INotificationConfigurationService configurationService =
+            Substitute.For<INotificationConfigurationService>();
+
+        // NotificationService is sealed; the endpoints under test never reach it.
+        NotificationService notificationService = new(
+            Substitute.For<ILogger<NotificationService>>(),
+            configurationService,
+            Substitute.For<INotificationProviderFactory>());
+
+        _controller = new NotificationProvidersController(
+            Substitute.For<ILogger<NotificationProvidersController>>(),
+            _dataContext,
+            configurationService,
+            notificationService,
+            Substitute.For<IAppriseCliDetector>());
+
+        ConfigControllerTestDataFactory.ConfigureProblemDetails(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static NotificationProviderResponse Created(IActionResult result) =>
+        result.ShouldBeOfType<CreatedAtActionResult>().Value.ShouldBeOfType<NotificationProviderResponse>();
+
+    private static NotificationProviderResponse Updated(IActionResult result) =>
+        result.ShouldBeOfType<OkObjectResult>().Value.ShouldBeOfType<NotificationProviderResponse>();
+
+    #region Notifiarr
+
+    [Fact]
+    public async Task CreateNotifiarrProvider_PersistsTheDownloadStoppedEvent()
+    {
+        CreateNotifiarrProviderRequest request = new()
+        {
+            Name = "Notifiarr",
+            ApiKey = "0123456789abcdef",
+            ChannelId = "123456789",
+            OnDownloadStopped = true,
+        };
+
+        NotificationProviderResponse provider = Created(await _controller.CreateNotifiarrProvider(request));
+
+        provider.Type.ShouldBe(NotificationProviderType.Notifiarr);
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UpdateNotifiarrProvider_ChangesTheDownloadStoppedEvent()
+    {
+        Guid id = Created(await _controller.CreateNotifiarrProvider(new CreateNotifiarrProviderRequest
+        {
+            Name = "Notifiarr",
+            ApiKey = "0123456789abcdef",
+            ChannelId = "123456789",
+            OnDownloadStopped = false,
+        })).Id;
+
+        NotificationProviderResponse provider = Updated(await _controller.UpdateNotifiarrProvider(id,
+            new UpdateNotifiarrProviderRequest
+            {
+                Name = "Notifiarr",
+                ApiKey = "0123456789abcdef",
+                ChannelId = "123456789",
+                OnDownloadStopped = true,
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    #endregion
+
+    #region Apprise
+
+    [Fact]
+    public async Task CreateAppriseProvider_PersistsTheDownloadStoppedEvent()
+    {
+        CreateAppriseProviderRequest request = new()
+        {
+            Name = "Apprise",
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "config-key",
+            OnDownloadStopped = true,
+        };
+
+        NotificationProviderResponse provider = Created(await _controller.CreateAppriseProvider(request));
+
+        provider.Type.ShouldBe(NotificationProviderType.Apprise);
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UpdateAppriseProvider_ChangesTheDownloadStoppedEvent()
+    {
+        Guid id = Created(await _controller.CreateAppriseProvider(new CreateAppriseProviderRequest
+        {
+            Name = "Apprise",
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "config-key",
+            OnDownloadStopped = false,
+        })).Id;
+
+        NotificationProviderResponse provider = Updated(await _controller.UpdateAppriseProvider(id,
+            new UpdateAppriseProviderRequest
+            {
+                Name = "Apprise",
+                Mode = AppriseMode.Api,
+                Url = "https://apprise.example.com",
+                Key = "config-key",
+                OnDownloadStopped = true,
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    #endregion
+
+    #region Ntfy
+
+    [Fact]
+    public async Task CreateNtfyProvider_PersistsTheDownloadStoppedEvent()
+    {
+        CreateNtfyProviderRequest request = new()
+        {
+            Name = "Ntfy",
+            ServerUrl = "https://ntfy.sh",
+            Topics = ["cleanuparr"],
+            OnDownloadStopped = true,
+        };
+
+        NotificationProviderResponse provider = Created(await _controller.CreateNtfyProvider(request));
+
+        provider.Type.ShouldBe(NotificationProviderType.Ntfy);
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UpdateNtfyProvider_ChangesTheDownloadStoppedEvent()
+    {
+        Guid id = Created(await _controller.CreateNtfyProvider(new CreateNtfyProviderRequest
+        {
+            Name = "Ntfy",
+            ServerUrl = "https://ntfy.sh",
+            Topics = ["cleanuparr"],
+            OnDownloadStopped = false,
+        })).Id;
+
+        NotificationProviderResponse provider = Updated(await _controller.UpdateNtfyProvider(id,
+            new UpdateNtfyProviderRequest
+            {
+                Name = "Ntfy",
+                ServerUrl = "https://ntfy.sh",
+                Topics = ["cleanuparr"],
+                OnDownloadStopped = true,
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    #endregion
+
+    #region Telegram
+
+    [Fact]
+    public async Task CreateTelegramProvider_PersistsTheDownloadStoppedEvent()
+    {
+        CreateTelegramProviderRequest request = new()
+        {
+            Name = "Telegram",
+            BotToken = "0123456789:token",
+            ChatId = "-1001234567890",
+            OnDownloadStopped = true,
+        };
+
+        NotificationProviderResponse provider = Created(await _controller.CreateTelegramProvider(request));
+
+        provider.Type.ShouldBe(NotificationProviderType.Telegram);
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UpdateTelegramProvider_ChangesTheDownloadStoppedEvent()
+    {
+        Guid id = Created(await _controller.CreateTelegramProvider(new CreateTelegramProviderRequest
+        {
+            Name = "Telegram",
+            BotToken = "0123456789:token",
+            ChatId = "-1001234567890",
+            OnDownloadStopped = false,
+        })).Id;
+
+        NotificationProviderResponse provider = Updated(await _controller.UpdateTelegramProvider(id,
+            new UpdateTelegramProviderRequest
+            {
+                Name = "Telegram",
+                BotToken = "0123456789:token",
+                ChatId = "-1001234567890",
+                OnDownloadStopped = true,
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    #endregion
+
+    #region Discord
+
+    [Fact]
+    public async Task CreateDiscordProvider_PersistsTheDownloadStoppedEvent()
+    {
+        CreateDiscordProviderRequest request = new()
+        {
+            Name = "Discord",
+            WebhookUrl = "https://discord.com/api/webhooks/1/token",
+            OnDownloadStopped = true,
+        };
+
+        NotificationProviderResponse provider = Created(await _controller.CreateDiscordProvider(request));
+
+        provider.Type.ShouldBe(NotificationProviderType.Discord);
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UpdateDiscordProvider_ChangesTheDownloadStoppedEvent()
+    {
+        Guid id = Created(await _controller.CreateDiscordProvider(new CreateDiscordProviderRequest
+        {
+            Name = "Discord",
+            WebhookUrl = "https://discord.com/api/webhooks/1/token",
+            OnDownloadStopped = false,
+        })).Id;
+
+        NotificationProviderResponse provider = Updated(await _controller.UpdateDiscordProvider(id,
+            new UpdateDiscordProviderRequest
+            {
+                Name = "Discord",
+                WebhookUrl = "https://discord.com/api/webhooks/1/token",
+                OnDownloadStopped = true,
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    #endregion
+
+    #region Pushover
+
+    [Fact]
+    public async Task CreatePushoverProvider_PersistsTheDownloadStoppedEvent()
+    {
+        CreatePushoverProviderRequest request = new()
+        {
+            Name = "Pushover",
+            ApiToken = "api-token",
+            UserKey = "user-key",
+            OnDownloadStopped = true,
+        };
+
+        NotificationProviderResponse provider = Created(await _controller.CreatePushoverProvider(request));
+
+        provider.Type.ShouldBe(NotificationProviderType.Pushover);
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UpdatePushoverProvider_ChangesTheDownloadStoppedEvent()
+    {
+        Guid id = Created(await _controller.CreatePushoverProvider(new CreatePushoverProviderRequest
+        {
+            Name = "Pushover",
+            ApiToken = "api-token",
+            UserKey = "user-key",
+            OnDownloadStopped = false,
+        })).Id;
+
+        NotificationProviderResponse provider = Updated(await _controller.UpdatePushoverProvider(id,
+            new UpdatePushoverProviderRequest
+            {
+                Name = "Pushover",
+                ApiToken = "api-token",
+                UserKey = "user-key",
+                OnDownloadStopped = true,
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    #endregion
+
+    #region Gotify
+
+    [Fact]
+    public async Task CreateGotifyProvider_PersistsTheDownloadStoppedEvent()
+    {
+        CreateGotifyProviderRequest request = new()
+        {
+            Name = "Gotify",
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "app-token",
+            OnDownloadStopped = true,
+        };
+
+        NotificationProviderResponse provider = Created(await _controller.CreateGotifyProvider(request));
+
+        provider.Type.ShouldBe(NotificationProviderType.Gotify);
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UpdateGotifyProvider_ChangesTheDownloadStoppedEvent()
+    {
+        Guid id = Created(await _controller.CreateGotifyProvider(new CreateGotifyProviderRequest
+        {
+            Name = "Gotify",
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "app-token",
+            OnDownloadStopped = false,
+        })).Id;
+
+        NotificationProviderResponse provider = Updated(await _controller.UpdateGotifyProvider(id,
+            new UpdateGotifyProviderRequest
+            {
+                Name = "Gotify",
+                ServerUrl = "https://gotify.example.com",
+                ApplicationToken = "app-token",
+                OnDownloadStopped = true,
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    #endregion
+
+    [Fact]
+    public async Task GetNotificationProviders_ReturnsTheDownloadStoppedEvent()
+    {
+        await _controller.CreateGotifyProvider(new CreateGotifyProviderRequest
+        {
+            Name = "Gotify",
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "app-token",
+            OnDownloadStopped = true,
+        });
+
+        NotificationProvidersResponse response = (await _controller.GetNotificationProviders())
+            .ShouldBeOfType<OkObjectResult>().Value.ShouldBeOfType<NotificationProvidersResponse>();
+
+        response.Providers.ShouldHaveSingleItem().Events.OnDownloadStopped.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task CreateGotifyProvider_WithoutEvents_LeavesDownloadStoppedDisabled()
+    {
+        NotificationProviderResponse provider = Created(await _controller.CreateGotifyProvider(
+            new CreateGotifyProviderRequest
+            {
+                Name = "Gotify",
+                ServerUrl = "https://gotify.example.com",
+                ApplicationToken = "app-token",
+            }));
+
+        provider.Events.OnDownloadStopped.ShouldBeFalse();
+    }
+}
@@ -0,0 +1,156 @@
+using Cleanuparr.Api.Features.QueueCleaner.Contracts.Requests;
+using Cleanuparr.Api.Features.QueueCleaner.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.QueueCleaner;
+
+public class QueueCleanerConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly IJobManagementService _jobManagementService;
+    private readonly QueueCleanerConfigController _controller;
+
+    public QueueCleanerConfigControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<QueueCleanerConfigController>>();
+        _jobManagementService = Substitute.For<IJobManagementService>();
+        _controller = new QueueCleanerConfigController(logger, _dataContext, _jobManagementService);
+        ConfigControllerTestDataFactory.ConfigureProblemDetails(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    [Fact]
+    public async Task GetQueueCleanerConfig_ReturnsExistingConfig()
+    {
+        // Act
+        var result = await _controller.GetQueueCleanerConfig();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        ok.Value.ShouldBeOfType<QueueCleanerConfig>();
+    }
+
+    [Fact]
+    public async Task UpdateQueueCleanerConfig_Enabled_StartsJob()
+    {
+        // Arrange
+        var request = new UpdateQueueCleanerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "0 0/5 * * * ?",
+            FailedImport = new FailedImportConfig(),
+            IgnoredDownloads = new List<string>(),
+        };
+
+        // Act
+        var result = await _controller.UpdateQueueCleanerConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StartJob(JobType.QueueCleaner, null, "0 0/5 * * * ?");
+        await _jobManagementService.DidNotReceive().StopJob(Arg.Any<JobType>());
+    }
+
+    [Fact]
+    public async Task UpdateQueueCleanerConfig_Disabled_StopsJob()
+    {
+        // Arrange — pre-enable
+        var existing = await _dataContext.QueueCleanerConfigs.FirstAsync();
+        existing.Enabled = true;
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateQueueCleanerConfigRequest
+        {
+            Enabled = false,
+            CronExpression = "0 0/5 * * * ?",
+            FailedImport = new FailedImportConfig(),
+            IgnoredDownloads = new List<string>(),
+        };
+
+        // Act
+        var result = await _controller.UpdateQueueCleanerConfig(request);
+
+        // Assert
+        result.ShouldBeOfType<OkObjectResult>();
+        await _jobManagementService.Received(1).StopJob(JobType.QueueCleaner);
+    }
+
+    [Fact]
+    public async Task UpdateQueueCleanerConfig_InvalidCronExpression_PropagatesValidationException()
+    {
+        // Arrange — CronValidationHelper throws Cleanuparr.Domain.Exceptions.ValidationException,
+        // which the controller's catch (System.ComponentModel.DataAnnotations.ValidationException) does NOT match.
+        var request = new UpdateQueueCleanerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "not-a-cron",
+            FailedImport = new FailedImportConfig(),
+            IgnoredDownloads = new List<string>(),
+        };
+
+        // Act / Assert
+        await Should.ThrowAsync<Cleanuparr.Domain.Exceptions.ValidationException>(
+            () => _controller.UpdateQueueCleanerConfig(request));
+        await _jobManagementService.DidNotReceive().StartJob(Arg.Any<JobType>(), Arg.Any<Cleanuparr.Infrastructure.Models.JobSchedule?>(), Arg.Any<string?>());
+    }
+
+    [Fact]
+    public async Task UpdateQueueCleanerConfig_ConfigValidationFails_ReturnsBadRequest()
+    {
+        // Arrange — DownloadingMetadataMaxStrikes < 3 (and > 0) triggers Validate() exception
+        var request = new UpdateQueueCleanerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "0 0/5 * * * ?",
+            FailedImport = new FailedImportConfig(),
+            DownloadingMetadataMaxStrikes = 2,
+            IgnoredDownloads = new List<string>(),
+        };
+
+        // Act + Assert
+        await Should.ThrowAsync<System.ComponentModel.DataAnnotations.ValidationException>(
+            () => _controller.UpdateQueueCleanerConfig(request));
+    }
+
+    [Fact]
+    public async Task UpdateQueueCleanerConfig_PersistsChanges()
+    {
+        // Arrange
+        var request = new UpdateQueueCleanerConfigRequest
+        {
+            Enabled = true,
+            CronExpression = "0 0/10 * * * ?",
+            FailedImport = new FailedImportConfig(),
+            DownloadingMetadataMaxStrikes = 5,
+            ProcessNoContentId = true,
+            IgnoredDownloads = new List<string> { "ignored" },
+        };
+
+        // Act
+        await _controller.UpdateQueueCleanerConfig(request);
+
+        // Assert
+        var saved = await _dataContext.QueueCleanerConfigs.AsNoTracking().FirstAsync();
+        saved.Enabled.ShouldBeTrue();
+        saved.CronExpression.ShouldBe("0 0/10 * * * ?");
+        saved.DownloadingMetadataMaxStrikes.ShouldBe((ushort)5);
+        saved.ProcessNoContentId.ShouldBeTrue();
+        saved.IgnoredDownloads.ShouldContain("ignored");
+    }
+}
@@ -0,0 +1,258 @@
+using Cleanuparr.Api.Features.QueueCleaner.Contracts.Requests;
+using Cleanuparr.Api.Features.QueueCleaner.Controllers;
+using Cleanuparr.Api.Tests.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Features.QueueCleaner;
+
+public class QueueRulesControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly IRuleIntervalValidator _validator;
+    private readonly QueueRulesController _controller;
+
+    public QueueRulesControllerTests()
+    {
+        _dataContext = ConfigControllerTestDataFactory.CreateDataContext();
+        var logger = Substitute.For<ILogger<QueueRulesController>>();
+        _validator = Substitute.For<IRuleIntervalValidator>();
+        _validator.ValidateStallRuleIntervals(Arg.Any<StallRule>(), Arg.Any<List<StallRule>>()).Returns(ValidationResult.Success());
+        _validator.ValidateSlowRuleIntervals(Arg.Any<SlowRule>(), Arg.Any<List<SlowRule>>()).Returns(ValidationResult.Success());
+        _controller = new QueueRulesController(logger, _dataContext, _validator);
+        ConfigControllerTestDataFactory.ConfigureProblemDetails(_controller);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    #region Stall Rules
+
+    [Fact]
+    public async Task GetStallRules_EmptyDatabase_ReturnsEmptyList()
+    {
+        // Act
+        var result = await _controller.GetStallRules();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var rules = ok.Value.ShouldBeOfType<List<StallRule>>();
+        rules.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task CreateStallRule_NewName_ReturnsCreatedWithRule()
+    {
+        // Arrange
+        var dto = NewStallDto(name: "default");
+
+        // Act
+        var result = await _controller.CreateStallRule(dto);
+
+        // Assert
+        var created = result.ShouldBeOfType<CreatedAtActionResult>();
+        var rule = created.Value.ShouldBeOfType<StallRule>();
+        rule.Name.ShouldBe("default");
+        rule.Id.ShouldNotBe(Guid.Empty);
+        (await _dataContext.StallRules.CountAsync()).ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task CreateStallRule_DuplicateName_ReturnsBadRequest()
+    {
+        // Arrange — seed existing rule
+        await _controller.CreateStallRule(NewStallDto(name: "rule-a"));
+
+        // Act — try to create another with same name (case-insensitive)
+        var result = await _controller.CreateStallRule(NewStallDto(name: "RULE-A"));
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+        (await _dataContext.StallRules.CountAsync()).ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task CreateStallRule_IntervalValidatorFails_ReturnsBadRequest()
+    {
+        // Arrange
+        _validator.ValidateStallRuleIntervals(Arg.Any<StallRule>(), Arg.Any<List<StallRule>>())
+            .Returns(ValidationResult.Failure("overlaps with existing rule"));
+
+        // Act
+        var result = await _controller.CreateStallRule(NewStallDto(name: "x"));
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+        (await _dataContext.StallRules.CountAsync()).ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task UpdateStallRule_NonExistentId_ReturnsNotFound()
+    {
+        // Act
+        var result = await _controller.UpdateStallRule(Guid.NewGuid(), NewStallDto("x"));
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    [Fact]
+    public async Task UpdateStallRule_ExistingRule_PersistsChanges()
+    {
+        // Arrange
+        var create = (CreatedAtActionResult)await _controller.CreateStallRule(NewStallDto(name: "orig"));
+        var id = ((StallRule)create.Value!).Id;
+
+        // Act
+        var result = await _controller.UpdateStallRule(id, NewStallDto(name: "renamed"));
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var rule = ok.Value.ShouldBeOfType<StallRule>();
+        rule.Name.ShouldBe("renamed");
+        var saved = await _dataContext.StallRules.AsNoTracking().FirstAsync(r => r.Id == id);
+        saved.Name.ShouldBe("renamed");
+    }
+
+    [Fact]
+    public async Task UpdateStallRule_DuplicateNameOtherRule_ReturnsBadRequest()
+    {
+        // Arrange
+        await _controller.CreateStallRule(NewStallDto(name: "alpha"));
+        var betaCreate = (CreatedAtActionResult)await _controller.CreateStallRule(NewStallDto(name: "beta"));
+        var betaId = ((StallRule)betaCreate.Value!).Id;
+
+        // Act — try to rename beta → alpha
+        var result = await _controller.UpdateStallRule(betaId, NewStallDto(name: "alpha"));
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+    }
+
+    [Fact]
+    public async Task DeleteStallRule_ExistingRule_ReturnsNoContent()
+    {
+        // Arrange
+        var create = (CreatedAtActionResult)await _controller.CreateStallRule(NewStallDto(name: "doomed"));
+        var id = ((StallRule)create.Value!).Id;
+
+        // Act
+        var result = await _controller.DeleteStallRule(id);
+
+        // Assert
+        result.ShouldBeOfType<NoContentResult>();
+        (await _dataContext.StallRules.CountAsync()).ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task DeleteStallRule_NonExistent_ReturnsNotFound()
+    {
+        // Act
+        var result = await _controller.DeleteStallRule(Guid.NewGuid());
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    #endregion
+
+    #region Slow Rules
+
+    [Fact]
+    public async Task GetSlowRules_EmptyDatabase_ReturnsEmptyList()
+    {
+        // Act
+        var result = await _controller.GetSlowRules();
+
+        // Assert
+        var ok = result.ShouldBeOfType<OkObjectResult>();
+        var rules = ok.Value.ShouldBeOfType<List<SlowRule>>();
+        rules.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task CreateSlowRule_NewName_ReturnsCreated()
+    {
+        // Arrange
+        var dto = NewSlowDto(name: "slow-default");
+
+        // Act
+        var result = await _controller.CreateSlowRule(dto);
+
+        // Assert
+        var created = result.ShouldBeOfType<CreatedAtActionResult>();
+        var rule = created.Value.ShouldBeOfType<SlowRule>();
+        rule.Name.ShouldBe("slow-default");
+        (await _dataContext.SlowRules.CountAsync()).ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task CreateSlowRule_DuplicateName_ReturnsBadRequest()
+    {
+        // Arrange
+        await _controller.CreateSlowRule(NewSlowDto(name: "x"));
+
+        // Act
+        var result = await _controller.CreateSlowRule(NewSlowDto(name: "X"));
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(400);
+    }
+
+    [Fact]
+    public async Task UpdateSlowRule_NonExistentId_ReturnsNotFound()
+    {
+        // Act
+        var result = await _controller.UpdateSlowRule(Guid.NewGuid(), NewSlowDto("x"));
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    [Fact]
+    public async Task DeleteSlowRule_NonExistent_ReturnsNotFound()
+    {
+        // Act
+        var result = await _controller.DeleteSlowRule(Guid.NewGuid());
+
+        // Assert
+        result.ShouldBeOfType<ObjectResult>().StatusCode.ShouldBe(404);
+    }
+
+    #endregion
+
+    private static StallRuleDto NewStallDto(string name) => new()
+    {
+        Name = name,
+        Enabled = true,
+        MaxStrikes = 3,
+        PrivacyType = TorrentPrivacyType.Public,
+        MinCompletionPercentage = 0,
+        MaxCompletionPercentage = 100,
+        ResetStrikesOnProgress = true,
+    };
+
+    private static SlowRuleDto NewSlowDto(string name) => new()
+    {
+        Name = name,
+        Enabled = true,
+        MaxStrikes = 3,
+        PrivacyType = TorrentPrivacyType.Public,
+        MinCompletionPercentage = 0,
+        MaxCompletionPercentage = 100,
+        ResetStrikesOnProgress = true,
+        MinSpeed = "1MB",
+    };
+}
@@ -0,0 +1,556 @@
+using System.Text.Json;
+using Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+using Cleanuparr.Api.Features.Seeker.Controllers;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
+using Cleanuparr.Persistence.Providers;
+using Microsoft.AspNetCore.Mvc;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker;
+
+public class CustomFormatScoreControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly EventsContext _eventsContext;
+    private readonly CustomFormatScoreController _controller;
+
+    public CustomFormatScoreControllerTests()
+    {
+        _dataContext = SeekerTestDataFactory.CreateDataContext();
+        _eventsContext = SeekerTestDataFactory.CreateEventsContext();
+        _controller = new CustomFormatScoreController(_dataContext, _eventsContext, new SqliteDatabaseProvider());
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        _eventsContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static JsonElement GetResponseBody(IActionResult result)
+    {
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var json = JsonSerializer.Serialize(okResult.Value);
+        return JsonDocument.Parse(json).RootElement;
+    }
+
+    #region GetCustomFormatScores Tests
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithPageBelowMinimum_ClampsToOne()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie A", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "Movie B", currentScore: 200, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(page: -5, pageSize: 50);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("Page").GetInt32().ShouldBe(1);
+        body.GetProperty("Items").GetArrayLength().ShouldBe(2);
+    }
+
+    // The sentinel is not a database value.
+    [Fact]
+    public async Task GetCustomFormatScores_WithTheUnknownItemType_IgnoresTheFilter()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie A", currentScore: 100, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(itemType: InstanceType.Unknown);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("Items").GetArrayLength().ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithPageSizeAboveMaximum_ClampsToHundred()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie A", currentScore: 100, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(page: 1, pageSize: 999);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("PageSize").GetInt32().ShouldBe(500);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithHideMetTrue_ExcludesItemsAtOrAboveCutoff()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Below Cutoff", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "At Cutoff", currentScore: 500, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 3, "Above Cutoff", currentScore: 600, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(cutoffFilter: CutoffFilter.Below);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Below Cutoff");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithHideUnmonitoredTrue_ExcludesUnmonitoredItems()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Monitored Movie", currentScore: 100, cutoffScore: 500, isMonitored: true);
+        AddScoreEntry(radarr.Id, 2, "Unmonitored Movie", currentScore: 200, cutoffScore: 500, isMonitored: false);
+        AddScoreEntry(radarr.Id, 3, "Another Monitored", currentScore: 300, cutoffScore: 500, isMonitored: true);
+
+        var result = await _controller.GetCustomFormatScores(monitoredFilter: MonitoredFilter.Monitored);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+        var items = body.GetProperty("Items");
+        items.GetArrayLength().ShouldBe(2);
+        items[0].GetProperty("Title").GetString().ShouldBe("Another Monitored");
+        items[1].GetProperty("Title").GetString().ShouldBe("Monitored Movie");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithSearchFilter_ReturnsMatchingTitlesOnly()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "The Matrix", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "Inception", currentScore: 200, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 3, "The Matrix Reloaded", currentScore: 300, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(search: "matrix");
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithSortByDate_OrdersByLastSyncedDescending()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Older", currentScore: 100, cutoffScore: 500,
+            lastSynced: DateTime.UtcNow.AddHours(-2));
+        AddScoreEntry(radarr.Id, 2, "Newer", currentScore: 200, cutoffScore: 500,
+            lastSynced: DateTime.UtcNow.AddHours(-1));
+
+        var result = await _controller.GetCustomFormatScores(sortBy: CfScoresSortBy.LastSyncedAt);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Newer");
+        body.GetProperty("Items")[1].GetProperty("Title").GetString().ShouldBe("Older");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithInstanceIdFilter_ReturnsOnlyThatInstance()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(sonarr.Id, 2, "Series", currentScore: 200, cutoffScore: 500,
+            itemType: InstanceType.Sonarr);
+
+        var result = await _controller.GetCustomFormatScores(instanceId: radarr.Id);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Movie");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_ReturnsCorrectTotalPagesCalculation()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        for (int i = 1; i <= 7; i++)
+        {
+            AddScoreEntry(radarr.Id, i, $"Movie {i}", currentScore: 100, cutoffScore: 500);
+        }
+
+        var result = await _controller.GetCustomFormatScores(page: 1, pageSize: 3);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(7);
+        body.GetProperty("TotalPages").GetInt32().ShouldBe(3); // ceil(7/3) = 3
+        body.GetProperty("Items").GetArrayLength().ShouldBe(3);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithCutoffFilterMet_ExcludesBelowCutoff()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Below", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "At", currentScore: 500, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 3, "Above", currentScore: 600, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(cutoffFilter: CutoffFilter.Met);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithCutoffFilterAll_IncludesEverything()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Below", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "Above", currentScore: 600, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(cutoffFilter: CutoffFilter.All);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithMonitoredFilterUnmonitored_ReturnsOnlyUnmonitored()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "A", currentScore: 100, cutoffScore: 500, isMonitored: true);
+        AddScoreEntry(radarr.Id, 2, "B", currentScore: 100, cutoffScore: 500, isMonitored: false);
+
+        var result = await _controller.GetCustomFormatScores(monitoredFilter: MonitoredFilter.Unmonitored);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("B");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithQualityProfileFilter_ReturnsOnlyMatchingProfile()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "HD Movie", currentScore: 100, cutoffScore: 500, qualityProfileName: "HD");
+        AddScoreEntry(radarr.Id, 2, "UHD Movie", currentScore: 200, cutoffScore: 500, qualityProfileName: "UHD");
+
+        var result = await _controller.GetCustomFormatScores(qualityProfile: "UHD");
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("UHD Movie");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithExplicitSortDirectionAsc_OverridesDefault()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "A", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "B", currentScore: 300, cutoffScore: 500);
+
+        // CurrentScore default is descending; overriding with Asc should flip it.
+        var result = await _controller.GetCustomFormatScores(
+            sortBy: CfScoresSortBy.CurrentScore,
+            sortDirection: Cleanuparr.Domain.Enums.SortDirection.Asc);
+        var body = GetResponseBody(result);
+
+        var items = body.GetProperty("Items");
+        items[0].GetProperty("CurrentScore").GetInt32().ShouldBe(100);
+        items[1].GetProperty("CurrentScore").GetInt32().ShouldBe(300);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithSortByTitleDescending_OrdersReverseAlphabetically()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Apple", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "Banana", currentScore: 200, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(
+            sortBy: CfScoresSortBy.Title,
+            sortDirection: Cleanuparr.Domain.Enums.SortDirection.Desc);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Banana");
+    }
+
+    #endregion
+
+    #region GetRecentUpgrades Tests
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithNoHistory_ReturnsEmptyList()
+    {
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(0);
+        body.GetProperty("Items").GetArrayLength().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithSingleEntryPerItem_ReturnsNoUpgrades()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithScoreIncrease_DetectsUpgrade()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 250, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        var upgrade = body.GetProperty("Items")[0];
+        upgrade.GetProperty("PreviousScore").GetInt32().ShouldBe(100);
+        upgrade.GetProperty("NewScore").GetInt32().ShouldBe(250);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithScoreDecrease_DoesNotCountAsUpgrade()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 300, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 150, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithMultipleUpgradesInSameGroup_CountsEach()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // 100 -> 200 -> 300 = two upgrades for the same item
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 200, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithDaysFilter_ExcludesOlderHistory()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // Old upgrade (outside 7-day window)
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-20));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 250, recordedAt: DateTime.UtcNow.AddDays(-15));
+        // Recent upgrade (inside 7-day window)
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades(days: 7);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithUpgradeCrossingWindowBoundary_IsDetected()
+    {
+        // CR2: pre-window baseline must still participate so the first in-window
+        // row can be recognised as an upgrade.
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-10));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 200, recordedAt: DateTime.UtcNow.AddDays(-3));
+
+        var result = await _controller.GetRecentUpgrades(days: 7);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        var upgrade = body.GetProperty("Items")[0];
+        upgrade.GetProperty("PreviousScore").GetInt32().ShouldBe(100);
+        upgrade.GetProperty("NewScore").GetInt32().ShouldBe(200);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithSortByScoreDeltaDescending_OrdersByLargestDelta()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // Item 1: +50
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 150, recordedAt: DateTime.UtcNow.AddDays(-2));
+        // Item 2: +400
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 500, recordedAt: DateTime.UtcNow.AddDays(-2));
+
+        var result = await _controller.GetRecentUpgrades(sortBy: CfUpgradesSortBy.ScoreDelta);
+        var body = GetResponseBody(result);
+
+        var items = body.GetProperty("Items");
+        items[0].GetProperty("NewScore").GetInt32().ShouldBe(500);
+        items[1].GetProperty("NewScore").GetInt32().ShouldBe(150);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithSortByTitleAscending_OrdersAlphabetically()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 200, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 200, recordedAt: DateTime.UtcNow.AddDays(-2));
+
+        var result = await _controller.GetRecentUpgrades(sortBy: CfUpgradesSortBy.Title);
+        var body = GetResponseBody(result);
+
+        var items = body.GetProperty("Items");
+        items[0].GetProperty("Title").GetString().ShouldBe("Item 1");
+        items[1].GetProperty("Title").GetString().ShouldBe("Item 2");
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithSearchFilter_ReturnsMatchingTitlesOnly()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // AddHistoryEntry titles as "Item {externalItemId}".
+        AddHistoryEntry(radarr.Id, externalItemId: 42, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 42, score: 200, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 99, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 99, score: 200, recordedAt: DateTime.UtcNow.AddDays(-2));
+
+        var result = await _controller.GetRecentUpgrades(search: "42");
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Item 42");
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_ReturnsSortedByMostRecentFirst()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // Item 1: upgrade happened 5 days ago
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-6));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 200, recordedAt: DateTime.UtcNow.AddDays(-5));
+        // Item 2: upgrade happened 1 day ago
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 100, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        var items = body.GetProperty("Items");
+        items.GetArrayLength().ShouldBe(2);
+        // Most recent upgrade (item 2) should be first
+        items[0].GetProperty("NewScore").GetInt32().ShouldBe(300);
+        items[1].GetProperty("NewScore").GetInt32().ShouldBe(200);
+    }
+
+    #endregion
+
+    #region GetStats Tests
+
+    [Fact]
+    public async Task GetStats_WithNoEntries_ReturnsZeroes()
+    {
+        var result = await _controller.GetStats();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var stats = okResult.Value.ShouldBeOfType<CustomFormatScoreStatsResponse>();
+
+        stats.TotalTracked.ShouldBe(0);
+        stats.BelowCutoff.ShouldBe(0);
+        stats.AtOrAboveCutoff.ShouldBe(0);
+        stats.RecentUpgrades.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetStats_CorrectlyCategorizesBelowAndAboveCutoff()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Below", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "At", currentScore: 500, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 3, "Above", currentScore: 600, cutoffScore: 500);
+
+        var result = await _controller.GetStats();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var stats = okResult.Value.ShouldBeOfType<CustomFormatScoreStatsResponse>();
+
+        stats.TotalTracked.ShouldBe(3);
+        stats.BelowCutoff.ShouldBe(1);
+        stats.AtOrAboveCutoff.ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetStats_CountsRecentUpgradesFromLast7Days()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie", currentScore: 300, cutoffScore: 500);
+
+        // Upgrade within 7 days
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        // Upgrade outside 7 days (should not be counted)
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 50, recordedAt: DateTime.UtcNow.AddDays(-20));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 200, recordedAt: DateTime.UtcNow.AddDays(-15));
+
+        var result = await _controller.GetStats();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var stats = okResult.Value.ShouldBeOfType<CustomFormatScoreStatsResponse>();
+
+        stats.RecentUpgrades.ShouldBe(1);
+    }
+
+    #endregion
+
+    #region Helpers
+
+    private void AddScoreEntry(
+        Guid arrInstanceId,
+        long externalItemId,
+        string title,
+        int currentScore,
+        int cutoffScore,
+        InstanceType itemType = InstanceType.Radarr,
+        DateTime? lastSynced = null,
+        bool isMonitored = true,
+        string qualityProfileName = "HD")
+    {
+        _eventsContext.CustomFormatScoreEntries.Add(new CustomFormatScoreEntry
+        {
+            ArrInstanceId = arrInstanceId,
+            ExternalItemId = externalItemId,
+            EpisodeId = 0,
+            ItemType = itemType,
+            Title = title,
+            FileId = externalItemId * 10,
+            CurrentScore = currentScore,
+            CutoffScore = cutoffScore,
+            QualityProfileName = qualityProfileName,
+            IsMonitored = isMonitored,
+            LastSyncedAt = lastSynced ?? DateTime.UtcNow
+        });
+        _eventsContext.SaveChanges();
+    }
+
+    private void AddHistoryEntry(
+        Guid arrInstanceId,
+        long externalItemId,
+        int score,
+        DateTime recordedAt,
+        long episodeId = 0,
+        int cutoffScore = 500,
+        InstanceType itemType = InstanceType.Radarr)
+    {
+        _eventsContext.CustomFormatScoreHistory.Add(new CustomFormatScoreHistory
+        {
+            ArrInstanceId = arrInstanceId,
+            ExternalItemId = externalItemId,
+            EpisodeId = episodeId,
+            ItemType = itemType,
+            Title = $"Item {externalItemId}",
+            Score = score,
+            CutoffScore = cutoffScore,
+            RecordedAt = recordedAt
+        });
+        _eventsContext.SaveChanges();
+    }
+
+    #endregion
+}
@@ -0,0 +1,295 @@
+using System.Text.Json;
+using Cleanuparr.Api.Features.Seeker.Controllers;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Mvc;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker;
+
+public class SearchStatsControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly EventsContext _eventsContext;
+    private readonly SearchStatsController _controller;
+
+    public SearchStatsControllerTests()
+    {
+        _dataContext = SeekerTestDataFactory.CreateDataContext();
+        _eventsContext = SeekerTestDataFactory.CreateEventsContext();
+        _controller = new SearchStatsController(_dataContext, _eventsContext);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        _eventsContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static JsonElement GetResponseBody(IActionResult result)
+    {
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var json = JsonSerializer.Serialize(okResult.Value);
+        return JsonDocument.Parse(json).RootElement;
+    }
+
+    #region GetEvents with SearchEventData
+
+    [Fact]
+    public async Task GetEvents_WithNoSearchEventData_ReturnsUnknownDefaults()
+    {
+        AddSearchEvent();
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("ItemTitle").GetString().ShouldBe("Unknown");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSearchEventData_ReturnsAllFields()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+
+        AddSearchEvent(
+            arrInstanceId: radarr.Id,
+            itemTitle: "Movie A",
+            searchType: SeekerSearchType.Proactive,
+            searchReason: SeekerSearchReason.Missing,
+            grabbedItems: ["Movie A (2024)"]);
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("ArrInstanceId").GetString().ShouldBe(radarr.Id.ToString());
+        item.GetProperty("InstanceType").GetString().ShouldBe(nameof(InstanceType.Radarr));
+        item.GetProperty("ItemTitle").GetString().ShouldBe("Movie A");
+        item.GetProperty("SearchType").GetString().ShouldBe(nameof(SeekerSearchType.Proactive));
+        item.GetProperty("SearchReason").GetString().ShouldBe(nameof(SeekerSearchReason.Missing));
+        item.GetProperty("GrabbedItems")[0].GetString().ShouldBe("Movie A (2024)");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithReplacementSearchType_ParsesCorrectEnum()
+    {
+        AddSearchEvent(
+            itemTitle: "Series A",
+            searchType: SeekerSearchType.Replacement,
+            searchReason: SeekerSearchReason.Replacement);
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("SearchType").GetString().ShouldBe(nameof(SeekerSearchType.Replacement));
+        item.GetProperty("SearchReason").GetString().ShouldBe(nameof(SeekerSearchReason.Replacement));
+    }
+
+    #endregion
+
+    #region GetEvents Filtering
+
+    [Fact]
+    public async Task GetEvents_WithInstanceIdFilter_FiltersByArrInstanceId()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+
+        AddSearchEvent(arrInstanceId: radarr.Id, itemTitle: "Radarr Movie");
+        AddSearchEvent(arrInstanceId: sonarr.Id, itemTitle: "Sonarr Series");
+
+        var result = await _controller.GetEvents(instanceId: radarr.Id);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("ArrInstanceId").GetString().ShouldBe(radarr.Id.ToString());
+    }
+
+    [Fact]
+    public async Task GetEvents_WithCycleIdFilter_ReturnsOnlyMatchingCycle()
+    {
+        var cycleA = Guid.NewGuid();
+        var cycleB = Guid.NewGuid();
+
+        AddSearchEvent(cycleId: cycleA, itemTitle: "Cycle A Movie");
+        AddSearchEvent(cycleId: cycleB, itemTitle: "Cycle B Movie");
+
+        var result = await _controller.GetEvents(cycleId: cycleA);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("ItemTitle").GetString().ShouldBe("Cycle A Movie");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSearchFilter_FiltersOnItemTitle()
+    {
+        AddSearchEvent(itemTitle: "The Matrix");
+        AddSearchEvent(itemTitle: "Breaking Bad");
+
+        var result = await _controller.GetEvents(search: "matrix");
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task GetEvents_WithPagination_ReturnsCorrectPageAndCount()
+    {
+        for (int i = 0; i < 5; i++)
+        {
+            AddSearchEvent(itemTitle: $"Event {i}");
+        }
+
+        var result = await _controller.GetEvents(page: 2, pageSize: 2);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(5);
+        body.GetProperty("TotalPages").GetInt32().ShouldBe(3);
+        body.GetProperty("Page").GetInt32().ShouldBe(2);
+        body.GetProperty("Items").GetArrayLength().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSortByTitleAscending_OrdersAlphabetically()
+    {
+        AddSearchEvent(itemTitle: "Charlie");
+        AddSearchEvent(itemTitle: "Alpha");
+        AddSearchEvent(itemTitle: "Bravo");
+
+        var result = await _controller.GetEvents(
+            sortBy: SearchEventsSortBy.Title,
+            sortDirection: Cleanuparr.Domain.Enums.SortDirection.Asc);
+        var body = GetResponseBody(result);
+
+        var items = body.GetProperty("Items");
+        items[0].GetProperty("ItemTitle").GetString().ShouldBe("Alpha");
+        items[1].GetProperty("ItemTitle").GetString().ShouldBe("Bravo");
+        items[2].GetProperty("ItemTitle").GetString().ShouldBe("Charlie");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSortByTimestampAscending_OldestFirst()
+    {
+        AddSearchEvent(itemTitle: "Newest", timestamp: DateTime.UtcNow);
+        AddSearchEvent(itemTitle: "Oldest", timestamp: DateTime.UtcNow.AddHours(-2));
+        AddSearchEvent(itemTitle: "Middle", timestamp: DateTime.UtcNow.AddHours(-1));
+
+        var result = await _controller.GetEvents(sortDirection: Cleanuparr.Domain.Enums.SortDirection.Asc);
+        var body = GetResponseBody(result);
+
+        var items = body.GetProperty("Items");
+        items[0].GetProperty("ItemTitle").GetString().ShouldBe("Oldest");
+        items[2].GetProperty("ItemTitle").GetString().ShouldBe("Newest");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSearchStatusFilter_ReturnsOnlyMatchingStatuses()
+    {
+        AddSearchEvent(itemTitle: "A", searchStatus: SearchCommandStatus.Completed);
+        AddSearchEvent(itemTitle: "B", searchStatus: SearchCommandStatus.Failed);
+        AddSearchEvent(itemTitle: "C", searchStatus: SearchCommandStatus.TimedOut);
+
+        var result = await _controller.GetEvents(
+            searchStatus: [SearchCommandStatus.Completed, SearchCommandStatus.Failed]);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSearchTypeFilter_ReturnsOnlyMatchingType()
+    {
+        AddSearchEvent(itemTitle: "Proactive Movie", searchType: SeekerSearchType.Proactive);
+        AddSearchEvent(itemTitle: "Replacement Movie", searchType: SeekerSearchType.Replacement);
+
+        var result = await _controller.GetEvents(searchType: SeekerSearchType.Replacement);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("ItemTitle").GetString().ShouldBe("Replacement Movie");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSearchReasonFilter_ReturnsOnlyMatchingReason()
+    {
+        AddSearchEvent(itemTitle: "Missing", searchReason: SeekerSearchReason.Missing);
+        AddSearchEvent(itemTitle: "Cutoff", searchReason: SeekerSearchReason.QualityCutoffNotMet);
+
+        var result = await _controller.GetEvents(searchReason: SeekerSearchReason.QualityCutoffNotMet);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("ItemTitle").GetString().ShouldBe("Cutoff");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithGrabbedTrue_KeepsOnlyEventsWithGrabbedItems()
+    {
+        AddSearchEvent(itemTitle: "With Grabs", grabbedItems: ["movie (2024)"]);
+        AddSearchEvent(itemTitle: "No Grabs", grabbedItems: []);
+
+        var result = await _controller.GetEvents(grabbed: true);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("ItemTitle").GetString().ShouldBe("With Grabs");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithGrabbedFalse_KeepsOnlyEventsWithoutGrabbedItems()
+    {
+        AddSearchEvent(itemTitle: "With Grabs", grabbedItems: ["movie (2024)"]);
+        AddSearchEvent(itemTitle: "No Grabs", grabbedItems: []);
+
+        var result = await _controller.GetEvents(grabbed: false);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("ItemTitle").GetString().ShouldBe("No Grabs");
+    }
+
+    #endregion
+
+    #region Helpers
+
+    private void AddSearchEvent(
+        string? itemTitle = null,
+        SeekerSearchType searchType = SeekerSearchType.Proactive,
+        SeekerSearchReason searchReason = SeekerSearchReason.Missing,
+        List<string>? grabbedItems = null,
+        Guid? arrInstanceId = null,
+        Guid? cycleId = null,
+        SearchCommandStatus? searchStatus = null,
+        DateTime? timestamp = null)
+    {
+        var appEvent = new AppEvent
+        {
+            EventType = EventType.SearchTriggered,
+            Message = "Search triggered",
+            Severity = EventSeverity.Information,
+            ArrInstanceId = arrInstanceId,
+            CycleId = cycleId,
+            SearchStatus = searchStatus,
+            Timestamp = timestamp ?? DateTime.UtcNow
+        };
+
+        if (itemTitle is not null)
+        {
+            appEvent.ItemTitle = itemTitle;
+            appEvent.SearchType = searchType;
+            appEvent.SearchReason = searchReason;
+            appEvent.GrabbedItems = grabbedItems ?? [];
+        }
+
+        _eventsContext.Events.Add(appEvent);
+        _eventsContext.SaveChanges();
+    }
+
+    #endregion
+}
@@ -0,0 +1,411 @@
+using Cleanuparr.Api.Features.Seeker.Contracts.Requests;
+using Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+using Cleanuparr.Api.Features.Seeker.Controllers;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker;
+
+public class SeekerConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly ILogger<SeekerConfigController> _logger;
+    private readonly IJobManagementService _jobManagementService;
+    private readonly SeekerConfigController _controller;
+
+    public SeekerConfigControllerTests()
+    {
+        _dataContext = SeekerTestDataFactory.CreateDataContext();
+        _logger = Substitute.For<ILogger<SeekerConfigController>>();
+        _jobManagementService = Substitute.For<IJobManagementService>();
+        _controller = new SeekerConfigController(_logger, _dataContext, _jobManagementService);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    #region GetSeekerConfig Tests
+
+    [Fact]
+    public async Task GetSeekerConfig_WithNoSeekerInstanceConfigs_ReturnsDefaults()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+
+        var result = await _controller.GetSeekerConfig();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var response = okResult.Value.ShouldBeOfType<SeekerConfigResponse>();
+
+        var instance = response.Instances.ShouldHaveSingleItem();
+        instance.ArrInstanceId.ShouldBe(radarr.Id);
+        instance.Enabled.ShouldBeFalse();
+        instance.SkipTags.ShouldBeEmpty();
+        instance.ActiveDownloadLimit.ShouldBe(3);
+        instance.IgnoreStruckDownloads.ShouldBeFalse();
+        instance.MinCycleTimeDays.ShouldBe(7);
+    }
+
+    [Fact]
+    public async Task GetSeekerConfig_WithIgnoreStruckDownloadsEnabled_ReturnsEnabledValue()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true,
+            IgnoreStruckDownloads = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        var result = await _controller.GetSeekerConfig();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var response = okResult.Value.ShouldBeOfType<SeekerConfigResponse>();
+
+        response.Instances.ShouldHaveSingleItem().IgnoreStruckDownloads.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task GetSeekerConfig_OnlyReturnsSonarrAndRadarrInstances()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+        var lidarr = SeekerTestDataFactory.AddLidarrInstance(_dataContext);
+
+        var result = await _controller.GetSeekerConfig();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var response = okResult.Value.ShouldBeOfType<SeekerConfigResponse>();
+
+        response.Instances.Count.ShouldBe(2);
+        response.Instances.ShouldContain(i => i.ArrInstanceId == radarr.Id);
+        response.Instances.ShouldContain(i => i.ArrInstanceId == sonarr.Id);
+        response.Instances.ShouldNotContain(i => i.ArrInstanceId == lidarr.Id);
+    }
+
+    #endregion
+
+    #region UpdateSeekerConfig Tests
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WithProactiveEnabledAndNoInstancesEnabled_ThrowsValidationException()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 5,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest
+                {
+                    ArrInstanceId = radarr.Id,
+                    Enabled = false // No instances enabled
+                }
+            ]
+        };
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.UpdateSeekerConfig(request));
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenIntervalChanges_ReschedulesSeeker()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // Default interval is 3, change to 5
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 5,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StartJob(JobType.Seeker, null, Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenIntervalUnchanged_DoesNotReschedule()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // Keep interval at default (10)
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 10,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.DidNotReceive()
+            .StartJob(Arg.Any<JobType>(), null, Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenCustomFormatScoreEnabled_StartsAndTriggersSyncerJob()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // UseCustomFormatScore was false (default), now enable it on the instance
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true, UseCustomFormatScore = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StartJob(JobType.CustomFormatScoreSyncer, null, Arg.Any<string>());
+        await _jobManagementService.Received(1)
+            .TriggerJobOnce(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenCustomFormatScoreDisabled_StopsSyncerJob()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true,
+            UseCustomFormatScore = true
+        });
+
+        // Syncer was running: both proactive and CF score were enabled
+        var config = await _dataContext.SeekerConfigs.FirstAsync();
+        config.ProactiveSearchEnabled = true;
+        await _dataContext.SaveChangesAsync();
+
+        // Disable CF score — syncer conditions no longer met
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true, UseCustomFormatScore = false }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StopJob(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenProactiveSearchDisabled_StopsSyncerJob()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true,
+            UseCustomFormatScore = true
+        });
+
+        // Syncer was running: both proactive and CF score were enabled
+        var config = await _dataContext.SeekerConfigs.FirstAsync();
+        config.ProactiveSearchEnabled = true;
+        await _dataContext.SaveChangesAsync();
+
+        // Disable proactive search — syncer should stop even though CF score is still enabled
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = false,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true, UseCustomFormatScore = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StopJob(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenProactiveSearchEnabled_WithCfScoreActive_StartsAndTriggersSyncer()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true,
+            UseCustomFormatScore = true
+        });
+
+        // Syncer was NOT running: CF score enabled but proactive was off (default)
+        await _dataContext.SaveChangesAsync();
+
+        // Enable proactive search — syncer should start
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true, UseCustomFormatScore = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StartJob(JobType.CustomFormatScoreSyncer, null, Arg.Any<string>());
+        await _jobManagementService.Received(1)
+            .TriggerJobOnce(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenCustomFormatScoreEnabledButProactiveDisabled_DoesNotStartSyncer()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true,
+            UseCustomFormatScore = false
+        });
+
+        // ProactiveSearchEnabled stays false (default)
+        await _dataContext.SaveChangesAsync();
+
+        // Enable CF score but keep proactive disabled — syncer should NOT start
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = false,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true, UseCustomFormatScore = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.DidNotReceive()
+            .StartJob(JobType.CustomFormatScoreSyncer, null, Arg.Any<string>());
+        await _jobManagementService.DidNotReceive()
+            .TriggerJobOnce(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_SyncsExistingAndCreatesNewInstanceConfigs()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+
+        // Radarr already has a config
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = false,
+            SkipTags = ["old-tag"],
+            ActiveDownloadLimit = 2,
+            MinCycleTimeDays = 5
+        });
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                // Update existing radarr config
+                new UpdateSeekerInstanceConfigRequest
+                {
+                    ArrInstanceId = radarr.Id,
+                    Enabled = true,
+                    SkipTags = ["new-tag"],
+                    ActiveDownloadLimit = 5,
+                    IgnoreStruckDownloads = true,
+                    MinCycleTimeDays = 14
+                },
+                // Create new sonarr config
+                new UpdateSeekerInstanceConfigRequest
+                {
+                    ArrInstanceId = sonarr.Id,
+                    Enabled = true,
+                    SkipTags = ["sonarr-tag"],
+                    ActiveDownloadLimit = 3,
+                    MinCycleTimeDays = 7
+                }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        var configs = await _dataContext.SeekerInstanceConfigs.ToListAsync();
+        configs.Count.ShouldBe(2);
+
+        var radarrConfig = configs.First(c => c.ArrInstanceId == radarr.Id);
+        radarrConfig.Enabled.ShouldBeTrue();
+        radarrConfig.SkipTags.ShouldContain("new-tag");
+        radarrConfig.ActiveDownloadLimit.ShouldBe(5);
+        radarrConfig.IgnoreStruckDownloads.ShouldBeTrue();
+        radarrConfig.MinCycleTimeDays.ShouldBe(14);
+
+        var sonarrConfig = configs.First(c => c.ArrInstanceId == sonarr.Id);
+        sonarrConfig.Enabled.ShouldBeTrue();
+        sonarrConfig.SkipTags.ShouldContain("sonarr-tag");
+        sonarrConfig.IgnoreStruckDownloads.ShouldBeFalse();
+    }
+
+    #endregion
+}
@@ -0,0 +1,168 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Cleanuparr.Persistence.Models.Configuration.General;
+using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+
+/// <summary>
+/// Factory for creating SQLite in-memory contexts for Seeker controller tests
+/// </summary>
+public static class SeekerTestDataFactory
+{
+    public static DataContext CreateDataContext()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<DataContext>()
+            .UseSqlite(connection)
+            .UseLowerCaseNamingConvention()
+            .UseSnakeCaseNamingConvention()
+            .Options;
+
+        var context = new DataContext(options);
+        context.Database.EnsureCreated();
+
+        SeedDefaultData(context);
+        return context;
+    }
+
+    public static EventsContext CreateEventsContext()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<EventsContext>()
+            .UseSqlite(connection)
+            .UseLowerCaseNamingConvention()
+            .UseSnakeCaseNamingConvention()
+            .Options;
+
+        var context = new EventsContext(options);
+        context.Database.EnsureCreated();
+        return context;
+    }
+
+    private static void SeedDefaultData(DataContext context)
+    {
+        context.GeneralConfigs.Add(new GeneralConfig
+        {
+            Id = Guid.NewGuid(),
+            DryRun = false,
+            IgnoredDownloads = [],
+            Log = new LoggingConfig()
+        });
+
+        context.ArrConfigs.AddRange(
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Sonarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Radarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Lidarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Readarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Whisparr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Sportarr, Instances = [], FailedImportMaxStrikes = 3 }
+        );
+
+        context.QueueCleanerConfigs.Add(new QueueCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            FailedImport = new FailedImportConfig()
+        });
+
+        context.ContentBlockerConfigs.Add(new ContentBlockerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            DeletePrivate = false,
+            Sonarr = new BlocklistSettings { Enabled = false },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false },
+            Sportarr = new BlocklistSettings { Enabled = false }
+        });
+
+        context.DownloadCleanerConfigs.Add(new DownloadCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = []
+        });
+
+        context.SeekerConfigs.Add(new SeekerConfig
+        {
+            Id = Guid.NewGuid(),
+            SearchEnabled = true,
+            ProactiveSearchEnabled = false
+        });
+
+        context.SaveChanges();
+    }
+
+    public static ArrInstance AddSonarrInstance(DataContext context, bool enabled = true)
+    {
+        var arrConfig = context.ArrConfigs.First(x => x.Type == InstanceType.Sonarr);
+        var instance = new ArrInstance
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "test-api-key",
+            Enabled = enabled,
+            ArrConfigId = arrConfig.Id,
+            ArrConfig = arrConfig
+        };
+
+        arrConfig.Instances.Add(instance);
+        context.ArrInstances.Add(instance);
+        context.SaveChanges();
+        return instance;
+    }
+
+    public static ArrInstance AddRadarrInstance(DataContext context, bool enabled = true)
+    {
+        var arrConfig = context.ArrConfigs.First(x => x.Type == InstanceType.Radarr);
+        var instance = new ArrInstance
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test Radarr",
+            Url = new Uri("http://radarr:7878"),
+            ApiKey = "test-api-key",
+            Enabled = enabled,
+            ArrConfigId = arrConfig.Id,
+            ArrConfig = arrConfig
+        };
+
+        arrConfig.Instances.Add(instance);
+        context.ArrInstances.Add(instance);
+        context.SaveChanges();
+        return instance;
+    }
+
+    public static ArrInstance AddLidarrInstance(DataContext context, bool enabled = true)
+    {
+        var arrConfig = context.ArrConfigs.First(x => x.Type == InstanceType.Lidarr);
+        var instance = new ArrInstance
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test Lidarr",
+            Url = new Uri("http://lidarr:8686"),
+            ApiKey = "test-api-key",
+            Enabled = enabled,
+            ArrConfigId = arrConfig.Id,
+            ArrConfig = arrConfig
+        };
+
+        arrConfig.Instances.Add(instance);
+        context.ArrInstances.Add(instance);
+        context.SaveChanges();
+        return instance;
+    }
+}
@@ -0,0 +1,63 @@
+using System.Text.Json;
+using Cleanuparr.Api.Json;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Json;
+
+public class InboundNullHandlingTests
+{
+    private static readonly JsonSerializerOptions Options = CreateOptions();
+
+    private static JsonSerializerOptions CreateOptions()
+    {
+        JsonSerializerOptions options = new();
+        CleanuparrJsonConfiguration.ConfigureApiInbound(options);
+        return options;
+    }
+
+    private sealed class Model
+    {
+        public List<string> Items { get; set; } = ["default"];
+
+        public string Name { get; set; } = "default-name";
+
+        public string? Optional { get; set; } = "opt";
+    }
+
+    [Fact]
+    public void ExplicitNull_OnNonNullableProperty_KeepsDefault()
+    {
+        Model result = JsonSerializer.Deserialize<Model>("""{"items": null, "name": null}""", Options)!;
+
+        result.Items.ShouldBe(["default"]);
+        result.Name.ShouldBe("default-name");
+    }
+
+    [Fact]
+    public void ExplicitNull_MatchesAbsent()
+    {
+        Model withNull = JsonSerializer.Deserialize<Model>("""{"items": null, "name": null}""", Options)!;
+        Model absent = JsonSerializer.Deserialize<Model>("{}", Options)!;
+
+        withNull.Items.ShouldBe(absent.Items);
+        withNull.Name.ShouldBe(absent.Name);
+    }
+
+    [Fact]
+    public void ExplicitNull_OnNullableProperty_SetsNull()
+    {
+        Model result = JsonSerializer.Deserialize<Model>("""{"optional": null}""", Options)!;
+
+        result.Optional.ShouldBeNull();
+    }
+
+    [Fact]
+    public void NonNullValue_StillDeserializes()
+    {
+        Model result = JsonSerializer.Deserialize<Model>("""{"items": ["a","b"], "name": "x"}""", Options)!;
+
+        result.Items.ShouldBe(["a", "b"]);
+        result.Name.ShouldBe("x");
+    }
+}
@@ -0,0 +1,115 @@
+using System.Text.Json;
+using Cleanuparr.Api.Json;
+using Cleanuparr.Domain.Entities.Arr;
+using Cleanuparr.Domain.Entities.Arr.Queue;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.DownloadRemover.Models;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Shouldly;
+using Xunit;
+
+namespace Cleanuparr.Api.Tests.Json;
+
+/// <summary>
+/// The in-memory bus serializes with these options, so a broken discriminator
+/// only shows up at runtime.
+/// </summary>
+public class RemovalRequestSerializationTests
+{
+    private static readonly JsonSerializerOptions Options = CreateOptions();
+
+    private static JsonSerializerOptions CreateOptions()
+    {
+        JsonSerializerOptions options = new();
+        CleanuparrJsonConfiguration.ConfigureCore(options);
+        return options;
+    }
+
+    private static QueueItemRemoveRequest CreateRequest(SearchItem searchItem)
+    {
+        return new QueueItemRemoveRequest
+        {
+            Instance = new ArrInstance
+            {
+                Name = "Test Instance",
+                Url = new Uri("http://sonarr.local"),
+                ApiKey = "test-api-key",
+                ArrConfig = new ArrConfig { Type = InstanceType.Sonarr },
+            },
+            Target = new ArrRemovalTarget
+            {
+                Record = new QueueRecord
+                {
+                    Id = 1,
+                    Title = "Test Record",
+                    Protocol = "torrent",
+                    DownloadId = "ABC123",
+                },
+                SearchItem = searchItem,
+                RemoveFromClient = true,
+                ChangeCategory = false,
+            },
+            DeleteReason = DeleteReason.Stalled,
+            JobRunId = Guid.NewGuid(),
+        };
+    }
+
+    private static QueueItemRemoveRequest RoundTrip(QueueItemRemoveRequest request)
+    {
+        string json = JsonSerializer.Serialize(request, Options);
+        return JsonSerializer.Deserialize<QueueItemRemoveRequest>(json, Options)!;
+    }
+
+    [Fact]
+    public void ArrTarget_SurvivesRoundTrip()
+    {
+        QueueItemRemoveRequest result = RoundTrip(CreateRequest(new SearchItem { Id = 42 }));
+
+        ArrRemovalTarget target = result.Target.ShouldBeOfType<ArrRemovalTarget>();
+        target.Record.DownloadId.ShouldBe("ABC123");
+        target.RemoveFromClient.ShouldBeTrue();
+        result.DeleteReason.ShouldBe(DeleteReason.Stalled);
+    }
+
+    [Fact]
+    public void BaseSearchItem_SurvivesRoundTrip()
+    {
+        QueueItemRemoveRequest result = RoundTrip(CreateRequest(new SearchItem { Id = 42 }));
+
+        SearchItem item = ArrTargetOf(result).SearchItem;
+        item.ShouldBeOfType<SearchItem>();
+        item.Id.ShouldBe(42);
+    }
+
+    [Fact]
+    public void SeriesSearchItem_KeepsItsDerivedType()
+    {
+        QueueItemRemoveRequest result = RoundTrip(CreateRequest(new SeriesSearchItem
+        {
+            Id = 100,
+            SeriesId = 10,
+            SearchType = SeriesSearchType.Episode,
+        }));
+
+        SeriesSearchItem item = ArrTargetOf(result).SearchItem.ShouldBeOfType<SeriesSearchItem>();
+        item.Id.ShouldBe(100);
+        item.SeriesId.ShouldBe(10);
+        item.SearchType.ShouldBe(SeriesSearchType.Episode);
+    }
+
+    [Fact]
+    public void Target_CarriesTheDiscriminator_AndOmitsDerivedMembers()
+    {
+        string json = JsonSerializer.Serialize(CreateRequest(new SearchItem { Id = 42 }), Options);
+
+        using JsonDocument document = JsonDocument.Parse(json);
+        JsonElement target = document.RootElement.GetProperty("Target");
+
+        target.GetProperty("$target").GetString().ShouldBe("arr");
+        target.TryGetProperty("DownloadId", out _).ShouldBeFalse();
+        target.TryGetProperty("Title", out _).ShouldBeFalse();
+    }
+
+    private static ArrRemovalTarget ArrTargetOf(QueueItemRemoveRequest request) =>
+        (ArrRemovalTarget)request.Target;
+}
@@ -0,0 +1,108 @@
+using Cleanuparr.Api.DependencyInjection;
+using Cleanuparr.Api.Middleware;
+using Cleanuparr.Domain.Exceptions;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Middleware;
+
+public class GlobalExceptionHandlerTests
+{
+    private static readonly ProblemDetailsFactory ProblemDetailsFactory = BuildProblemDetailsFactory();
+
+    private static ProblemDetailsFactory BuildProblemDetailsFactory()
+    {
+        ServiceCollection services = new();
+        services.AddLogging();
+        services.AddControllers();
+        services.AddCleanuparrProblemDetails();
+        return services.BuildServiceProvider().GetRequiredService<ProblemDetailsFactory>();
+    }
+
+    private static async Task<(bool handled, HttpContext context, ProblemDetails problemDetails)> Handle(Exception exception)
+    {
+        IProblemDetailsService problemDetailsService = Substitute.For<IProblemDetailsService>();
+        problemDetailsService
+            .TryWriteAsync(Arg.Any<ProblemDetailsContext>())
+            .Returns(callInfo => ValueTask.FromResult(true));
+
+        DefaultHttpContext context = new();
+        GlobalExceptionHandler handler = new(problemDetailsService, ProblemDetailsFactory, NullLogger<GlobalExceptionHandler>.Instance);
+
+        bool handled = await handler.TryHandleAsync(context, exception, CancellationToken.None);
+
+        ProblemDetailsContext captured = (ProblemDetailsContext)problemDetailsService
+            .ReceivedCalls()
+            .Single()
+            .GetArguments()[0]!;
+
+        return (handled, context, captured.ProblemDetails);
+    }
+
+    [Fact]
+    public async Task ValidationException_MapsTo400_WithMessageAsDetail()
+    {
+        (bool handled, HttpContext context, ProblemDetails problemDetails) = await Handle(new ValidationException("Name is required"));
+
+        handled.ShouldBeTrue();
+        context.Response.StatusCode.ShouldBe(StatusCodes.Status400BadRequest);
+        problemDetails.Status.ShouldBe(StatusCodes.Status400BadRequest);
+        problemDetails.Title.ShouldBe("Validation failed");
+        problemDetails.Detail.ShouldBe("Name is required");
+        problemDetails.Type.ShouldNotBeNullOrEmpty();
+        problemDetails.Extensions.ShouldContainKey("traceId");
+    }
+
+    [Fact]
+    public async Task NotificationTestException_MapsTo400()
+    {
+        (bool handled, HttpContext context, ProblemDetails problemDetails) = await Handle(new NotificationTestException("Test failed: connection refused"));
+
+        handled.ShouldBeTrue();
+        context.Response.StatusCode.ShouldBe(StatusCodes.Status400BadRequest);
+        problemDetails.Status.ShouldBe(StatusCodes.Status400BadRequest);
+        problemDetails.Title.ShouldBe("Notification test failed");
+        problemDetails.Detail.ShouldBe("Test failed: connection refused");
+    }
+
+    [Fact]
+    public async Task RateLimitException_MapsTo429_WithRetryAfterExtensionAndHeader()
+    {
+        (bool handled, HttpContext context, ProblemDetails problemDetails) = await Handle(new RateLimitException("Account is locked", 30));
+
+        handled.ShouldBeTrue();
+        context.Response.StatusCode.ShouldBe(StatusCodes.Status429TooManyRequests);
+        problemDetails.Status.ShouldBe(StatusCodes.Status429TooManyRequests);
+        problemDetails.Title.ShouldBe("Too many requests");
+        problemDetails.Extensions["retryAfterSeconds"].ShouldBe(30);
+        context.Response.Headers.RetryAfter.ToString().ShouldBe("30");
+    }
+
+    [Fact]
+    public async Task RateLimitException_WithZeroRetry_MapsTo429_WithoutRetryAfter()
+    {
+        (bool handled, HttpContext context, ProblemDetails problemDetails) = await Handle(new RateLimitException("Too many pending OIDC flows", 0));
+
+        handled.ShouldBeTrue();
+        context.Response.StatusCode.ShouldBe(StatusCodes.Status429TooManyRequests);
+        problemDetails.Extensions.ShouldNotContainKey("retryAfterSeconds");
+        context.Response.Headers.RetryAfter.ToString().ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task UnknownException_MapsTo500_WithGenericDetail_AndDoesNotLeakMessage()
+    {
+        (bool handled, HttpContext context, ProblemDetails problemDetails) = await Handle(new InvalidOperationException("internal connection string leaked"));
+
+        handled.ShouldBeTrue();
+        context.Response.StatusCode.ShouldBe(StatusCodes.Status500InternalServerError);
+        problemDetails.Status.ShouldBe(StatusCodes.Status500InternalServerError);
+        problemDetails.Detail.ShouldBe("An unexpected error occurred");
+        problemDetails.Detail.ShouldNotContain("connection string");
+    }
+}
@@ -0,0 +1,226 @@
+using System.Net;
+using Cleanuparr.Api.Middleware;
+using Microsoft.AspNetCore.Http;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Middleware;
+
+public class TrustedForwardedHeadersMiddlewareTests
+{
+    private static HttpContext NewContext(IPAddress peer, Action<HttpContext>? configure = null)
+    {
+        var ctx = new DefaultHttpContext();
+        ctx.Connection.RemoteIpAddress = peer;
+        ctx.Request.Scheme = "http";
+        ctx.Request.Host = new HostString("backend.local");
+        configure?.Invoke(ctx);
+        return ctx;
+    }
+
+    [Fact]
+    public void Untrusted_direct_peer_leaves_everything_alone()
+    {
+        var ctx = NewContext(IPAddress.Parse("203.0.113.1"), c =>
+        {
+            c.Request.Headers["X-Forwarded-For"] = "10.0.0.5";
+            c.Request.Headers["X-Forwarded-Proto"] = "https";
+            c.Request.Headers["X-Forwarded-Host"] = "spoofed.example.com";
+        });
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Parse("203.0.113.1"));
+        ctx.Request.Scheme.ShouldBe("http");
+        ctx.Request.Host.Value.ShouldBe("backend.local");
+    }
+
+    [Fact]
+    public void Local_peer_no_xff_is_a_no_op()
+    {
+        var ctx = NewContext(IPAddress.Loopback);
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Loopback);
+    }
+
+    [Fact]
+    public void Spoofed_local_xff_with_appended_attacker_promotes_attacker_ip_only()
+    {
+        var ctx = NewContext(IPAddress.Loopback, c =>
+            c.Request.Headers["X-Forwarded-For"] = "10.0.0.5, 99.99.99.99");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Parse("99.99.99.99"));
+    }
+
+    [Fact]
+    public void Single_xff_entry_from_overwrite_mode_proxy_becomes_client_ip()
+    {
+        var ctx = NewContext(IPAddress.Loopback, c => c.Request.Headers["X-Forwarded-For"] = "203.0.113.45");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Parse("203.0.113.45"));
+    }
+
+    [Fact]
+    public void Legitimate_lan_client_through_local_proxy_resolves_to_lan_ip()
+    {
+        var ctx = NewContext(IPAddress.Loopback, c => c.Request.Headers["X-Forwarded-For"] = "192.168.1.50");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Parse("192.168.1.50"));
+    }
+
+    [Fact]
+    public void Custom_trusted_network_pops_through_to_real_client()
+    {
+        var ctx = NewContext(IPAddress.Loopback, c => c.Request.Headers["X-Forwarded-For"] = "100.64.1.5, 100.64.0.7");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string> { "100.64.0.0/10" });
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Parse("100.64.1.5"));
+    }
+
+    [Fact]
+    public void Forwarded_proto_and_host_applied_when_chain_consumed()
+    {
+        var ctx = NewContext(IPAddress.Loopback, c =>
+        {
+            c.Request.Headers["X-Forwarded-For"] = "203.0.113.45";
+            c.Request.Headers["X-Forwarded-Proto"] = "https";
+            c.Request.Headers["X-Forwarded-Host"] = "cleanuparr.example.com";
+        });
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Request.Scheme.ShouldBe("https");
+        ctx.Request.Host.Value.ShouldBe("cleanuparr.example.com");
+    }
+
+    [Fact]
+    public void Forwarded_proto_not_applied_when_peer_untrusted()
+    {
+        var ctx = NewContext(IPAddress.Parse("203.0.113.1"), c => c.Request.Headers["X-Forwarded-Proto"] = "https");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Request.Scheme.ShouldBe("http");
+    }
+
+    [Fact]
+    public void X_real_ip_is_ignored()
+    {
+        var ctx = NewContext(IPAddress.Loopback, c => c.Request.Headers["X-Real-IP"] = "10.0.0.5");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Loopback);
+    }
+
+    [Fact]
+    public void Malformed_xff_entry_fails_closed()
+    {
+        var ctx = NewContext(IPAddress.Loopback, c =>
+        {
+            c.Request.Headers["X-Forwarded-For"] = "10.0.0.5, not-an-ip";
+            c.Request.Headers["X-Forwarded-Proto"] = "https";
+        });
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Loopback);
+        ctx.Request.Scheme.ShouldBe("http");
+    }
+
+    [Fact]
+    public void Empty_entries_in_xff_are_skipped()
+    {
+        // nginx with `proxy_set_header X-Forwarded-For "$http_x_forwarded_for, 1.2.3.4"`
+        // produces a leading empty entry when the input header was absent.
+        var ctx = NewContext(IPAddress.Loopback, c => c.Request.Headers["X-Forwarded-For"] = ", 99.99.99.99");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Parse("99.99.99.99"));
+    }
+
+    [Fact]
+    public void Ipv4_mapped_ipv6_loopback_is_treated_as_trusted()
+    {
+        // Kestrel may surface "::ffff:127.0.0.1" as the peer.
+        var mapped = IPAddress.Parse("::ffff:127.0.0.1");
+        var ctx = NewContext(mapped, c => c.Request.Headers["X-Forwarded-For"] = "203.0.113.45");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Parse("203.0.113.45"));
+    }
+
+    [Fact]
+    public void Forwarded_proto_with_multiple_values_uses_only_first_token()
+    {
+        // Chained proxies that append (rather than overwrite) X-Forwarded-Proto
+        // produce comma-separated values like "https, http". Only the leftmost
+        // hop's value should be applied — matching how XFF is handled.
+        var ctx = NewContext(IPAddress.Loopback, c =>
+        {
+            c.Request.Headers["X-Forwarded-For"] = "203.0.113.45";
+            c.Request.Headers["X-Forwarded-Proto"] = "https, http";
+        });
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Request.Scheme.ShouldBe("https");
+    }
+
+    [Fact]
+    public void Forwarded_proto_with_unknown_scheme_is_ignored()
+    {
+        // Anything outside the http/https allowlist is dropped to keep
+        // arbitrary values (e.g. "javascript:") from flowing into URLs.
+        var ctx = NewContext(IPAddress.Loopback, c =>
+        {
+            c.Request.Headers["X-Forwarded-For"] = "203.0.113.45";
+            c.Request.Headers["X-Forwarded-Proto"] = "javascript:";
+        });
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Request.Scheme.ShouldBe("http");
+    }
+
+    [Fact]
+    public void Forwarded_host_with_multiple_values_uses_only_first_token()
+    {
+        // Same multi-hop concern as X-Forwarded-Proto — the host string must
+        // not end up as "a.example, b.example".
+        var ctx = NewContext(IPAddress.Loopback, c =>
+        {
+            c.Request.Headers["X-Forwarded-For"] = "203.0.113.45";
+            c.Request.Headers["X-Forwarded-Host"] = "cleanuparr.example.com, attacker.example.com";
+        });
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Request.Host.Value.ShouldBe("cleanuparr.example.com");
+    }
+
+    [Fact]
+    public void Malformed_entry_mid_chain_does_not_partially_mutate_remote_ip()
+    {
+        // Walk right-to-left: 10.0.0.5 (trusted) is popped first, then
+        // "not-an-ip" fails. The pre-fix middleware committed mutation eagerly,
+        // leaving RemoteIpAddress = 10.0.0.5. Fix: validate-then-commit, so the
+        // original peer is preserved when any chain entry is malformed.
+        var ctx = NewContext(IPAddress.Loopback, c =>
+            c.Request.Headers["X-Forwarded-For"] = "not-an-ip, 10.0.0.5");
+
+        TrustedForwardedHeadersMiddleware.ApplyForwardedHeaders(ctx, new List<string>());
+
+        ctx.Connection.RemoteIpAddress.ShouldBe(IPAddress.Loopback);
+    }
+}
@@ -0,0 +1,140 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Cleanuparr.Persistence.Models.Configuration.General;
+using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using NSubstitute;
+
+namespace Cleanuparr.Api.Tests.TestHelpers;
+
+/// <summary>
+/// Shared SQLite in-memory factory for controller tests that need a populated DataContext.
+/// Seeds one row per config table so first-or-default reads succeed.
+/// </summary>
+public static class ConfigControllerTestDataFactory
+{
+    public static DataContext CreateDataContext()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<DataContext>()
+            .UseSqlite(connection)
+            .UseLowerCaseNamingConvention()
+            .UseSnakeCaseNamingConvention()
+            .Options;
+
+        var context = new DataContext(options);
+        context.Database.EnsureCreated();
+
+        SeedDefaults(context);
+        return context;
+    }
+
+    public static EventsContext CreateEventsContext()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<EventsContext>()
+            .UseSqlite(connection)
+            .UseLowerCaseNamingConvention()
+            .UseSnakeCaseNamingConvention()
+            .Options;
+
+        var context = new EventsContext(options);
+        context.Database.EnsureCreated();
+        return context;
+    }
+
+    public static void ConfigureProblemDetails(ControllerBase controller)
+    {
+        ProblemDetailsFactory factory = Substitute.For<ProblemDetailsFactory>();
+        factory
+            .CreateProblemDetails(
+                Arg.Any<HttpContext>(),
+                Arg.Any<int?>(),
+                Arg.Any<string?>(),
+                Arg.Any<string?>(),
+                Arg.Any<string?>(),
+                Arg.Any<string?>())
+            .Returns(call => new ProblemDetails
+            {
+                Status = call.ArgAt<int?>(1),
+                Title = call.ArgAt<string?>(2),
+                Detail = call.ArgAt<string?>(4),
+            });
+
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext(),
+        };
+        controller.ProblemDetailsFactory = factory;
+    }
+
+    private static void SeedDefaults(DataContext context)
+    {
+        context.GeneralConfigs.Add(new GeneralConfig
+        {
+            Id = Guid.NewGuid(),
+            DryRun = false,
+            IgnoredDownloads = [],
+            Log = new LoggingConfig(),
+        });
+
+        context.ArrConfigs.AddRange(
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Sonarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Radarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Lidarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Readarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Whisparr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Sportarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.LazyLibrarian, Instances = [], FailedImportMaxStrikes = 3 }
+        );
+
+        context.QueueCleanerConfigs.Add(new QueueCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            FailedImport = new FailedImportConfig(),
+        });
+
+        context.ContentBlockerConfigs.Add(new ContentBlockerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            DeletePrivate = false,
+            Sonarr = new BlocklistSettings { Enabled = false },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false },
+            Sportarr = new BlocklistSettings { Enabled = false },
+            LazyLibrarian = new BlocklistSettings { Enabled = false },
+        });
+
+        context.DownloadCleanerConfigs.Add(new DownloadCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+        });
+
+        context.BlacklistSyncConfigs.Add(new BlacklistSyncConfig
+        {
+            Id = Guid.NewGuid(),
+            Enabled = false,
+            CronExpression = "0 0 * * * ?",
+        });
+
+        context.SaveChanges();
+    }
+}
@@ -0,0 +1,35 @@
+using Cleanuparr.Api.DependencyInjection;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Cleanuparr.Api.Tests.TestHelpers;
+
+/// <summary>
+/// Attaches a minimal MVC <see cref="ControllerContext"/> (with a real <see cref="ProblemDetailsFactory"/>
+/// and <see cref="HttpContext"/>) to a directly-instantiated controller so that
+/// <c>this.ProblemResult(...)</c> can build problem-details responses in unit tests.
+/// </summary>
+public static class ControllerTestContext
+{
+    private static readonly IServiceProvider Services = BuildServices();
+
+    private static IServiceProvider BuildServices()
+    {
+        ServiceCollection services = new();
+        services.AddLogging();
+        services.AddControllers();
+        services.AddCleanuparrProblemDetails();
+        return services.BuildServiceProvider();
+    }
+
+    public static void Attach(ControllerBase controller)
+    {
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { RequestServices = Services },
+        };
+        controller.ProblemDetailsFactory = Services.GetRequiredService<ProblemDetailsFactory>();
+    }
+}
@@ -16,19 +16,22 @@ public static class TrustedNetworkAuthenticationDefaults

 public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
 {
+    private readonly DataContext _dataContext;
+    
    public TrustedNetworkAuthenticationHandler(
        IOptionsMonitor<AuthenticationSchemeOptions> options,
        ILoggerFactory logger,
-        UrlEncoder encoder)
+        UrlEncoder encoder,
+        DataContext dataContext)
        : base(options, logger, encoder)
    {
+        _dataContext = dataContext;
    }

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        // Load auth config from database
-        await using var dataContext = DataContext.CreateStaticInstance();
-        var config = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+        var config = await _dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();

        if (config is null || !config.Auth.DisableAuthForLocalAddresses)
        {
@@ -36,7 +39,7 @@ public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<Authent
        }

        // Determine client IP
-        var clientIp = GetClientIp(config.Auth.TrustForwardedHeaders);
+        var clientIp = ResolveClientIp(Context);
        if (clientIp is null)
        {
            return AuthenticateResult.NoResult();
@@ -73,42 +76,13 @@ public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<Authent
        return AuthenticateResult.Success(ticket);
    }

-    private IPAddress? GetClientIp(bool trustForwardedHeaders) =>
-        ResolveClientIp(Context, trustForwardedHeaders);
-
-    public static IPAddress? ResolveClientIp(HttpContext httpContext, bool trustForwardedHeaders)
-    {
-        var remoteIp = httpContext.Connection.RemoteIpAddress;
-        if (remoteIp is null)
-        {
-            return null;
-        }
-
-        // Only trust forwarded headers if the direct connection is from a local address
-        if (trustForwardedHeaders && remoteIp.IsLocalAddress())
-        {
-            // Check X-Forwarded-For first, then X-Real-IP
-            var forwardedFor = httpContext.Request.Headers["X-Forwarded-For"].FirstOrDefault();
-            if (!string.IsNullOrEmpty(forwardedFor))
-            {
-                // X-Forwarded-For can contain multiple IPs: client, proxy1, proxy2
-                // The first one is the original client
-                var firstIp = forwardedFor.Split(',')[0].Trim();
-                if (IPAddress.TryParse(firstIp, out var parsedIp))
-                {
-                    return parsedIp;
-                }
-            }
-
-            var realIp = httpContext.Request.Headers["X-Real-IP"].FirstOrDefault();
-            if (!string.IsNullOrEmpty(realIp) && IPAddress.TryParse(realIp, out var realParsedIp))
-            {
-                return realParsedIp;
-            }
-        }
-
-        return remoteIp;
-    }
+    /// <summary>
+    /// Returns the connection's remote IP address. Callers must run <see cref="Cleanuparr.Api.Middleware.TrustedForwardedHeadersMiddleware"/>
+    /// earlier in the pipeline so that <c>X-Forwarded-*</c> headers from trusted proxy chains have already been resolved into <c>Connection.RemoteIpAddress</c>.
+    /// </summary>
+    /// <param name="httpContext">The current HTTP context.</param>
+    /// <returns>The resolved client IP, or <c>null</c> when unavailable.</returns>
+    public static IPAddress? ResolveClientIp(HttpContext httpContext) => httpContext.Connection.RemoteIpAddress;

    public static bool IsTrustedAddress(IPAddress clientIp, List<string> trustedNetworks)
    {
@@ -7,6 +7,8 @@
        <Nullable>enable</Nullable>
        <ImplicitUsings>enable</ImplicitUsings>
        <PublishReadyToRun>true</PublishReadyToRun>
+        <ServerGarbageCollection>false</ServerGarbageCollection>
+        <ConcurrentGarbageCollection>true</ConcurrentGarbageCollection>
        <EnableMacOSCodeSign>false</EnableMacOSCodeSign>
        <CodeSignOnCopy>false</CodeSignOnCopy>
        <_CodeSignDuringBuild>false</_CodeSignDuringBuild>
@@ -20,6 +22,8 @@

    <ItemGroup>
      <ProjectReference Include="..\Cleanuparr.Infrastructure\Cleanuparr.Infrastructure.csproj" />
+      <ProjectReference Include="..\Cleanuparr.Persistence.Sqlite\Cleanuparr.Persistence.Sqlite.csproj" />
+      <ProjectReference Include="..\Cleanuparr.Persistence.Postgres\Cleanuparr.Persistence.Postgres.csproj" />
    </ItemGroup>

    <ItemGroup>
@@ -0,0 +1,47 @@
+using Cleanuparr.Infrastructure.Features.DatabaseMigration;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.Extensions.Configuration;
+
+namespace Cleanuparr.Api.Commands;
+
+public static class MigrateToPostgresCommand
+{
+    public const string Name = "migrate-to-postgres";
+    public const string ForceFlag = "--force";
+
+    public static bool Matches(string[] args) => args.Length > 0 && args[0] == Name;
+
+    public static async Task<int> RunAsync(string[] args)
+    {
+        IConfiguration configuration = new ConfigurationBuilder()
+            .AddJsonFile(ConfigurationPathProvider.GetConfigFilePath(), optional: true)
+            .AddEnvironmentVariables()
+            .Build();
+        DatabaseConfigProvider.Initialize(configuration);
+
+        bool force = args.Contains(ForceFlag);
+        SqliteToPostgresMigrator migrator = new();
+        MigrationResult result = await migrator.RunAsync(force, new ConsoleProgress(), CancellationToken.None);
+
+        if (!result.Success)
+        {
+            Console.Error.WriteLine($"Migration failed: {result.Error}");
+            return 1;
+        }
+
+        Console.WriteLine("Migration complete. Row counts:");
+        foreach (KeyValuePair<string, int> entry in result.TableCounts.OrderBy(pair => pair.Key))
+        {
+            Console.WriteLine($"  {entry.Key}: {entry.Value}");
+        }
+
+        Console.WriteLine("Set DATABASE_PROVIDER=postgres and restart Cleanuparr to run on PostgreSQL.");
+        Console.WriteLine("(Your SQLite databases were upgraded to the current schema in place; their data was preserved.)");
+        return 0;
+    }
+
+    private sealed class ConsoleProgress : IProgress<string>
+    {
+        public void Report(string value) => Console.WriteLine($"  {value}");
+    }
+}
@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Common;
+
+public static class TimelineWindow
+{
+    public const int MinHours = 1;
+
+    public const int MaxHours = 8760;
+
+    public static int ClampHours(int hours) => Math.Clamp(hours, MinHours, MaxHours);
+}
@@ -0,0 +1,22 @@
+using System.Text.Json.Serialization;
+
+namespace Cleanuparr.Api.Contracts.Responses;
+
+public class PaginatedResult<T>
+{
+    public List<T> Items { get; set; } = new();
+
+    public int Page { get; set; }
+
+    public int PageSize { get; set; }
+
+    public int TotalCount { get; set; }
+
+    public int TotalPages { get; set; }
+
+    [JsonIgnore]
+    public bool HasPrevious => Page > 1;
+
+    [JsonIgnore]
+    public bool HasNext => Page < TotalPages;
+}
@@ -1,7 +1,11 @@
-using System.Text.Json.Serialization;
+using Cleanuparr.Api.Common;
+using Cleanuparr.Api.Contracts.Responses;
+using Cleanuparr.Api.Features.Events.Contracts.Responses;
 using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Stats;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
+using Cleanuparr.Persistence.Providers;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
@@ -14,23 +18,25 @@ namespace Cleanuparr.Api.Controllers;
 public class EventsController : ControllerBase
 {
    private readonly EventsContext _context;
+    private readonly IDatabaseProvider _databaseProvider;

-    public EventsController(EventsContext context)
+    public EventsController(EventsContext context, IDatabaseProvider databaseProvider)
    {
        _context = context;
+        _databaseProvider = databaseProvider;
    }

    /// <summary>
    /// Gets events with pagination and filtering
    /// </summary>
    [HttpGet]
-    public async Task<ActionResult<PaginatedResult<AppEvent>>> GetEvents(
+    public async Task<ActionResult<PaginatedResult<EventListItem>>> GetEvents(
        [FromQuery] int page = 1,
-        [FromQuery] int pageSize = 100,
+        [FromQuery] int pageSize = 50,
        [FromQuery] string? severity = null,
        [FromQuery] string? eventType = null,
-        [FromQuery] DateTime? fromDate = null,
-        [FromQuery] DateTime? toDate = null,
+        [FromQuery] DateTimeOffset? fromDate = null,
+        [FromQuery] DateTimeOffset? toDate = null,
        [FromQuery] string? search = null,
        [FromQuery] string? jobRunId = null)
    {
@@ -42,42 +48,47 @@ public class EventsController : ControllerBase

        if (pageSize < 1)
        {
-            pageSize = 100;
+            pageSize = 50;
        }
-        
-        if (pageSize > 1000)
+
+        if (pageSize > 500)
        {
-            pageSize = 1000; // Cap at 1000 for performance
+            pageSize = 500;
        }
-        
-        var query = _context.Events.AsQueryable();
+
+        IQueryable<EventListItem> query = _context.Events
+            .Select(EventListItem.FromEvent);

        // Apply filters
        if (!string.IsNullOrWhiteSpace(severity))
        {
-            if (Enum.TryParse<EventSeverity>(severity, true, out var severityEnum))
+            if (EnumSentinel.TryParseSelectable(severity, out EventSeverity severityEnum))
+            {
                query = query.Where(e => e.Severity == severityEnum);
+            }
        }

        if (!string.IsNullOrWhiteSpace(eventType))
        {
-            if (Enum.TryParse<EventType>(eventType, true, out var eventTypeEnum))
+            if (EnumSentinel.TryParseSelectable(eventType, out EventType eventTypeEnum))
+            {
                query = query.Where(e => e.EventType == eventTypeEnum);
+            }
        }
-        
+
        // Apply date range filters
        if (fromDate.HasValue)
        {
            query = query.Where(e => e.Timestamp >= fromDate.Value);
        }
-        
+
        if (toDate.HasValue)
        {
            query = query.Where(e => e.Timestamp <= toDate.Value);
        }

        // Apply job run ID exact-match filter
-        if (!string.IsNullOrWhiteSpace(jobRunId) && Guid.TryParse(jobRunId, out var jobRunGuid))
+        if (!string.IsNullOrWhiteSpace(jobRunId) && Guid.TryParse(jobRunId, out Guid jobRunGuid))
        {
            query = query.Where(e => e.JobRunId == jobRunGuid);
        }
@@ -87,31 +98,29 @@ public class EventsController : ControllerBase
        {
            string pattern = EventsContext.GetLikePattern(search);
            query = query.Where(e =>
-                EF.Functions.Like(e.Message, pattern) ||
-                EF.Functions.Like(e.Data, pattern) ||
-                EF.Functions.Like(e.TrackingId.ToString(), pattern) ||
-                EF.Functions.Like(e.InstanceUrl, pattern) ||
-                EF.Functions.Like(e.DownloadClientName, pattern) ||
-                EF.Functions.Like(e.JobRunId.ToString(), pattern)
+                EF.Functions.Like(e.Message.ToLower(), pattern, "\\") ||
+                (e.ItemTitle != null && EF.Functions.Like(e.ItemTitle.ToLower(), pattern, "\\")) ||
+                EF.Functions.Like(e.TrackingId.ToString().ToLower(), pattern, "\\") ||
+                EF.Functions.Like(e.JobRunId.ToString().ToLower(), pattern, "\\")
            );
        }

        // Count total matching records for pagination
-        var totalCount = await query.CountAsync();
-        
+        int totalCount = await query.CountAsync();
+
        // Calculate pagination
-        var totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);
-        var skip = (page - 1) * pageSize;
-        
-        // Get paginated data
-        var events = await query
+        int totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);
+        int skip = (page - 1) * pageSize;
+
+        List<EventListItem> events = await query
            .OrderByDescending(e => e.Timestamp)
+            .ThenByDescending(e => e.Id)
            .Skip(skip)
            .Take(pageSize)
            .ToListAsync();

        // Return paginated result
-        var result = new PaginatedResult<AppEvent>
+        PaginatedResult<EventListItem> result = new()
        {
            Items = events,
            Page = page,
@@ -119,7 +128,7 @@ public class EventsController : ControllerBase
            TotalCount = totalCount,
            TotalPages = totalPages
        };
-        
+
        return Ok(result);
    }

@@ -130,7 +139,7 @@ public class EventsController : ControllerBase
    public async Task<ActionResult<AppEvent>> GetEvent(Guid id)
    {
        var eventEntity = await _context.Events.FindAsync(id);
-        
+
        if (eventEntity == null)
            return NotFound();

@@ -151,29 +160,13 @@ public class EventsController : ControllerBase
        return Ok(events);
    }

-    /// <summary>
-    /// Manually triggers cleanup of old events
-    /// </summary>
-    [HttpPost("cleanup")]
-    public async Task<ActionResult<object>> CleanupOldEvents([FromQuery] int retentionDays = 30)
-    {
-        var cutoffDate = DateTime.UtcNow.AddDays(-retentionDays);
-        
-        await _context.Events
-            .Where(e => e.Timestamp < cutoffDate)
-            .ExecuteDeleteAsync();
-        
-        return Ok();
-    }
-
    /// <summary>
    /// Gets unique event types
    /// </summary>
    [HttpGet("types")]
    public async Task<ActionResult<List<string>>> GetEventTypes()
    {
-        var types = Enum.GetNames(typeof(EventType)).ToList();
-        return Ok(types);
+        return Ok(EnumSentinel.SelectableNames<EventType>());
    }

    /// <summary>
@@ -182,51 +175,75 @@ public class EventsController : ControllerBase
    [HttpGet("severities")]
    public async Task<ActionResult<List<string>>> GetSeverities()
    {
-        var severities = Enum.GetNames(typeof(EventSeverity)).ToList();
-        return Ok(severities);
+        return Ok(EnumSentinel.SelectableNames<EventSeverity>());
    }
-} 

-/// <summary>
-/// Represents a paginated result set
-/// </summary>
-/// <typeparam name="T">Type of items in the result</typeparam>
-public class PaginatedResult<T>
-{
-    /// <summary>
-    /// The items in the current page
-    /// </summary>
-    public List<T> Items { get; set; } = new();
-    
-    /// <summary>
-    /// Current page number (1-based)
-    /// </summary>
-    public int Page { get; set; }
-    
-    /// <summary>
-    /// Number of items per page
-    /// </summary>
-    public int PageSize { get; set; }
-    
-    /// <summary>
-    /// Total number of items across all pages
-    /// </summary>
-    public int TotalCount { get; set; }
-    
-    /// <summary>
-    /// Total number of pages
-    /// </summary>
-    public int TotalPages { get; set; }
-    
-    /// <summary>
-    /// Whether there is a previous page
-    /// </summary>
-    [JsonIgnore]
-    public bool HasPrevious => Page > 1;
-    
-    /// <summary>
-    /// Whether there is a next page
-    /// </summary>
-    [JsonIgnore]
-    public bool HasNext => Page < TotalPages;
-}
+    [HttpGet("timeline")]
+    public async Task<ActionResult<EventTypeTimelineResponse>> GetTimeline([FromQuery] int hours = 720)
+    {
+        hours = TimelineWindow.ClampHours(hours);
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+        DateTimeOffset cutoff = now.AddHours(-hours);
+        TimelineBucketSize size = TimelineBucketing.DefaultFor(hours);
+
+        string bucketExpr = _databaseProvider.GetTimelineBucketExpr(size);
+        string? schema = _databaseProvider.GetSchema(DbContextKind.Events);
+        string eventsTable = schema is null ? "events" : $"{schema}.events";
+        List<BucketTypeCount> rows = await _context.Database
+            .SqlQueryRaw<BucketTypeCount>(
+                $$"""
+                SELECT {{bucketExpr}} AS "bucket", event_type AS "event_type", COUNT(*) AS "count"
+                FROM {{eventsTable}}
+                WHERE "timestamp" >= {0}
+                GROUP BY {{bucketExpr}}, event_type
+                """,
+                cutoff)
+            .ToListAsync();
+
+        Dictionary<(DateTimeOffset Bucket, EventType Type), int> byBucketType = new();
+        HashSet<EventType> presentSet = [];
+        foreach (BucketTypeCount row in rows)
+        {
+            DateTimeOffset bucket = TimelineBucketing.ParseKey(row.Bucket, size);
+            // Raw SQL skips the value converters, so mirror what they do with unknown text.
+            EventType type = EnumSentinel.ParseOrUnknown<EventType>(row.EventType);
+            // Several unrecognised types read as one.
+            // Their rows have to add up.
+            byBucketType.TryGetValue((bucket, type), out int running);
+            byBucketType[(bucket, type)] = running + row.Count;
+            presentSet.Add(type);
+        }
+
+        List<EventType> presentTypes = presentSet
+            .OrderBy(t => (int)t)
+            .ToList();
+
+        List<EventTypeTimelineBucket> buckets = [];
+        foreach (DateTimeOffset bucket in TimelineBucketing.Buckets(cutoff, now, size))
+        {
+            Dictionary<string, int> counts = new();
+            foreach (EventType type in presentTypes)
+            {
+                if (byBucketType.TryGetValue((bucket, type), out int count) && count > 0)
+                {
+                    counts[type.ToString()] = count;
+                }
+            }
+
+            buckets.Add(new EventTypeTimelineBucket { Date = bucket, Counts = counts });
+        }
+
+        return Ok(new EventTypeTimelineResponse
+        {
+            Types = presentTypes.Select(t => t.ToString()).ToList(),
+            Buckets = buckets,
+        });
+    }
+
+    private sealed class BucketTypeCount
+    {
+        public string Bucket { get; set; } = string.Empty;
+        public string EventType { get; set; } = string.Empty;
+        public int Count { get; set; }
+    }
+}
@@ -1,3 +1,4 @@
+using Cleanuparr.Api.Extensions;
 using Cleanuparr.Infrastructure.Health;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -12,17 +13,13 @@ namespace Cleanuparr.Api.Controllers;
 [Authorize]
 public class HealthCheckController : ControllerBase
 {
-    private readonly ILogger<HealthCheckController> _logger;
    private readonly IHealthCheckService _healthCheckService;

    /// <summary>
    /// Initializes a new instance of the <see cref="HealthCheckController"/> class
    /// </summary>
-    public HealthCheckController(
-        ILogger<HealthCheckController> logger,
-        IHealthCheckService healthCheckService)
+    public HealthCheckController(IHealthCheckService healthCheckService)
    {
-        _logger = logger;
        _healthCheckService = healthCheckService;
    }

@@ -32,16 +29,8 @@ public class HealthCheckController : ControllerBase
    [HttpGet]
    public IActionResult GetAllHealth()
    {
-        try
-        {
-            var healthStatuses = _healthCheckService.GetAllClientHealth();
-            return Ok(healthStatuses);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error retrieving client health statuses");
-            return StatusCode(500, new { Error = "An error occurred while retrieving client health statuses" });
-        }
+        var healthStatuses = _healthCheckService.GetAllClientHealth();
+        return Ok(healthStatuses);
    }

    /// <summary>
@@ -50,21 +39,13 @@ public class HealthCheckController : ControllerBase
    [HttpGet("{id:guid}")]
    public IActionResult GetClientHealth(Guid id)
    {
-        try
+        var healthStatus = _healthCheckService.GetClientHealth(id);
+        if (healthStatus == null)
        {
-            var healthStatus = _healthCheckService.GetClientHealth(id);
-            if (healthStatus == null)
-            {
-                return NotFound(new { Message = $"Health status for client with ID '{id}' not found" });
-            }
+            return this.ProblemResult(StatusCodes.Status404NotFound, $"Health status for client with ID '{id}' not found");
+        }

-            return Ok(healthStatus);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error retrieving health status for client {id}", id);
-            return StatusCode(500, new { Error = "An error occurred while retrieving the client health status" });
-        }
+        return Ok(healthStatus);
    }

    /// <summary>
@@ -73,16 +54,8 @@ public class HealthCheckController : ControllerBase
    [HttpPost("check")]
    public async Task<IActionResult> CheckAllHealth()
    {
-        try
-        {
-            var results = await _healthCheckService.CheckAllClientsHealthAsync();
-            return Ok(results);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error checking health for all clients");
-            return StatusCode(500, new { Error = "An error occurred while checking client health" });
-        }
+        var results = await _healthCheckService.CheckAllClientsHealthAsync();
+        return Ok(results);
    }

    /// <summary>
@@ -91,15 +64,7 @@ public class HealthCheckController : ControllerBase
    [HttpPost("check/{id:guid}")]
    public async Task<IActionResult> CheckClientHealth(Guid id)
    {
-        try
-        {
-            var result = await _healthCheckService.CheckClientHealthAsync(id);
-            return Ok(result);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error checking health for client {id}", id);
-            return StatusCode(500, new { Error = "An error occurred while checking client health" });
-        }
+        var result = await _healthCheckService.CheckClientHealthAsync(id);
+        return Ok(result);
    }
 }
@@ -36,13 +36,13 @@ public class HealthController : ControllerBase
                registration => registration.Tags.Contains("liveness"));
            
            return result.Status == HealthStatus.Healthy 
-                ? Ok(new { status = "healthy", timestamp = DateTime.UtcNow })
-                : StatusCode(503, new { status = "unhealthy", timestamp = DateTime.UtcNow });
+                ? Ok(new { status = "healthy", timestamp = DateTimeOffset.UtcNow })
+                : StatusCode(503, new { status = "unhealthy", timestamp = DateTimeOffset.UtcNow });
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Health check failed");
-            return StatusCode(503, new { status = "unhealthy", error = "Health check failed", timestamp = DateTime.UtcNow });
+            return StatusCode(503, new { status = "unhealthy", error = "Health check failed", timestamp = DateTimeOffset.UtcNow });
        }
    }

@@ -62,13 +62,13 @@ public class HealthController : ControllerBase
            
            if (result.Status == HealthStatus.Healthy)
            {
-                return Ok(new { status = "ready", timestamp = DateTime.UtcNow });
+                return Ok(new { status = "ready", timestamp = DateTimeOffset.UtcNow });
            }
            
            // For readiness, we consider degraded as not ready
            return StatusCode(503, new { 
                status = "not_ready", 
-                timestamp = DateTime.UtcNow,
+                timestamp = DateTimeOffset.UtcNow,
                details = result.Entries.Where(e => e.Value.Status != HealthStatus.Healthy)
                    .ToDictionary(e => e.Key, e => new { 
                        status = e.Value.Status.ToString().ToLowerInvariant(),
@@ -79,7 +79,7 @@ public class HealthController : ControllerBase
        catch (Exception ex)
        {
            _logger.LogError(ex, "Readiness check failed");
-            return StatusCode(503, new { status = "not_ready", error = "Readiness check failed", timestamp = DateTime.UtcNow });
+            return StatusCode(503, new { status = "not_ready", error = "Readiness check failed", timestamp = DateTimeOffset.UtcNow });
        }
    }

@@ -97,7 +97,7 @@ public class HealthController : ControllerBase
            var response = new
            {
                status = result.Status.ToString().ToLowerInvariant(),
-                timestamp = DateTime.UtcNow,
+                timestamp = DateTimeOffset.UtcNow,
                totalDuration = result.TotalDuration.TotalMilliseconds,
                entries = result.Entries.ToDictionary(
                    e => e.Key,
@@ -122,7 +122,7 @@ public class HealthController : ControllerBase
            return StatusCode(503, new { 
                status = "unhealthy", 
                error = "Detailed health check failed", 
-                timestamp = DateTime.UtcNow 
+                timestamp = DateTimeOffset.UtcNow 
            });
        }
    }
@@ -1,3 +1,4 @@
+using Cleanuparr.Api.Extensions;
 using Cleanuparr.Api.Models;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Models;
@@ -13,114 +14,89 @@ namespace Cleanuparr.Api.Controllers;
 public class JobsController : ControllerBase
 {
    private readonly IJobManagementService _jobManagementService;
-    private readonly ILogger<JobsController> _logger;

-    public JobsController(IJobManagementService jobManagementService, ILogger<JobsController> logger)
+    public JobsController(IJobManagementService jobManagementService)
    {
        _jobManagementService = jobManagementService;
-        _logger = logger;
    }

    [HttpGet]
    public async Task<IActionResult> GetAllJobs()
    {
-        try
-        {
-            var result = await _jobManagementService.GetAllJobs();
-            return Ok(result);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error getting all jobs");
-            return StatusCode(500, "An error occurred while retrieving jobs");
-        }
+        var result = await _jobManagementService.GetAllJobs();
+        return Ok(result);
    }

    [HttpGet("{jobType}")]
    public async Task<IActionResult> GetJob(JobType jobType)
    {
-        try
+        var jobInfo = await _jobManagementService.GetJob(jobType);
+
+        if (jobInfo.Status == "Not Found")
        {
-            var jobInfo = await _jobManagementService.GetJob(jobType);
-            
-            if (jobInfo.Status == "Not Found")
-            {
-                return NotFound($"Job '{jobType}' not found");
-            }
-            return Ok(jobInfo);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error getting job {jobType}", jobType);
-            return StatusCode(500, $"An error occurred while retrieving job '{jobType}'");
+            return this.ProblemResult(StatusCodes.Status404NotFound, $"Job '{jobType}' not found");
        }
+        return Ok(jobInfo);
    }

    [HttpPost("{jobType}/start")]
-    public async Task<IActionResult> StartJob(JobType jobType, [FromBody] ScheduleRequest scheduleRequest = null)
+    public async Task<IActionResult> StartJob(JobType jobType, [FromBody] ScheduleRequest scheduleRequest)
    {
-        try
+        if (jobType == JobType.Seeker)
        {
-            // Get the schedule from the request body if provided
-            JobSchedule jobSchedule = scheduleRequest.Schedule;
-            
-            var result = await _jobManagementService.StartJob(jobType, jobSchedule);
-            
-            if (!result)
-            {
-                return BadRequest($"Failed to start job '{jobType}'");
-            }
-            return Ok(new { Message = $"Job '{jobType}' started successfully" });
+            return this.ProblemResult(StatusCodes.Status400BadRequest, "The Seeker job cannot be manually controlled");
        }
-        catch (Exception ex)
+
+        if (scheduleRequest?.Schedule is null)
        {
-            _logger.LogError(ex, "Error starting job {jobType}", jobType);
-            return StatusCode(500, $"An error occurred while starting job '{jobType}'");
+            return this.ProblemResult(StatusCodes.Status400BadRequest, "Schedule is required");
        }
+
+        var result = await _jobManagementService.StartJob(jobType, scheduleRequest.Schedule);
+
+        if (!result)
+        {
+            return this.ProblemResult(StatusCodes.Status400BadRequest, $"Failed to start job '{jobType}'");
+        }
+        return Ok(new { Message = $"Job '{jobType}' started successfully" });
    }

    [HttpPost("{jobType}/trigger")]
    public async Task<IActionResult> TriggerJob(JobType jobType)
    {
-        try
+        if (jobType == JobType.Seeker)
        {
-            var result = await _jobManagementService.TriggerJobOnce(jobType);
-            
-            if (!result)
-            {
-                return BadRequest($"Failed to trigger job '{jobType}' - job may not exist or be configured");
-            }
-            return Ok(new { Message = $"Job '{jobType}' triggered successfully for one-time execution" });
+            return this.ProblemResult(StatusCodes.Status400BadRequest, "The Seeker job cannot be manually triggered");
        }
-        catch (Exception ex)
+
+        var result = await _jobManagementService.TriggerJobOnce(jobType);
+
+        if (!result)
        {
-            _logger.LogError(ex, "Error triggering job {jobType}", jobType);
-            return StatusCode(500, $"An error occurred while triggering job '{jobType}'");
+            return this.ProblemResult(StatusCodes.Status400BadRequest, $"Failed to trigger job '{jobType}' - job may not exist or be configured");
        }
+        return Ok(new { Message = $"Job '{jobType}' triggered successfully for one-time execution" });
    }

    [HttpPut("{jobType}/schedule")]
    public async Task<IActionResult> UpdateJobSchedule(JobType jobType, [FromBody] ScheduleRequest scheduleRequest)
    {
-        if (scheduleRequest?.Schedule == null)
+        if (jobType == JobType.Seeker)
        {
-            return BadRequest("Schedule is required");
+            return this.ProblemResult(StatusCodes.Status400BadRequest, "The Seeker job schedule cannot be manually modified");
        }

-        try
+        if (scheduleRequest?.Schedule == null)
        {
-            var result = await _jobManagementService.UpdateJobSchedule(jobType, scheduleRequest.Schedule);
-            
-            if (!result)
-            {
-                return BadRequest($"Failed to update schedule for job '{jobType}'");
-            }
-            return Ok(new { Message = $"Job '{jobType}' schedule updated successfully" });
+            return this.ProblemResult(StatusCodes.Status400BadRequest, "Schedule is required");
        }
-        catch (Exception ex)
+
+        var result = await _jobManagementService.UpdateJobSchedule(jobType, scheduleRequest.Schedule);
+
+        if (!result)
        {
-            _logger.LogError(ex, "Error updating job {jobType} schedule", jobType);
-            return StatusCode(500, $"An error occurred while updating schedule for job '{jobType}'");
+            return this.ProblemResult(StatusCodes.Status400BadRequest, $"Failed to update schedule for job '{jobType}'");
        }
+        return Ok(new { Message = $"Job '{jobType}' schedule updated successfully" });
    }
 }
@@ -1,3 +1,4 @@
+using Cleanuparr.Api.Contracts.Responses;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
@@ -25,17 +26,28 @@ public class ManualEventsController : ControllerBase
    [HttpGet]
    public async Task<ActionResult<PaginatedResult<ManualEvent>>> GetManualEvents(
        [FromQuery] int page = 1,
-        [FromQuery] int pageSize = 100,
+        [FromQuery] int pageSize = 50,
        [FromQuery] bool? isResolved = null,
        [FromQuery] string? severity = null,
-        [FromQuery] DateTime? fromDate = null,
-        [FromQuery] DateTime? toDate = null,
+        [FromQuery] DateTimeOffset? fromDate = null,
+        [FromQuery] DateTimeOffset? toDate = null,
        [FromQuery] string? search = null)
    {
        // Validate pagination parameters
-        if (page < 1) page = 1;
-        if (pageSize < 1) pageSize = 100;
-        if (pageSize > 1000) pageSize = 1000; // Cap at 1000 for performance
+        if (page < 1)
+        {
+            page = 1;
+        }
+        
+        if (pageSize < 1)
+        {
+            pageSize = 50;
+        }
+        
+        if (pageSize > 500)
+        {
+            pageSize = 500;
+        }

        var query = _context.ManualEvents.AsQueryable();

@@ -47,7 +59,7 @@ public class ManualEventsController : ControllerBase

        if (!string.IsNullOrWhiteSpace(severity))
        {
-            if (Enum.TryParse<EventSeverity>(severity, true, out var severityEnum))
+            if (EnumSentinel.TryParseSelectable(severity, out EventSeverity severityEnum))
                query = query.Where(e => e.Severity == severityEnum);
        }

@@ -67,10 +79,8 @@ public class ManualEventsController : ControllerBase
        {
            string pattern = EventsContext.GetLikePattern(search);
            query = query.Where(e =>
-                EF.Functions.Like(e.Message, pattern) ||
-                EF.Functions.Like(e.Data, pattern) ||
-                EF.Functions.Like(e.InstanceUrl, pattern) ||
-                EF.Functions.Like(e.DownloadClientName, pattern)
+                EF.Functions.Like(e.Message.ToLower(), pattern, "\\") ||
+                (e.ItemTitle != null && EF.Functions.Like(e.ItemTitle.ToLower(), pattern, "\\"))
            );
        }

@@ -127,11 +137,28 @@ public class ManualEventsController : ControllerBase
            return NotFound();

        eventEntity.IsResolved = true;
+        eventEntity.ResolvedAt = DateTimeOffset.UtcNow;
        await _context.SaveChangesAsync();

        return Ok();
    }

+    /// <summary>
+    /// Marks all unresolved manual events as resolved
+    /// </summary>
+    [HttpPost("resolve_all")]
+    public async Task<ActionResult<object>> ResolveAllManualEvents()
+    {
+        DateTimeOffset resolvedAt = DateTimeOffset.UtcNow;
+        int resolvedCount = await _context.ManualEvents
+            .Where(e => !e.IsResolved)
+            .ExecuteUpdateAsync(setter => setter
+                .SetProperty(e => e.IsResolved, true)
+                .SetProperty(e => e.ResolvedAt, resolvedAt));
+
+        return Ok(new { ResolvedCount = resolvedCount });
+    }
+
    /// <summary>
    /// Gets manual event statistics
    /// </summary>
@@ -163,22 +190,6 @@ public class ManualEventsController : ControllerBase
    [HttpGet("severities")]
    public async Task<ActionResult<List<string>>> GetSeverities()
    {
-        var severities = Enum.GetNames(typeof(EventSeverity)).ToList();
-        return Ok(severities);
-    }
-
-    /// <summary>
-    /// Manually triggers cleanup of old resolved events
-    /// </summary>
-    [HttpPost("cleanup")]
-    public async Task<ActionResult<object>> CleanupOldResolvedEvents([FromQuery] int retentionDays = 30)
-    {
-        var cutoffDate = DateTime.UtcNow.AddDays(-retentionDays);
-
-        var deletedCount = await _context.ManualEvents
-            .Where(e => e.IsResolved && e.Timestamp < cutoffDate)
-            .ExecuteDeleteAsync();
-
-        return Ok(new { DeletedCount = deletedCount });
+        return Ok(EnumSentinel.SelectableNames<EventSeverity>());
    }
 }
@@ -1,53 +0,0 @@
-using Cleanuparr.Infrastructure.Stats;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-
-namespace Cleanuparr.Api.Controllers;
-
-/// <summary>
-/// Aggregated statistics endpoint for dashboard integrations
-/// </summary>
-[ApiController]
-[Route("api/[controller]")]
-[Authorize]
-public class StatsController : ControllerBase
-{
-    private readonly ILogger<StatsController> _logger;
-    private readonly IStatsService _statsService;
-
-    public StatsController(
-        ILogger<StatsController> logger,
-        IStatsService statsService)
-    {
-        _logger = logger;
-        _statsService = statsService;
-    }
-
-    /// <summary>
-    /// Gets aggregated application statistics for the specified timeframe
-    /// </summary>
-    /// <param name="hours">Timeframe in hours (default 24, range 1-720)</param>
-    /// <param name="includeEvents">Number of recent events to include (0 = none, max 100)</param>
-    /// <param name="includeStrikes">Number of recent strikes to include (0 = none, max 100)</param>
-    [HttpGet]
-    public async Task<IActionResult> GetStats(
-        [FromQuery] int hours = 24,
-        [FromQuery] int includeEvents = 0,
-        [FromQuery] int includeStrikes = 0)
-    {
-        try
-        {
-            hours = Math.Clamp(hours, 1, 720);
-            includeEvents = Math.Clamp(includeEvents, 0, 100);
-            includeStrikes = Math.Clamp(includeStrikes, 0, 100);
-
-            var stats = await _statsService.GetStatsAsync(hours, includeEvents, includeStrikes);
-            return Ok(stats);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error retrieving stats");
-            return StatusCode(500, new { Error = "An error occurred while retrieving stats" });
-        }
-    }
-}
@@ -0,0 +1,64 @@
+using Cleanuparr.Api.Common;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Stats;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Cleanuparr.Api.Controllers;
+
+[ApiController]
+[Route("api/v2/stats")]
+[Authorize]
+public class StatsV2Controller : ControllerBase
+{
+    private readonly IStatsService _statsService;
+
+    public StatsV2Controller(IStatsService statsService)
+    {
+        _statsService = statsService;
+    }
+
+    /// <summary>
+    /// Aggregated statistics for the given timeframe. Every section except health is scoped to the timeframe and, by
+    /// default, excludes dry-run activity.
+    /// </summary>
+    /// <param name="hours">Timeframe in hours (default 168, range 1-8760)</param>
+    /// <param name="includeDryRun">Include dry-run activity in the timeframe-scoped sections (default false)</param>
+    [HttpGet]
+    public async Task<IActionResult> GetStats([FromQuery] int hours = 168, [FromQuery] bool includeDryRun = false)
+    {
+        hours = TimelineWindow.ClampHours(hours);
+        StatsV2Response stats = await _statsService.GetStatsV2Async(hours, includeDryRun);
+        return Ok(stats);
+    }
+
+    /// <summary>
+    /// Bucketed timeline for a single metric.
+    /// </summary>
+    /// <param name="metric">strikesIssued | recovered | removed | malwareBlocked | events</param>
+    /// <param name="hours">Timeframe in hours (default 720, range 1-8760)</param>
+    /// <param name="bucket">Bucket size: hour | day | week | month. When omitted, hourly for timeframes up to 24h, daily otherwise.</param>
+    /// <param name="includeDryRun">Include dry-run activity (default false)</param>
+    [HttpGet("timeline")]
+    public async Task<IActionResult> GetTimeline(
+        [FromQuery] string metric = "events",
+        [FromQuery] int hours = 720,
+        [FromQuery] string? bucket = null,
+        [FromQuery] bool includeDryRun = false)
+    {
+        TimelineBucketSize? size = null;
+        if (!string.IsNullOrWhiteSpace(bucket))
+        {
+            if (!Enum.TryParse(bucket, ignoreCase: true, out TimelineBucketSize parsed) || !Enum.IsDefined(parsed))
+            {
+                return BadRequest($"Unsupported bucket '{bucket}'. Supported values: hour, day, week, month.");
+            }
+
+            size = parsed;
+        }
+
+        hours = TimelineWindow.ClampHours(hours);
+        List<TimelineBucketDto> series = await _statsService.GetTimelineAsync(metric, hours, size, includeDryRun);
+        return Ok(series);
+    }
+}
@@ -1,7 +1,10 @@
-using System.Diagnostics;
+using System.Diagnostics;
+using Cleanuparr.Api.Features.Status.Contracts.Responses;
 using Cleanuparr.Domain.Enums;
-using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Cleanuparr.Infrastructure.Health;
 using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
@@ -15,262 +18,129 @@ public class StatusController : ControllerBase
 {
    private readonly ILogger<StatusController> _logger;
    private readonly DataContext _dataContext;
-    private readonly IArrClientFactory _arrClientFactory;
+    private readonly IInstanceHealthChecker _healthChecker;
+
+    // Every member is seeded in arr_configs, so a new one must not be forgotten here.
+    private static readonly IReadOnlyList<InstanceType> ArrTypes = EnumSentinel.SelectableValues<InstanceType>();

    public StatusController(
        ILogger<StatusController> logger,
        DataContext dataContext,
-        IArrClientFactory arrClientFactory)
+        IInstanceHealthChecker healthChecker)
    {
        _logger = logger;
        _dataContext = dataContext;
-        _arrClientFactory = arrClientFactory;
+        _healthChecker = healthChecker;
    }

    [HttpGet]
    public async Task<IActionResult> GetSystemStatus()
    {
-        try
-        {
-            var process = Process.GetCurrentProcess();
-            
-            // Get configuration
-            var downloadClients = await _dataContext.DownloadClients
-                .AsNoTracking()
-                .ToListAsync();
-            var sonarrConfig = await _dataContext.ArrConfigs
-                .Include(x => x.Instances)
-                .AsNoTracking()
-                .FirstAsync(x => x.Type == InstanceType.Sonarr);
-            var radarrConfig = await _dataContext.ArrConfigs
-                .Include(x => x.Instances)
-                .AsNoTracking()
-                .FirstAsync(x => x.Type == InstanceType.Radarr);
-            var lidarrConfig = await _dataContext.ArrConfigs
-                .Include(x => x.Instances)
-                .AsNoTracking()
-                .FirstAsync(x => x.Type == InstanceType.Lidarr);
-            var readarrConfig = await _dataContext.ArrConfigs
-                .Include(x => x.Instances)
-                .AsNoTracking()
-                .FirstAsync(x => x.Type == InstanceType.Readarr);
-            
-            var status = new
-            {
-                Application = new
-                {
-                    Version = GetType().Assembly.GetName().Version?.ToString() ?? "Unknown",
-                    process.StartTime,
-                    UpTime = DateTime.Now - process.StartTime,
-                    MemoryUsageMB = Math.Round(process.WorkingSet64 / 1024.0 / 1024.0, 2),
-                    ProcessorTime = process.TotalProcessorTime
-                },
-                DownloadClient = new
-                {
-                    // TODO
-                },
-                MediaManagers = new
-                {
-                    Sonarr = new
-                    {
-                        InstanceCount = sonarrConfig.Instances.Count
-                    },
-                    Radarr = new
-                    {
-                        InstanceCount = radarrConfig.Instances.Count
-                    },
-                    Lidarr = new
-                    {
-                        InstanceCount = lidarrConfig.Instances.Count
-                    },
-                    Readarr = new
-                    {
-                        InstanceCount = readarrConfig.Instances.Count
-                    }
-                }
-            };
+        using var process = Process.GetCurrentProcess();

-            return Ok(status);
-        }
-        catch (Exception ex)
+        Dictionary<InstanceType, ArrConfig> configsByType = await _dataContext.ArrConfigs
+            .Include(x => x.Instances)
+            .Where(x => ArrTypes.Contains(x.Type))
+            .AsNoTracking()
+            .ToDictionaryAsync(x => x.Type);
+
+        Dictionary<string, MediaManagerStatusResponse> mediaManagers = ArrTypes.ToDictionary(
+            type => type.ToString(),
+            type => new MediaManagerStatusResponse
+            {
+                InstanceCount = configsByType.TryGetValue(type, out ArrConfig? config) ? config.Instances.Count : 0,
+            });
+
+        SystemStatusResponse status = new()
        {
-            _logger.LogError(ex, "Error retrieving system status");
-            return StatusCode(500, "An error occurred while retrieving system status");
-        }
+            Application = new ApplicationStatusResponse
+            {
+                Version = GetType().Assembly.GetName().Version?.ToString() ?? "Unknown",
+                StartTime = process.StartTime,
+                UpTime = DateTimeOffset.UtcNow - process.StartTime.ToUniversalTime(),
+                MemoryUsageMB = Math.Round(process.WorkingSet64 / 1024.0 / 1024.0, 2),
+                ProcessorTime = process.TotalProcessorTime,
+            },
+            MediaManagers = mediaManagers,
+        };
+
+        return Ok(status);
    }

    [HttpGet("download-client")]
    public async Task<IActionResult> GetDownloadClientStatus()
    {
-        try
-        {
-            var downloadClients = await _dataContext.DownloadClients
-                .AsNoTracking()
-                .ToListAsync();
-            var result = new Dictionary<string, object>();
-            
-            // Check for configured clients
-            if (downloadClients.Count > 0)
-            {
-                var clientsStatus = new List<object>();
-                foreach (var client in downloadClients)
-                {
-                    clientsStatus.Add(new
-                    {
-                        client.Id,
-                        client.Name,
-                        Type = client.TypeName,
-                        client.Host,
-                        client.Enabled,
-                        IsConnected = client.Enabled, // We can't check connection status without implementing test methods
-                    });
-                }
-                
-                result["Clients"] = clientsStatus;
-            }
+        List<DownloadClientConfig> downloadClients = await _dataContext.DownloadClients
+            .AsNoTracking()
+            .ToListAsync();

-            return Ok(result);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error retrieving download client status");
-            return StatusCode(500, "An error occurred while retrieving download client status");
-        }
+        List<DownloadClientStatusResponse> clients = downloadClients
+            .Select(client => new DownloadClientStatusResponse
+            {
+                Id = client.Id,
+                Name = client.Name,
+                Type = client.TypeName,
+                Host = client.Host,
+                Enabled = client.Enabled,
+                IsConnected = client.Enabled,
+            })
+            .ToList();
+
+        return Ok(new Dictionary<string, List<DownloadClientStatusResponse>> { ["Clients"] = clients });
    }

    [HttpGet("arrs")]
    public async Task<IActionResult> GetMediaManagersStatus()
    {
-        try
+        Dictionary<string, List<InstanceConnectionResponse>> status = new();
+
+        foreach (InstanceType type in ArrTypes)
        {
-            var status = new Dictionary<string, object>();
-            
-            // Get configurations
-            var enabledSonarrInstances = await _dataContext.ArrConfigs
+            List<ArrInstance> enabledInstances = await _dataContext.ArrConfigs
                .Include(x => x.Instances)
-                .Where(x => x.Type == InstanceType.Sonarr)
+                .Where(x => x.Type == type)
                .SelectMany(x => x.Instances)
                .Where(x => x.Enabled)
                .AsNoTracking()
                .ToListAsync();
-            var enabledRadarrInstances = await _dataContext.ArrConfigs
-                .Include(x => x.Instances)
-                .Where(x => x.Type == InstanceType.Radarr)
-                .SelectMany(x => x.Instances)
-                .Where(x => x.Enabled)
-                .AsNoTracking()
-                .ToListAsync();
-            var enabledLidarrInstances = await _dataContext.ArrConfigs
-                .Include(x => x.Instances)
-                .Where(x => x.Type == InstanceType.Lidarr)
-                .SelectMany(x => x.Instances)
-                .Where(x => x.Enabled)
-                .AsNoTracking()
-                .ToListAsync();;

-            
-            // Check Sonarr instances
-            var sonarrStatus = new List<object>();
-            
-            foreach (var instance in enabledSonarrInstances)
-            {
-                try
-                {
-                    var sonarrClient = _arrClientFactory.GetClient(InstanceType.Sonarr, instance.Version);
-                    await sonarrClient.HealthCheckAsync(instance);
-                    
-                    sonarrStatus.Add(new
-                    {
-                        instance.Name,
-                        instance.Url,
-                        IsConnected = true,
-                        Message = "Successfully connected"
-                    });
-                }
-                catch (Exception ex)
-                {
-                    sonarrStatus.Add(new
-                    {
-                        instance.Name,
-                        instance.Url,
-                        IsConnected = false,
-                        Message = $"Connection failed: {ex.Message}"
-                    });
-                }
-            }
-
-            status["Sonarr"] = sonarrStatus;
-
-            // Check Radarr instances
-            var radarrStatus = new List<object>();
-            
-            foreach (var instance in enabledRadarrInstances)
-            {
-                try
-                {
-                    var radarrClient = _arrClientFactory.GetClient(InstanceType.Radarr, instance.Version);
-                    await radarrClient.HealthCheckAsync(instance);
-                    
-                    radarrStatus.Add(new
-                    {
-                        instance.Name,
-                        instance.Url,
-                        IsConnected = true,
-                        Message = "Successfully connected"
-                    });
-                }
-                catch (Exception ex)
-                {
-                    radarrStatus.Add(new
-                    {
-                        instance.Name,
-                        instance.Url,
-                        IsConnected = false,
-                        Message = $"Connection failed: {ex.Message}"
-                    });
-                }
-            }
-
-            status["Radarr"] = radarrStatus;
-
-            // Check Lidarr instances
-            var lidarrStatus = new List<object>();
-            
-            foreach (var instance in enabledLidarrInstances)
-            {
-                try
-                {
-                    var lidarrClient = _arrClientFactory.GetClient(InstanceType.Lidarr, instance.Version);
-                    await lidarrClient.HealthCheckAsync(instance);
-                    
-                    lidarrStatus.Add(new
-                    {
-                        instance.Name,
-                        instance.Url,
-                        IsConnected = true,
-                        Message = "Successfully connected"
-                    });
-                }
-                catch (Exception ex)
-                {
-                    lidarrStatus.Add(new
-                    {
-                        instance.Name,
-                        instance.Url,
-                        IsConnected = false,
-                        Message = $"Connection failed: {ex.Message}"
-                    });
-                }
-            }
-
-            status["Lidarr"] = lidarrStatus;
-
-            return Ok(status);
+            status[type.ToString()] = await CheckInstancesAsync(type, enabledInstances);
        }
-        catch (Exception ex)
+
+        return Ok(status);
+    }
+
+    private async Task<List<InstanceConnectionResponse>> CheckInstancesAsync(InstanceType type, IReadOnlyList<ArrInstance> instances)
+    {
+        List<InstanceConnectionResponse> results = new(instances.Count);
+
+        foreach (ArrInstance instance in instances)
        {
-            _logger.LogError(ex, "Error retrieving media managers status");
-            return StatusCode(500, "An error occurred while retrieving media managers status");
+            try
+            {
+                await _healthChecker.CheckAsync(type, instance);
+
+                results.Add(new InstanceConnectionResponse
+                {
+                    Name = instance.Name,
+                    Url = instance.Url,
+                    IsConnected = true,
+                    Message = "Successfully connected",
+                });
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "health check failed for {Type} instance | {Url}", type, instance.Url);
+                results.Add(new InstanceConnectionResponse
+                {
+                    Name = instance.Name,
+                    Url = instance.Url,
+                    IsConnected = false,
+                    Message = $"Connection failed: {ex.Message}",
+                });
+            }
        }
+
+        return results;
    }
 }
@@ -1,3 +1,5 @@
+using Cleanuparr.Api.Contracts.Responses;
+using Cleanuparr.Api.Features.Strikes.Contracts.Responses;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.State;
@@ -29,9 +31,20 @@ public class StrikesController : ControllerBase
        [FromQuery] string? search = null,
        [FromQuery] string? type = null)
    {
-        if (page < 1) page = 1;
-        if (pageSize < 1) pageSize = 50;
-        if (pageSize > 100) pageSize = 100;
+        if (page < 1)
+        {
+            page = 1;
+        }
+
+        if (pageSize < 1)
+        {
+            pageSize = 50;
+        }
+
+        if (pageSize > 500)
+        {
+            pageSize = 500;
+        }

        var query = _context.DownloadItems
            .Include(d => d.Strikes)
@@ -40,7 +53,7 @@ public class StrikesController : ControllerBase
        // Filter by strike type: only show items that have strikes of this type
        if (!string.IsNullOrWhiteSpace(type))
        {
-            if (Enum.TryParse<StrikeType>(type, true, out var strikeType))
+            if (EnumSentinel.TryParseSelectable(type, out StrikeType strikeType))
                query = query.Where(d => d.Strikes.Any(s => s.Type == strikeType));
        }

@@ -49,8 +62,8 @@ public class StrikesController : ControllerBase
        {
            string pattern = EventsContext.GetLikePattern(search);
            query = query.Where(d =>
-                EF.Functions.Like(d.Title, pattern) ||
-                EF.Functions.Like(d.DownloadId, pattern));
+                EF.Functions.Like(d.Title.ToLower(), pattern, "\\") ||
+                EF.Functions.Like(d.DownloadId.ToLower(), pattern, "\\"));
        }

        var totalCount = await query.CountAsync();
@@ -135,8 +148,7 @@ public class StrikesController : ControllerBase
    [HttpGet("types")]
    public ActionResult<List<string>> GetStrikeTypes()
    {
-        var types = Enum.GetNames(typeof(StrikeType)).ToList();
-        return Ok(types);
+        return Ok(EnumSentinel.SelectableNames<StrikeType>());
    }

    /// <summary>
@@ -159,39 +171,3 @@ public class StrikesController : ControllerBase
        return NoContent();
    }
 }
-
-public class DownloadItemStrikesDto
-{
-    public Guid DownloadItemId { get; set; }
-    public string DownloadId { get; set; } = string.Empty;
-    public string Title { get; set; } = string.Empty;
-    public int TotalStrikes { get; set; }
-    public Dictionary<string, int> StrikesByType { get; set; } = new();
-    public DateTime LatestStrikeAt { get; set; }
-    public DateTime FirstStrikeAt { get; set; }
-    public bool IsMarkedForRemoval { get; set; }
-    public bool IsRemoved { get; set; }
-    public bool IsReturning { get; set; }
-    public bool HasDryRunStrikes { get; set; }
-    public List<StrikeDetailDto> Strikes { get; set; } = [];
-}
-
-public class StrikeDetailDto
-{
-    public Guid Id { get; set; }
-    public string Type { get; set; } = string.Empty;
-    public DateTime CreatedAt { get; set; }
-    public long? LastDownloadedBytes { get; set; }
-    public Guid JobRunId { get; set; }
-    public bool IsDryRun { get; set; }
-}
-
-public class RecentStrikeDto
-{
-    public Guid Id { get; set; }
-    public string Type { get; set; } = string.Empty;
-    public DateTime CreatedAt { get; set; }
-    public string DownloadId { get; set; } = string.Empty;
-    public string Title { get; set; } = string.Empty;
-    public bool IsDryRun { get; set; }
-}
@@ -1,5 +1,4 @@
-using System.Text.Json.Serialization;
-using System.Text.Json.Serialization.Metadata;
+using System.Diagnostics;
 using Cleanuparr.Api.Filters;
 using Cleanuparr.Api.Json;
 using Cleanuparr.Infrastructure.Health;
@@ -7,6 +6,7 @@ using Cleanuparr.Infrastructure.Hubs;
 using Microsoft.AspNetCore.Http.Json;
 using System.Text;
 using Cleanuparr.Api.Middleware;
+using Cleanuparr.Shared.Configuration;
 using Microsoft.Extensions.Options;

 namespace Cleanuparr.Api.DependencyInjection;
@@ -15,14 +15,7 @@ public static class ApiDI
 {
    public static IServiceCollection AddApiServices(this IServiceCollection services)
    {
-        services.Configure<JsonOptions>(options =>
-        {
-            options.SerializerOptions.PropertyNameCaseInsensitive = true;
-            options.SerializerOptions.Converters.Add(new JsonStringEnumConverter());
-            options.SerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
-            options.SerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
-                options.SerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
-        });
+        services.Configure<JsonOptions>(options => CleanuparrJsonConfiguration.ConfigureApiInbound(options.SerializerOptions));

        // Make JsonSerializerOptions available for injection
        services.AddSingleton(sp =>
@@ -31,53 +24,64 @@ public static class ApiDI
        // Add API-specific services
        services
            .AddControllers()
-            .AddJsonOptions(options =>
-            {
-                options.JsonSerializerOptions.PropertyNameCaseInsensitive = true;
-                options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
-                options.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
-                options.JsonSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
-                    options.JsonSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
-            });
+            .AddJsonOptions(options => CleanuparrJsonConfiguration.ConfigureApiInbound(options.JsonSerializerOptions));
        services.AddEndpointsApiExplorer();

        // Add SignalR for real-time updates
        services
            .AddSignalR()
-            .AddJsonProtocol(options =>
-            {
-                options.PayloadSerializerOptions.PropertyNameCaseInsensitive = true;
-                options.PayloadSerializerOptions.Converters.Add(new JsonStringEnumConverter());
-                options.PayloadSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
-                    options.PayloadSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
-            });
+            .AddJsonProtocol(options => CleanuparrJsonConfiguration.ConfigureApi(options.PayloadSerializerOptions));
        
        // Add health status broadcaster
        services.AddHostedService<HealthStatusBroadcaster>();

+        services.AddCleanuparrProblemDetails();
+        services.AddExceptionHandler<GlobalExceptionHandler>();
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers RFC 9457 problem-details responses for both the exception handler and
+    /// [ApiController] model-state validation, attaching a uniform Activity-tied traceId.
+    /// </summary>
+    public static IServiceCollection AddCleanuparrProblemDetails(this IServiceCollection services)
+    {
+        services.AddProblemDetails(options =>
+        {
+            options.CustomizeProblemDetails = ctx =>
+                ctx.ProblemDetails.Extensions.TryAdd(
+                    "traceId", Activity.Current?.Id ?? ctx.HttpContext.TraceIdentifier);
+        });
+
        return services;
    }

    public static WebApplication ConfigureApi(this WebApplication app)
    {
-        ILogger<Program> logger = app.Services.GetRequiredService<ILogger<Program>>();
-        
+        // Map unhandled exceptions to RFC 9457 problem-details responses (GlobalExceptionHandler).
+        // Registered first so it also covers exceptions thrown by downstream middleware.
+        app.UseExceptionHandler();
+
        // Enable compression
        app.UseResponseCompression();
-        
+
        // Serve static files without caching
        app.UseStaticFiles(new StaticFileOptions
        {
            OnPrepareResponse = ctx => NoCacheAttribute.Apply(ctx.Context.Response.Headers)
        });
-        
-        // Add the global exception handling middleware first
-        app.UseMiddleware<ExceptionMiddleware>();
+
+        // Resolve the real client IP / scheme / host from X-Forwarded-* headers
+        app.UseMiddleware<TrustedForwardedHeadersMiddleware>();

        // Block non-auth requests until setup is complete
        app.UseMiddleware<SetupGuardMiddleware>();

-        app.UseCors("Any");
+        if (app.Environment.IsDevelopment())
+        {
+            app.UseCors("DevSpa");
+        }
        app.UseRouting();

        app.UseAuthentication();
@@ -87,7 +91,7 @@ public static class ApiDI
        // Custom SPA fallback to inject base path
        app.MapFallback(async context =>
        {
-            var basePath = app.Configuration.GetValue<string>("BASE_PATH") ?? "/";
+            var basePath = app.Configuration.GetValue<string>(ConfigurationKeys.BasePath) ?? "/";
            
            // Normalize the base path (remove trailing slash if not root)
            if (basePath != "/" && basePath.EndsWith("/"))
@@ -1,13 +1,12 @@
-using System.Text.Json.Serialization;
+using Cleanuparr.Api.Json;
 using Cleanuparr.Domain.Entities.Arr;
-using Cleanuparr.Infrastructure.Features.DownloadHunter.Consumers;
 using Cleanuparr.Infrastructure.Features.DownloadRemover.Consumers;
 using Cleanuparr.Infrastructure.Features.Notifications.Consumers;
 using Cleanuparr.Infrastructure.Features.Notifications.Models;
 using Cleanuparr.Infrastructure.Health;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
-using Data.Models.Arr;
+using Cleanuparr.Shared.Helpers;
 using MassTransit;
 using Microsoft.Extensions.Caching.Memory;

@@ -28,42 +27,28 @@ public static class MainDI
            {
                config.DisableUsageTelemetry();
                
-                config.AddConsumer<DownloadRemoverConsumer<SearchItem>>();
-                config.AddConsumer<DownloadRemoverConsumer<SeriesSearchItem>>();
-                config.AddConsumer<DownloadHunterConsumer<SearchItem>>();
-                config.AddConsumer<DownloadHunterConsumer<SeriesSearchItem>>();
-                
+                config.AddConsumer<DownloadRemoverConsumer>();
                config.AddConsumer<NotificationConsumer<FailedImportStrikeNotification>>();
                config.AddConsumer<NotificationConsumer<StalledStrikeNotification>>();
                config.AddConsumer<NotificationConsumer<SlowSpeedStrikeNotification>>();
                config.AddConsumer<NotificationConsumer<SlowTimeStrikeNotification>>();
                config.AddConsumer<NotificationConsumer<QueueItemDeletedNotification>>();
                config.AddConsumer<NotificationConsumer<DownloadCleanedNotification>>();
+                config.AddConsumer<NotificationConsumer<DownloadStoppedNotification>>();
                config.AddConsumer<NotificationConsumer<CategoryChangedNotification>>();

                config.UsingInMemory((context, cfg) =>
                {
                    cfg.ConfigureJsonSerializerOptions(options =>
                    {
-                        options.PropertyNameCaseInsensitive = true;
-                        options.Converters.Add(new JsonStringEnumConverter());
-                        options.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+                        CleanuparrJsonConfiguration.ConfigureCore(options);

                        return options;
                    });
                    
                    cfg.ReceiveEndpoint("download-remover-queue", e =>
                    {
-                        e.ConfigureConsumer<DownloadRemoverConsumer<SearchItem>>(context);
-                        e.ConfigureConsumer<DownloadRemoverConsumer<SeriesSearchItem>>(context);
-                        e.ConcurrentMessageLimit = 1;
-                        e.PrefetchCount = 1;
-                    });
-                    
-                    cfg.ReceiveEndpoint("download-hunter-queue", e =>
-                    {
-                        e.ConfigureConsumer<DownloadHunterConsumer<SearchItem>>(context);
-                        e.ConfigureConsumer<DownloadHunterConsumer<SeriesSearchItem>>(context);
+                        e.ConfigureConsumer<DownloadRemoverConsumer>(context);
                        e.ConcurrentMessageLimit = 1;
                        e.PrefetchCount = 1;
                    });
@@ -76,6 +61,7 @@ public static class MainDI
                        e.ConfigureConsumer<NotificationConsumer<SlowTimeStrikeNotification>>(context);
                        e.ConfigureConsumer<NotificationConsumer<QueueItemDeletedNotification>>(context);
                        e.ConfigureConsumer<NotificationConsumer<DownloadCleanedNotification>>(context);
+                        e.ConfigureConsumer<NotificationConsumer<DownloadStoppedNotification>>(context);
                        e.ConfigureConsumer<NotificationConsumer<CategoryChangedNotification>>(context);
                        e.ConcurrentMessageLimit = 1;
                        e.PrefetchCount = 1;
@@ -91,12 +77,6 @@ public static class MainDI
        // Add the dynamic HTTP client provider that uses the new system
        services.AddSingleton<IDynamicHttpClientProvider, DynamicHttpClientProvider>();

-        // Add HTTP client for Plex authentication
-        services.AddHttpClient("PlexAuth");
-
-        // Add HTTP client for OIDC authentication
-        services.AddHttpClient("OidcAuth");
-
        return services;
    }

@@ -1,12 +1,14 @@
+using Cleanuparr.Api.Features.Auth;
+using Cleanuparr.Infrastructure.Health;
+using Cleanuparr.Infrastructure.Features.LazyLibrarian;
 using Cleanuparr.Infrastructure.Events;
 using Cleanuparr.Infrastructure.Events.Interfaces;
 using Cleanuparr.Infrastructure.Features.Arr;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Infrastructure.Features.BlacklistSync;
+using Cleanuparr.Infrastructure.Features.DownloadCleaner.Services;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
-using Cleanuparr.Infrastructure.Features.DownloadHunter;
-using Cleanuparr.Infrastructure.Features.DownloadHunter.Interfaces;
 using Cleanuparr.Infrastructure.Features.DownloadRemover;
 using Cleanuparr.Infrastructure.Features.DownloadRemover.Interfaces;
 using Cleanuparr.Infrastructure.Features.Files;
@@ -19,6 +21,7 @@ using Cleanuparr.Infrastructure.Services;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Stats;
 using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Providers;

 namespace Cleanuparr.Api.DependencyInjection;

@@ -29,9 +32,11 @@ public static class ServicesDI
            .AddScoped<EventsContext>()
            .AddScoped<DataContext>()
            .AddScoped<UsersContext>()
+            .AddSingleton<IDatabaseProvider>(_ => DatabaseProviderFactory.Current)
            .AddSingleton<IJwtService, JwtService>()
            .AddSingleton<IPasswordService, PasswordService>()
            .AddSingleton<ITotpService, TotpService>()
+            .AddScoped<LoginAttemptTracker>()
            .AddScoped<IPlexAuthService, PlexAuthService>()
            .AddScoped<IOidcAuthService, OidcAuthService>()
            .AddScoped<IEventPublisher, EventPublisher>()
@@ -39,18 +44,28 @@ public static class ServicesDI
            .AddScoped<IDryRunInterceptor, DryRunInterceptor>()
            .AddScoped<CertificateValidationService>()
            .AddScoped<ISonarrClient, SonarrClient>()
+            .AddScoped<ISportarrClient, SportarrClient>()
            .AddScoped<IRadarrClient, RadarrClient>()
            .AddScoped<ILidarrClient, LidarrClient>()
            .AddScoped<IReadarrClient, ReadarrClient>()
            .AddScoped<IWhisparrV2Client, WhisparrV2Client>()
            .AddScoped<IWhisparrV3Client, WhisparrV3Client>()
+            .AddScoped<ILazyLibrarianService, LazyLibrarianService>()
+            .AddScoped<IInstanceHealthChecker, InstanceHealthChecker>()
+            .AddKeyedScoped<ILazyLibrarianEvaluator, LazyLibrarianServiceQC>(ILazyLibrarianEvaluator.QueueCleanerKey)
+            .AddKeyedScoped<ILazyLibrarianEvaluator, LazyLibrarianServiceCB>(ILazyLibrarianEvaluator.MalwareBlockerKey)
            .AddScoped<IArrClientFactory, ArrClientFactory>()
            .AddScoped<QueueCleaner>()
            .AddScoped<BlacklistSynchronizer>()
            .AddScoped<MalwareBlocker>()
            .AddScoped<DownloadCleaner>()
+            .AddScoped<ISeedingRulesCleanupService, SeedingRulesCleanupService>()
+            .AddScoped<IUnlinkedDownloadsService, UnlinkedDownloadsService>()
+            .AddScoped<IDeadTorrentService, DeadTorrentService>()
+            .AddScoped<IOrphanedFilesCleanupService, OrphanedFilesCleanupService>()
+            .AddScoped<Seeker>()
+            .AddScoped<CustomFormatScoreSyncer>()
            .AddScoped<IQueueItemRemover, QueueItemRemover>()
-            .AddScoped<IDownloadHunter, DownloadHunter>()
            .AddScoped<IFilenameEvaluator, FilenameEvaluator>()
            .AddScoped<IHardLinkFileService, HardLinkFileService>()
            .AddScoped<IUnixHardLinkFileService, UnixHardLinkFileService>()
@@ -58,14 +73,17 @@ public static class ServicesDI
            .AddScoped<IArrQueueIterator, ArrQueueIterator>()
            .AddScoped<IDownloadServiceFactory, DownloadServiceFactory>()
            .AddScoped<IStriker, Striker>()
+            .AddScoped<IConnectivityChecker, ConnectivityChecker>()
            .AddScoped<FileReader>()
-            .AddScoped<IRuleManager, RuleManager>()
-            .AddScoped<IRuleEvaluator, RuleEvaluator>()
+            .AddScoped<IQueueRuleManager, QueueRuleManager>()
+            .AddScoped<IQueueRuleEvaluator, QueueRuleEvaluator>()
+            .AddScoped<ISeedingRuleEvaluator, SeedingRuleEvaluator>()
            .AddScoped<IRuleIntervalValidator, RuleIntervalValidator>()
            .AddScoped<IStatsService, StatsService>()
            .AddSingleton<IJobManagementService, JobManagementService>()
            .AddSingleton<IBlocklistProvider, BlocklistProvider>()
            .AddSingleton(TimeProvider.System)
            .AddSingleton<AppStatusSnapshot>()
-            .AddHostedService<AppStatusRefreshService>();
+            .AddHostedService<AppStatusRefreshService>()
+            .AddHostedService<SeekerCommandMonitor>();
 }
@@ -0,0 +1,9 @@
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore.Design;
+
+namespace Cleanuparr.Api.DesignTime;
+
+public sealed class DataContextFactory : IDesignTimeDbContextFactory<DataContext>
+{
+    public DataContext CreateDbContext(string[] args) => DataContext.CreateStaticInstance();
+}
@@ -0,0 +1,9 @@
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore.Design;
+
+namespace Cleanuparr.Api.DesignTime;
+
+public sealed class EventsContextFactory : IDesignTimeDbContextFactory<EventsContext>
+{
+    public EventsContext CreateDbContext(string[] args) => EventsContext.CreateStaticInstance();
+}
@@ -0,0 +1,9 @@
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore.Design;
+
+namespace Cleanuparr.Api.DesignTime;
+
+public sealed class UsersContextFactory : IDesignTimeDbContextFactory<UsersContext>
+{
+    public UsersContext CreateDbContext(string[] args) => UsersContext.CreateStaticInstance();
+}
@@ -0,0 +1,38 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace Cleanuparr.Api.Extensions;
+
+public static class ControllerBaseExtensions
+{
+    /// <summary>
+    /// Builds an RFC 9457 problem-details error response for a direct (non-throwing) controller return.
+    /// Mirrors the shape produced by <see cref="Middleware.GlobalExceptionHandler"/> so every error
+    /// response carries the same <c>application/problem+json</c> body and <c>traceId</c>. The
+    /// <c>traceId</c> extension is added by the shared <c>CustomizeProblemDetails</c> hook inside
+    /// <see cref="ProblemDetailsFactory.CreateProblemDetails"/>.
+    /// </summary>
+    public static ObjectResult ProblemResult(
+        this ControllerBase controller,
+        int statusCode,
+        string detail,
+        string? title = null,
+        IReadOnlyDictionary<string, object?>? extensions = null)
+    {
+        ProblemDetails problemDetails = controller.ProblemDetailsFactory
+            .CreateProblemDetails(controller.HttpContext, statusCode: statusCode, title: title, detail: detail);
+
+        if (extensions is not null)
+        {
+            foreach (KeyValuePair<string, object?> extension in extensions)
+            {
+                problemDetails.Extensions[extension.Key] = extension.Value;
+            }
+        }
+
+        return new ObjectResult(problemDetails)
+        {
+            StatusCode = statusCode,
+            ContentTypes = { "application/problem+json" },
+        };
+    }
+}
@@ -1,5 +1,3 @@
-using Cleanuparr.Infrastructure.Extensions;
-
 namespace Cleanuparr.Api.Extensions;

 public static class HttpRequestExtensions
@@ -19,26 +17,13 @@ public static class HttpRequestExtensions
    }

    /// <summary>
-    /// Returns the external base URL (scheme + host + basePath), respecting
-    /// X-Forwarded-Proto and X-Forwarded-Host headers when the connection
-    /// originates from a local address.
+    /// Returns the external base URL (scheme + host + basePath).
+    /// TrustedForwardedHeadersMiddleware has already applied X-Forwarded-Proto and X-Forwarded-Host to <see cref="HttpRequest.Scheme"/> / <see cref="HttpRequest.Host"/>.
    /// </summary>
    public static string GetExternalBaseUrl(this HttpContext context)
    {
        var request = context.Request;
-        var scheme = request.Scheme;
-        var host = request.Host.ToString();
-        var remoteIp = context.Connection.RemoteIpAddress;
-
-        // Trust forwarded headers only from local connections
-        // (consistent with TrustedNetworkAuthenticationHandler)
-        if (remoteIp is not null && remoteIp.IsLocalAddress())
-        {
-            scheme = request.Headers["X-Forwarded-Proto"].FirstOrDefault() ?? scheme;
-            host = request.Headers["X-Forwarded-Host"].FirstOrDefault() ?? host;
-        }
-
        var basePath = request.GetSafeBasePath();
-        return $"{scheme}://{host}{basePath}";
+        return $"{request.Scheme}://{request.Host}{basePath}";
    }
 }
@@ -1,13 +1,16 @@
+using Cleanuparr.Api.Extensions;
 using Cleanuparr.Api.Features.Arr.Contracts.Requests;
 using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Events.Interfaces;
 using Cleanuparr.Infrastructure.Features.Arr.Dtos;
-using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Cleanuparr.Infrastructure.Health;
 using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
 using Cleanuparr.Shared.Helpers;
-using Mapster;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;

 namespace Cleanuparr.Api.Features.Arr.Controllers;

@@ -18,16 +21,25 @@ public sealed class ArrConfigController : ControllerBase
 {
    private readonly ILogger<ArrConfigController> _logger;
    private readonly DataContext _dataContext;
-    private readonly IArrClientFactory _arrClientFactory;
+    private readonly EventsContext _eventsContext;
+    private readonly IInstanceHealthChecker _healthChecker;
+    private readonly IEventPublisher _eventPublisher;

+    /// <summary>
+    /// Creates the controller with its injected dependencies.
+    /// </summary>
    public ArrConfigController(
        ILogger<ArrConfigController> logger,
        DataContext dataContext,
-        IArrClientFactory arrClientFactory)
+        EventsContext eventsContext,
+        IInstanceHealthChecker healthChecker,
+        IEventPublisher eventPublisher)
    {
        _logger = logger;
        _dataContext = dataContext;
-        _arrClientFactory = arrClientFactory;
+        _eventsContext = eventsContext;
+        _healthChecker = healthChecker;
+        _eventPublisher = eventPublisher;
    }

    [HttpGet("sonarr")]
@@ -45,6 +57,11 @@ public sealed class ArrConfigController : ControllerBase
    [HttpGet("whisparr")]
    public Task<IActionResult> GetWhisparrConfig() => GetArrConfig(InstanceType.Whisparr);

+    [HttpGet("sportarr")]
+    public Task<IActionResult> GetSportarrConfig() => GetArrConfig(InstanceType.Sportarr);
+    [HttpGet("lazylibrarian")]
+    public Task<IActionResult> GetLazyLibrarianConfig() => GetArrConfig(InstanceType.LazyLibrarian);
+
    [HttpPut("sonarr")]
    public Task<IActionResult> UpdateSonarrConfig([FromBody] UpdateArrConfigRequest request)
        => UpdateArrConfig(InstanceType.Sonarr, request);
@@ -65,6 +82,13 @@ public sealed class ArrConfigController : ControllerBase
    public Task<IActionResult> UpdateWhisparrConfig([FromBody] UpdateArrConfigRequest request)
        => UpdateArrConfig(InstanceType.Whisparr, request);

+    [HttpPut("sportarr")]
+    public Task<IActionResult> UpdateSportarrConfig([FromBody] UpdateArrConfigRequest request)
+        => UpdateArrConfig(InstanceType.Sportarr, request);
+    [HttpPut("lazylibrarian")]
+    public Task<IActionResult> UpdateLazyLibrarianConfig([FromBody] UpdateArrConfigRequest request)
+        => UpdateArrConfig(InstanceType.LazyLibrarian, request);
+
    [HttpPost("sonarr/instances")]
    public Task<IActionResult> CreateSonarrInstance([FromBody] ArrInstanceRequest request)
        => CreateArrInstance(InstanceType.Sonarr, request);
@@ -125,6 +149,29 @@ public sealed class ArrConfigController : ControllerBase
    public Task<IActionResult> DeleteWhisparrInstance(Guid id)
        => DeleteArrInstance(InstanceType.Whisparr, id);

+    [HttpPost("sportarr/instances")]
+    public Task<IActionResult> CreateSportarrInstance([FromBody] ArrInstanceRequest request)
+        => CreateArrInstance(InstanceType.Sportarr, request);
+
+    [HttpPut("sportarr/instances/{id}")]
+    public Task<IActionResult> UpdateSportarrInstance(Guid id, [FromBody] ArrInstanceRequest request)
+        => UpdateArrInstance(InstanceType.Sportarr, id, request);
+
+    [HttpDelete("sportarr/instances/{id}")]
+    public Task<IActionResult> DeleteSportarrInstance(Guid id)
+        => DeleteArrInstance(InstanceType.Sportarr, id);
+    [HttpPost("lazylibrarian/instances")]
+    public Task<IActionResult> CreateLazyLibrarianInstance([FromBody] ArrInstanceRequest request)
+        => CreateArrInstance(InstanceType.LazyLibrarian, request);
+
+    [HttpPut("lazylibrarian/instances/{id}")]
+    public Task<IActionResult> UpdateLazyLibrarianInstance(Guid id, [FromBody] ArrInstanceRequest request)
+        => UpdateArrInstance(InstanceType.LazyLibrarian, id, request);
+
+    [HttpDelete("lazylibrarian/instances/{id}")]
+    public Task<IActionResult> DeleteLazyLibrarianInstance(Guid id)
+        => DeleteArrInstance(InstanceType.LazyLibrarian, id);
+
    [HttpPost("sonarr/instances/test")]
    public Task<IActionResult> TestSonarrInstance([FromBody] TestArrInstanceRequest request)
        => TestArrInstance(InstanceType.Sonarr, request);
@@ -145,6 +192,13 @@ public sealed class ArrConfigController : ControllerBase
    public Task<IActionResult> TestWhisparrInstance([FromBody] TestArrInstanceRequest request)
        => TestArrInstance(InstanceType.Whisparr, request);

+    [HttpPost("sportarr/instances/test")]
+    public Task<IActionResult> TestSportarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Sportarr, request);
+    [HttpPost("lazylibrarian/instances/test")]
+    public Task<IActionResult> TestLazyLibrarianInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.LazyLibrarian, request);
+
    private async Task<IActionResult> GetArrConfig(InstanceType type)
    {
        await DataContext.Lock.WaitAsync();
@@ -159,7 +213,7 @@ public sealed class ArrConfigController : ControllerBase
                .OrderBy(i => i.Name)
                .ToList();

-            return Ok(config.Adapt<ArrConfigDto>());
+            return Ok(ToDto(config));
        }
        finally
        {
@@ -182,11 +236,6 @@ public sealed class ArrConfigController : ControllerBase

            return Ok(new { Message = $"{type} configuration updated successfully" });
        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Failed to save {Type} configuration", type);
-            throw;
-        }
        finally
        {
            DataContext.Lock.Release();
@@ -205,12 +254,7 @@ public sealed class ArrConfigController : ControllerBase
            await _dataContext.ArrInstances.AddAsync(instance);
            await _dataContext.SaveChangesAsync();

-            return CreatedAtAction(GetConfigActionName(type), new { id = instance.Id }, instance.Adapt<ArrInstanceDto>());
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Failed to create {Type} instance", type);
-            throw;
+            return CreatedAtAction(GetConfigActionName(type), new { id = instance.Id }, ToDto(instance));
        }
        finally
        {
@@ -230,19 +274,14 @@ public sealed class ArrConfigController : ControllerBase
            var instance = config.Instances.FirstOrDefault(i => i.Id == id);
            if (instance is null)
            {
-                return NotFound($"{type} instance with ID {id} not found");
+                return this.ProblemResult(StatusCodes.Status404NotFound, $"{type} instance with ID {id} not found");
            }

            request.ApplyTo(instance);

            await _dataContext.SaveChangesAsync();

-            return Ok(instance.Adapt<ArrInstanceDto>());
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Failed to update {Type} instance with ID {Id}", type, id);
-            throw;
+            return Ok(ToDto(instance));
        }
        finally
        {
@@ -262,24 +301,85 @@ public sealed class ArrConfigController : ControllerBase
            var instance = config.Instances.FirstOrDefault(i => i.Id == id);
            if (instance is null)
            {
-                return NotFound($"{type} instance with ID {id} not found");
+                return this.ProblemResult(StatusCodes.Status404NotFound, $"{type} instance with ID {id} not found");
            }

-            config.Instances.Remove(instance);
-            await _dataContext.SaveChangesAsync();
+            await using IDbContextTransaction transaction = await _dataContext.Database.BeginTransactionAsync();
+
+            try
+            {
+                config.Instances.Remove(instance);
+                await _dataContext.SaveChangesAsync();
+
+                await DeleteSeekerEventsForInstanceAsync(id);
+
+                await transaction.CommitAsync();
+            }
+            catch
+            {
+                await transaction.RollbackAsync();
+                throw;
+            }
+
+            await FailStrandedSearchEventsForInstanceAsync(id);

            return NoContent();
        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Failed to delete {Type} instance with ID {Id}", type, id);
-            throw;
-        }
        finally
        {
            DataContext.Lock.Release();
        }
    }
+    
+    private async Task DeleteSeekerEventsForInstanceAsync(Guid arrInstanceId, CancellationToken cancellationToken = default)
+    {
+        await using IDbContextTransaction transaction = await _eventsContext.Database.BeginTransactionAsync(cancellationToken);
+
+        try
+        {
+
+            await _eventsContext.CustomFormatScoreEntries
+                .Where(e => e.ArrInstanceId == arrInstanceId)
+                .ExecuteDeleteAsync(cancellationToken);
+
+            await _eventsContext.CustomFormatScoreHistory
+                .Where(e => e.ArrInstanceId == arrInstanceId)
+                .ExecuteDeleteAsync(cancellationToken);
+
+            await _eventsContext.SeekerHistory
+                .Where(e => e.ArrInstanceId == arrInstanceId)
+                .ExecuteDeleteAsync(cancellationToken);
+
+            await _eventsContext.SearchQueue
+                .Where(e => e.ArrInstanceId == arrInstanceId)
+                .ExecuteDeleteAsync(cancellationToken);
+
+            await _eventsContext.SeekerCommandTrackers
+                .Where(e => e.ArrInstanceId == arrInstanceId)
+                .ExecuteDeleteAsync(cancellationToken);
+
+            await transaction.CommitAsync(cancellationToken);
+        }
+        catch
+        {
+            await transaction.RollbackAsync(cancellationToken);
+            throw;
+        }
+    }
+
+    private async Task FailStrandedSearchEventsForInstanceAsync(Guid arrInstanceId)
+    {
+        try
+        {
+            await _eventPublisher.FailStrandedSearchEvents(arrInstanceId);
+        }
+        catch (Exception exception)
+        {
+            _logger.LogError(exception,
+                "Failed to mark the search events of instance {InstanceId} as failed, the seeker command monitor will retry",
+                arrInstanceId);
+        }
+    }

    private async Task<IActionResult> TestArrInstance(InstanceType type, TestArrInstanceRequest request)
    {
@@ -295,25 +395,43 @@ public sealed class ArrConfigController : ControllerBase

                if (existingInstance is null)
                {
-                    return NotFound($"Instance with ID {request.InstanceId.Value} not found");
+                    return this.ProblemResult(StatusCodes.Status404NotFound, $"Instance with ID {request.InstanceId.Value} not found");
                }

                resolvedApiKey = existingInstance.ApiKey;
            }

            var testInstance = request.ToTestInstance(resolvedApiKey);
-            var client = _arrClientFactory.GetClient(type, request.Version);
-            await client.HealthCheckAsync(testInstance);
+            await _healthChecker.CheckAsync(type, testInstance);

            return Ok(new { Message = $"Connection to {type} instance successful" });
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to test {Type} instance connection", type);
-            return BadRequest(new { Message = $"Connection failed: {ex.Message}" });
+            return this.ProblemResult(StatusCodes.Status400BadRequest, $"Connection failed: {ex.Message}");
        }
    }

+    private static ArrConfigDto ToDto(ArrConfig config) => new()
+    {
+        Id = config.Id,
+        Type = config.Type,
+        FailedImportMaxStrikes = config.FailedImportMaxStrikes,
+        Instances = config.Instances.Select(ToDto).ToList(),
+    };
+
+    private static ArrInstanceDto ToDto(ArrInstance instance) => new()
+    {
+        Id = instance.Id,
+        Enabled = instance.Enabled,
+        Version = instance.Version,
+        Name = instance.Name,
+        Url = instance.Url.ToString(),
+        ApiKey = instance.ApiKey,
+        ExternalUrl = instance.ExternalUrl?.ToString(),
+    };
+
    private static string GetConfigActionName(InstanceType type) => type switch
    {
        InstanceType.Sonarr => nameof(GetSonarrConfig),
@@ -321,6 +439,8 @@ public sealed class ArrConfigController : ControllerBase
        InstanceType.Lidarr => nameof(GetLidarrConfig),
        InstanceType.Readarr => nameof(GetReadarrConfig),
        InstanceType.Whisparr => nameof(GetWhisparrConfig),
+        InstanceType.Sportarr => nameof(GetSportarrConfig),
+        InstanceType.LazyLibrarian => nameof(GetLazyLibrarianConfig),
        _ => nameof(GetSonarrConfig),
    };
 }
@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record ChangeUsernameRequest
+{
+    [Required]
+    public required string CurrentPassword { get; init; }
+
+    [Required]
+    [MinLength(3)]
+    [MaxLength(50)]
+    public required string NewUsername { get; init; }
+}
@@ -8,6 +8,6 @@ public sealed record Disable2faRequest
    public required string Password { get; init; }

    [Required]
-    [StringLength(6, MinimumLength = 6)]
+    [StringLength(32)]
    public required string TotpCode { get; init; }
 }
@@ -0,0 +1,17 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+/// <summary>
+/// Request to record that the current user has seen the given features, used to drive the "NEW" feature badges in the UI.
+/// </summary>
+public sealed record RecordFeatureViewsRequest
+{
+    /// <summary>
+    /// The feature identifiers the user has been exposed to.
+    /// Unknown ids are recorded with the current timestamp; already-seen ids are ignored.
+    /// </summary>
+    [Required]
+    [MaxLength(100)]
+    public required IReadOnlyList<string> FeatureIds { get; init; }
+}
@@ -8,6 +8,6 @@ public sealed record Regenerate2faRequest
    public required string Password { get; init; }

    [Required]
-    [StringLength(6, MinimumLength = 6)]
+    [StringLength(32)]
    public required string TotpCode { get; init; }
 }
@@ -5,6 +5,6 @@ namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
 public sealed record VerifyTotpRequest
 {
    [Required]
-    [StringLength(6, MinimumLength = 6)]
+    [StringLength(32)]
    public required string Code { get; init; }
 }
@@ -0,0 +1,15 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record FeatureViewsResponse
+{
+    /// <summary>
+    /// The user's account creation timestamp, used as the anchor for "new feature" detection:
+    /// a feature is only considered new if it was first seen meaningfully after this point.
+    /// </summary>
+    public required DateTimeOffset CreatedAt { get; init; }
+
+    /// <summary>
+    /// Map of feature id to the UTC timestamp the user first saw it.
+    /// </summary>
+    public required Dictionary<string, DateTimeOffset> Views { get; init; }
+}
@@ -4,13 +4,14 @@ using Cleanuparr.Api.Extensions;
 using Cleanuparr.Api.Features.Auth.Contracts.Requests;
 using Cleanuparr.Api.Features.Auth.Contracts.Responses;
 using Cleanuparr.Api.Filters;
+using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Auth;
+using Cleanuparr.Shared.Helpers;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;

 namespace Cleanuparr.Api.Features.Auth.Controllers;

@@ -25,6 +26,7 @@ public sealed class AccountController : ControllerBase
    private readonly ITotpService _totpService;
    private readonly IPlexAuthService _plexAuthService;
    private readonly IOidcAuthService _oidcAuthService;
+    private readonly LoginAttemptTracker _loginAttemptTracker;
    private readonly ILogger<AccountController> _logger;

    public AccountController(
@@ -33,6 +35,7 @@ public sealed class AccountController : ControllerBase
        ITotpService totpService,
        IPlexAuthService plexAuthService,
        IOidcAuthService oidcAuthService,
+        LoginAttemptTracker loginAttemptTracker,
        ILogger<AccountController> logger)
    {
        _usersContext = usersContext;
@@ -40,6 +43,7 @@ public sealed class AccountController : ControllerBase
        _totpService = totpService;
        _plexAuthService = plexAuthService;
        _oidcAuthService = oidcAuthService;
+        _loginAttemptTracker = loginAttemptTracker;
        _logger = logger;
    }

@@ -65,217 +69,314 @@ public sealed class AccountController : ControllerBase
    [HttpPut("password")]
    public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest request)
    {
-        if (await IsOidcExclusiveModeActive())
+        await UsersContext.Lock.WaitAsync();
+
+        try
        {
-            return StatusCode(403, new { error = "Password changes are disabled while OIDC exclusive mode is active." });
-        }
+            if (await IsOidcExclusiveModeActive())
+            {
+                return this.ProblemResult(StatusCodes.Status403Forbidden, "Password changes are disabled while OIDC exclusive mode is active.");
+            }

-        var user = await GetCurrentUser();
-        if (user is null)
+            User? user = await GetCurrentUser();
+            if (user is null)
+            {
+                return Unauthorized();
+            }
+
+            if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "Current password is incorrect");
+            }
+
+            DateTimeOffset now = DateTimeOffset.UtcNow;
+
+            user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
+            user.UpdatedAt = now;
+
+            await RevokeActiveRefreshTokens(user.Id, now);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Password changed for user {Username}", user.Username);
+
+            return Ok(new { message = "Password changed" });
+        }
+        finally
        {
-            return Unauthorized();
+            UsersContext.Lock.Release();
        }
+    }

-        if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+    [HttpPut("username")]
+    public async Task<IActionResult> ChangeUsername([FromBody] ChangeUsernameRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+
+        try
        {
-            return BadRequest(new { error = "Current password is incorrect" });
+            if (await IsOidcExclusiveModeActive())
+            {
+                return this.ProblemResult(StatusCodes.Status403Forbidden, "Username changes are disabled while OIDC exclusive mode is active.");
+            }
+
+            User? user = await GetCurrentUser();
+            if (user is null)
+            {
+                return Unauthorized();
+            }
+
+            if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "Current password is incorrect");
+            }
+
+            // Login compares the stored value, so surrounding whitespace would lock the user out
+            string newUsername = request.NewUsername.Trim();
+
+            if (newUsername.Length < 3)
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "Username must be at least 3 characters");
+            }
+
+            if (string.Equals(newUsername, user.Username, StringComparison.Ordinal))
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "New username must be different from the current username");
+            }
+
+            DateTimeOffset now = DateTimeOffset.UtcNow;
+            string previousUsername = user.Username;
+
+            user.Username = newUsername;
+            user.UpdatedAt = now;
+
+            await RevokeActiveRefreshTokens(user.Id, now);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Username changed from {PreviousUsername} to {Username}",
+                previousUsername.SanitizeForLog(), newUsername.SanitizeForLog());
+
+            return Ok(new { message = "Username changed" });
        }
-
-        DateTime now = DateTime.UtcNow;
-
-        user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
-        user.UpdatedAt = now;
-
-        // Revoke all existing refresh tokens so old sessions can't be reused
-        var activeTokens = await _usersContext.RefreshTokens
-            .Where(r => r.UserId == user.Id && r.RevokedAt == null)
-            .ToListAsync();
-
-        foreach (var token in activeTokens)
+        finally
        {
-            token.RevokedAt = now;
+            UsersContext.Lock.Release();
        }
-
-        await _usersContext.SaveChangesAsync();
-
-        _logger.LogInformation("Password changed for user {Username}", user.Username);
-
-        return Ok(new { message = "Password changed" });
    }

    [HttpPost("2fa/regenerate")]
    public async Task<IActionResult> Regenerate2fa([FromBody] Regenerate2faRequest request)
    {
-        var user = await GetCurrentUser(includeRecoveryCodes: true);
-        if (user is null)
+        User user;
+        string? failureMessage = null;
+        int retryAfterSeconds = 0;
+        TotpSetupResponse? setup = null;
+
+        await UsersContext.Lock.WaitAsync();
+
+        try
        {
-            return Unauthorized();
-        }
-
-        // Verify current credentials
-        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
-        {
-            return BadRequest(new { error = "Incorrect password" });
-        }
-
-        if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
-        {
-            return BadRequest(new { error = "Invalid 2FA code" });
-        }
-
-        // Generate new TOTP
-        var secret = _totpService.GenerateSecret();
-        var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
-        var recoveryCodes = _totpService.GenerateRecoveryCodes();
-
-        user.TotpSecret = secret;
-        user.UpdatedAt = DateTime.UtcNow;
-
-        // Replace recovery codes
-        _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
-
-        foreach (var code in recoveryCodes)
-        {
-            _usersContext.RecoveryCodes.Add(new RecoveryCode
+            User? currentUser = await GetCurrentUser(includeRecoveryCodes: true);
+            if (currentUser is null)
            {
-                Id = Guid.NewGuid(),
-                UserId = user.Id,
-                CodeHash = _totpService.HashRecoveryCode(code),
-                IsUsed = false
-            });
+                return Unauthorized();
+            }
+
+            user = currentUser;
+
+            if (LoginAttemptTracker.GetLockoutSecondsRemaining(user) is { } remaining)
+            {
+                throw new RateLimitException("Account is locked", remaining);
+            }
+
+            // Verify current credentials
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                failureMessage = "Incorrect password";
+            }
+            else if (!_totpService.VerifySecondFactor(user, request.TotpCode))
+            {
+                failureMessage = "Invalid authenticator or recovery code";
+            }
+            else
+            {
+                setup = TwoFactorSecretRotation.Rotate(_totpService, _usersContext, user);
+
+                await _usersContext.SaveChangesAsync();
+            }
+
+            if (failureMessage is not null)
+            {
+                retryAfterSeconds = await _loginAttemptTracker.IncrementFailedAttempts(user.Id);
+            }
+            else
+            {
+                await _loginAttemptTracker.ResetFailedAttempts(user.Id);
+            }
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
        }

-        await _usersContext.SaveChangesAsync();
+        if (failureMessage is not null)
+        {
+            return this.ProblemResult(StatusCodes.Status400BadRequest, failureMessage,
+                extensions: new Dictionary<string, object?> { ["retryAfterSeconds"] = retryAfterSeconds });
+        }

        _logger.LogInformation("2FA regenerated for user {Username}", user.Username);

-        return Ok(new TotpSetupResponse
-        {
-            Secret = secret,
-            QrCodeUri = qrUri,
-            RecoveryCodes = recoveryCodes
-        });
+        return Ok(setup);
    }

    [HttpPost("2fa/enable")]
    public async Task<IActionResult> Enable2fa([FromBody] Enable2faRequest request)
    {
-        var user = await GetCurrentUser(includeRecoveryCodes: true);
-        if (user is null)
+        await UsersContext.Lock.WaitAsync();
+
+        try
        {
-            return Unauthorized();
-        }
-
-        if (user.TotpEnabled)
-        {
-            return Conflict(new { error = "2FA is already enabled" });
-        }
-
-        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
-        {
-            return BadRequest(new { error = "Incorrect password" });
-        }
-
-        // Generate new TOTP
-        var secret = _totpService.GenerateSecret();
-        var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
-        var recoveryCodes = _totpService.GenerateRecoveryCodes();
-
-        user.TotpSecret = secret;
-        user.UpdatedAt = DateTime.UtcNow;
-
-        // Replace any existing recovery codes
-        _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
-
-        foreach (var code in recoveryCodes)
-        {
-            _usersContext.RecoveryCodes.Add(new RecoveryCode
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null)
            {
-                Id = Guid.NewGuid(),
-                UserId = user.Id,
-                CodeHash = _totpService.HashRecoveryCode(code),
-                IsUsed = false
-            });
+                return Unauthorized();
+            }
+
+            if (user.TotpEnabled)
+            {
+                return this.ProblemResult(StatusCodes.Status409Conflict, "2FA is already enabled");
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "Incorrect password");
+            }
+
+            TotpSetupResponse setup = TwoFactorSecretRotation.Rotate(_totpService, _usersContext, user);
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA setup generated for user {Username}", user.Username);
+
+            return Ok(setup);
        }
-
-        await _usersContext.SaveChangesAsync();
-
-        _logger.LogInformation("2FA setup generated for user {Username}", user.Username);
-
-        return Ok(new TotpSetupResponse
+        finally
        {
-            Secret = secret,
-            QrCodeUri = qrUri,
-            RecoveryCodes = recoveryCodes
-        });
+            UsersContext.Lock.Release();
+        }
    }

    [HttpPost("2fa/enable/verify")]
    public async Task<IActionResult> VerifyEnable2fa([FromBody] VerifyTotpRequest request)
    {
-        var user = await GetCurrentUser();
-        if (user is null)
+        await UsersContext.Lock.WaitAsync();
+
+        try
        {
-            return Unauthorized();
-        }
+            var user = await GetCurrentUser();
+            if (user is null)
+            {
+                return Unauthorized();
+            }

-        if (user.TotpEnabled)
+            if (user.TotpEnabled)
+            {
+                return this.ProblemResult(StatusCodes.Status409Conflict, "2FA is already enabled");
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "Generate 2FA setup first");
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "Invalid verification code");
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTimeOffset.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA enabled" });
+        }
+        finally
        {
-            return Conflict(new { error = "2FA is already enabled" });
+            UsersContext.Lock.Release();
        }
-
-        if (string.IsNullOrEmpty(user.TotpSecret))
-        {
-            return BadRequest(new { error = "Generate 2FA setup first" });
-        }
-
-        if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
-        {
-            return BadRequest(new { error = "Invalid verification code" });
-        }
-
-        user.TotpEnabled = true;
-        user.UpdatedAt = DateTime.UtcNow;
-        await _usersContext.SaveChangesAsync();
-
-        _logger.LogInformation("2FA enabled for user {Username}", user.Username);
-
-        return Ok(new { message = "2FA enabled" });
    }

    [HttpPost("2fa/disable")]
    public async Task<IActionResult> Disable2fa([FromBody] Disable2faRequest request)
    {
-        var user = await GetCurrentUser(includeRecoveryCodes: true);
-        if (user is null)
+        User user;
+        string? failureMessage = null;
+        int retryAfterSeconds = 0;
+
+        await UsersContext.Lock.WaitAsync();
+
+        try
        {
-            return Unauthorized();
+            User? currentUser = await GetCurrentUser(includeRecoveryCodes: true);
+            if (currentUser is null)
+            {
+                return Unauthorized();
+            }
+
+            user = currentUser;
+
+            if (!user.TotpEnabled)
+            {
+                return this.ProblemResult(StatusCodes.Status400BadRequest, "2FA is not enabled");
+            }
+
+            if (LoginAttemptTracker.GetLockoutSecondsRemaining(user) is { } remaining)
+            {
+                throw new RateLimitException("Account is locked", remaining);
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                failureMessage = "Incorrect password";
+            }
+            else if (!_totpService.VerifySecondFactor(user, request.TotpCode))
+            {
+                failureMessage = "Invalid authenticator or recovery code";
+            }
+            else
+            {
+                user.TotpEnabled = false;
+                user.TotpSecret = string.Empty;
+                user.UpdatedAt = DateTimeOffset.UtcNow;
+
+                // Remove all recovery codes
+                _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+                await _usersContext.SaveChangesAsync();
+            }
+
+            if (failureMessage is not null)
+            {
+                retryAfterSeconds = await _loginAttemptTracker.IncrementFailedAttempts(user.Id);
+            }
+            else
+            {
+                await _loginAttemptTracker.ResetFailedAttempts(user.Id);
+            }
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
        }

-        if (!user.TotpEnabled)
+        if (failureMessage is not null)
        {
-            return BadRequest(new { error = "2FA is not enabled" });
+            return this.ProblemResult(StatusCodes.Status400BadRequest, failureMessage,
+                extensions: new Dictionary<string, object?> { ["retryAfterSeconds"] = retryAfterSeconds });
        }

-        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
-        {
-            return BadRequest(new { error = "Incorrect password" });
-        }
-
-        if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
-        {
-            return BadRequest(new { error = "Invalid 2FA code" });
-        }
-
-        user.TotpEnabled = false;
-        user.TotpSecret = string.Empty;
-        user.UpdatedAt = DateTime.UtcNow;
-
-        // Remove all recovery codes
-        _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
-
-        await _usersContext.SaveChangesAsync();
-
        _logger.LogInformation("2FA disabled for user {Username}", user.Username);

        return Ok(new { message = "2FA disabled" });
@@ -307,7 +408,7 @@ public sealed class AccountController : ControllerBase
        rng.GetBytes(bytes);

        user.ApiKey = Convert.ToHexString(bytes).ToLowerInvariant();
-        user.UpdatedAt = DateTime.UtcNow;
+        user.UpdatedAt = DateTimeOffset.UtcNow;
        await _usersContext.SaveChangesAsync();

        _logger.LogInformation("API key regenerated for user {Username}", user.Username);
@@ -320,7 +421,7 @@ public sealed class AccountController : ControllerBase
    {
        if (await IsOidcExclusiveModeActive())
        {
-            return StatusCode(403, new { error = "Plex account management is disabled while OIDC exclusive mode is active." });
+            return this.ProblemResult(StatusCodes.Status403Forbidden, "Plex account management is disabled while OIDC exclusive mode is active.");
        }

        var pin = await _plexAuthService.RequestPin();
@@ -333,7 +434,7 @@ public sealed class AccountController : ControllerBase
    {
        if (await IsOidcExclusiveModeActive())
        {
-            return StatusCode(403, new { error = "Plex account management is disabled while OIDC exclusive mode is active." });
+            return this.ProblemResult(StatusCodes.Status403Forbidden, "Plex account management is disabled while OIDC exclusive mode is active.");
        }

        var pinResult = await _plexAuthService.CheckPin(request.PinId);
@@ -355,7 +456,7 @@ public sealed class AccountController : ControllerBase
        user.PlexUsername = plexAccount.Username;
        user.PlexEmail = plexAccount.Email;
        user.PlexAuthToken = pinResult.AuthToken;
-        user.UpdatedAt = DateTime.UtcNow;
+        user.UpdatedAt = DateTimeOffset.UtcNow;
        await _usersContext.SaveChangesAsync();

        _logger.LogInformation("Plex account linked for user {Username}: {PlexUsername}",
@@ -369,7 +470,7 @@ public sealed class AccountController : ControllerBase
    {
        if (await IsOidcExclusiveModeActive())
        {
-            return StatusCode(403, new { error = "Plex account management is disabled while OIDC exclusive mode is active." });
+            return this.ProblemResult(StatusCodes.Status403Forbidden, "Plex account management is disabled while OIDC exclusive mode is active.");
        }

        var user = await GetCurrentUser();
@@ -382,7 +483,7 @@ public sealed class AccountController : ControllerBase
        user.PlexUsername = null;
        user.PlexEmail = null;
        user.PlexAuthToken = null;
-        user.UpdatedAt = DateTime.UtcNow;
+        user.UpdatedAt = DateTimeOffset.UtcNow;
        await _usersContext.SaveChangesAsync();

        _logger.LogInformation("Plex account unlinked for user {Username}", user.Username);
@@ -405,9 +506,11 @@ public sealed class AccountController : ControllerBase
    [HttpPut("oidc")]
    public async Task<IActionResult> UpdateOidcConfig([FromBody] UpdateOidcConfigRequest request)
    {
+        await UsersContext.Lock.WaitAsync();
+
        try
        {
-            var user = await GetCurrentUser();
+            User? user = await GetCurrentUser();
            if (user is null)
            {
                return Unauthorized();
@@ -415,14 +518,14 @@ public sealed class AccountController : ControllerBase

            request.ApplyTo(user.Oidc);
            user.Oidc.Validate();
-            user.UpdatedAt = DateTime.UtcNow;
+            user.UpdatedAt = DateTimeOffset.UtcNow;
            await _usersContext.SaveChangesAsync();

            return Ok(new { message = "OIDC configuration updated" });
        }
-        catch (ValidationException ex)
+        finally
        {
-            return BadRequest(new { error = ex.Message });
+            UsersContext.Lock.Release();
        }
    }

@@ -437,7 +540,7 @@ public sealed class AccountController : ControllerBase

        if (user.Oidc is not { Enabled: true })
        {
-            return BadRequest(new { error = "OIDC is not enabled" });
+            return this.ProblemResult(StatusCodes.Status400BadRequest, "OIDC is not enabled");
        }

        var redirectUri = GetOidcLinkCallbackUrl(user.Oidc.RedirectUrl);
@@ -450,8 +553,7 @@ public sealed class AccountController : ControllerBase
        }
        catch (InvalidOperationException ex)
        {
-            _logger.LogWarning(ex, "Failed to start OIDC link authorization");
-            return StatusCode(429, new { error = ex.Message });
+            throw new RateLimitException(ex.Message, ex);
        }
    }

@@ -504,7 +606,7 @@ public sealed class AccountController : ControllerBase
        }

        user.Oidc.AuthorizedSubject = result.Subject;
-        user.UpdatedAt = DateTime.UtcNow;
+        user.UpdatedAt = DateTimeOffset.UtcNow;
        await _usersContext.SaveChangesAsync();

        _logger.LogInformation("OIDC account linked with subject: {Subject} by user: {Username}",
@@ -527,7 +629,7 @@ public sealed class AccountController : ControllerBase

            user.Oidc.AuthorizedSubject = string.Empty;
            user.Oidc.ExclusiveMode = false;
-            user.UpdatedAt = DateTime.UtcNow;
+            user.UpdatedAt = DateTimeOffset.UtcNow;
            await _usersContext.SaveChangesAsync();

            _logger.LogInformation("OIDC account unlinked for user {Username}", user.Username);
@@ -540,6 +642,79 @@ public sealed class AccountController : ControllerBase
        }
    }

+    private const int MaxFeatureIdsPerRequest = 100;
+    private const int MaxFeatureIdLength = 64;
+
+    /// <summary>
+    /// Records that the current user has seen the given features, used to drive the "NEW" feature badges in the UI.
+    /// Recording is idempotent: unknown ids are stamped with the current time, already-seen ids keep their original timestamp.
+    /// </summary>
+    /// <param name="request">The feature ids the user has been exposed to.</param>
+    /// <returns>
+    /// The user's account creation timestamp and the full map of feature id to first-seen timestamp.
+    /// </returns>
+    [HttpPost("feature-views")]
+    public async Task<IActionResult> RecordFeatureViews([FromBody] RecordFeatureViewsRequest request)
+    {
+        if (request.FeatureIds.Count > MaxFeatureIdsPerRequest)
+        {
+            return this.ProblemResult(StatusCodes.Status400BadRequest, $"featureIds exceeds the maximum allowed ({MaxFeatureIdsPerRequest}).");
+        }
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null)
+            {
+                return Unauthorized();
+            }
+
+            var existing = await _usersContext.UserFeatureViews
+                .Where(v => v.UserId == user.Id)
+                .ToListAsync();
+
+            var existingIds = existing
+                .Select(v => v.FeatureId)
+                .ToHashSet();
+
+            DateTimeOffset now = DateTimeOffset.UtcNow;
+
+            foreach (var featureId in request.FeatureIds.Distinct())
+            {
+                if (string.IsNullOrWhiteSpace(featureId) ||
+                    featureId.Length > MaxFeatureIdLength ||
+                    existingIds.Contains(featureId))
+                {
+                    continue;
+                }
+
+                var view = new UserFeatureView
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    FeatureId = featureId,
+                    FirstSeenAt = now
+                };
+
+                _usersContext.UserFeatureViews.Add(view);
+                existing.Add(view);
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(new FeatureViewsResponse
+            {
+                CreatedAt = user.CreatedAt,
+                Views = existing.ToDictionary(v => v.FeatureId, v => v.FirstSeenAt)
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
    private string GetOidcLinkCallbackUrl(string? redirectUrl = null)
    {
        var baseUrl = string.IsNullOrEmpty(redirectUrl)
@@ -548,6 +723,21 @@ public sealed class AccountController : ControllerBase
        return $"{baseUrl}/api/account/oidc/link/callback";
    }

+    /// <summary>
+    /// Revokes every active refresh token so sessions opened before a credential change cannot be reused.
+    /// </summary>
+    private async Task RevokeActiveRefreshTokens(Guid userId, DateTimeOffset now)
+    {
+        List<RefreshToken> activeTokens = await _usersContext.RefreshTokens
+            .Where(r => r.UserId == userId && r.RevokedAt == null)
+            .ToListAsync();
+
+        foreach (RefreshToken token in activeTokens)
+        {
+            token.RevokedAt = now;
+        }
+    }
+
    private async Task<bool> IsOidcExclusiveModeActive()
    {
        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
Author	SHA1	Message	Date
Flaminel	156dc8bf34	Fix some dead torrents not being processed (#778 )	2026-09-08 14:39:26 +03:00
Flaminel	bba4e943bc	Fix Seeker not reporting an episode grab (#776 )	2026-09-08 13:14:46 +03:00
Flaminel	eee5af9268	Add support for changing the username (#775 )	2026-09-08 13:14:30 +03:00
Flaminel	d4485748a0	Fix torrent hash inconsistent casing (#771 )	2026-09-08 00:11:38 +03:00
Flaminel	68aac966f2	Improve seeding rule UX (#770 )	2026-09-08 00:11:12 +03:00
Flaminel	1057d25e5f	Add seeding rule option to stop a torrent instead of deleting it (#769 )	2026-09-08 00:08:34 +03:00
Flaminel	2ae82cbeab	Fix UI e2e tests (#767 )	2026-09-04 15:10:05 +03:00
Flaminel	d0f309931d	Add e2e tests for the v2 stats endpoint (#766 )	2026-09-04 15:08:17 +03:00
Flaminel	cb7e9116f1	Remove the v1 stats endpoint (#765 )	2026-09-04 15:06:56 +03:00
Flaminel	2dca20aa59	Fix missing event history retention docs (#764 )	2026-09-03 11:01:24 +03:00
Flaminel	3b32311ab6	Fix the dead torrent docs anchor (#763 )	2026-09-03 10:57:55 +03:00
Flaminel	be03a74005	Add a warning when the database is newer than the app (#756 )	2026-09-02 18:24:16 +00:00
Flaminel	8c9b8bd252	Fix app crashing on unknown enum values (#755 )	2026-09-02 21:22:16 +03:00
Flaminel	a0a37a5a8a	Fix stale health statuses for clients that have been removed (#762 )	2026-09-01 15:21:52 +03:00
Flaminel	caebcf550d	Add a shared SQLite test database helper (#754 )	2026-08-31 17:04:44 +03:00
Flaminel	47bd8b0e50	Add option for proactive search to ignore downloads that have strikes (#760 )	2026-08-28 16:48:27 +03:00
Flaminel	0ba32e7bad	Fix the GitHub sponsor button (#759 )	2026-08-27 17:21:57 +03:00
Flaminel	6d6d11914d	Fix e2e tests shared volume permissions (#752 )	2026-08-22 23:05:54 +03:00
Flaminel	41dbbf155b	Add option to send the User-Agent header on all HTTP requests (#750 )	2026-08-22 22:18:49 +03:00
Flaminel	8f8f30c37a	Fix OIDC discovery client never picking up DNS changes (#749 )	2026-08-22 22:18:20 +03:00
Flaminel	f2b119c724	Collapse Whisparr v2 client code onto Sonarr client code (#741 )	2026-08-22 13:49:46 +03:00
Flaminel	0c02bf57d7	Fix Sonarr and Whisparr v2 episode search commands merging into unrelated commands (#740 )	2026-08-22 13:47:21 +03:00
Flaminel	d87fdbf974	Fix missing download removal dedupe cache key (#748 )	2026-08-22 13:43:32 +03:00
Flaminel	d7d8ff8afd	Fix 2FA code rejected when it has spaces (#743 )	2026-08-22 12:00:16 +03:00
Flaminel	237b02b1f1	Add rate limiting to failed 2FA attempts (#737 )	2026-08-22 11:59:37 +03:00
Flaminel	0ad587a7e1	Accept recovery codes when disabling or regenerating 2FA (#736 )	2026-08-22 11:59:08 +03:00
Flaminel	7907ae846d	Add support for LazyLibrarian (#625 )	2026-08-22 00:54:47 +03:00
Flaminel	ea7ea9630d	Fix slow page loads on iOS caused by the background orbs (#744 )	2026-08-18 15:59:47 +03:00
Flaminel	a502eb6407	Update frontend packages (#734 )	2026-08-16 01:14:01 +03:00
Flaminel	323c2e3bda	Update docs packages (#735 )	2026-08-16 01:13:45 +03:00
Flaminel	934b19efc1	Add e2e coverage for Seeker against live Sonarr and Radarr (#739 )	2026-08-16 01:03:54 +03:00
Flaminel	dd7d83837b	Checked the arr one last time before marking a search as timed out (#729 )	2026-08-16 01:03:54 +03:00
Flaminel	88e882f72d	Add e2e coverage for search command status transitions (#724 )	2026-08-16 01:03:54 +03:00
Flaminel	88f0103527	Fix some search events staying pending forever (#723 )	2026-08-16 01:03:54 +03:00
Flaminel	b7c0d211eb	Raised the search command timeout to 30 minutes (#726 )	2026-08-16 01:03:54 +03:00
Flaminel	4b74aa23f3	Reduce the number of arr requests made while monitoring searches (#722 )	2026-08-16 01:03:54 +03:00
Flaminel	5d18f203ad	Fix duplicate search notifications when publishing a search result fails (#721 )	2026-08-16 01:03:54 +03:00
Flaminel	a798eeb129	Fix wrong statuses reported for failed and timed out searches (#720 )	2026-08-16 01:03:12 +03:00
Flaminel	8164d910e7	Fix the disabled save button state on some settings pages (#733 )	2026-08-14 02:52:19 +03:00
Flaminel	50bbf5bf5d	Add PR approval workflow (#732 )	2026-08-14 02:35:24 +03:00
Sportarr	557dde83e1	Add support for Sportarr (#696 )	2026-08-13 11:15:58 +03:00
Flaminel	a4a4ad0f14	Add m2ts to the blacklist (#717 )	2026-08-13 11:02:40 +03:00
Flaminel	f7e3ba4196	Fix Transmission connections failing when the 409 session challenge is retried (#714 )	2026-08-12 15:39:33 +03:00
Flaminel	f541cfa97c	Fix Download Cleaner e2e test failing on GitHub (#716 )	2026-08-12 15:19:42 +03:00
Flaminel	f8584136b8	Fix e2e tests healthchecks failing (#715 )	2026-08-12 13:38:46 +03:00
Flaminel	d819994a71	Fix uTorrent torrent list failing on unexpected value types (#712 )	2026-08-11 19:07:42 +03:00
Flaminel	edbd37efec	Fix Pushover notification errors when the response body is not JSON (#711 )	2026-08-11 18:35:36 +03:00
Flaminel	145d08e97e	Fix Sonarr's queue not loading when sizeleft has a decimal point (#710 )	2026-08-11 18:25:32 +03:00
Flaminel	fc919a52ab	Fix arr commands failing when the response body is empty (#709 )	2026-08-11 17:57:03 +03:00
Flaminel	d524eb5632	Fix Deluge API contract failures (#708 )	2026-08-11 17:56:26 +03:00
Flaminel	9edc685e31	Fix orphaned files cleanup failing when moving the directory (#701 )	2026-08-07 15:16:44 +03:00
Flaminel	71f18457d1	Add commit statuses so PR builds show in the PR checks (#702 )	2026-08-07 14:27:00 +03:00
Flaminel	775fa1e5c6	Fix e2e tests (#699 )	2026-08-07 09:51:20 +03:00
Flaminel	824513f006	Add on-demand test, e2e and Docker PR builds and allow them from forks (#698 )	2026-08-06 19:05:00 +03:00
Flaminel	c42c02d2dc	Add more failed import message examples to the docs (#695 )	2026-08-05 10:31:07 +03:00
Flaminel	1729456121	Add frontend tests (#691 )	2026-08-02 23:51:17 +03:00
Flaminel	4cece1c892	Fix Deluge unknown hash error crashing the processing (#694 )	2026-08-02 23:44:21 +03:00
Flaminel	93753f099b	Fix relative docs links (#693 )	2026-08-02 22:03:58 +03:00
Flaminel	d5718f9219	Fix test attachment failing for Apprise (#690 )	2026-07-31 11:15:32 +03:00
Flaminel	46ef402b82	Add configurable config and logs directories (#687 )	2026-07-31 10:59:43 +03:00
Flaminel	895dc4517b	Fix chip input overwriting initial value (#689 )	2026-07-31 10:59:11 +03:00
Flaminel	32a4c5da5c	Add Linux build on PR comment (#685 )	2026-07-28 16:58:09 +03:00
Flaminel	c4b3adcf87	Fix external API response handling (#684 )	2026-07-28 15:20:02 +03:00
Flaminel	075461391b	Fix MacOS workflow permissions (#682 )	2026-07-26 02:10:18 +03:00
Flaminel	2c1346f95f	Add versioning policy (#679 )	2026-07-26 01:54:30 +03:00
Flaminel	e20fa1339d	Update frontend packages (#681 )	2026-07-26 01:47:02 +03:00
Flaminel	4dc8b5e051	Update docs packages (#680 )	2026-07-26 01:37:55 +03:00
Flaminel	dcdc07610a	Add last active guard for qBittorrent seeding rules (#678 )	2026-07-25 22:15:53 +03:00
Flaminel	6a6a7a79a7	Remove Newtonsoft.Json (#677 )	2026-07-24 17:00:40 +03:00
Flaminel	282ec1d325	Improve Windows installer (#674 )	2026-07-24 15:07:03 +03:00
Flaminel	a28caf1bc9	Fix Windows installer failing to build (#676 )	2026-07-24 13:50:38 +03:00
Flaminel	1fbfcc0803	Fix pr-build workflow missing permissions (#675 )	2026-07-24 13:29:52 +03:00
Flaminel	5c5a217430	Add option to pause Queue Cleaner when the internet is unreachable (#673 )	2026-07-24 10:59:22 +03:00
Flaminel	ccdbb6294a	Add option to ignore specific download clients for Queue Cleaner and Malware Blocker (#672 )	2026-07-23 17:20:05 +03:00
Flaminel	107b0e7579	Add alternate speed option for slow download rules (#671 )	2026-07-23 16:19:37 +03:00
Flaminel	4884f1f297	Update GitHub workflows (#670 )	2026-07-21 12:04:52 +03:00
Flaminel	74ec19ae48	Add PostgreSQL support (#669 )	2026-07-21 09:24:24 +03:00
Flaminel	6ae7592f6c	Add workflow dispatch for docs preview cleanup(#668 )	2026-07-14 14:30:59 +03:00
Flaminel	3089b61a7a	Fix docs preview cleanup (#667 )	2026-07-14 14:24:25 +03:00
Flaminel	18da58c346	Change docs root path (#666 )	2026-07-14 14:13:30 +03:00
Flaminel	4d852911a5	Improve memory usage for Seeker and CF score sync (#663 )	2026-07-10 16:24:06 +03:00
Flaminel	71113d8838	Address even more tech debt (#661 )	2026-07-08 19:16:23 +03:00
Flaminel	c4cddf8897	Fix docs and status workflows being skipped on release (#660 )	2026-07-07 17:31:44 +03:00
Flaminel	d7bb3195de	Improve event history, add stats v2 endpoint and add graphs to show data (#656 )	2026-07-07 17:02:48 +03:00
Flaminel	569cac9d61	Improve release workflow to include docs and status deployments (#658 )	2026-07-04 13:46:19 +03:00
Flaminel	96844ac89c	Disable e2e tests (#657 )	2026-07-04 13:36:11 +03:00
Flaminel	9642ea263d	Add bulk dismiss and lazy paging for action required events (#655 )	2026-07-04 13:28:50 +03:00
Flaminel	d34ddb841d	Fix e2e pipelines (#654 )	2026-07-04 03:12:43 +03:00
Flaminel	65afcaf3a4	Fix orphaned files name checks (#653 )	2026-07-04 02:54:27 +03:00
Flaminel	d784091ee4	Address some of the frontend tech debt (#648 )	2026-07-03 14:53:13 +03:00
Flaminel	81cd7583cd	Improve Plex login flow by redirecting instead of opening a new tab (#651 )	2026-07-03 12:45:20 +03:00
Flaminel	3f6c3321e9	Fix user session being reset on transient refresh failure (#650 )	2026-07-03 12:31:10 +03:00
Flaminel	be3db1616e	Upgrade frontend to Angular v22 (#644 )	2026-07-01 21:16:26 +03:00
Flaminel	9fd99bd5f5	Fixed download directory mapping docs (#645 )	2026-07-01 17:31:16 +03:00
Flaminel	8f1ea44466	Upgrade Docusaurus to v3.10.1 (#642 )	2026-06-30 20:42:27 +03:00
Flaminel	6ec19a92b2	Fix docs sidebar on small screens (#641 )	2026-06-30 17:37:28 +03:00
Flaminel	fa1801875e	Update frontend packages (#633 )	2026-06-16 17:17:52 +03:00
Flaminel	c6ef6ad979	Use ProblemDetails handling for the API (#632 )	2026-06-16 15:26:56 +03:00
Flaminel	74f11f5beb	Migrate from DateTime to DateTimeOffset (#629 )	2026-06-15 17:15:06 +03:00
Flaminel	c0950537ab	Fix width of the recent events card (#630 )	2026-06-14 17:49:32 +03:00
Flaminel	7cc079c61b	Add new feature badge (#628 )	2026-06-14 17:04:59 +03:00
Flaminel	7aa3224f4d	Add dead torrent handling (#627 )	2026-06-14 02:14:10 +03:00
Flaminel	1cc068c2ab	Add Transmission label option for unlinked downloads (#626 )	2026-06-13 23:09:26 +03:00
Flaminel	28f22f1085	Fix running orphaned files cleanup for unavailable clients (#624 )	2026-06-01 00:36:02 +03:00
Flaminel	084f83efca	Add option to remove malware if any file is blocked (#621 )	2026-05-30 01:33:51 +03:00
Flaminel	26b76908eb	Add min seeders to seeding rules (#620 )	2026-05-28 17:23:41 +03:00
Flaminel	ffc8a0a39a	Fix some backgrounds not respecting the custom color (#619 )	2026-05-27 20:08:43 +03:00
Flaminel	8ccd93dc97	Add orphaned files cleanup (#618 )	2026-05-27 19:26:39 +03:00
Flaminel	1ca935b62b	Fix Deluge crashing when removing malware (#308 )	2026-05-15 03:53:05 +03:00
Flaminel	90a4909e57	Fix qBittorrent v5.2.0 login (#607 )	2026-05-09 03:55:13 +03:00
Flaminel	ef8fb2dd0b	Fix flaky unit tests (#604 )	2026-05-06 10:49:16 +03:00
Flaminel	20ad056400	Add seeding completed Transmission status for Download Cleaner (#603 )	2026-05-05 16:53:12 +03:00
Flaminel	ab792f5fad	Add option to change the category instead of deleting queue items (#602 )	2026-05-05 15:59:42 +03:00
Flaminel	48c36fab8f	Add paused and queued Deluge states for Download Cleaner (#596 )	2026-05-04 14:50:07 +03:00
Flaminel	3553fce597	Fix Seeker failing in dry run mode (#601 )	2026-05-04 12:17:19 +03:00
Flaminel	c1d2790c8d	Fix value step for number inputs when using decimals (#599 )	2026-05-03 23:11:31 +03:00
Flaminel	18a9c66ce7	Add name clarification (#598 )	2026-05-03 01:40:13 +03:00
Flaminel	7ec60c7ea0	Update application description (#597 )	2026-05-03 00:53:41 +03:00
Flaminel	a96bc36a1e	Add AI usage policy in contributing guide (#593 )	2026-04-28 17:39:34 +03:00
Flaminel	b575644d5f	Improve docs layout (#570 )	2026-04-28 16:22:07 +03:00
David Young	13bc71c3cd	Add ElfHosted as managed deployment option in the docs (#590 )	2026-04-28 13:54:03 +03:00
Flaminel	c3f3ee880d	Add UI warning when not linking an OIDC account (#587 )	2026-04-27 13:19:46 +03:00
Flaminel	8ab4a55595	Remove CORS policy for production environments (#588 )	2026-04-27 13:13:06 +03:00
Flaminel	85de80a463	Fix forwarded header parsing (#586 )	2026-04-27 12:49:33 +03:00
Flaminel	9f48d3565a	Add customizable theme color (#582 )	2026-04-26 01:28:07 +03:00
Mike Lonergan	db2e3e71db	Fix number input eager clamping on keystrokes (#583 )	2026-04-26 01:06:26 +03:00
Flaminel	5d400ad854	Fix Custom Format score syncer not being scheduled accordingly (#584 )	2026-04-25 23:57:12 +03:00
Flaminel	02a07d4fa3	Add sorting and filters for Seeker stats (#576 )	2026-04-25 11:57:38 +03:00
Flaminel	41ca55d615	Fix log config inputs not allowing for zero (#579 )	2026-04-22 16:15:56 +03:00
Flaminel	8770a8b18e	Add hour intervals for Seeker (#578 )	2026-04-21 16:56:58 +03:00
Flaminel	24ecd88cd0	Fix backend page size to be in sync with the UI (#577 )	2026-04-21 16:29:59 +03:00
Flaminel	7ed0f307be	Add customizable pagination size (#575 )	2026-04-20 19:51:02 +03:00
Flaminel	5b500c533e	Improve the scrollbar position and visibility (#574 )	2026-04-20 15:40:19 +03:00
Flaminel	b1ef63ef43	Add sticky headers for pages with tables (#573 )	2026-04-20 15:37:45 +03:00
Flaminel	f14e345b52	Add full width UI toggle (#572 )	2026-04-20 15:33:04 +03:00
Flaminel	89a0d1281f	Fix Seeker's filters allowing searching for all types of movies regardless of settings (#567 )	2026-04-16 18:21:36 +03:00
Flaminel	ee5e7c0819	Replace Moq with NSubstitute for unit tests (#566 )	2026-04-16 12:13:36 +03:00
Flaminel	d875d88191	Add per-instance Seeker settings (#565 )	2026-04-15 23:16:16 +03:00
Flaminel	447db6990a	Add item grabbed notification (#564 )	2026-04-15 21:51:09 +03:00
Flaminel	4e9d20db0a	Improve seeding rule customization (#553 )	2026-04-11 17:13:41 +03:00
Flaminel	53fc5eff3b	Fix qBittorrent tracker fetching (#555 )	2026-04-10 21:00:28 +03:00
Flaminel	69fa09e23a	Fix disabled arr instances being processed in some cases (#554 )	2026-04-09 14:41:32 +03:00
Flaminel	3360b7a849	Fix db migration not being applied (#552 )	2026-04-07 11:51:07 +03:00
Flaminel	80b46df8e5	Add search event reason (#546 )	2026-04-06 09:59:31 +03:00
Flaminel	88aa71c343	Fix duplicated grabbed items reported for Sonarr on season packs (#549 )	2026-04-05 22:11:48 +03:00
Flaminel	7b80e038cc	Fix rTorrent path evaluation for items without a subdirectory (#548 )	2026-04-05 22:11:22 +03:00
Flaminel	ef280ec398	Fix queue rules upper bound to never allow 0 (#543 )	2026-04-03 16:11:12 +03:00
Flaminel	81f6de03e7	Improve Seeker's total number description (#542 )	2026-04-03 15:59:23 +03:00
Flaminel	17c3a6b02a	Fix duplicated event search when changing instance for Seeker stats (#537 )	2026-04-01 13:29:14 +03:00
Flaminel	4903b3137b	Add hide unmonitored toggle for quality scores (#535 )	2026-04-01 13:28:43 +03:00
Flaminel	868406c95c	Fix tags not being excluded by Seeker (#533 )	2026-03-31 12:22:45 +03:00
Flaminel	7122b16a7a	Add support for separate Download Cleaner settings per download client (#531 )	2026-03-30 18:31:48 +03:00
Flaminel	b9fbac4ddc	Add performance mode description (#532 )	2026-03-30 18:30:37 +03:00
Flaminel	33e948d1e7	Update frontend packages (#528 )	2026-03-29 17:36:02 +03:00
Flaminel	9f551f151e	Fix duplicated events on the dashboard (#527 )	2026-03-29 17:22:58 +03:00
Flaminel	9447cb37c0	Fix round robin toggle not changing state correctly (#526 )	2026-03-29 17:22:27 +03:00
Flaminel	8183b324a0	Fix Seeker being scheduled when disabled (#523 )	2026-03-28 00:25:49 +02:00
Flaminel	a6a25de19c	Fix Seeker not grouping season packs when checking active downloads (#522 )	2026-03-28 00:18:11 +02:00
Flaminel	51a2a1b391	Add missing and upgrade search (#507 )	2026-03-27 19:40:09 +02:00
Flaminel	d7ab81ddcf	Fix Firefox missing the bookmark icon (#520 )	2026-03-26 02:14:39 +02:00
Flaminel	8da07d4e93	Fix dashboard logs initial order (#519 )	2026-03-26 01:16:04 +02:00